DecryptSecret.

POST

/api/secret_management/namespaces/system/voltshare/decrypt_secret

curl --request POST \
  --url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/secret_management/namespaces/system/voltshare/decrypt_secret \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "blinded_encrypted_key_base64": "example", "policy_document": { "author": { "email": "hello@example.com", "tenant": "example" }, "blindfold_key_version": 1, "creation_time": "2026-04-15T12:00:00Z", "policy": { "allowed_users": [ { "email": "hello@example.com", "tenant": "example" } ], "expiration_timestamp": "2026-04-15T12:00:00Z" }, "policy_id": "example", "secret_name": "example" }, "policy_document_hmac_base64": "example" }'

• F5 Distributed Cloud Console

DecryptSecret API takes blinded encrypted secret and policy and responds with blinded decrypted secret if user is allowed by the policy.

Examples of this operation.

Authorizations

• ApiToken

Request Body^required

Media typeapplication/json

DecryptSecret Request

DecryptSecretRequest contains parameters for DecryptSecret API.

object

blinded_encrypted_key_base64

blinded_encrypted_key

Blinded Encrypted Key in base64 format Required: YES.

string

<= 1024 characters

policy_document

object

author

object

email

email

Email ID of the user.

string format: email

>= 1 characters <= 256 characters /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/

tenant

tenant

Tenant of the user.

string

>= 1 characters <= 256 characters

blindfold_key_version

blindfold_key_version

Version of BlindfoldKey that will be used for encryption.

integer format: int64

creation_time

creation_time

Creation time for this policy document.

string format: date-time

<= 1024 characters

policy

object

allowed_users

allowed_users

List of Users allowed to decrypt the secret.

Array<object>

<= 256 items

User Record

UserRecordType contains information about a user.

object

email

email

Email ID of the user.

string format: email

>= 1 characters <= 256 characters /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/

tenant

tenant

Tenant of the user.

string

>= 1 characters <= 256 characters

expiration_timestamp

expiration_timestamp

Until when this policy is valid. After expiration only author can decrypt the secret.

string format: date-time

<= 1024 characters

policy_id

policy_id

A unique 31 bit number assigned to this policy.

string format: uint64

<= 1024 characters

secret_name

secret_name

Name of the secret.

string

<= 1024 characters

policy_document_hmac_base64

policy_document_hmac

Base64 encoded HMAC of the policy document Required: YES.

string

<= 1024 characters

Example^generated

{
  "blinded_encrypted_key_base64": "example",
  "policy_document": {
    "author": {
      "email": "hello@example.com",
      "tenant": "example"
    },
    "blindfold_key_version": 1,
    "creation_time": "2026-04-15T12:00:00Z",
    "policy": {
      "allowed_users": [
        {
          "email": "hello@example.com",
          "tenant": "example"
        }
      ],
      "expiration_timestamp": "2026-04-15T12:00:00Z"
    },
    "policy_id": "example",
    "secret_name": "example"
  },
  "policy_document_hmac_base64": "example"
}

Responses

200

A successful response.

Media typeapplication/json

DecryptSecret Response

DecryptSecretResponse contains the response of DecryptSecret API.

object

blinded_key_base64

blinded_key

Blinded Key in base64 format.

string

<= 1024 characters

Example^generated

{
  "blinded_key_base64": "example"
}

401

Returned when operation is not authorized.

Media typeapplication/json

string format: string

Example^generated

example

403

Returned when there is no permission to access resource.

Media typeapplication/json

string format: string

Example^generated

example

404

Returned when resource is not found.

Media typeapplication/json

string format: string

Example^generated

example

409

Returned when operation on resource is conflicting with current value.

Media typeapplication/json

string format: string

Example^generated

example

429

Returned when operation has been rejected as it is happening too frequently.

Media typeapplication/json

string format: string

Example^generated

example

500

Returned when server encountered an error in processing API.

Media typeapplication/json

string format: string

Example^generated

example

503

Returned when service is unavailable temporarily.

Media typeapplication/json

string format: string

Example^generated

example

504

Returned when server timed out processing request.

Media typeapplication/json

string format: string

Example^generated

example