Encryption Policy

General Information

Policy Type

policy-encryption

Description

Encryption policy encrypts data using cryptographic keys or certificates. It reads data from source variables, encrypts them using specified cipher algorithms, and stores the encrypted data in target variables. This policy provides data confidentiality capabilities.

Endpoints

List Policies

GET /apiops/projects/{projectName}/apiProxies/{apiProxyName}/policies/

Add Policy

POST /apiops/projects/{projectName}/apiProxies/{apiProxyName}/policies/{policyName}/

Update Policy

PUT /apiops/projects/{projectName}/apiProxies/{apiProxyName}/policies/{policyName}/

Delete Policy

DELETE /apiops/projects/{projectName}/apiProxies/{apiProxyName}/policies/{policyName}/

---

List Policies

Endpoint

GET /apiops/projects/{projectName}/apiProxies/{apiProxyName}/policies/

Request

Headers

Header	Value
Authorization	Bearer {token}

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
apiProxyName	string	Yes	API Proxy name

Response

Success Response (200 OK)

{
  "status": "SUCCESS",
  "resultList": [
    {
      "apiProxy": {
        "name": "MyAPI",
        "requestPolicyList": [
          {
            "type": "policy-encryption",
            "name": "encryption-policy",
            "description": "Encrypt sensitive data",
            "active": true
          }
        ],
        "responsePolicyList": [],
        "errorPolicyList": []
      }
    }
  ]
}

---

Add Policy

Endpoint

POST /apiops/projects/{projectName}/apiProxies/{apiProxyName}/policies/{policyName}/

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes
Content-Type	application/json	Yes

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
apiProxyName	string	Yes	API Proxy name
policyName	string	Yes	Policy name (unique identifier)

Request Body

Important: The request body must follow the PolicyOperationDTO structure with separate operationMetadata and policy objects. See Add Policy for the general structure.

Full JSON Body Example - Basic Encryption

{
  "operationMetadata": {
    "targetScope": "ALL",
    "targetPipeline": "REQUEST",
    "deploy": true,
    "deployTargetEnvironmentNameList": ["tester"],
    "order": 1
  },
  "policy": {
    "type": "policy-encryption",
    "description": "Encrypt sensitive data",
    "active": true,
    "encryptionDefList": [
      {
        "description": "Encrypt request body",
        "sourceVar": {
          "name": "requestBody",
          "type": "BODY",
          "dataType": "STRING"
        },
        "targetVar": {
          "name": "encryptedBody",
          "type": "CONTEXT_VALUES",
          "dataType": "STRING"
        },
        "cipherAlgorithm": "AES_CBC_PKCS5Padding",
        "keyName": "my-aes-key",
        "keyCertificateType": "KEY",
        "createIV": true,
        "ivEncodingType": "BASE64",
        "ivVar": {
          "name": "iv",
          "type": "CONTEXT_VALUES",
          "dataType": "STRING"
        },
        "outputEncodingType": "BASE64"
      }
    ]
  }
}

Full JSON Body Example - Multiple Encryption Definitions

{
  "operationMetadata": {
    "targetScope": "ENDPOINT",
    "targetEndpoint": "/api/data",
    "targetEndpointHTTPMethod": "POST",
    "targetPipeline": "REQUEST",
    "deploy": false,
    "deployTargetEnvironmentNameList": [],
    "order": 1
  },
  "policy": {
    "type": "policy-encryption",
    "description": "Encrypt multiple fields",
    "active": true,
    "encryptionDefList": [
      {
        "description": "Encrypt request body with AES",
        "sourceVar": {
          "name": "requestBody",
          "type": "BODY",
          "dataType": "STRING"
        },
        "targetVar": {
          "name": "encryptedBody",
          "type": "CONTEXT_VALUES",
          "dataType": "STRING"
        },
        "cipherAlgorithm": "AES_CBC_PKCS5Padding",
        "keyName": "my-aes-key",
        "keyCertificateType": "KEY",
        "createIV": true,
        "ivEncodingType": "BASE64",
        "ivVar": {
          "name": "iv",
          "type": "CONTEXT_VALUES",
          "dataType": "STRING"
        },
        "outputEncodingType": "BASE64"
      },
      {
        "description": "Encrypt header value with RSA",
        "sourceVar": {
          "name": "sensitiveHeader",
          "type": "HEADER",
          "dataType": "STRING"
        },
        "targetVar": {
          "name": "encryptedHeader",
          "type": "HEADER",
          "dataType": "STRING"
        },
        "cipherAlgorithm": "RSA_ECB_PKCS1Padding",
        "certificateName": "my-rsa-cert",
        "keyCertificateType": "CERTIFICATE",
        "createIV": false,
        "outputEncodingType": "BASE64"
      }
    ]
  }
}

