canonical: https://jentic.com/apis/evervault.com

# Evervault APIs

Evervault provides encryption-as-a-service for sensitive data such as PII, payment card numbers, and health records. Its APIs let applications encrypt and decrypt payloads server-side, run serverless Functions over encrypted inputs, route outbound traffic through Relays that tokenize or encrypt data on the wire, mint network tokens for stored cards, issue short-lived client tokens for selective in-browser decryption, and configure webhooks for event-driven flows. Together the two published APIs cover both a slim core encryption surface and the full platform, so plaintext stays out of your database, logs, and downstream partners without rebuilding key management in-house.

## For AI agents

Across Evervault's APIs, an agent can encrypt and decrypt sensitive fields, run Functions over encrypted inputs, inspect ciphertext, proxy outbound calls through Relays, tokenize payment cards, and mint client tokens for browser-side decryption. It can chain these into a full data-protection pipeline so plaintext never reaches the agent context or your stack.

## Scope

Use for: Field-level encryption, decryption, encrypted serverless compute, card tokenization, and outbound Relay proxying of sensitive data

Not supported:
- payment processing
- fraud scoring
- transport-layer SSL
- general-purpose KMS rotation
- CRM data management

## APIs

| API | Category | Endpoints | Description |
| --- | --- | --- | --- |
| Evervault API | security | 43 | Encrypt and decrypt data, proxy outbound traffic through Evervault Relays, tokenize cards, run Functions, and manage webhooks via the full Evervault platform. |
| Evervault Encryption API | security | 4 | Encrypt and decrypt sensitive data, run encrypted serverless Functions, and mint client tokens through Evervault's encryption-as-a-service. |

## Which API to use

| Need | API | Why |
| --- | --- | --- |
| Core encrypt, decrypt, Functions, and client tokens only | encryption-api | The four-endpoint surface covers the encryption primitives without the wider platform operations. |
| Relays, card tokenization, inspect, webhooks, and custom domains | evervault-api | The 43-endpoint surface adds outbound proxying, network tokens, and event configuration on top of encrypt and decrypt. |

## Cross-API use cases

### Encrypt PII then proxy it to partners as tokens

An application encrypts customer fields with the core encryption surface, then routes outbound calls to third-party vendors through an Evervault Relay so partners only ever receive tokenized representations. The slim surface handles the encrypt step while the full platform sets up the Relay and custom domain.

Example prompt: Call POST /encrypt on the encryption surface for each PII field, then POST /relays on the full platform to tokenize outbound calls to the partner API

### Card vault with client-side selective reveal

A merchant encrypts payment cards and mints network tokens through the full platform, then issues a short-lived client token so a customer dashboard can reveal only the last four digits in the browser. The full surface handles storage and tokenization while either surface mints the client token.

Example prompt: POST /encrypt with the card number and store the ciphertext, then POST /client-tokens scoped to that record so the browser decrypts only the last four digits

### Encrypted compute triggered by webhooks

A background workflow runs an Evervault Function over encrypted inputs and reacts when the run completes. The core surface invokes the Function while the full platform registers the webhook that fires on the function-run.completed event.

Example prompt: POST /functions/{functionName}/runs on the encryption surface, then register a webhook on the full platform to call a downstream service when the run completes

## Why Jentic

- **Setup:** Wiring Evervault by hand means handling its auth against api.evervault.com and coding the encrypt, decrypt, Function-run, and Relay calls across two surfaces yourself. With Jentic One installed, your agent finds and adds either Evervault API from the Jentic directory, stores the credentials once, and calls it.
- **Permission scoping:** Evervault takes data in the request body and resource ids such as the relay id in the URL path, so your own rules in Jentic One can pin the agent to specific operations. Decrypt or Relay creation are not available to the agent unless you add them to the allowed set.
- **Credential handling:** Your Evervault credentials are stored encrypted by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context window.
- **Discovery method:** Agents search the Jentic directory by intent such as 'encrypt cardholder data with Evervault' or 'create an Evervault relay', and Jentic returns the matching operation with its input schema so the agent calls the right endpoint without reading the reference docs.

## Related vendors

- **Stripe** — Runs the payment flow while Evervault encrypts the surrounding customer PII and card data at rest.
- **Cloudflare** — Provides WAF, DDoS, and SSL protection but not field-level encryption-as-a-service.
- **HashiCorp Vault** — Offers self-managed secrets storage and key management as an alternative to hosted encryption-as-a-service.

## FAQ

### What is the difference between the two Evervault APIs?

The encryption surface is a slim four-endpoint API covering encrypt, decrypt, Functions, and client tokens. The full Evervault API is a 43-endpoint surface that adds Relays, card and network tokenization, ciphertext inspection, webhooks, and custom domains. Choose the slim surface for core encryption primitives and the full one when you need proxying or platform operations.

### Does one Evervault account work across both APIs?

Yes. Both APIs call api.evervault.com and use your Evervault app credentials, so a single account covers both. The encryption surface is presented with an apiKey header while the full platform uses HTTP Basic auth with the app ID as username and the API key as password.

### Why does Jentic publish these specs?

Evervault does not publish an official OpenAPI specification. Jentic generates and maintains both specs so agents and developers can call Evervault through structured tooling. They are validated against the live API and kept up to date.

### How do the APIs keep plaintext out of my stack?

Encrypt returns opaque ciphertext that is safe to store, Functions compute over encrypted inputs without the host seeing plaintext, and Relays tokenize or encrypt data on the way to partners. Decryption happens only inside trusted code paths or briefly in the browser via short-lived client tokens.

### Can these APIs help reduce PCI scope?

Yes. You can encrypt raw card numbers into ciphertext, mint network tokens from that ciphertext through a Function, and route outbound payment-partner traffic through a Relay, so plaintext PANs never sit in your infrastructure. Confirm your compliance requirements independently before relying on this for an audit.

### What are the rate limits?

Neither generated spec declares quantitative rate limits. Evervault applies plan-based throttling, so watch for 429 responses and Retry-After headers and confirm your account ceiling with Evervault support before high-throughput workloads.