{ "openapi": "3.0.1", "info": { "title": "Enigma Vault API", "description": "## Welcome to Enigma Vault's API Documentation\n\nEnigma Vault encrypts and tokenizes data of all shapes and sizes. Enigma Vault provides the following services:\n\n- **Card Vault**: encrypts and tokenizes card data. One way in and no way out except through our proxy services.\n- **Data Vault**: encrypts and tokenizes data. Encrypted data can be easily searched and retrieved.\n- **File Vault**: encrypts and stores files up to 5 GB in size.\n- **Customer Vault**: creates customers, generates intake URLs for secure data collection (files, cards, signatures, custom fields), and manages webhook notifications.\n\nTo get started, sign up in our [developer portal](https://portal.enigmavault.io) and subscribe to one of our products. Once you have credentials, feel free to use the [PostMan app](https://www.postman.com/downloads/)\nor our [Swagger UI](https://api.enigmavault.io/index.html).\n\nLite is a free sandbox with limits, and the paid plans have no request rate limit. See [plans and limits](https://docs.enigmavault.io/pricing.html#plan-limits).\n\n## Version 1.14 Notes\n### 10/19/2026\n#### Card Vault\n- The proxy now supports optional JWE body encryption through a new encryption block alongside signing\n- Set encryption algorithm to RSA-OAEP or RSA-OAEP-256 and pass the provider's RSA public key as encryption jwk (kty, n, e, optional kid); contentEncryption defaults to A256GCM\n- After card placeholders are substituted (and any signature is computed over that plaintext), the body is replaced by a compact JWE and sent with the Content-Type from your headers\n- This is what Cybersource Flex API v2 token requests require: use the jwk from the capture context's flx claim, put the capture context in the body's context field, and the transient token JWT is returned as the proxy response\n- For Cybersource token calls send both Content-Type: application/jwt and Accept: application/jwt in the proxy headers; Cybersource returns 406 without them\n- The tokens URL is the capture context's flx.origin plus flx.path (testflex.cybersource.com in test, not apitest.cybersource.com), so take the host from the capture context and whitelist it\n- Keys must be RSA, 2048 to 8192 bits, with a public exponent of at most 64 bits; other keys are rejected with a 400\n- oauth1-rsa-sha256 signing cannot be combined with encryption (its body hash must cover the bytes actually sent) and is rejected with a 400; sha256 and hmac-sha256 signing sign the plaintext before encryption\n- Requests without the encryption block are unchanged\n### 09/14/2026\n#### Card Vault\n- The proxy signing block now supports OAuth 1.0a with RSA-SHA256, as required by Mastercard APIs such as Mastercard Send\n- Set signing algorithm to oauth1-rsa-sha256 and pass your OAuth consumer key in signing consumerKey\n- The request is signed with the private key of the client certificate attached to your Client ID, so upload your Mastercard signing key (.p12) in the developer portal first\n- The full OAuth Authorization header is generated for you, including the body hash of the final request after card placeholders are substituted\n- Secret, headerName, and encoding are not used with oauth1-rsa-sha256; the header defaults to Authorization\n- Existing sha256 and hmac-sha256 signing is unchanged\n", "contact": { "name": "Enigma Vault Support", "url": "https://www.enigmavault.io", "email": "support@enigmavault.io" }, "version": "1.14" }, "servers": [ { "url": "https://api.enigmavault.io" } ], "paths": { "/cardvault/cards": { "post": { "tags": [ "CardVault" ], "summary": "Store a card.", "description": "When a card is stored in the vault, the original card information is not retrievable by the client without the cardvault_raw scope (add it to your client ID in the developer portal). The CVV's ttl is set to the same ttl as the card unless the card is stored longer than 30 minutes. If the card is stored longer than 30 minutes, the CVV's ttl is set to 30 minutes. The CVV should be deleted immediately after transacting (see the /cardvault/cards/cvv DELETE endpoint). After the CVV's ttl, the CVV automatically gets deleted. After the card's ttl, the card is deleted. To make the card permanent, leave out the ttl property. The full card number can be used through the proxy endpoint. You can get the first six, the last four, full name, and expiration from /cardvault/cards (GET). If you need Luhn tokens with custom BIN ranges or deterministic tokens, please contact support@enigmavault.io.", "operationId": "StoreCard", "parameters": [ { "name": "preserveFormat", "in": "query", "description": "If true, a Luhn passable token is returned consisting of the original first six and last four.", "schema": { "type": "boolean" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "requestBody": { "description": "Card information.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CardModel" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CardTokenModel" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "409": { "description": "Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms. token_limit_reached (tokenType card): Card Vault Lite stores up to 100 live cards; cards past their ttl do not count. Upgrade to Starter. AWS Marketplace Starter and Growth subscriptions only, except those on grandfathered terms. band_exceeded: the subscription is over its plan's stored card token band and the 14-day grace after the band email has ended (limit or limitBytes, stored or storedBytes, since). Change the plan in the AWS Marketplace console (upgrade); the stop clears within minutes. Reads, updates and deletes keep working.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] }, "get": { "tags": [ "CardVault" ], "summary": "Get a card.", "description": "Provides card data. The first six and the last four are included in the response. The ttl values represent the time remaining in seconds until that item is purged. the original card information is not retrievable by the client without the cardvault_raw scope (add it to your client ID in the developer portal). If you have the proper scope, use the cardvault/raw/cards endpoint.", "operationId": "RetrieveCard", "parameters": [ { "name": "cardToken", "in": "header", "description": "Card token.", "schema": { "maxLength": 120, "minLength": 13, "type": "string" } }, { "name": "ccn", "in": "header", "description": "Card number.", "schema": { "type": "string", "format": "credit-card" } }, { "name": "referenceId", "in": "header", "description": "Customer or other internal app reference.", "schema": { "maxLength": 128, "minLength": 1, "type": "string" } }, { "name": "ephemeralKey", "in": "query", "description": "Expiring key for temporary access.", "schema": { "type": "string", "format": "uuid" } }, { "name": "stealthRead", "in": "query", "description": "When true, dateLastAccessed does not get updated.", "schema": { "type": "boolean", "default": false } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/CardReadModel" } } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] }, "delete": { "tags": [ "CardVault" ], "summary": "Delete a card.", "description": "Returns an empty 204 response on success.", "operationId": "DeleteCard", "parameters": [ { "name": "cardToken", "in": "header", "description": "Card token.", "required": true, "schema": { "maxLength": 120, "minLength": 13, "type": "string" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "204": { "description": "No Content", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmptyResult" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/cardvault/raw/cards": { "get": { "tags": [ "CardVault" ], "summary": "Get a card. Scope cardvault_raw only.", "description": "Special endpoint to retrieve raw card data. It can only be used with the cardvault_raw scope. Add the scope to a client ID in the developer portal; doing so brings the systems that use that client ID into your PCI DSS scope.", "operationId": "RetrieveRawCard", "parameters": [ { "name": "cardToken", "in": "header", "description": "Card token.", "schema": { "maxLength": 120, "minLength": 13, "type": "string" } }, { "name": "ccn", "in": "header", "description": "Card number.", "schema": { "type": "string", "format": "credit-card" } }, { "name": "referenceId", "in": "header", "description": "Customer or other internal app reference.", "schema": { "maxLength": 128, "minLength": 1, "type": "string" } }, { "name": "ephemeralKey", "in": "query", "description": "Expiring key for temporary access.", "schema": { "type": "string", "format": "uuid" } }, { "name": "stealthRead", "in": "query", "description": "When true, dateLastAccessed does not get updated.", "schema": { "type": "boolean", "default": false } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/CardReadModel" } } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/cardvault/cards/ephemeralkeys": { "get": { "tags": [ "CardVault" ], "summary": "Get an ephemeral key for a specific card token and client.", "description": "The ephemeralKey is a one time transaction use expiring key that allows an external client to use a temporary card token. The token guid, tokenGuid, is used wherever a token is normally used. The destinationClientId is a valid Enigma Vault clientId of the destination app. The time to live (ttl) is in seconds.", "operationId": "GetCardEphemeralKey", "parameters": [ { "name": "cardToken", "in": "header", "description": "Reference to the vaulted card.", "required": true, "schema": { "maxLength": 120, "minLength": 13, "type": "string" } }, { "name": "destinationClientId", "in": "query", "description": "Enigma Vault client granted use of the