Request Body Fields

The request body has two top-level fields:

Field	Type	Required	Description
operationMetadata	object	Yes	Operation metadata. See Policy Operation Metadata
policy	object	Yes	Policy configuration (see below)

Policy Object Fields

Field	Type	Required	Default	Description
type	string	Yes	-	Must be "policy-encryption"
description	string	No	-	Policy description
active	boolean	No	true	Whether the policy is active
policyCondition	object	No	null	Policy condition. See Policy Condition
errorMessageList	array	No	[]	List of error messages. See Error Messages
encryptionDefList	array	Yes	-	List of encryption definitions. See Encryption Definition

Encryption Definition (encryptionDefList)

Field	Type	Required	Default	Description
description	string	No	-	Definition description
sourceVar	object	Yes	-	Source variable to encrypt. See Variable Object
targetVar	object	Yes	-	Target variable for encrypted data. See Variable Object
cipherAlgorithm	string	Yes	-	Cipher algorithm. See EnumCipherAlgorithm
cipherAlgorithmVar	object	No	null	Variable containing cipher algorithm name (if dynamic)
keyName	string	No	null	Key name (for symmetric algorithms or asymmetric with KEY type). Resolved by name.
certificateName	string	No	null	Certificate name (for asymmetric algorithms with CERTIFICATE type). Resolved by name.
keyCertificateType	string	No	KEY	Key/certificate type. See EnumKeyCertificateType
createIV	boolean	No	false	Whether to create initialization vector (IV)
ivEncodingType	string	No	null	IV encoding type (if createIV=true). See EnumEncodingType
ivVar	object	No	null	Variable to store IV (if createIV=true)
outputEncodingType	string	Yes	-	Output encoding type. See EnumEncodingType

EnumCipherAlgorithm (cipherAlgorithm)

Symmetric Algorithms:

• AES_CBC_NoPadding - AES/CBC/NoPadding
• AES_CBC_PKCS5Padding - AES/CBC/PKCS5Padding (requires IV)
• AES_ECB_NoPadding - AES/ECB/NoPadding
• AES_ECB_PKCS5Padding - AES/ECB/PKCS5Padding
• DES_CBC_NoPadding - DES/CBC/NoPadding
• DES_CBC_PKCS5Padding - DES/CBC/PKCS5Padding (requires IV)
• DES_ECB_NoPadding - DES/ECB/NoPadding
• DES_ECB_PKCS5Padding - DES/ECB/PKCS5Padding
• DESede_CBC_NoPadding - DESede/CBC/NoPadding
• DESede_CBC_PKCS5Padding - DESede/CBC/PKCS5Padding (requires IV)
• DESede_ECB_NoPadding - DESede/ECB/NoPadding
• DESede_ECB_PKCS5Padding - DESede/ECB/PKCS5Padding

Asymmetric Algorithms:

• RSA_ECB_PKCS1Padding - RSA/ECB/PKCS1Padding
• RSA_ECB_OAEPWithSHA_1AndMGF1Padding - RSA/ECB/OAEPWithSHA-1AndMGF1Padding
• RSA_ECB_OAEPWithSHA_256AndMGF1Padding - RSA/ECB/OAEPWithSHA-256AndMGF1Padding

EnumEncodingType (outputEncodingType, ivEncodingType)

• BASE64 - Base64 encoding
• HEXADECIMAL - Hexadecimal encoding

EnumKeyCertificateType (keyCertificateType)

• KEY - Use cryptographic key (specified by keyName)
• CERTIFICATE - Use certificate (specified by certificateName)

Variable Object (sourceVar, targetVar, ivVar, cipherAlgorithmVar)

See Variable Definition for complete variable documentation.

Variable Types

• HEADER - Extract from HTTP header
• PARAMETER - Extract from query/path/form parameter
• BODY - Extract from request/response body (XML, JSON, or raw)
• CONTEXT_VALUES - Extract from system context values
• CUSTOM - Extract using custom script

Policy Condition (policyCondition)

See Policy Condition Documentation for detailed information.

Policy Operation Metadata (operationMetadata)

See Policy Operation Metadata Documentation for detailed information.

Error Messages (errorMessageList)

See Error Messages Documentation for detailed information.

Response

Success Response (200 OK)

{
  "status": "SUCCESS",
  "resultList": null,
  "resultCount": null,
  "deploymentResult": null
}

Error Response (400 Bad Request)

{
  "status": "FAILURE",
  "resultMessage": "encryptionDefList cannot be empty"
}

---

Update Policy

Endpoint

PUT /apiops/projects/{projectName}/apiProxies/{apiProxyName}/policies/{policyName}/

Request

Same as Add Policy. All fields can be updated.

Response

Same as Add Policy.

