Answer a request as the responder
POST/request/:key/secret
Requires a licensed server. No credentials: knowing the request ID is
enough. Encrypt the secret to the request's public key (see
GET /request/{key}) and send it here. A request takes one answer.
Verify the key first. The server hands out the public key, so a
compromised server could substitute its own. The request link the
requester shared is https://yopass.example.com/#/r/{id}/{fingerprint},
where fingerprint is the last 16 hex characters of the key's
fingerprint. Compare it with the key you fetched, and do not encrypt to a
key that does not match. After a key rotation, ask the requester for their
new link.
Request
Responses
- 200
- 400
- 404
- 409
- 412
- 413
- 500
Answer stored.
An error. message says what went wrong.
Not found, expired, already read (one-time) or revoked. A response without
JSON (404 page not found) means the route itself is switched off.
Already answered.
The requester rotated the key. Read the request again and encrypt to the new key.
An error. message says what went wrong.
An error. message says what went wrong.