ephemeralKey.", "required": true, "schema": { "type": "string" } }, { "name": "ttl", "in": "query", "description": "Time to live in seconds, max of 1800 seconds. This is only applicable when\r\n the card has a ttl of 0 (permanent). Otherwise the ephemeralKey ttl is set to the card ttl.", "schema": { "maximum": 1800, "minimum": 60, "type": "integer", "format": "int32" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EphemeralKeyModel" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/cardvault/cards/ttl": { "get": { "tags": [ "CardVault" ], "summary": "Get the current ttl of a card.", "description": "The card's time to live in seconds. Once expired the card is deleted from the vault. If -1, the card lives forever until manually deleted.", "operationId": "GetTtl", "parameters": [ { "name": "cardToken", "in": "header", "description": "Card token.", "required": true, "schema": { "maxLength": 120, "minLength": 13, "type": "string" } }, { "name": "ephemeralKey", "in": "query", "description": "Expiring key for temporary access.", "schema": { "type": "string", "format": "uuid" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CardTtlReadModel" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] }, "put": { "tags": [ "CardVault" ], "summary": "Update the card ttl.", "description": "Adjusts the time (seconds) until deletion. Additional time cannot be added to the CVV's ttl.", "operationId": "UpdateCardTtl", "parameters": [ { "name": "cardToken", "in": "header", "description": "Card token.", "required": true, "schema": { "maxLength": 120, "minLength": 13, "type": "string" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "requestBody": { "description": "New card ttl value.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CardTtlModel" } } }, "required": true }, "responses": { "204": { "description": "No Content", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmptyResult" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/cardvault/cards/cvv": { "delete": { "tags": [ "CardVault" ], "summary": "Delete a card's cvv.", "description": "Returns an empty 204 response on success.", "operationId": "DeleteCardCvv", "parameters": [ { "name": "cardToken", "in": "header", "description": "Card token.", "required": true, "schema": { "maxLength": 120, "minLength": 13, "type": "string" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "204": { "description": "No Content", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmptyResult" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/cardvault/proxy": { "post": { "tags": [ "CardVault" ], "summary": "Send detokenized card data and transaction info to any gateway / upstream provider.", "description": "This endpoint allows you to use a stored card without touching the card data. Build out the request meant for the upstream url and then use the following placeholders to have the endpoint populate them with card data: ${ccn}, ${cvv}, ${fullName}, ${lastName}, ${firstName}, ${cardType}, ${mm}, ${yy}, and ${yyyy}. Supports GET/PUT/POST/DELETE. Optionally sign the request (signing block) and/or encrypt the body as a JWE (encryption block). With encryption, the body you supply is the JWE plaintext: after placeholders are substituted and any signature is computed over that plaintext, the body is replaced by a compact JWE (RSA-OAEP or RSA-OAEP-256 key wrap, A256GCM) encrypted to the RSA public JWK you supply, and sent with the Content-Type from your headers. This is how Cybersource Flex API v2 (POST /flex/v2/tokens) accepts card data: pass the jwk from the capture context's flx claim, put the capture context in the body's context field, and the transient token JWT comes back as the proxy response. Send both Content-Type: application/jwt and Accept: application/jwt in headers (Cybersource returns 406 otherwise), and build the url from the capture context's flx.origin plus flx.path (testflex.cybersource.com in test), whitelisting that host. The JWK must be an RSA key of 2048 to 8192 bits with a public exponent of at most 64 bits. oauth1-rsa-sha256 signing cannot be combined with encryption (its body hash must cover the bytes actually sent); both cases return 400. Requests without the encryption block are unchanged. When finished transacting, delete the CVV by using the /cardvault/cards/cvv DELETE endpoint.", "operationId": "CardProxy", "parameters": [ { "name": "cardToken", "in": "header", "description": "Card token.", "required": true, "schema": { "maxLength": 120, "minLength": 13, "type": "string" } }, { "name": "ephemeralKey", "in": "query", "description": "Expiring key for temporary access.", "schema": { "type": "string", "format": "uuid" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "requestBody": { "description": "Token and gateway information.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CardProxyModel" } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProxyResponseModel" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "503": { "description": "Service Unavailable", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/cardvault/store/forms": { "get": { "tags": [ "CardVault" ], "summary": "Get a url to the card store UI.", "description": "The card store form allows your app to store and later use customer card data without touching it. After the cardTtl expires, the card is deleted. If the user decides to save the card, the card is stored permanently. If you're seeking to permanently store the card outside of a transaction (wallet style), set walletSave to true. When finished transacting, delete the CVV by using the /cardvault/cards/cvv DELETE endpoint. If you set walletSave to true, the buttonText and cardTtl are overriden. If walletSave is true the CVV isn't requested. If you intend to use the card in a transaction within 30 minutes, set walletSave to false. On callback, your app will receive via POST the card token within the parameter eVtoken. If the customer chooses to cancel or if the form timeouts, the evException parameter will contain the reason. For cancels, evException's value will be 'cancel'. For timeouts, evException's value will be 'timeout'. If embedFormForControl is set to true, pass 'submit' as a message over to the iframe to submit the form. On response, the parent will receive an object that consists of the status, the token, and CardModel object. There are multiple ways to integrate the card store form. You can use it within a popup, redirect, simple iframe, or iframe where the parent page has control to submit the form. You can find example code for the advanced iframe integration on [GitHub](https://github.com/Enigma-Vault/card-vault-integration-examples).", "operationId": "GetCardStoreForm", "parameters": [ { "name": "showTimer", "in": "query", "description": "Show or hide the timer.", "required": true, "schema": { "type": "boolean" } }, { "name": "showCard", "in": "query", "description": "Show or hide the card visual.", "required": true, "schema": { "type": "boolean" } }, { "name": "walletSave", "in": "query", "description": "Make true to store the card in your app's wallet. This overrides\r\n the cardTtl and buttonText values. The CVV isn't requested if true.\r\n If you intend to use the card in a transaction within 30 minutes,\r\n set walletSave to false.", "required": true, "schema": { "type": "boolean" } }, { "name": "embedFormForControl", "in": "query", "description": "If true, it removes its buttons and\r\n any additional padding/spacing, and enables the windows interface for 2-way comms.", "required": true, "schema": { "type": "boolean" } }, { "name": "ttl", "in": "query", "description": "Form session time to live in seconds. After it expires, the form can no\r\n longer be used.", "required": true, "schema": { "maximum": 1800, "minimum": 60, "type": "integer", "format": "int32" } }, { "name": "cardTtl", "in": "query", "description": "The card's time to live in seconds (60-1800 secs).\r\n Once expired the card is deleted from the vault. Use the /cardvault/cards/ttl\r\n endpoint to extend it. This field is required if walletSave is false.", "schema": { "maximum": 1800, "minimum": 60, "type": "integer", "format": "int32" } }, { "name": "preserveFormat", "in": "query", "description": "If true, a Luhn passable token is returned consisting of the original first six and last four.", "schema": { "type": "boolean" } }, { "name": "cardTypes", "in": "query", "description": "Card types, comma delimited. Omit for any card.\r\n (amex, diners_club_carte_blanche, diners_club_international,\r\n jcb, laser, visa_electron, visa, mastercard, discover, dankort, maestro, uatp, mir, dina).", "schema": { "type": "string" } }, { "name": "referenceId", "in": "header", "description": "Customer or other internal app reference.", "schema": { "maxLength": 128, "minLength": 1, "type": "string" } }, { "name": "callbackUrl", "in": "query", "description": "URL the user is redirected to after storing the card.", "schema": { "type": "string", "format": "uri" } }, { "name": "parentUrl", "in": "query", "description": "The parent page URL. The store form uses it when embedFormForControl\r\n is true to communicate with the parent window.", "schema": { "type": "string", "format": "uri" } }, { "name": "pageHeader", "in": "query", "description": "Configurable page header.", "schema": { "maxLength": 35, "minLength": 3, "type": "string" } }, { "name": "css", "in": "query", "description": "CSS to customize the web form.", "schema": { "maxLength": 1024, "minLength": 3, "type": "string" } }, { "name": "language", "in": "query", "description": "The language to use on the form. Supported values include:\r\n en (English), es (Spanish), it (Italian), fr (French), pt-BR (Brazilian Portuguese), zh-Hans (Simplified Chinese), sr (Serbian - Cyrillic), sr-Latn (Serbian - Latin), hr (Croatian), me (Montenegrin), bs (Bosnian), mk (Macedonian), sl (Slovenian).", "schema": { "pattern": "^(en|es|it|fr|zh-Hans|pt-BR|sr|sr-Latn|hr|me|bs|mk|sl)$", "type": "string", "default": "en" } }, { "name": "submitButtonText", "in": "query", "description": "Text of the submit button.", "schema": { "maxLength": 20, "minLength": 0, "type": "string", "default": "Save" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FormUrlModel" } } } }, "400": { "description": "Bad Request. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms. feature_not_in_plan (custom_css): custom CSS on hosted forms is available on Growth and Business.", "content": { "application/json": { "schema": { "oneOf": [ { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } }, { "$ref": "#/components/schemas/PlanRefusalModel" } ] } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/cardvault/store/cvv/forms": { "get": { "tags": [ "CardVault" ], "summary": "Get a url to the CVV store UI.", "description": "The CVV store form allows your app to temporarily store the CVV until you're finished transacting. When finished, delete the CVV by using the /cardvault/cards/cvv DELETE endpoint. The CVV ttl is the shorter of the card's remaining ttl and 1800 seconds (30 minutes). If the card has a ttl of -1, the CVV ttl will be set to 1800 seconds. If autoSave is true, the callback will not trigger so the client app will need to verify the cvv ttl for its existence. There are multiple ways to integrate the cvv form. You can use it within a popup, redirect, simple iframe, (previous 3 can use autosave) or iframe where the parent page has control to submit the form. You can find example code for the advanced iframe integration on [GitHub](https://github.com/Enigma-Vault/card-vault-integration-examples).", "operationId": "GetCvvStoreForm", "parameters": [ { "name": "cardToken", "in": "header", "description": "Card token.", "required": true, "schema": { "maxLength": 120, "minLength": 13, "type": "string" } }, { "name": "showTimer", "in": "query", "description": "Show or hide the timer.", "required": true, "schema": { "type": "boolean" } }, { "name": "showCancelButton", "in": "query", "description": "Show or hide the cancel button.", "required": true, "schema": { "type": "boolean" } }, { "name": "autoSave", "in": "query", "description": "If true, the buttons and header are removed, and cvv will be autosaved after user entry.\r\n The callback will not trigger so the client app will need to verify the cvv ttl for its existence.", "required": true, "schema": { "type": "boolean" } }, { "name": "embedFormForControl", "in": "query", "description": "If true, it removes its buttons and\r\n any additional padding/spacing, and enables the windows interface for 2-way comms.", "required": true, "schema": { "type": "boolean" } }, { "name": "callbackUrl", "in": "query", "description": "URL the user is redirected to after storing the card.", "schema": { "type": "string", "format": "uri" } }, { "name": "parentUrl", "in": "query", "description": "The parent page URL. The store form uses it when embedFormForControl\r\n is true to communicate with the parent window.", "schema": { "type": "string", "format": "uri" } }, { "name": "pageHeader", "in": "query", "description": "Configurable page header.", "schema": { "maxLength": 35, "minLength": 3, "type": "string" } }, { "name": "css", "in": "query", "description": "CSS to customize the web form.", "schema": { "maxLength": 1024, "minLength": 3, "type": "string" } }, { "name": "language", "in": "query", "description": "The language to use on the form. Supported values include:\r\n en (English), es (Spanish), it (Italian), fr (French), pt-BR (Brazilian Portuguese), zh-Hans (Simplified Chinese), sr (Serbian - Cyrillic), sr-Latn (Serbian - Latin), hr (Croatian), me (Montenegrin), bs (Bosnian), mk (Macedonian), sl (Slovenian).", "schema": { "pattern": "^(en|es|it|fr|zh-Hans|pt-BR|sr|sr-Latn|hr|me|bs|mk|sl)$", "type": "string", "default": "en" } }, { "name": "submitButtonText", "in": "query", "description": "Text of the submit button.", "schema": { "maxLength": 20, "minLength": 0, "type": "string", "default": "Submit" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FormUrlModel" } } } }, "400": { "description": "Bad Request. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms. feature_not_in_plan (custom_css): custom CSS on hosted forms is available on Growth and Business.", "content": { "application/json": { "schema": { "oneOf": [ { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } }, { "$ref": "#/components/schemas/PlanRefusalModel" } ] } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/cardvault/references/cultures": { "get": { "tags": [ "CardVault" ], "summary": "Get a listing of all supported cultures and currencies.", "description": "", "operationId": "GetCultures", "parameters": [ { "name": "cultureCode", "in": "query", "description": "ISO 639-1 (language) and ISO 3166-1 (country) code.", "schema": { "type": "string" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/CultureModel" } } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/customervault/customers": { "post": { "tags": [ "CustomerVault" ], "summary": "Create a new customer with an external ID.", "description": "Creates a customer record with your external GUID. Returns the new customerId and an intake URL where end customers can securely submit files, cards, signatures, and custom fields. If a customer with the same externalId already exists, returns 409 Conflict.", "operationId": "CreateCustomer", "parameters": [ { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateCustomerRequest" } } } }, "responses": { "201": { "description": "Created" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/customervault/customers/{id}": { "get": { "tags": [ "CustomerVault" ], "summary": "Get customer status by internal or external ID.", "description": "Returns intake status for the specified customer. By default returns lightweight counts (fileCount, cardCount, signatureCount, fieldCount) suitable for polling. Add ?detail=true to get item-level metadata: file names/sizes, card tokens/last four, signature timestamps, and field names. The {id} parameter accepts either the internal 32-character customerId or your external ID.", "operationId": "GetCustomer", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "detail", "in": "query", "schema": { "type": "boolean", "default": false } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] }, "delete": { "tags": [ "CustomerVault" ], "summary": "Delete a customer.", "description": "Removes a customer record. This does not delete files or card tokens that were collected during intake — those remain in their respective vaults. The {id} parameter accepts either the internal 32-character customerId or your external ID.", "operationId": "DeleteCustomer", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "204": { "description": "No Content" }, "404": { "description": "Not Found", "content": { "text/plain; v=1.14": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } }, "application/json; v=1.14": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } }, "text/json; v=1.14": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/customervault/customers/{id}/intake-url": { "get": { "tags": [ "CustomerVault" ], "summary": "Get intake URL for an existing customer.", "description": "Returns the intake page URL for the specified customer. Share this URL with your end customer so they can securely submit files, card information, signatures, and custom fields. The {id} parameter accepts either the internal 32-character customerId or your external ID.", "operationId": "GetIntakeUrl", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK" }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/customervault/webhooks": { "get": { "tags": [ "CustomerVault" ], "summary": "Get webhook configuration.", "description": "Returns the current webhook configuration including the URL and enabled status. The webhook secret is write-only and is never included in responses. Configure webhooks to receive real-time notifications when intake events occur (file uploads, card submissions, signature captures, custom field saves).", "operationId": "GetWebhookConfig", "parameters": [ { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK" }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] }, "put": { "tags": [ "CustomerVault" ], "summary": "Update webhook configuration.", "description": "Updates webhook URL, secret, and/or enabled flag. Only fields included in the request are updated — omitted fields are left unchanged. The webhookUrl must be a valid HTTPS URL. The webhookSecret is used to compute HMAC-SHA256 signatures on webhook payloads (sent in the X-Webhook-Signature header) so you can verify authenticity. The secret is write-only and never returned in responses.", "operationId": "UpdateWebhookConfig", "parameters": [ { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateWebhookRequest" } } } }, "responses": { "200": { "description": "OK" }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProblemDetails" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/datavault/secrets": { "post": { "tags": [ "DataVault" ], "summary": "Store a secret.", "description": "Supports up to 5,000 plaintext objects per request. Plaintext strings must be less than 1000 characters in length. The customIdentifier attribute ties your unencrypted data to the tokens. The customIdentifier is not stored within the vault.", "operationId": "StoreDataSecrets", "parameters": [ { "name": "deterministicToken", "in": "query", "description": "Returns a deterministic token instead of an arbitrary/unique token", "schema": { "type": "boolean" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "requestBody": { "description": "Your secrets to vault.