---

Delete Policy

Endpoint

DELETE /apiops/projects/{projectName}/apiProxies/{apiProxyName}/policies/{policyName}/

Request

Headers

Header	Value	Required
Authorization	Bearer {token}	Yes

Path Parameters

Parameter	Type	Required	Description
projectName	string	Yes	Project name
apiProxyName	string	Yes	API Proxy name
policyName	string	Yes	Policy name

Response

Success Response (200 OK)

{
  "status": "SUCCESS",
  "resultList": null,
  "resultCount": null,
  "deploymentResult": null
}

---

cURL Examples

Example 1: Add Basic Encryption Policy

curl -X POST \
  "https://demo.apinizer.com/apiops/projects/MyProject/apiProxies/MyAPI/policies/encryption-policy/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "operationMetadata": {
      "targetScope": "ALL",
      "targetPipeline": "REQUEST",
      "deploy": true,
      "deployTargetEnvironmentNameList": ["tester"],
      "order": 1
    },
    "policy": {
      "type": "policy-encryption",
      "description": "Encrypt sensitive data",
      "active": true,
      "encryptionDefList": [
        {
          "sourceVar": {
            "name": "requestBody",
            "type": "BODY",
            "dataType": "STRING"
          },
          "targetVar": {
            "name": "encryptedBody",
            "type": "CONTEXT_VALUES",
            "dataType": "STRING"
          },
          "cipherAlgorithm": "AES_CBC_PKCS5Padding",
          "keyName": "my-aes-key",
          "keyCertificateType": "KEY",
          "createIV": true,
          "ivEncodingType": "BASE64",
          "outputEncodingType": "BASE64"
        }
      ]
    }
  }'

Example 2: Update Encryption Policy

curl -X PUT \
  "https://demo.apinizer.com/apiops/projects/MyProject/apiProxies/MyAPI/policies/encryption-policy/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "operationMetadata": {
      "targetScope": "ALL",
      "targetPipeline": "REQUEST",
      "deploy": true,
      "deployTargetEnvironmentNameList": ["tester"],
      "order": 1
    },
    "policy": {
      "type": "policy-encryption",
      "description": "Updated encryption policy",
      "active": true,
      "encryptionDefList": [
        {
          "sourceVar": {
            "name": "requestBody",
            "type": "BODY",
            "dataType": "STRING"
          },
          "targetVar": {
            "name": "encryptedBody",
            "type": "CONTEXT_VALUES",
            "dataType": "STRING"
          },
          "cipherAlgorithm": "AES_CBC_PKCS5Padding",
          "keyName": "my-new-aes-key",
          "keyCertificateType": "KEY",
          "createIV": true,
          "ivEncodingType": "BASE64",
          "outputEncodingType": "BASE64"
        }
      ]
    }
  }'

Example 3: Delete Encryption Policy

curl -X DELETE \
  "https://demo.apinizer.com/apiops/projects/MyProject/apiProxies/MyAPI/policies/encryption-policy/" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "operationMetadata": {
      "targetScope": "ALL",
      "targetPipeline": "REQUEST",
      "deploy": true,
      "deployTargetEnvironmentNameList": ["tester"]
    }
  }'

---

Notes and Warnings

• Cipher Algorithms:

  • Symmetric algorithms (AES, DES, DESede) require keyName
  • Asymmetric algorithms (RSA) can use either keyName (KEY) or certificateName (CERTIFICATE)
  • CBC mode algorithms require IV (set createIV: true)
  • ECB mode algorithms do not require IV

• Initialization Vector (IV):

  • Required for CBC mode algorithms
  • Set createIV: true to generate IV automatically
  • IV is stored in ivVar with specified ivEncodingType
  • IV must be provided for decryption

• Encoding Types:

  • BASE64 - Common encoding for encrypted data
  • HEXADECIMAL - Alternative encoding format
  • Output encoding must match input encoding for decryption

• Key/Certificate Management:

  • Keys must be configured in Key Store before use
  • Certificates must be configured in Certificate Store before use
  • Use keyCertificateType to specify key or certificate source
  • Specify keys and certificates by name; they are resolved to IDs automatically

• Variable Types:

  • Source and target variables can be from headers, parameters, body, or context
  • Use appropriate variable types based on data location

• Multiple Definitions:

  • Multiple encryption definitions can be configured in one policy
  • Each definition encrypts a different source variable
  • Definitions are executed in order

Permissions

User must have API_MANAGEMENT + MANAGE permission in the project. For deployment operations (when deploy: true is set), user must also have API_MANAGEMENT + DEPLOY_UNDEPLOY permission.

Related Documentation

• List Policies - List all policies
• Add Policy - Add a policy
• Update Policy - Update a policy
• Delete Policy - Delete a policy
• Decryption Policy - Decrypt encrypted data