openapi: 3.1.0
info:
  contact:
    email: encryption-service-support@nubexx.com
    name: Encryption-Service Support-Team
    url: https://nubexx.com/products/encryption-service/
  description: |
    This is the Nubexx-Encryption-Service API documentation.

    ## OpenAPI specification

    This API is documented in OpenAPI format.
  title: Nubexx Encryption Service
  version: 1.0.0-RC2
externalDocs:
  description: Additional documentation
  url: https://docs.nubexx.com/Encryption-Service
servers:
- description: Generated server url
  url: http://localhost
tags:
- description: Endpoint for encrypt data
  name: Encrypt
- description: Endpoint for decrypt data
  name: Decrypt
- description: Endpoint for system status check
  name: Status
- description: Monitor and interact
  externalDocs:
    description: Spring Boot Actuator Web API Documentation
    url: https://docs.spring.io/spring-boot/docs/current/actuator-api/html/
  name: Actuator
paths:
  /actuator:
    get:
      description: Requires the role `ADMIN` or `METRICS`.
      operationId: links
      responses:
        "200":
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: object
                  additionalProperties:
                    $ref: "#/components/schemas/Link"
            application/vnd.spring-boot.actuator.v2+json:
              schema:
                type: object
                additionalProperties:
                  type: object
                  additionalProperties:
                    $ref: "#/components/schemas/Link"
            application/vnd.spring-boot.actuator.v3+json:
              schema:
                type: object
                additionalProperties:
                  type: object
                  additionalProperties:
                    $ref: "#/components/schemas/Link"
          description: OK
      security:
      - apiKeyHeader: []
        basicAuth: []
      summary: Actuator root web endpoint
      tags:
      - Actuator
  /actuator/health:
    get:
      description: Requires the role `ADMIN` or `METRICS`.
      operationId: health
      responses:
        "200":
          content:
            application/json:
              schema:
                type: object
            application/vnd.spring-boot.actuator.v2+json:
              schema:
                type: object
            application/vnd.spring-boot.actuator.v3+json:
              schema:
                type: object
          description: OK
      security:
      - apiKeyHeader: []
        basicAuth: []
      summary: Actuator web endpoint 'health'
      tags:
      - Actuator
  /actuator/info:
    get:
      description: Requires the role `ADMIN` or `METRICS`.
      operationId: info
      responses:
        "200":
          content:
            application/json:
              schema:
                type: object
            application/vnd.spring-boot.actuator.v2+json:
              schema:
                type: object
            application/vnd.spring-boot.actuator.v3+json:
              schema:
                type: object
          description: OK
      security:
      - apiKeyHeader: []
        basicAuth: []
      summary: Actuator web endpoint 'info'
      tags:
      - Actuator
  /actuator/metrics:
    get:
      description: Requires the role `ADMIN` or `METRICS`.
      operationId: listNames
      responses:
        "200":
          content:
            application/json:
              schema:
                type: object
            application/vnd.spring-boot.actuator.v2+json:
              schema:
                type: object
            application/vnd.spring-boot.actuator.v3+json:
              schema:
                type: object
          description: OK
      security:
      - apiKeyHeader: []
        basicAuth: []
      summary: Actuator web endpoint 'metrics'
      tags:
      - Actuator
  /actuator/metrics/{requiredMetricName}:
    get:
      description: Requires the role `ADMIN` or `METRICS`.
      operationId: metric
      parameters:
      - in: path
        name: requiredMetricName
        required: true
        schema:
          type: string
      - in: query
        name: tag
        schema:
          type: string
      responses:
        "200":
          content:
            application/json:
              schema:
                type: object
            application/vnd.spring-boot.actuator.v2+json:
              schema:
                type: object
            application/vnd.spring-boot.actuator.v3+json:
              schema:
                type: object
          description: OK
        "404":
          description: Not Found
      security:
      - apiKeyHeader: []
        basicAuth: []
      summary: Actuator web endpoint 'metrics-requiredMetricName'
      tags:
      - Actuator
  /api/decrypt:
    get:
      description: Querying the endpoint status. Requires the role `ADMIN` or `API`.
      operationId: getStatus_1
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Decrypt (GET)"
          description: OK
      security:
      - apiKeyHeader: []
      - basicAuth: []
      summary: Endpoint status
      tags:
      - Decrypt
    post:
      description: Decrypt data and returns as application/octet-stream or application/json.
        Requires the role `ADMIN` or `API`.
      operationId: decryptWidthBinaryResponse
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/Decrypt request"
          multipart/form-data:
            schema:
              $ref: "#/components/schemas/Decrypt request"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Decrypt JSON"
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/Decrypt Binary"
          description: Decryption success
      security:
      - apiKeyHeader: []
      - basicAuth: []
      summary: Decrypt data
      tags:
      - Decrypt
  /api/encrypt:
    get:
      description: Querying the endpoint status. Requires the role `ADMIN` or `API`.
      operationId: getStatus
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Encrypt (GET)"
          description: OK
      security:
      - apiKeyHeader: []
      - basicAuth: []
      summary: Endpoint status
      tags:
      - Encrypt
    post:
      description: Encrypt data and returns as application/octet-stream or application/json.