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/PlaintextCustomerIdentifierModel" } } } }, "required": true }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/TokenCustomIdentifierModel" } } } } }, "400": { "description": "Bad Request. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms. feature_not_in_plan (batch_size): Lite and Starter accept up to 500 plaintexts per request; Growth and Business up to 5,000.", "content": { "application/json": { "schema": { "oneOf": [ { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } }, { "$ref": "#/components/schemas/PlanRefusalModel" } ] } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "409": { "description": "Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms. token_limit_reached (tokenType data): Data Vault Lite stores up to 100 live data tokens; tokens past their ttl do not count. A batch that would go past the limit is refused whole; values that match an existing deterministic token do not count. Upgrade to Starter. AWS Marketplace Starter and Growth subscriptions only, except those on grandfathered terms. band_exceeded: the subscription is over its plan's stored data token band and the 14-day grace after the band email has ended (limit or limitBytes, stored or storedBytes, since). Change the plan in the AWS Marketplace console (upgrade); the stop clears within minutes. Reads, updates and deletes keep working.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/datavault/secrets/{token}": { "get": { "tags": [ "DataVault" ], "summary": "Get a secret by token.", "description": "The ephemeralKey is a one time use expiring key that allows an external client to obtain the token's secret. To generate one, use the datavault/secrets/ephemeralKey endpoint.", "operationId": "GetDataSecret", "parameters": [ { "name": "token", "in": "path", "description": "Reference to the vaulted secret.", "required": true, "schema": { "maxLength": 120, "minLength": 13, "type": "string" } }, { "name": "ephemeralKey", "in": "query", "description": "One time use expiring key.", "schema": { "type": "string", "format": "uuid" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlaintextReadModel" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] }, "delete": { "tags": [ "DataVault" ], "summary": "Delete a secret.", "description": "", "operationId": "DeleteDataSecret", "parameters": [ { "name": "token", "in": "path", "description": "Reference to the vaulted secret.", "required": true, "schema": { "maxLength": 120, "minLength": 13, "type": "string" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "204": { "description": "No Content", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmptyResult" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/datavault/search": { "post": { "tags": [ "DataVault" ], "summary": "Search by plaintext.", "description": "Exact matches will only be returned and is case sensitive. This endpoint will not return a deterministic token.", "operationId": "SearchDataSecrets", "parameters": [ { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "requestBody": { "description": "Text to search within the vault. Exact matches will only be returned and is case sensitive.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlaintextModel" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/TokenModel" } } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/datavault/ephemeralkeys/{token}": { "get": { "tags": [ "DataVault" ], "summary": "Get an ephemeral key for a specific token and client.", "description": "The ephemeralKey is a one time use expiring key that allows an external client to obtain the token's secret. The destinationClientId is a valid Enigma Vault clientId of the destination app. The time to live (ttl) is in seconds. This endpoint does not currently work with deterministic tokens.", "operationId": "GetDataEphemeralKey", "parameters": [ { "name": "token", "in": "path", "description": "Reference to the vaulted secret.", "required": true, "schema": { "maxLength": 120, "minLength": 13, "type": "string" } }, { "name": "destinationClientId", "in": "query", "description": "Enigma Vault client granted use of the ephemeralKey.", "required": true, "schema": { "type": "string" } }, { "name": "ttl", "in": "query", "description": "Time to live in seconds, max of 300.", "required": true, "schema": { "maximum": 300, "minimum": 1, "type": "integer", "format": "int32" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EphemeralKeyModel" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/datavault/store/forms": { "get": { "tags": [ "DataVault" ], "summary": "Get a URL to the data store form with a single field.", "description": "The data store form allows your application to securely collect and store sensitive customer data—such as Social Security numbers, driver's license numbers, and other personal identifiers—without directly handling it. When the user completes the form, your application will receive the tokenized result through the windows API. On success or failure, messaging will be sent to the parent page indicating the status. You may integrate the form through a controlled iframe setup. Send the message 'submit' to the iframe to trigger submission. The response will be posted to the parent with a payload containing the status and token. Example integration patterns can be found on [GitHub](https://github.com/Enigma-Vault/card-vault-integration-examples).", "operationId": "GetDataStoreForm", "parameters": [ { "name": "ttl", "in": "query", "description": "Form session time to live in seconds. After it expires, the form can no\r\n longer be used.", "required": true, "schema": { "maximum": 86400, "minimum": 60, "type": "integer", "format": "int32" } }, { "name": "parentUrl", "in": "query", "description": "The parent page URL. The store form uses it when embedFormForControl\r\n is true to communicate with the parent window.", "schema": { "type": "string", "format": "uri" } }, { "name": "inputRegex", "in": "query", "description": "Regular expression to validate the input against.", "required": true, "schema": { "maxLength": 256, "minLength": 2, "type": "string" } }, { "name": "css", "in": "query", "description": "CSS to customize the web form.", "schema": { "maxLength": 1024, "minLength": 3, "type": "string" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FormUrlModel" } } } }, "400": { "description": "Bad Request. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms. feature_not_in_plan (custom_css): custom CSS on hosted forms is available on Growth and Business.", "content": { "application/json": { "schema": { "oneOf": [ { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } }, { "$ref": "#/components/schemas/PlanRefusalModel" } ] } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/datavault/secrets/ttl": { "get": { "tags": [ "DataVault" ], "summary": "Get the current ttl of a secret.", "description": "The secret's time to live in seconds. Once expired the secret is deleted from the vault. If -1, the secret lives forever until manually deleted.", "operationId": "GetDataTtl", "parameters": [ { "name": "dataToken", "in": "header", "description": "Data token.", "required": true, "schema": { "maxLength": 120, "minLength": 13, "type": "string" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTtlReadModel" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] }, "put": { "tags": [ "DataVault" ], "summary": "Update the secret ttl.", "description": "Adjusts the time (seconds) until deletion. Set to 0 to make permanent.", "operationId": "UpdateDataTtl", "parameters": [ { "name": "dataToken", "in": "header", "description": "Data token.", "required": true, "schema": { "maxLength": 120, "minLength": 13, "type": "string" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "requestBody": { "description": "New secret ttl value.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DataTtlModel" } } }, "required": true }, "responses": { "204": { "description": "No Content", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmptyResult" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/filevault/uploadurls": { "get": { "tags": [ "FileVault" ], "summary": "Get a url to upload a file.", "description": "The url is used to upload (PUT) a file into the vault. The url has an exipration of five minutes. The file size cannot exceed 5 gigabytes. A websocket url is provided so that the status of the file can be tracked in realtime.", "operationId": "GetUploadUrl", "parameters": [ { "name": "contentType", "in": "query", "description": "The MIME type associated with the file.", "required": true, "schema": { "maxLength": 255, "minLength": 3, "type": "string" } }, { "name": "fileExtension", "in": "query", "description": "The file extension without the leading .", "required": true, "schema": { "pattern": "^[0-9a-zA-Z]{1,10}$", "type": "string" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UploadUrlModel" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "409": { "description": "Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms. storage_limit_reached: File Vault Lite stores up to 5 GB (refreshed hourly). Upgrade to Starter. AWS Marketplace Starter and Growth subscriptions only, except those on grandfathered terms. band_exceeded: the subscription is over its plan's storage band and the 14-day grace after the band email has ended (limit or limitBytes, stored or storedBytes, since). Change the plan in the AWS Marketplace console (upgrade); the stop clears within minutes. Reads, updates and deletes keep working.