Skip to content
This page View Markdown Open in ChatGPT Open in Claude

Hash data

Answers the SHA-256 hash of the body, computed with the nonce (or, without one, the secret) of the default secret. A string is hashed as it is, exactly like the hashing conversion of a schema hashes a field, so the hash of a password or a tax id given here equals the one stored in the table and can be used to find the row.
Method POST
URL /api/system-api/admin/hash-data : admin is the user path of your account
Body the value to hash : a string, or any JSON
Answer data : the hash, a hex string
From code g.sys.system.hash

The call

Body : a string
"Joseph"
Body : an object (hashed as its JSON text)
{ "name": "Joseph" }
Answer
{ "success": true, "statusCode": 200, "data": "be2a6a457cc36a48e4e231411d8d6498213f7ffb6d1e03066dd7fbaa6ec9402e" }
  • The algorithm is hashingAlgorithm of the secret : SHA256 is the one supported.
  • The same value always gives the same hash for the same secret, which is the point : hash a value on the way in and compare hashes on the way out.

Look up a hashed column

Find the customer whose tax id (hashed in the table) is known
const hash = await g.sys.system.hash(taxId);
const rows = await g.sys.db.query({ instance: 'mongodb', database: 'shop', collection: 'products', find: { supplier_tax_id_hash: hash } });
  • Keep an encrypted copy of the value in another field when you also need to read it back : encryption is reversible, hashing is not.

Access and settings

  • Over HTTP, a system API answers once its settings give it apiAccessType: TOKEN_ACCESS (the token of an API user whose group grants this system API, in x-am-authorization) or IS_PUBLIC. Without settings it is NO_ACCESS : your code calls it through g.sys, the admin panel tests it, and an HTTP call is refused.
  • The settings can also cache the answer or require person tokens (authProviders) ; pre and post hooks run around it like around any API.
  • The request headers apply : x-am-response-case, x-am-content-type-response, x-am-internationalization, x-am-tenant-username…

Errors

Code When
400 The body is wrong : the message names the missing or invalid key.
401 No valid API user token, or the API is NO_ACCESS : You are not authorized to access this API.
403 No group grants this system API.