The encrypt/decrypt routes analyst credentials authenticate.
Analyst access
Per-analyst credentials replace a single shared secret for the legacy encrypt/decrypt routes — each analyst gets their own credential, provisioned and revoked individually, rather than everyone sharing one token.
Provisioning under /admin/analyst-claims
Credential provisioning and claim-link routes live under the /admin/analyst-claims path. An analyst credential is minted at provisioning time and handed to the analyst via a one-time claim link — it's never stored or transmitted in plaintext after that point, only as a hash.
This documentation section covers the model rather than every sub-route in detail; if you're building admin tooling against these endpoints directly, treat the credential lifecycle described here as the contract to build against.
What an analyst credential can't do
A resolved analyst credential is accepted only on the legacy /encrypt and /decrypt routes — never for key rotation, shredding, or minting further credentials. This is enforced centrally in the request-authentication layer, not on a route-by-route basis, so it can't accidentally be missed on a new route.
Base URL, auth conventions, and the full endpoint index.