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/filevault/statuses/{fileName}": { "get": { "tags": [ "FileVault" ], "summary": "Get the status of a file.", "description": "This endpoint has been deprecated because the file status is now provided through a websocket API.", "operationId": "GetFileStatus", "parameters": [ { "name": "fileName", "in": "path", "description": "Tokenized file name.", "required": true, "schema": { "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\\.[0-9a-zA-Z]{1,10}$", "type": "string" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FileStatusModel" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "deprecated": true, "security": [ { "oauth2": [ ] } ] } }, "/filevault/downloadurls/{fileName}": { "get": { "tags": [ "FileVault" ], "summary": "Get a url to decrypt and download the file.", "description": "The url is used to download the file out of the vault. The url has an exipration of five minutes. When aSync is set to true for large files, a websocket API url is returned so that the file status can be monitored in real time. When the file is finished decrypting, the download url is provided through the websocket connection.", "operationId": "GetDownloadUrl", "parameters": [ { "name": "fileName", "in": "path", "description": "Tokenized file name.", "required": true, "schema": { "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\\.[0-9a-zA-Z]{1,10}$", "type": "string" } }, { "name": "aSync", "in": "query", "description": "Set to true to decrypt large files; you'll use the websocket API for notifications.", "required": true, "schema": { "type": "boolean" } }, { "name": "ephemeralKey", "in": "query", "description": "One time use expiring key.", "schema": { "type": "string", "format": "uuid" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DownloadUrlModel" } } } }, "202": { "description": "Accepted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WsUrlModel" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "409": { "description": "Conflict", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/filevault/files/{fileName}": { "delete": { "tags": [ "FileVault" ], "summary": "Delete a file.", "description": "On successful deletion, a 204 response is returned.", "operationId": "DeleteFile", "parameters": [ { "name": "fileName", "in": "path", "description": "Tokenized file name.", "required": true, "schema": { "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\\.[0-9a-zA-Z]{1,10}$", "type": "string" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "204": { "description": "No Content" }, "400": { "description": "Bad Request", "content": { "text/plain; v=1.14": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } }, "application/json; v=1.14": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } }, "text/json; v=1.14": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "text/plain; v=1.14": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } }, "application/json; v=1.14": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } }, "text/json; v=1.14": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "text/plain; v=1.14": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } }, "application/json; v=1.14": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } }, "text/json; v=1.14": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "text/plain; v=1.14": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } }, "application/json; v=1.14": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } }, "text/json; v=1.14": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "text/plain; v=1.14": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } }, "application/json; v=1.14": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } }, "text/json; v=1.14": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "text/plain; v=1.14": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } }, "application/json; v=1.14": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } }, "text/json; v=1.14": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "text/plain; v=1.14": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } }, "application/json; v=1.14": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } }, "text/json; v=1.14": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/filevault/ephemeralkeys/{fileName}": { "get": { "tags": [ "FileVault" ], "summary": "Get an ephemeral key for a specific fileName and client.", "description": "The ephemeralKey is a one time use expiring key that allows an external client to obtain a download url. The destinationClientId is a valid Enigma Vault clientId of the destination app. The time to live (ttl) is in seconds.", "operationId": "GetFileEphemeralKey", "parameters": [ { "name": "fileName", "in": "path", "description": "Tokenized file name.", "required": true, "schema": { "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\\.[0-9a-zA-Z]{1,10}$", "type": "string" } }, { "name": "destinationClientId", "in": "query", "description": "Enigma Vault client granted use of the ephemeralKey.", "required": true, "schema": { "type": "string" } }, { "name": "ttl", "in": "query", "description": "Time to live in seconds, max of 300.", "required": true, "schema": { "maximum": 300, "minimum": 1, "type": "integer", "format": "int32" } }, { "name": "x-api-version", "in": "header", "description": "The requested API version", "required": true, "schema": { "type": "string", "default": "1.14" } } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EphemeralKeyModel" } } } }, "400": { "description": "Bad Request", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } } } } }, "401": { "description": "Unauthorized", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "403": { "description": "Forbidden", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "413": { "description": "Content Too Large", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "415": { "description": "Unsupported Media Type", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClientErrorModel" } } } }, "500": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServerErrorModel" } } } }, "429": { "description": "Lite (the free plan) only: the monthly request allowance is used up (allowance_exhausted) or more than 10 requests were sent in one second (rate_limited). Retry after the Retry-After header. Paid plans have no request rate limit. Developer-portal and AWS Marketplace subscriptions, except Marketplace subscriptions on grandfathered terms.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PlanRefusalModel" } } } }, "421": { "description": "wrong_region: the client belongs to the other data region and must call the base URL in apiBase. An EU data residency client calling https://api.enigmavault.io is refused, and so is a US client calling https://api-eu.enigmavault.io. On File Vault, https://api-eu.enigmavault.io also refuses a client without EU data residency.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegionRefusalModel" } } } } }, "security": [ { "oauth2": [ ] } ] } }, "/cardvault/twilio/store": { "post": { "tags": [ "CardVault" ], "summary": "Tokenize a card via Twilio Pay.", "description": "Receives card data from Twilio's Pay Generic Pay Connector and returns a token. This endpoint uses HTTP Basic Auth (not JWT). Set the Authorization header to Basic base64(clientId:password). Generate your Twilio Pay password in the Enigma Vault developer portal under Twilio Pay settings, then configure Twilio's Generic Pay Connector with your clientId as the username, your password, and this endpoint URL.\n\n**Authentication:**\nHTTP Basic Auth — Authorization: Basic base64(clientId:password). Contact support@enigmavault.io or use the developer portal to enable Twilio Pay and set a password.\n\n**Standard fields** (sent automatically by Twilio):\n- method — Must be \"tokenize\"\n- transaction_id — Twilio's idempotency token\n- cardnumber — Card number (required)\n- cvv — Security code (stored with a 30-minute TTL, or matches card TTL if card TTL is less than 1800s)\n- expiry_month — MM format\n- expiry_year — YY or YYYY format\n- postal_code — Zip/postal code\n\n**Custom parameters** (pass via Parameter noun in TwiML):\n- full_name — Cardholder name\n- card_type — Card brand override (auto-detected from BIN if omitted: visa, mastercard, amex, discover)\n- reference_id — Customer or internal reference identifier (max 128 characters)\n- ttl — Card time-to-live in seconds (60–220,903,200). Omit for permanent storage\n- preserve_format — Set to true for Luhn-passable tokens using the card's first six and last four\n\n**TwiML example:**\n```\n\n \n \n \n \n \n\n```\n\n**Features:**\n- Preserve-format tokens (Luhn-passable) via preserve_format parameter or BIN range config\n- Deterministic dedup when CardVaultDeterministic is enabled — same card returns same token\n- All responses use Twilio's expected format: token_id, error_code, error_message", "operationId": "TwilioStore", "requestBody": { "description": "Twilio Pay request body sent by the Generic Pay Connector.