enterprise_ai.encryption
Source: sdks/python/src/enterprise_ai/encryption/__init__.py. Back to the Python SDK reference index.
This page is generated by tools/docs/gen_sdk_reference.py from the SDK sources and the OpenAPI text folders. Do not edit it by hand: change the source and regenerate.
Class EncryptionClient
/v1/encryption.
Resource
EncryptionClient.create_key
create_key(name: str, purpose: str | None = None, **extra: Any) -> Any
Create an encryption key. Creates a named key with its first version; the data key is generated and wrapped by OpenBao Transit when configured, locally otherwise. The name must be lowercase letters, digits, ., _ or -, at most 63 characters (400 invalid_request); a name already used answers 409 conflict. Needs tenant_admin or security_officer. Writes the audit event encryption.key.create.
Route: /v1/encryption/keys (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
name | str | yes | Unique name: lowercase letters, digits, ., _ or -, starting with a letter or a digit, at most 63 characters. | |
purpose | str | None | None | no | Free label of the use of the key, data by default. |
**extra | Any | no | Extra fields merged into the request body. |
Returns: Any. Decoded JSON answer of the operation "Create an encryption key".
Raises: the typed errors of the transport (Errors).
EncryptionClient.decrypt
decrypt(ciphertext: str, aad: str | None = None, as_base64: bool | None = None, **extra: Any) -> Any
Decrypt a ciphertext. Decrypts an eaienc1 ciphertext of the tenant with the key version it names, checking the same aad as at encryption. Returns plaintext, or plaintext_base64 with as_base64 or when the data is not UTF-8 text, and key_version. Old versions keep decrypting after a rotation. Open to any member of the tenant. Writes the audit event encryption.decrypt.
Route: /v1/encryption/decrypt (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
ciphertext | str | yes | Ciphertext returned by encrypt, eaienc1:<key id>:<version>:.... | |
aad | str | None | None | no | Associated data given at encryption (empty by default). |
as_base64 | bool | None | None | no | When true, returns the data as plaintext_base64 (default false). |
**extra | Any | no | Extra fields merged into the request body. |
Returns: Any. Decoded JSON answer of the operation "Decrypt a ciphertext".
Raises: the typed errors of the transport (Errors).
EncryptionClient.encrypt
encrypt(plaintext: bytes | str, key: str, aad: str | None = None, **extra: Any) -> Any
Encrypt data with a tenant key. Encrypts plaintext (UTF-8 text) or plaintext_base64 (bytes) with the current version of the key, bound to aad. Returns ciphertext (eaienc1:...), key_id and key_version. One of the two inputs is required, and base64 must be valid (400 invalid_request); an unknown key answers 404 key_not_found. Open to any member of the tenant. Writes the audit event encryption.encrypt (size only).
Route: /v1/encryption/encrypt (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
plaintext | bytes | str | yes | UTF-8 text to encrypt. | |
key | str | yes | Key to use, by identifier (UUID) or name. | |
aad | str | None | None | no | Associated data bound to the ciphertext; the same value is required to decrypt (empty by default). |
**extra | Any | no | Extra fields merged into the request body. |
Returns: Any. Decoded JSON answer of the operation "Encrypt data with a tenant key".
Raises: the typed errors of the transport (Errors).
EncryptionClient.list_keys
list_keys() -> Any
List the encryption keys. Lists the encryption keys of the tenant ordered by name: id, name, backend (openbao-transit or local), purpose, current version and dates. Never the key material. Open to any member of the tenant.
Route: /v1/encryption/keys (GET).
This element takes no parameter.
Returns: Any. Decoded JSON answer of the operation "List the encryption keys".
Raises: the typed errors of the transport (Errors).
EncryptionClient.plaintext_bytes
plaintext_bytes(result: dict[str, Any]) -> bytes
Decode the plaintext_base64 (or plaintext) field of a decrypt answer.
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
result | dict[str, Any] | yes | Answer of decrypt. |
Returns: bytes. The decrypted bytes.
EncryptionClient.rotate_key
rotate_key(key_id: str) -> Any
Rotate an encryption key. Adds a new version to the key: new encryptions use it, older ciphertexts keep decrypting with their own version. Needs tenant_admin or security_officer. Answers 404 key_not_found. Writes the audit event encryption.key.rotate.
Route: /v1/encryption/keys/{key_id}/rotate (POST).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
key_id | str | yes | Identifier (UUID) or name of the key. |
Returns: Any. Decoded JSON answer of the operation "Rotate an encryption key".
Raises: the typed errors of the transport (Errors).
Functions
b64
b64(data: bytes | str) -> str
Base64 encode bytes (or UTF-8 text).
| Name | Type | Default | Required | Description |
|---|---|---|---|---|
data | bytes | str | yes | Bytes, or text encoded as UTF-8 first. |
Returns: str. Base64 text.