Skip to main content

​
Salt management

​
Get salt

Retrieve the user’s vault salt for key derivation. 
GET /api/vault/salt
Authentication: Required Response 200 OK: 
{
  "salt": "base64-encoded-salt"
}
Response 404 Not Found — salt not yet created for this user.

​
Set salt

Create or update the user’s vault salt. Called once during initial vault setup. 
POST /api/vault/salt
Authentication: Required CSRF: Required Request body: 
{
  "salt": "base64-encoded-salt"
}
The salt is generated client-side using crypto.getRandomValues() and sent to the server for storage. It is not secret — it ensures different users derive different keys from the same password. Response 200 OK: 
{
  "success": true
}

​
RSA key management

​
Check keys

Check whether the user has RSA keys stored and retrieve the encrypted private key. 
GET /api/vault/keys
Authentication: Required Response 200 OK: 
{
  "hasKeys": true,
  "encryptedPrivateKey": "base64-encrypted-rsa-private-key",
  "publicKey": "base64-rsa-public-key"
}
Response 200 OK (no keys): 
{
  "hasKeys": false
}

​
Store keys

Store a newly generated RSA keypair. Called during vault setup after client-side key generation. 
POST /api/vault/keys
Authentication: Required CSRF: Required Request body: 
{
  "publicKey": "base64-rsa-public-key",
  "encryptedPrivateKey": "base64-encrypted-rsa-private-key"
}
The private key is encrypted with the vault key (AES-256-GCM) before being sent to the server. Response 201 Created: 
{
  "success": true
}

​
Server-side encryption (legacy)

These endpoints use Evervault for server-side encryption. New installations should use zero-trust client-side encryption instead.

​
Encrypt

POST /api/encrypt
Authentication: Required CSRF: Required Request body: 
{
  "data": "plaintext-to-encrypt"
}
Response 200 OK: 
{
  "encrypted": "ev:encrypted-data"
}

​
Decrypt

POST /api/decrypt
Authentication: Required CSRF: Required Request body: 
{
  "data": "ev:encrypted-data"
}
Response 200 OK: 
{
  "decrypted": "plaintext-data"
}
The server-side encryption endpoints are provided for backward compatibility with Evervault-encrypted data. New vault entries should use zero-trust client-side encryption exclusively.