Yopass API
The HTTP API for creating and retrieving secrets, files and secret requests.
Encrypt before you send. The server checks the format, not the content: it
rejects a message that is not ASCII-armored OpenPGP, but an armored message can
still be unencrypted, and the server cannot tell. Only a correct client sends
ciphertext. The label and note of a secret request are stored as plain text, so
keep secrets out of them. Read the API guide for the encryption model and a worked
example, or use the CLI to skip writing encryption code.
Some routes only exist when the server is configured for them. A route that
is switched off answers 404 with a plain-text 404 page not found body,
the same as an unknown URL:
| Server setting | Routes that disappear |
|---|---|
--read-only | POST /create/secret, POST /create/file and every /request route |
--disable-upload | POST /create/file, /file/{key} and /file/{key}/status |
--prefetch-secret=false | GET /secret/{key}/status and GET /file/{key}/status |
| no license | every /request route (an expired license keeps them, but POST /request answers 403) |
Licensed features. Secret requests, read receipts and require_auth
token-gated creation need a licensed server. Operations marked
Requires a licensed server answer 404 or 400 without one.
Authentication
- HTTP: Bearer Auth
- API Key: sessionCookie
- API Key: receiptToken
- API Key: requestToken
A static token the server operator configures with --api-token. It
authorizes the creation endpoints only (/create/secret, /create/file,
/request). See OpenID Connect.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Set by the browser sign-in flow. Scripts normally use an apiToken instead.
Security Scheme Type: | apiKey |
|---|---|
Cookie parameter name: | yopass_session |
The receipt_token returned when the secret or file was created.
Security Scheme Type: | apiKey |
|---|---|
Header parameter name: | X-Yopass-Receipt-Token |
The management token returned when the request was created.
Security Scheme Type: | apiKey |
|---|---|
Header parameter name: | X-Yopass-Request-Token |
License
Apache 2.0