Create an encrypted record
curl --request POST \
--url https://api.airctrl.dev/v1/records \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"accountId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"tags": [
"<string>"
],
"ciphertext": "<string>",
"cipherMeta": {},
"wrappedDek": {},
"accessScope": "general",
"environmentValues": [
{
"ciphertext": "<string>",
"cipherMeta": {},
"secretDueAt": "2023-11-07T05:31:56Z",
"rotationIntervalDays": 2
}
],
"projectWrappedDek": {},
"projectKeyVersion": 2,
"secretDueAt": "2023-11-07T05:31:56Z",
"rotationIntervalDays": 2
}
'import requests
url = "https://api.airctrl.dev/v1/records"
payload = {
"accountId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"tags": ["<string>"],
"ciphertext": "<string>",
"cipherMeta": {},
"wrappedDek": {},
"accessScope": "general",
"environmentValues": [
{
"ciphertext": "<string>",
"cipherMeta": {},
"secretDueAt": "2023-11-07T05:31:56Z",
"rotationIntervalDays": 2
}
],
"projectWrappedDek": {},
"projectKeyVersion": 2,
"secretDueAt": "2023-11-07T05:31:56Z",
"rotationIntervalDays": 2
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
accountId: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
projectId: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
name: '<string>',
tags: ['<string>'],
ciphertext: '<string>',
cipherMeta: {},
wrappedDek: {},
accessScope: 'general',
environmentValues: [
{
ciphertext: '<string>',
cipherMeta: {},
secretDueAt: '2023-11-07T05:31:56Z',
rotationIntervalDays: 2
}
],
projectWrappedDek: {},
projectKeyVersion: 2,
secretDueAt: '2023-11-07T05:31:56Z',
rotationIntervalDays: 2
})
};
fetch('https://api.airctrl.dev/v1/records', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.airctrl.dev/v1/records",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'accountId' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'projectId' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'name' => '<string>',
'tags' => [
'<string>'
],
'ciphertext' => '<string>',
'cipherMeta' => [
],
'wrappedDek' => [
],
'accessScope' => 'general',
'environmentValues' => [
[
'ciphertext' => '<string>',
'cipherMeta' => [
],
'secretDueAt' => '2023-11-07T05:31:56Z',
'rotationIntervalDays' => 2
]
],
'projectWrappedDek' => [
],
'projectKeyVersion' => 2,
'secretDueAt' => '2023-11-07T05:31:56Z',
'rotationIntervalDays' => 2
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.airctrl.dev/v1/records"
payload := strings.NewReader("{\n \"accountId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"projectId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"name\": \"<string>\",\n \"tags\": [\n \"<string>\"\n ],\n \"ciphertext\": \"<string>\",\n \"cipherMeta\": {},\n \"wrappedDek\": {},\n \"accessScope\": \"general\",\n \"environmentValues\": [\n {\n \"ciphertext\": \"<string>\",\n \"cipherMeta\": {},\n \"secretDueAt\": \"2023-11-07T05:31:56Z\",\n \"rotationIntervalDays\": 2\n }\n ],\n \"projectWrappedDek\": {},\n \"projectKeyVersion\": 2,\n \"secretDueAt\": \"2023-11-07T05:31:56Z\",\n \"rotationIntervalDays\": 2\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.airctrl.dev/v1/records")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"accountId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"projectId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"name\": \"<string>\",\n \"tags\": [\n \"<string>\"\n ],\n \"ciphertext\": \"<string>\",\n \"cipherMeta\": {},\n \"wrappedDek\": {},\n \"accessScope\": \"general\",\n \"environmentValues\": [\n {\n \"ciphertext\": \"<string>\",\n \"cipherMeta\": {},\n \"secretDueAt\": \"2023-11-07T05:31:56Z\",\n \"rotationIntervalDays\": 2\n }\n ],\n \"projectWrappedDek\": {},\n \"projectKeyVersion\": 2,\n \"secretDueAt\": \"2023-11-07T05:31:56Z\",\n \"rotationIntervalDays\": 2\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.airctrl.dev/v1/records")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"accountId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"projectId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"name\": \"<string>\",\n \"tags\": [\n \"<string>\"\n ],\n \"ciphertext\": \"<string>\",\n \"cipherMeta\": {},\n \"wrappedDek\": {},\n \"accessScope\": \"general\",\n \"environmentValues\": [\n {\n \"ciphertext\": \"<string>\",\n \"cipherMeta\": {},\n \"secretDueAt\": \"2023-11-07T05:31:56Z\",\n \"rotationIntervalDays\": 2\n }\n ],\n \"projectWrappedDek\": {},\n \"projectKeyVersion\": 2,\n \"secretDueAt\": \"2023-11-07T05:31:56Z\",\n \"rotationIntervalDays\": 2\n}"
response = http.request(request)
puts response.read_body{
"ok": true,
"data": {
"recordId": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"ok": false,
"error": {
"code": "bad_request",
"message": "Request validation failed",
"details": [
"Check the submitted values."
