Get Encryption Key

Returns the agent's RSA key pair for decrypting vault item secrets. Only available for AGENT-scoped API keys.

GET /api/v1/machine/vault/encryption-key

Headers

Header	Type	Required	Description
`X-API-Key`	string	Yes	Your AGENT-scoped API key

Response

Success (200 OK)

{
  "encryptionKeyId": "507f1f77bcf86cd799439015",
  "privateKey": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA...\n-----END RSA PRIVATE KEY-----",
  "publicKey": "-----BEGIN RSA PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...\n-----END RSA PUBLIC KEY-----"
}

Response Fields

Field	Type	Description
`encryptionKeyId`	string	The encryption key ID
`privateKey`	string	PEM-encoded RSA private key for decrypting vault item secrets
`publicKey`	string	PEM-encoded RSA public key for encrypting vault item secrets

Error Responses

403 Forbidden - Not an AGENT-scoped API key

{
  "error": {
    "code": "agent_scope_required",
    "message": "This endpoint is only available for AGENT-scoped API keys."
  }
}

404 Not Found - Agent or encryption key not found

{
  "error": {
    "code": "encryption_key_not_found",
    "message": "No encryption key found for this agent."
  }
}

Example Request

curl -X GET "https://r4.dev/api/v1/machine/vault/encryption-key" \
  -H "X-API-Key: rk_abc123def456.ghijklmnopqrstuvwxyz"

Security

Requires an AGENT-scoped API key
The private key is envelope-encrypted (AES-256-GCM with KEK) at rest
This request is audit logged for compliance

Use Cases

Agent deployment: Retrieve the decryption key during agent instance bootstrap
Secret decryption: Decrypt RSA-encrypted field values returned by the vault item detail endpoint
Key rotation: Fetch the current key pair for re-encryption workflows

Decryption Example

import crypto from 'crypto'
 
// 1. Get the encryption key
const keyResponse = await fetch('https://r4.dev/api/v1/machine/vault/encryption-key', {
  headers: { 'X-API-Key': API_KEY },
}).then(r => r.json())
 
// 2. Get a vault item with encrypted fields
const item = await fetch(`https://r4.dev/api/v1/machine/vault/${vaultId}/items/${itemId}`, {
  headers: { 'X-API-Key': API_KEY },
}).then(r => r.json())
 
// 3. Decrypt secret field values
for (const field of item.fields) {
  if (field.isSecret && field.value) {
    const decrypted = crypto.privateDecrypt(
      keyResponse.privateKey,
      Buffer.from(field.value, 'base64'),
    )
    console.log(`${field.name}: ${decrypted.toString('utf8')}`)
  }
}