DEK wrap and unwrap endpoints for file encryption

The DEK (Data Encryption Key) endpoints handle encryption key wrapping. The client’s VPS sends a plain DEK, and the Metadata Service encrypts it with the master key (wrap) or decrypts an existing wrapped DEK back to plaintext (unwrap).

These endpoints are called by the client VPS (VPS 20) during file upload and download flows. The plain DEK never leaves the internal network unencrypted.

Wrap DEK

POST /api/v1/dek/wrap

Encrypts a plain DEK using the master key. The client VPS sends the plain DEK, and the service returns it wrapped.

Request body

string

required

The plain 32-bit Data Encryption Key to wrap.

Example request

{
  "dek": "pl41n_d3k_k3y_32b1ts_0000000000"
}

Response `200`

{
  "dekEnc": "enc_k3y_wr4pp3d_by_m4st3r_k3y_00"
}

Response `400`

Returned when the provided DEK is invalid or malformed.

{
  "error": "invalid_dek"
}

Unwrap DEK

POST /api/v1/dek/unwrap

Decrypts a wrapped DEK back to its plaintext form using the master key.

Request body

string

required

The 32-bit encrypted DEK (wrapped by the master key) to unwrap.

Example request

{
  "dekEnc": "enc_k3y_wr4pp3d_by_m4st3r_k3y_00"
}

Response `200`

{
  "dek": "pl41n_d3k_k3y_32b1ts_0000000000"
}

Response `400`

Returned when the provided encrypted DEK is invalid or cannot be decrypted.

{
  "error": "invalid_enc_dek"
}

Core

Experimental

DEK wrap and unwrap endpoints for file encryption

Wrap DEK

Request body

Response `200`

Response `400`

Unwrap DEK

Request body

Response `200`

Response `400`

​Wrap DEK

​Request body

​Response 200

​Response 400

​Unwrap DEK

​Request body

​Response 200

​Response 400

Wrap DEK

Request body

Response `200`

Response `400`

Unwrap DEK

Request body

Response `200`

Response `400`