]
},
"requestId": "req_example"
}{
"ok": false,
"error": {
"code": "unauthorized",
"message": "Authentication is required"
},
"requestId": "req_example"
}{
"ok": false,
"error": {
"code": "forbidden",
"message": "not_authorized"
},
"requestId": "req_example"
}{
"ok": false,
"error": {
"code": "conflict",
"message": "idempotency_key_reused_with_different_params"
},
"requestId": "req_example"
}{
"ok": false,
"error": {
"code": "rate_limited",
"message": "Too many requests"
},
"requestId": "req_example"
}{
"ok": false,
"error": {
"code": "internal_error",
"message": "Internal server error"
},
"requestId": "req_example"
}Records
Create an encrypted record
Stores one General ciphertext by default, or one logical Environment record with zero to three separately encrypted values when accessScope=environment. The record scope cannot change later. AIRCTRL never receives plaintext. Requires records:create.
POST
/
records
Create an encrypted record
curl --request POST \
--url https://api.airctrl.dev/v1/records \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"accountId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"tags": [
"<string>"
],
"ciphertext": "<string>",
"cipherMeta": {},
"wrappedDek": {},
"accessScope": "general",
"environmentValues": [
{
"ciphertext": "<string>",
"cipherMeta": {},
"secretDueAt": "2023-11-07T05:31:56Z",
"rotationIntervalDays": 2
}
],
"projectWrappedDek": {},
"projectKeyVersion": 2,
"secretDueAt": "2023-11-07T05:31:56Z",
"rotationIntervalDays": 2
}
'import requests
url = "https://api.airctrl.dev/v1/records"
payload = {
"accountId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"tags": ["<string>"],
"ciphertext": "<string>",
"cipherMeta": {},
"wrappedDek": {},
"accessScope": "general",
"environmentValues": [
{
"ciphertext": "<string>",
"cipherMeta": {},
"secretDueAt": "2023-11-07T05:31:56Z",
"rotationIntervalDays": 2
}
],
"projectWrappedDek": {},
"projectKeyVersion": 2,
"secretDueAt": "2023-11-07T05:31:56Z",
"rotationIntervalDays": 2
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
accountId: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
projectId: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
name: '<string>',
tags: ['<string>'],
ciphertext: '<string>',
cipherMeta: {},
wrappedDek: {},
accessScope: 'general',
environmentValues: [
{
ciphertext: '<string>',
cipherMeta: {},
secretDueAt: '2023-11-07T05:31:56Z',
rotationIntervalDays: 2
}
],
projectWrappedDek: {},
projectKeyVersion: 2,
secretDueAt: '2023-11-07T05:31:56Z',
rotationIntervalDays: 2
})
};
fetch('https://api.airctrl.dev/v1/records', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.airctrl.dev/v1/records",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'accountId' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'projectId' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
'name' => '<string>',
'tags' => [
'<string>'
],
'ciphertext' => '<string>',
'cipherMeta' => [
],
'wrappedDek' => [
],
'accessScope' => 'general',
'environmentValues' => [
[
'ciphertext' => '<string>',
'cipherMeta' => [
],
'secretDueAt' => '2023-11-07T05:31:56Z',
'rotationIntervalDays' => 2
]
],
'projectWrappedDek' => [
],
'projectKeyVersion' => 2,
'secretDueAt' => '2023-11-07T05:31:56Z',
'rotationIntervalDays' => 2
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.airctrl.dev/v1/records"