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TwilioPayRequestModel" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TwilioPayTokenizeResponse" } } } } } } } }, "components": { "schemas": { "CardModel": { "required": [ "ccn" ], "type": "object", "properties": { "ccn": { "minLength": 1, "pattern": "^\\d+$", "type": "string", "description": "Card number.", "format": "credit-card", "example": "4111111111111111" }, "fullName": { "maxLength": 30, "minLength": 2, "type": "string", "description": "Full name located on the card.", "nullable": true, "example": "Edward E Nigma" }, "expMonth": { "maximum": 12, "minimum": 1, "type": "integer", "description": "Expiration month.", "format": "int32", "nullable": true, "example": 12 }, "expYear": { "pattern": "^\\d{4}$", "type": "integer", "description": "Expiration year.", "format": "int32", "nullable": true, "example": 9999 }, "cvv": { "pattern": "^\\d{3}$|^\\d{4}$", "type": "string", "description": "Card verification value (security code). This value is not stored permanently.", "nullable": true, "example": "123" }, "cardType": { "maxLength": 30, "minLength": 1, "type": "string", "description": "Type of card (amex, diners_club_carte_blanche, diners_club_international,\r\njcb, laser, visa_electron, visa, mastercard, discover, dankort, maestro, uatp, mir, dina).", "nullable": true, "example": "visa" }, "cvvTtl": { "maximum": 1800, "minimum": 0, "type": "integer", "description": "Remaining ttl before the CVV gets deleted.", "format": "int32", "nullable": true, "example": 60 }, "ttl": { "maximum": 220903200, "minimum": 60, "type": "integer", "description": "The card's time to live in seconds. Once expired the\r\ncard is deleted from the vault.", "format": "int32", "nullable": true, "example": 1800 }, "referenceId": { "maxLength": 128, "minLength": 1, "type": "string", "description": "Customer or other internal reference identifier", "nullable": true, "example": "1234567ABCD" } }, "additionalProperties": false }, "CardProxyModel": { "required": [ "httpMethod", "url" ], "type": "object", "properties": { "url": { "minLength": 1, "type": "string", "description": "URL to use on the payment gateway request.", "format": "uri", "example": "https://apitest.authorize.net/xml/v1/request.api" }, "httpMethod": { "minLength": 1, "pattern": "^GET$|^PUT$|^POST$|^DELETE$/i", "type": "string", "description": "HTTP method to use on the payment gateway request.", "example": "POST" }, "headers": { "type": "array", "items": { "$ref": "#/components/schemas/HeadersModel" }, "description": "Headers to use on the payment gateway request.", "nullable": true }, "body": { "type": "string", "description": "Body to use on the payment gateway request. Card placeholders are substituted\r\nbefore the request is sent. When the encryption block is set, this is the JWE\r\nplaintext; for Cybersource Flex API v2 that is, for example:\r\n{\"data\":{\"paymentInformation\":{\"card\":{\"number\":\"${ccn}\",\"expirationMonth\":\"${mm}\",\"expirationYear\":\"${yyyy}\",\"type\":\"001\",\"securityCode\":\"${cvv}\"}}},\"context\":\"eyJraWQiOi...capture context JWT...\",\"index\":0}\r\nwith the url taken from the capture context's flx.origin plus flx.path (testflex.cybersource.com\r\nin test) and headers that include Content-Type: application/jwt and Accept: application/jwt\r\n(Cybersource returns 406 otherwise).", "nullable": true, "example": "{\"createTransactionRequest\":{\"merchantAuthentication\":{\"name\":\"XXXXXXXXX\",\"transactionKey\":\"XXXXXXXXXXX\"},\"refId\":\"123456\",\"transactionRequest\":{\"transactionType\":\"authOnlyTransaction\",\"amount\":\"5.50\",\"payment\":{\"creditCard\":{\"cardNumber\":\"${ccn}\",\"expirationDate\":\"${yyyy}-${mm}\",\"cardCode\":\"999\"}},\"billTo\":{\"firstName\":\"${firstName}\",\"lastName\":\"${lastName}\",\"company\":\"Souveniropolis\",\"address\":\"14 Main Street\",\"city\":\"Pecan Springs\",\"state\":\"TX\",\"zip\":\"44628\",\"country\":\"USA\"}}}}" }, "signing": { "$ref": "#/components/schemas/SigningModel" }, "encryption": { "$ref": "#/components/schemas/EncryptionModel" } }, "additionalProperties": false }, "CardReadModel": { "required": [ "cardType", "cvvTtl", "firstSix", "fullName", "lastFour", "token", "ttl" ], "type": "object", "properties": { "firstSix": { "maxLength": 6, "minLength": 6, "type": "string", "description": "First six digits of the card number.", "example": "411111" }, "lastFour": { "maxLength": 4, "minLength": 4, "type": "string", "description": "Last four digits of the card number.", "example": "1111" }, "ccn": { "pattern": "^\\d+$", "type": "string", "description": "Card number.", "format": "credit-card", "nullable": true, "example": "4111111111111111" }, "expMonth": { "maximum": 12, "minimum": 1, "type": "integer", "description": "Expiration month.", "format": "int32", "nullable": true, "example": 12 }, "expYear": { "pattern": "^\\d{4}$", "type": "integer", "description": "Expiration year.", "format": "int32", "nullable": true, "example": 9999 }, "fullName": { "maxLength": 30, "minLength": 2, "type": "string", "description": "Full name located on the card.", "example": "Edward E Nigma" }, "cardType": { "maxLength": 30, "minLength": 1, "type": "string", "description": "Type of card (amex, diners_club_carte_blanche, diners_club_international,\r\njcb, laser, visa_electron, visa, mastercard, discover, dankort, maestro, uatp, mir, dina).", "example": "visa" }, "token": { "minLength": 1, "type": "string", "description": "Card token" }, "cvv": { "pattern": "^\\d{3}$|^\\d{4}$", "type": "string", "description": "Card verification value (security code). This value is not stored permanently.", "nullable": true, "example": "123" }, "cvvTtl": { "maximum": 1800, "minimum": 0, "type": "integer", "description": "Remaining ttl before the CVV gets deleted.", "format": "int32", "example": 60 }, "ttl": { "maximum": 1800, "minimum": 0, "type": "integer", "description": "Remaining ttl before the card gets deleted. If -1, card lives forever until manually deleted.", "format": "int32", "example": 60 }, "dateAdded": { "type": "string", "description": "ISO 8601 timestamp when the token was created.", "nullable": true, "example": "2020-12-15T14:17:45.5239370Z" }, "dateLastAccessed": { "type": "string", "description": "ISO 8601 timestamp when the token data was last accessed.", "nullable": true, "example": "2020-12-15T14:17:45.5239370Z" }, "referenceId": { "type": "string", "description": "Customer or other internal reference identifier", "nullable": true, "example": "1234567ABCD" } }, "additionalProperties": false }, "CardTokenModel": { "required": [ "token" ], "type": "object", "properties": { "token": { "maxLength": 120, "minLength": 13, "type": "string", "description": "Card token.", "example": "dBjftJeZ4CVP-OB1IT_xVQ" } }, "additionalProperties": false }, "CardTtlModel": { "required": [ "ttl" ], "type": "object", "properties": { "ttl": { "maximum": 1800, "minimum": 60, "type": "integer", "description": "The card's new time to live in seconds. Once expired the\r\ncard is deleted from the vault. This endpoint cannot make a\r\ncard permanent.", "format": "int32", "example": 1800 } }, "additionalProperties": false }, "CardTtlReadModel": { "required": [ "cvvTtl", "ttl" ], "type": "object", "properties": { "cvvTtl": { "maximum": 1800, "minimum": 60, "type": "integer", "description": "The card's CVV time to live in seconds. Once expired the\r\nCVV is deleted from the vault.", "format": "int32", "example": 1800 }, "ttl": { "maximum": 1800, "minimum": 60, "type": "integer", "description": "The card's time to live in seconds. Once expired the\r\ncard is deleted from the vault. If -1, card lives forever until\r\nmanually deleted.", "format": "int32", "example": 1800 } }, "additionalProperties": false }, "ClientErrorModel": { "type": "object", "properties": { "message": { "type": "string", "description": "Client error message.", "nullable": true } }, "additionalProperties": false }, "CreateCustomerRequest": { "type": "object", "properties": { "externalId": { "type": "string", "nullable": true }, "firstName": { "type": "string", "nullable": true }, "lastName": { "type": "string", "nullable": true }, "email": { "type": "string", "nullable": true }, "phone": { "type": "string", "nullable": true }, "timeZone": { "type": "string", "nullable": true } }, "additionalProperties": false }, "CultureModel": { "required": [ "cultureCode", "cultureName", "currencySymbol" ], "type": "object", "properties": { "cultureCode": { "minLength": 1, "type": "string", "description": "ISO 639-1 (language) and ISO 3166-1 (country) code.", "example": "en-US" }, "cultureName": { "minLength": 1, "type": "string", "description": "Full name of the language and country.", "example": "English (United States)" }, "currencySymbol": { "minLength": 1, "type": "string", "description": "Symbol of the currency.", "example": "$" } }, "additionalProperties": false }, "DataTtlModel": { "required": [ "ttl" ], "type": "object", "properties": { "ttl": { "maximum": 220903200, "minimum": 0, "type": "integer", "description": "The secret's time to live in seconds. Once expired the\r\nsecret is deleted from the vault. Set to 0 to make permanent.", "format": "int32", "example": 86400 } }, "additionalProperties": false }, "DataTtlReadModel": { "type": "object", "properties": { "ttl": { "type": "integer", "description": "The secret's remaining time to live in seconds. -1 means permanent.", "format": "int32", "example": 86400 } }, "additionalProperties": false }, "DeleteCustomerResponse": { "type": "object", "properties": { "clientId": { "type": "string", "nullable": true }, "customerName": { "type": "string", "nullable": true }, "deletedCounts": { "type": "object", "additionalProperties": { "type": "integer", "format": "int32" }, "nullable": true }, "deletedUtc": { "type": "string", "nullable": true } }, "additionalProperties": false }, "DownloadUrlModel": { "required": [ "url" ], "type": "object", "properties": { "url": { "minLength": 1, "type": "string", "description": "The URL to GET the decrypted file. The URL expires in 5 minutes.", "format": "uri" } }, "additionalProperties": false }, "EmptyResult": { "type": "object", "additionalProperties": false }, "EncryptionModel": { "required": [ "algorithm", "jwk" ], "type": "object", "properties": { "algorithm": { "minLength": 1, "pattern": "(?i)^(RSA-OAEP|RSA-OAEP-256)$", "type": "string", "description": "JWE