Skip to content
This page View Markdown Open in ChatGPT Open in Claude

Encrypt data

Encrypts a string, a number, an object or an array and answers the encrypted text. By default it uses encryptionAlgorithmFETransfer and secretFETransfer of the default secret : the key you share with your frontend or mobile app, so the two sides can exchange encrypted data.
Method POST
URL /api/system-api/admin/encrypt-data : admin is the user path of your account
Body { data, algorithm?, pass? }
Answer data : the encrypted string
From code g.sys.system.encrypt

The call

Body
{ "data": { "name": "Joseph", "card": "4111 1111 1111 1111" } }
Answer
{ "success": true, "statusCode": 200, "data": "U2FsdGVkX19iIBA3FQy3OgFXeE4B2cC8lAfaJjCbMmUllceqb58YwvQqU33PkQEQ" }
Key Meaning
data Required. Any JSON value. It is serialised before encryption, so decrypt gives the same type back.
algorithm AES (default from the secret). RC4 and TRIPLEDES are legacy ciphers, kept for the data of API Maker 3.
pass Your own key, instead of secretFETransfer of the secret.
  • The keys come from the default secret of the account, unless the body gives its own algorithm and pass.

From code

const text = await g.sys.system.encrypt({ name: 'Joseph' });                                  // with the transfer key of the secret
const mine = await g.sys.system.encrypt('hello', T.EEncryptionAlgorithm.AES, 'my-own-key');  // with the algorithm and the key given

text = await g.sys.system.encrypt({'name': 'Joseph'})                    # with the transfer key of the secret
mine = await g.sys.system.encrypt_with('hello', 'AES', 'my-own-key')  # with the algorithm and the key given

$text = $g->sys->system->encrypt(['name' => 'Joseph']);                    // with the transfer key of the secret
$mine = $g->sys->system->encryptWith('hello', 'AES', 'my-own-key');  // with the algorithm and the key given

var text = await g.Sys.System.Encrypt(new { name = "Joseph" });                     // with the transfer key of the secret
var mine = await g.Sys.System.EncryptWith("hello", "AES", "my-own-key");  // with the algorithm and the key given

text, err := g.Sys.System.Encrypt(am.M{"name": "Joseph"}) // with the transfer key of the secret
if err != nil {
    return nil, err
}
mine, err := g.Sys.System.EncryptWith("hello", "AES", "my-own-key") // with the algorithm and the key given
if err != nil {
    return nil, err
}

let text = g.sys.system.encrypt(json!({ "name": "Joseph" }))?;                     // with the transfer key of the secret
let mine = g.sys.system.encrypt_with("hello", "AES", Some("my-own-key"))?;  // with the algorithm and the key given

String text = g.sys.system.encrypt(Map.of("name", "Joseph"));                     // with the transfer key of the secret
String mine = g.sys.system.encryptWith("hello", "AES", "my-own-key");  // with the algorithm and the key given

val text = g.sys.system.encrypt(mapOf("name" to "Joseph"))                     // with the transfer key of the secret
val mine = g.sys.system.encryptWith("hello", "AES", "my-own-key")  // with the algorithm and the key given

Good to know

  • Fields of a table are encrypted at rest with conversions: { encryption: true } in the schema, with the secret key of the secret, not this API.
  • To send an encrypted request body, see encrypted payloads ; to get an encrypted answer, the header x-am-get-encrypted-data.

Access and settings

  • Over HTTP, a system API answers once its settings give it apiAccessType: TOKEN_ACCESS (the token of an API user whose group grants this system API, in x-am-authorization) or IS_PUBLIC. Without settings it is NO_ACCESS : your code calls it through g.sys, the admin panel tests it, and an HTTP call is refused.
  • The settings can also cache the answer or require person tokens (authProviders) ; pre and post hooks run around it like around any API.
  • The request headers apply : x-am-response-case, x-am-content-type-response, x-am-internationalization, x-am-tenant-username…

Errors

Code When
400 The body is wrong : the message names the missing or invalid key, for example an unknown algorithm.
401 No valid API user token, or the API is NO_ACCESS : You are not authorized to access this API.
403 No group grants this system API.