payload := strings.NewReader("{\n \"accountId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"projectId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"name\": \"<string>\",\n \"tags\": [\n \"<string>\"\n ],\n \"ciphertext\": \"<string>\",\n \"cipherMeta\": {},\n \"wrappedDek\": {},\n \"accessScope\": \"general\",\n \"environmentValues\": [\n {\n \"ciphertext\": \"<string>\",\n \"cipherMeta\": {},\n \"secretDueAt\": \"2023-11-07T05:31:56Z\",\n \"rotationIntervalDays\": 2\n }\n ],\n \"projectWrappedDek\": {},\n \"projectKeyVersion\": 2,\n \"secretDueAt\": \"2023-11-07T05:31:56Z\",\n \"rotationIntervalDays\": 2\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.airctrl.dev/v1/records")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"accountId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"projectId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"name\": \"<string>\",\n \"tags\": [\n \"<string>\"\n ],\n \"ciphertext\": \"<string>\",\n \"cipherMeta\": {},\n \"wrappedDek\": {},\n \"accessScope\": \"general\",\n \"environmentValues\": [\n {\n \"ciphertext\": \"<string>\",\n \"cipherMeta\": {},\n \"secretDueAt\": \"2023-11-07T05:31:56Z\",\n \"rotationIntervalDays\": 2\n }\n ],\n \"projectWrappedDek\": {},\n \"projectKeyVersion\": 2,\n \"secretDueAt\": \"2023-11-07T05:31:56Z\",\n \"rotationIntervalDays\": 2\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.airctrl.dev/v1/records")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"accountId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"projectId\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n \"name\": \"<string>\",\n \"tags\": [\n \"<string>\"\n ],\n \"ciphertext\": \"<string>\",\n \"cipherMeta\": {},\n \"wrappedDek\": {},\n \"accessScope\": \"general\",\n \"environmentValues\": [\n {\n \"ciphertext\": \"<string>\",\n \"cipherMeta\": {},\n \"secretDueAt\": \"2023-11-07T05:31:56Z\",\n \"rotationIntervalDays\": 2\n }\n ],\n \"projectWrappedDek\": {},\n \"projectKeyVersion\": 2,\n \"secretDueAt\": \"2023-11-07T05:31:56Z\",\n \"rotationIntervalDays\": 2\n}"
response = http.request(request)
puts response.read_body{
"ok": true,
"data": {
"recordId": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
}
}{
"ok": false,
"error": {
"code": "bad_request",
"message": "Request validation failed",
"details": [
"Check the submitted values."
]
},
"requestId": "req_example"
}{
"ok": false,
"error": {
"code": "unauthorized",
"message": "Authentication is required"
},
"requestId": "req_example"
}{
"ok": false,
"error": {
"code": "forbidden",
"message": "not_authorized"
},
"requestId": "req_example"
}{
"ok": false,
"error": {
"code": "conflict",
"message": "idempotency_key_reused_with_different_params"
},
"requestId": "req_example"
}{
"ok": false,
"error": {
"code": "rate_limited",
"message": "Too many requests"
},
"requestId": "req_example"
}{
"ok": false,
"error": {
"code": "internal_error",
"message": "Internal server error"
},
"requestId": "req_example"
}Authorizations
Human personal access token (sk-actrl-pat-...).
Headers
Stable key for safely retrying this write. Reuse the same key only with the same request body; results are retained for 24 hours and conflicting reuse returns 409.
Body
application/json
- Option 1
- Option 2
Account that owns the project.
Project where the record will be created.
Record name.
Searchable labels.
Required for General; forbidden for Environment except null.
Client-generated General encryption metadata.
Encrypted record key. AIRCTRL stores it without opening it.
Available options:
plain, json, env, password, api_key, database, ssh, certificate, oauth_client, cloud_iam, service_account, webhook, license, totp Omitted by older clients: General. Immutable after creation.
Available options:
general Optional independently encrypted Development, Staging and Production values. Empty is allowed.
Show child attributes
Show child attributes
Record key encrypted for the project key. Required when replacing an existing project copy; otherwise optional.
Required when projectWrappedDek is sent. Version of the project key used by the client; stale or pending re-key material is rejected.
Required range:
x >= 1Optional review or expiration time.
Required range:
x >= 1