key management algorithm used to wrap the content encryption key with the\r\nRSA public key in jwk. Supported: \"RSA-OAEP\" (OAEP with SHA-1, the algorithm in\r\nCybersource's Flex v2 samples) and \"RSA-OAEP-256\" (OAEP with SHA-256).", "example": "RSA-OAEP" }, "contentEncryption": { "pattern": "(?i)^A256GCM$", "type": "string", "description": "JWE content encryption algorithm. Supported: \"A256GCM\" (default when omitted).", "nullable": true, "example": "A256GCM" }, "jwk": { "$ref": "#/components/schemas/JwkModel" }, "kid": { "maxLength": 256, "minLength": 0, "type": "string", "description": "Optional key id to place in the JWE protected header. Defaults to the kid of jwk\r\nwhen present; when neither is set the header carries no kid.", "nullable": true, "example": "00q4xwAb3FpnOIGfuCLqnzS8ro7EmHNf" } }, "additionalProperties": false }, "EphemeralKeyModel": { "type": "object", "properties": { "ephemeralKey": { "type": "string", "description": "One time transaction use expiring key.", "format": "uuid", "example": "b99b4ad0-2c32-4db8-bc03-283f420a3549" }, "tokenGuid": { "type": "string", "description": "The temporary token, tToken, is used wherever a token is normally used.", "format": "uuid", "example": "6a0a72b6-07c0-422f-9829-81a41809163a" } }, "additionalProperties": false }, "FileStatusModel": { "required": [ "fileStatus" ], "type": "object", "properties": { "fileStatus": { "minLength": 1, "type": "string" } }, "additionalProperties": false }, "FormUrlModel": { "required": [ "url" ], "type": "object", "properties": { "url": { "minLength": 1, "type": "string", "description": "URL to the requested form.", "format": "uri" } }, "additionalProperties": false }, "HeadersModel": { "required": [ "name", "value" ], "type": "object", "properties": { "name": { "minLength": 1, "type": "string", "description": "Name of the header.", "example": "Content-type" }, "value": { "minLength": 1, "type": "string", "description": "Value of the header.", "example": "application/json" } }, "additionalProperties": false }, "JwkModel": { "required": [ "e", "kty", "n" ], "type": "object", "properties": { "kty": { "minLength": 1, "type": "string", "description": "Key type. Must be \"RSA\".", "example": "RSA" }, "n": { "maxLength": 2048, "minLength": 0, "type": "string", "description": "RSA modulus, base64url encoded (RFC 7518 section 6.3.1.1).", "example": "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtVT86zwu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMstn64tZ_2W-5JsGY4Hc5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_FDW2QvzqY368QQMicAtaSqzs8KJZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1n91CbOpbISD08qNLyrdkt-bFTWhAI4vMQFh6WeZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqbw0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw" }, "e": { "maxLength": 16, "minLength": 0, "type": "string", "description": "RSA public exponent, base64url encoded.", "example": "AQAB" }, "kid": { "maxLength": 256, "minLength": 0, "type": "string", "description": "Optional key id. Used as the JWE header kid unless overridden by encryption kid.", "nullable": true, "example": "00q4xwAb3FpnOIGfuCLqnzS8ro7EmHNf" }, "use": { "type": "string", "description": "Optional public key use (for example \"enc\"). Not validated.", "nullable": true, "example": "enc" }, "alg": { "type": "string", "description": "Optional algorithm hint carried on the key. Not validated; the encryption\r\nalgorithm comes from encryption algorithm.", "nullable": true, "example": "RSA-OAEP" } }, "additionalProperties": false }, "PlaintextCustomerIdentifierModel": { "required": [ "plaintext" ], "type": "object", "properties": { "plaintext": { "maxLength": 1000, "minLength": 1, "type": "string", "description": "Secret text to vault.", "example": "Super secret info" }, "customIdentifier": { "maxLength": 100, "minLength": 0, "type": "string", "description": "Client provided identifier tying the tokens back to some other client data.", "nullable": true, "example": "123" }, "ttl": { "maximum": 220903200, "minimum": 60, "type": "integer", "description": "The secret's time to live in seconds. Once expired the\r\nsecret is deleted from the vault. Omit to make permanent.", "format": "int32", "nullable": true, "example": 86400 } }, "additionalProperties": false }, "PlaintextModel": { "required": [ "plaintext" ], "type": "object", "properties": { "plaintext": { "maxLength": 1000, "minLength": 1, "type": "string", "description": "Secret text.", "example": "Super secret info" } }, "additionalProperties": false }, "PlaintextReadModel": { "required": [ "plaintext" ], "type": "object", "properties": { "plaintext": { "maxLength": 1000, "minLength": 1, "type": "string", "description": "Secret text.", "example": "Super secret info" }, "ttl": { "type": "integer", "description": "Remaining ttl before the secret gets deleted. -1 means permanent.", "format": "int32", "example": 86400 } }, "additionalProperties": false }, "PlanRefusalModel": { "type": "object", "properties": { "error": { "type": "string", "description": "allowance_exhausted, rate_limited, token_limit_reached, storage_limit_reached or feature_not_in_plan.", "nullable": true, "example": "token_limit_reached" }, "plan": { "type": "string", "description": "The subscription's plan.", "nullable": true, "example": "Lite" }, "requiredPlan": { "type": "string", "description": "The lowest plan without the limit, or with the feature.", "nullable": true, "example": "Starter" }, "feature": { "type": "string", "description": "feature_not_in_plan only: custom_css or batch_size.", "nullable": true }, "tokenType": { "type": "string", "description": "token_limit_reached only: card or data.", "nullable": true }, "limit": { "type": "integer", "description": "The limit (tokens, plaintexts per request, requests per second for rate_limited) where one applies.", "format": "int64", "nullable": true }, "stored": { "type": "integer", "description": "token_limit_reached: live tokens stored under the key now (counted up to the limit).", "format": "int64", "nullable": true }, "requested": { "type": "integer", "description": "The number of items the request would add, for a Data Vault batch.", "format": "int64", "nullable": true }, "limitBytes": { "type": "integer", "description": "storage_limit_reached: the storage limit in bytes.", "format": "int64", "nullable": true }, "storedBytes": { "type": "integer", "description": "storage_limit_reached: bytes stored, refreshed hourly.", "format": "int64", "nullable": true }, "resets": { "type": "string", "description": "allowance_exhausted: when the billing period resets (UTC). The response also carries Retry-After.", "nullable": true }, "upgrade": { "type": "string", "description": "Where to change plan: the portal's billing page, or the AWS Marketplace console for a Marketplace subscription.", "nullable": true, "example": "https://portal.enigmavault.io/Billing" }, "message": { "type": "string", "description": "A readable explanation.", "nullable": true } }, "additionalProperties": false, "description": "A plan refusal. The response description says which subscriptions are refused." }, "ProblemDetails": { "type": "object", "properties": { "type": { "type": "string", "nullable": true }, "title": { "type": "string", "nullable": true }, "status": { "type": "integer", "format": "int32", "nullable": true }, "detail": { "type": "string", "nullable": true }, "instance": { "type": "string", "nullable": true } }, "additionalProperties": { } }, "ProvisionCustomerRequest": { "required": [ "customerName", "email", "scopes" ], "type": "object", "properties": { "customerName": { "minLength": 1, "type": "string", "description": "Display name for the customer or organization.", "example": "Acme Corp" }, "email": { "minLength": 1, "type": "string", "description": "Primary contact email address.", "format": "email", "example": "admin@acme.com" }, "phone": { "type": "string", "description": "Primary contact phone number.", "nullable": true }, "scopes": { "minItems": 1, "type": "array", "items": { "type": "string" }, "description": "Scopes to assign to the Cognito app client (e.g., \"cardvault\", \"datavault\", \"filevault\", \"api\").\r\nThe scope domain prefix is added automatically.", "example": [ "cardvault", "datavault" ] }, "domains": { "type": "array", "items": { "type": "string" }, "description": "IP/domain whitelist for API access.", "nullable": true }, "networks": { "type": "array", "items": { "type": "string" }, "description": "CIDR ranges for network-level access control.", "nullable": true }, "entRestricted": { "type": "string", "description": "Restricts the customer to a single vault type (e.g., \"cardvault\", \"datavault\").", "nullable": true }, "activeClient": { "type": "boolean", "description": "Whether to activate the client immediately. Defaults to true." } }, "additionalProperties": false }, "ProvisionCustomerResponse": { "type": "object", "properties": { "clientId": { "type": "string", "nullable": true }, "clientSecret": { "type": "string", "nullable": true }, "keyName": { "type": "string", "nullable": true }, "customerName": { "type": "string", "nullable": true }, "email": { "type": "string", "nullable": true }, "scopes": { "type": "array", "items": { "type": "string" }, "nullable": true }, "activeClient": { "type": "boolean" }, "createdUtc": { "type": "string", "nullable": true } }, "additionalProperties": false }, "ProxyResponseModel": { "required": [ "body", "contentType", "statusCode" ], "type": "object", "properties": { "headers": { "type": "array", "items": { "$ref": "#/components/schemas/HeadersModel" }, "description": "Headers from the payment gateway response.", "nullable": true }, "statusCode": { "type": "integer", "description": "HTTP status code from the payment gateway response.", "format": "int32", "example": 200 }, "contentType": { "minLength": 1, "type": "string", "description": "Content type from the payment gateway response.", "example": "application/json" }, "body": { "minLength": 1, "type": "string", "description": "Body from the payment gateway response.", "example": "{\"transactionResponse\":{\"responseCode\":\"1\",\"authCode\":\"AKXD8T\",\"avsResultCode\":\"Y\",\"cvvResultCode\":\"P\",\"cavvResultCode\":\"2\",\"transId\":\"60159519275\",\"refTransID\":\"\",\"transHash\":\"\",\"testRequest\":\"0\",\"accountNumber\":\"XXXX1111\",\"accountType\":\"Visa\",\"messages\":[{\"code\":\"1\",\"description\":\"This transaction has been approved.