OpenAPI document

The rypt API is described by one OpenAPI 3.0.3 document, kept with the API's code and published here unchanged, as YAML and as JSON. The API reference renders it.

Fetch it

URL	What it is
https://rypt.dev/openapi.yaml	The newest version, as YAML
https://rypt.dev/openapi.json	The newest version, as JSON
https://rypt.dev/openapi/0.8.0/openapi.yaml	Version 0.8.0, as YAML
https://rypt.dev/openapi/0.8.0/openapi.json	Version 0.8.0, as JSON
https://rypt.dev/openapi/0.7.1/openapi.yaml	Version 0.7.1, as YAML
https://rypt.dev/openapi/0.7.1/openapi.json	Version 0.7.1, as JSON

curl -sS https://rypt.dev/openapi.json -o rypt-openapi.json

The JSON is the YAML parsed and written out again, so the two always hold the same document. Every one of these files is served with Access-Control-Allow-Origin: *, so a browser-based tool on any origin can load it.

Versions

A document's version is its info.version, and each version keeps its own folder, /openapi/<version>/. A version's files do not change once they are published, so pin a versioned URL in a code generator or a CI job, and use /openapi.yaml or /openapi.json when you want whatever is newest.

The document's version is not the API's path version: every route is under /v1, whatever the document's version.

What it covers

• The five cryptographic operations (encrypt, decrypt, wrap, unwrap, rewrap), the key lifecycle apart from Delete now, usage and the audit log. An API key can call these, held to its key list and actions.
• The console endpoints the dashboard uses: the signed-in user, containers and the permission record, API keys, firewalls, billing, and Delete now (POST /v1/keys/{id}/destroy). They take a dashboard session, not an API key.
• The Stripe webhook, which is for Stripe, not for clients.

The servers list names https://api.rypt.dev, the address to call. Its second entry, http://127.0.0.1:8080, is not for clients.