# Hash Data API

> Hash a value with the hash data system API of API Maker - HMAC SHA-256 with the nonce or secret of your secret, the same hash the hashing conversion of a schema stores, so you can look a hashed column up.

Source: https://docs.apimaker.dev/v1/docs/apis-all/system-apis/system-generated-hash-data-api.html

Answers the SHA-256 hash of the body, computed with the `nonce` (or, without one, the `secret`) of the default secret. A string is hashed as it is, exactly like the `hashing` conversion of a [schema](https://docs.apimaker.dev/v1/docs/schema/schema.html) hashes a field, so the hash of a password or a tax id given here equals the one stored in the table and can be used to find the row.

| | |
|---|---|
| Method | POST |
| URL | `/api/system-api/admin/hash-data` : `admin` is the user path of your account |
| Body | the value to hash : a string, or any JSON |
| Answer | `data` : the hash, a hex string |
| From code | [`g.sys.system.hash`](https://docs.apimaker.dev/v1/examples/sys/system/hash.html) |

## The call

**Body : a string**

```json
"Joseph"
```

**Body : an object (hashed as its JSON text)**

```json
{ "name": "Joseph" }
```

**Answer**

```json
{ "success": true, "statusCode": 200, "data": "be2a6a457cc36a48e4e231411d8d6498213f7ffb6d1e03066dd7fbaa6ec9402e" }
```

- The algorithm is `hashingAlgorithm` of the secret : `SHA256` is the one supported.
- The same value always gives the same hash for the same secret, which is the point : hash a value on the way in and compare hashes on the way out.

## Look up a hashed column

**Find the customer whose tax id (hashed in the table) is known**

```typescript
const hash = await g.sys.system.hash(taxId);
const rows = await g.sys.db.query({ instance: 'mongodb', database: 'shop', collection: 'products', find: { supplier_tax_id_hash: hash } });
```

- Keep an encrypted copy of the value in another field when you also need to read it back : encryption is reversible, hashing is not.

## Access and settings

- Over HTTP, a system API answers once its [settings](https://docs.apimaker.dev/v1/docs/settings/systemApiSettings.html) give it `apiAccessType: TOKEN_ACCESS` (the token of an API user whose [group](https://docs.apimaker.dev/v1/docs/apis-security/api-group-permission.html) grants this system API, in `x-am-authorization`) or `IS_PUBLIC`. Without settings it is `NO_ACCESS` : your code calls it through `g.sys`, the admin panel tests it, and an HTTP call is refused.
- The settings can also cache the answer or require person tokens (`authProviders`) ; [pre and post hooks](https://docs.apimaker.dev/v1/docs/apis-all/hooks/preHook-api.html) run around it like around any API.
- The [request headers](https://docs.apimaker.dev/v1/docs/apis-all/header/requestHeader.html) apply : `x-am-response-case`, `x-am-content-type-response`, `x-am-internationalization`, `x-am-tenant-username`…

## Errors

| Code | When |
|---|---|
| `400` | The body is wrong : the message names the missing or invalid key. |
| `401` | No valid API user token, or the API is `NO_ACCESS` : `You are not authorized to access this API.` |
| `403` | No group grants this system API. |

## Related

- [All APIs at a glance](https://docs.apimaker.dev/v1/docs/apis-all/overview.html) · [Response format](https://docs.apimaker.dev/v1/docs/apis-all/response-format.html) · [System API settings](https://docs.apimaker.dev/v1/docs/settings/systemApiSettings.html) · [System APIs from code](https://docs.apimaker.dev/v1/examples/sys/system/system.html)