Key lifecycle, legacy encrypt/decrypt, and on-demand vault decrypt.
Chameleon API reference
The REST API behind everything described in core concepts: key lifecycle, the PII registry, deletion and lineage, certificates, and decrypted views. Grouped by concern below — pick the area you're integrating with.
One host, no version prefix
Every endpoint on this page is relative to your Key Vault instance's own host — for example https://<your-key-vault-host> for a hosted deployment, or wherever you've deployed it yourself if you're self-hosting. There's no /v1 prefix; the API is not currently versioned in the URL path.
Four different mechanisms, by purpose
| Mechanism | Used for | Notes |
|---|---|---|
| Bearer token (service credential) | Fetching an issued certificate, and other authenticated service-level routes | Sent as a standard Authorization: Bearer <token> header. |
| Write token + tenant header | PII registry writes (declare, update, delete a resource) | Authorization: Bearer <write token> plus an x-tenant-id header. If the write token isn't configured server-side, writes are disabled and return 503 — reads are unaffected. This is the safe default. |
| Per-analyst credential | The legacy /encrypt and /decrypt routes only | A hashed, per-analyst credential — never valid for key rotation, shredding, or minting further credentials, regardless of what it can decrypt. |
| None (public by design) | JWKS, the certificate public key, and chain-by-hash lookups | Deliberately unauthenticated so a certificate can be verified independently, without trusting a live authenticated session. |
Some routes only exist if a feature is configured
A handful of routes — on-demand vault decrypt and the entire decrypted-views group — are only registered at all when their corresponding configuration is set. If that configuration is absent, the route doesn't exist (a plain 404), not a permissions error.
Declare, update, query, and monitor coverage for registry resources.
Deletion requests, janitor callbacks, and lineage events.
Fetch and independently verify a Certificate of Destruction.
Manage view definitions that decrypt on read.
Per-analyst credentials for the legacy encrypt/decrypt routes.