\"}],\"transHashSha2\":\"\",\"SupplementalDataQualificationIndicator\":0,\"networkTransId\":\"0V3X5LPO079GCBFQM2B348D\"},\"refId\":\"123456\",\"messages\":{\"resultCode\":\"Ok\",\"message\":[{\"code\":\"I00001\",\"text\":\"Successful.\"}]}}" } }, "additionalProperties": false }, "RegionRefusalModel": { "type": "object", "properties": { "error": { "type": "string", "description": "Always wrong_region.", "nullable": true, "example": "wrong_region" }, "region": { "type": "string", "description": "The client's data region.", "nullable": true, "example": "eu-west-1" }, "apiBase": { "type": "string", "description": "The API base URL that serves this client.", "nullable": true, "example": "https://api-eu.enigmavault.io" }, "message": { "type": "string", "description": "A readable explanation.", "nullable": true } }, "additionalProperties": false, "description": "The client belongs to the other data region (EU data residency). Call the API base URL given." }, "ServerErrorModel": { "type": "object", "properties": { "type": { "type": "string", "description": "A reference to the type of error\r\nreturned.", "nullable": true }, "title": { "type": "string", "description": "Title/summary of the error.", "nullable": true }, "status": { "type": "integer", "description": "HTTP status code.", "format": "int32" }, "detail": { "type": "string", "description": "Detailed error message.", "nullable": true }, "traceId": { "type": "string", "description": "Identifies the request associated\r\nwith the error.", "nullable": true } }, "additionalProperties": false }, "SigningModel": { "required": [ "algorithm" ], "type": "object", "properties": { "algorithm": { "minLength": 1, "pattern": "(?i)^(sha256|hmac-sha256|oauth1-rsa-sha256)$", "type": "string", "description": "Signing algorithm. Supported: \"sha256\", \"hmac-sha256\", \"oauth1-rsa-sha256\".\r\n\"oauth1-rsa-sha256\" produces a full OAuth 1.0a Authorization header (RSA-SHA256,\r\nwith an oauth_body_hash of the final request body) as required by Mastercard APIs.\r\nIt signs with the private key of the client certificate attached to your Client ID\r\nin the developer portal.", "example": "hmac-sha256" }, "secret": { "type": "string", "description": "Secret key used for signing. Required for \"sha256\" and \"hmac-sha256\".\r\nNot used for \"oauth1-rsa-sha256\".", "nullable": true, "example": "your-secret-key" }, "consumerKey": { "type": "string", "description": "OAuth consumer key. Required for \"oauth1-rsa-sha256\" (for example, the consumer key\r\nfrom your Mastercard Developers project). Not used for other algorithms.", "nullable": true, "example": "AbCdEf...!0123456789abcdef0000000000000000" }, "headerName": { "type": "string", "description": "Name of the header to place the computed signature in. Required for \"sha256\" and\r\n\"hmac-sha256\". Defaults to \"Authorization\" for \"oauth1-rsa-sha256\".", "nullable": true, "example": "X-Api-Signature" }, "encoding": { "type": "string", "description": "Output encoding: \"hex\" (default) or \"base64\". Not used for \"oauth1-rsa-sha256\".", "nullable": true, "example": "hex" } }, "additionalProperties": false }, "TokenCustomIdentifierModel": { "required": [ "token" ], "type": "object", "properties": { "token": { "maxLength": 120, "minLength": 13, "type": "string", "description": "Reference to the vaulted secret.", "example": "dBjftJeZ4CVP-OB1IT_xVQ" }, "customIdentifier": { "maxLength": 100, "minLength": 0, "type": "string", "description": "Client provided identifier tying the tokens back to some other client data.", "nullable": true, "example": "123" }, "ttl": { "type": "integer", "description": "Remaining ttl before the secret gets deleted. -1 means permanent.", "format": "int32", "example": 86400 } }, "additionalProperties": false }, "TokenModel": { "required": [ "token" ], "type": "object", "properties": { "token": { "maxLength": 120, "minLength": 13, "type": "string", "description": "Reference to the vaulted secret.", "example": "dBjftJeZ4CVP-OB1IT_xVQ" }, "ttl": { "type": "integer", "description": "Remaining ttl before the secret gets deleted. -1 means permanent.", "format": "int32", "example": 86400 } }, "additionalProperties": false }, "TwilioPayRequestModel": { "type": "object", "properties": { "method": { "type": "string", "description": "Transaction method. Must be \"tokenize\".", "nullable": true, "example": "tokenize" }, "transaction_id": { "type": "string", "description": "Twilio's idempotency token for the transaction.", "nullable": true, "example": "txn-abc123" }, "cardnumber": { "type": "string", "description": "Card number.", "nullable": true, "example": "4111111111111111" }, "expiry_month": { "type": "string", "description": "Expiration month (MM).", "nullable": true, "example": "12" }, "expiry_year": { "type": "string", "description": "Expiration year (YY or YYYY).", "nullable": true, "example": "2028" }, "cvv": { "type": "string", "description": "Card verification value (security code). Stored temporarily with a 30-minute TTL\r\n(or matches card TTL if card TTL is less than 1800 seconds).", "nullable": true, "example": "123" }, "postal_code": { "type": "string", "description": "Cardholder's postal/zip code.", "nullable": true, "example": "94111" }, "parameters": { "type": "object", "additionalProperties": { "type": "string", "nullable": true }, "description": "Custom parameters passed via the TwiML Parameter noun.\r\nSupported keys: full_name, card_type, reference_id.", "nullable": true } }, "additionalProperties": false }, "TwilioPayTokenizeResponse": { "type": "object", "properties": { "token_id": { "type": "string", "description": "The generated card token. Null when an error occurs.", "nullable": true, "example": "4111117302171111" }, "error_code": { "type": "string", "description": "Error code (HTTP-style). Null on success.", "nullable": true, "example": "400" }, "error_message": { "type": "string", "description": "Human-readable error message. Null on success.", "nullable": true, "example": "Card is expired" } }, "additionalProperties": false }, "UpdateWebhookRequest": { "type": "object", "properties": { "webhookUrl": { "type": "string", "nullable": true }, "webhookSecret": { "type": "string", "nullable": true }, "webhookEnabled": { "type": "boolean", "nullable": true } }, "additionalProperties": false }, "UploadUrlModel": { "required": [ "fileName", "url", "wsUrl" ], "type": "object", "properties": { "url": { "minLength": 1, "type": "string", "description": "The URL to PUT the file. The URL expires in 5 minutes.", "format": "uri" }, "fileName": { "minLength": 1, "type": "string", "description": "Tokenized file name.", "example": "b99b4ad0-2c32-4db8-bc03-283f420a3549.pdf" }, "wsUrl": { "minLength": 1, "type": "string", "description": "WebSocket URL to receive messages on the status of the file.\r\nIt returns the following jSON response {\"status\":\"string\",\"detailedMessage\":\"string\",\"url\":\"string\"}\r\nThe status can be one of the following: Waiting on upload, Encrypting, Vaulted, Decrypting, Decrypted, Error.\r\nThe url property will contain a download url when the status is Decrypted. The download url is valid for 5 minutes.", "format": "uri", "example": "wss://filestatus-api.enigmavault.io?fileName=b99b4ad0-2c32-4db8-bc03-283f420a3549.pdf&sessionId=abcdefg" } }, "additionalProperties": false }, "WsUrlModel": { "type": "object", "properties": { "wsUrl": { "type": "string", "description": "WebSocket URL to receive messages on the status of the file.\r\nIt returns the following jSON response {\"status\":\"string\",\"detailedMessage\":\"string\",\"url\":\"string\"}\r\nThe status can be one of the following: Waiting on upload, Encrypting, Vaulted, Decrypting, Decrypted, Error.\r\nThe url property will contain a download url when the status is Decrypted. The download url is valid for 5 minutes.", "nullable": true, "example": "wss://filestatus-api.enigmavault.io?fileName=b99b4ad0-2c32-4db8-bc03-283f420a3549.pdf&sessionId=abcdefg" } }, "additionalProperties": false } }, "securitySchemes": { "oauth2": { "type": "oauth2", "flows": { "clientCredentials": { "tokenUrl": "https://api-auth.enigmavault.io/oauth2/token", "scopes": { "io.enigmavault/api": "All access", "io.enigmavault/cardvault": "Card Vault access", "io.enigmavault/cardvault_raw": "Card Vault access w/ raw data", "io.enigmavault/datavault": "Data Vault access", "io.enigmavault/filevault": "File Vault access", "io.enigmavault/customervault": "Customer Vault access" } } } } } }, "tags": [ { "name": "CardVault", "description": "Store, tokenize, and process card data without touching it." }, { "name": "CustomerVault", "description": "Create and manage customers for secure data intake (files, cards, signatures, custom fields). Configure webhooks to receive real-time intake event notifications." }, { "name": "DataVault", "description": "Store and tokenize plaintext data." }, { "name": "FileVault", "description": "Store and tokenize files of all types and sizes." } ] }