Docs / API reference

Decrypted views

Decrypted views let an application render specific PII fields on demand, without ever persisting a standing plaintext copy. A view declares which vault fields it exposes, and that declaration is validated live against the vault's actual schema — not trusted blindly.

See where this fits in the architecture

Only available when configured

This entire route group only exists on deployments that have decrypted views enabled. If it isn't configured, these routes return a plain 404 rather than an authorization error.

GET/decrypted-views/available-fieldsAuthenticated

Lists which vault fields are currently valid to expose in a view, based on the vault's live schema.

GET/decrypted-viewsAuthenticated

Lists existing view definitions.

POST/decrypted-viewsAuthenticated

Creates a new view, declaring which vault fields it exposes.

DELETE/decrypted-views/:idAuthenticated

Removes a view definition.

Batch decrypt is not a customer-facing endpoint

The batch-decrypt path that actually performs decryption for a view is invoked internally, not called directly by your application — you interact with view definitions through the endpoints above, and the platform handles decryption on read.

Keep reading

The control plane vs. data plane split, and how decrypt-on-read fits in.

Architecture →