        Requires the role `ADMIN` or `API`.
      operationId: encryptWidthBinaryResponse
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/Encrypt request"
          multipart/form-data:
            schema:
              $ref: "#/components/schemas/Encrypt request"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Encrypt JSON"
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/Encrypt Binary"
          description: Encryption success
          headers:
            X-IV:
              description: Initialization Vector used for encryption
              schema:
                type: string
                example: a1b2c3d4e5f6...
              style: simple
            X-IV-EMBEDDED:
              description: Whether the IV is prepended at the output
              schema:
                type: boolean
                example: false
              style: simple
      security:
      - apiKeyHeader: []
      - basicAuth: []
      summary: Encrypt data
      tags:
      - Encrypt
  /api/encrypt/stream:
    post:
      description: Encrypt data and returns as stream response (application/octet-stream).
        Requires the role `ADMIN` or `API`.
      operationId: encryptStream
      parameters:
      - description: "If true, the IV is prepended to the encrypted data"
        in: query
        name: embedIv
        required: false
        schema:
          type: boolean
          default: false
          description: "If true, the IV is prepended to the encrypted data"
      - description: Base64 encoded AES Key (128 or 256 bits)
        example: MDEyMzQ1Njc4OUFCQ0RFRg==
        in: query
        name: key
        required: true
        schema:
          type: string
          description: Base64 encoded AES Key (128 or 256 bits)
          example: MDEyMzQ1Njc4OUFCQ0RFRg==
      - description: "The AES mode to be used for processing - Default: CTR"
        in: query
        name: aesMode
        required: false
        schema:
          type: string
          default: CTR
          description: AES-Modes
          enum:
          - CTR
          - GCM
      - description: "Base64-encoded IV (128 bits for CTR or 96 bits for GCM). If\
          \ not set, IV is generated randomly"
        example: MDEyMzQ1Njc4OUFCQ0RFRg==
        in: query
        name: iv
        required: false
        schema:
          type: string
          description: "Base64-encoded IV (128 bits for CTR or 96 bits for GCM). If\
            \ not set, IV is generated randomly"
          example: MDEyMzQ1Njc4OUFCQ0RFRg==
      requestBody:
        content:
          application/octet-stream:
            schema:
              type: string
              format: binary
        description: Raw binary file to encrypt
        required: true
      responses:
        "200":
          content:
            application/octet-stream:
              schema:
                $ref: "#/components/schemas/Encrypt Binary"
          description: Encryption success
          headers:
            X-IV:
              description: Initialization Vector used for encryption
              schema:
                type: string
                example: a1b2c3d4e5f6...
              style: simple
            X-IV-EMBEDDED:
              description: Whether the IV is prepended at the output
              schema:
                type: boolean
                default: "false"
                example: false
              style: simple
      security:
      - apiKeyHeader: []
      - basicAuth: []
      summary: Encrypt stream data
      tags:
      - Encrypt
  /status:
    get:
      description: Returns the system status
      operationId: getStatus_2
      responses:
        "200":
          content:
            '*/*':
              schema:
                $ref: "#/components/schemas/Status"
          description: OK
      summary: System status
      tags:
      - Status
components:
  schemas:
    Decrypt (GET):
      type: object
      description: Response for GET request
      properties:
        status:
          type: string
          format: string
          description: Status of the service
          example: UP
        timestamp:
          format: date-time
          description: Timestamp of the response
          example: 2025-08-25T16:56:15+0000
        version:
          type: string
          format: string
          description: Version of the API
          example: 1.0.0
    Decrypt Binary:
      type: object
      description: Response for POST request for Accept-Header = application/octet-stream
      properties:
        application/octet-stream:
          type: string
          format: byte
          description: Encrypted binary data
    Decrypt JSON:
      type: object
      description: Response for POST request for Accept-Header = application/json
      properties:
        data:
          type: string
          format: string
          description: Decrypted data (Base64 encoded)
          example: Decrypted text
        timestamp:
          format: date-time
          description: Timestamp of the response
          example: 2025-08-25T16:56:15+0000
    Decrypt request:
      type: object
      description: POST Request to decrypt data
      properties:
        aesMode:
          type: string
          default: CTR
          description: "The AES mode to be used for processing - Default: CTR"
          enum:
          - CTR
          - GCM
        embedIv:
          type: boolean
          default: false
          description: "If true, the IV must prepended in the encrypted data"
        file:
          type: string
          format: binary
          description: Data to be processed
        iv:
          type: string
          description: "Base64-encoded IV (128 bits for CTR or 96 bits for GCM). If\
            \ not set, IV is generated randomly"
          example: MDEyMzQ1Njc4OUFCQ0RFRg==
        key:
          type: string
          description: Base64 encoded AES Key (128 or 256 bits)
          example: MDEyMzQ1Njc4OUFCQ0RFRg==
      required:
      - file
      - key
    Encrypt (GET):
      type: object
      description: Response for GET request
      properties:
        status:
          type: string
          format: string
          description: Status of the service
          example: UP
        timestamp:
          format: date-time
          description: Timestamp of the response
          example: 2025-08-25T16:56:15+0000
        version:
          type: string
          format: string
          description: Version of the API
          example: 1.0.0
    Encrypt Binary:
      type: object
      description: Response for POST request for Accept-Header = application/octet-stream
      properties:
        application/octet-stream:
          type: string
          format: byte
          description: Encrypted binary data
    Encrypt JSON:
      type: object
      description: Response for POST request for Accept-Header = application/json
      properties:
        data:
          type: string
          format: string
          description: Encrypted data (Base64 encoded)
          example: VGhpcyBhcmUgZW5jcnlwdGVkIGRhdGE=
        iv:
          type: string
          format: string
          description: "The generates, or submitted IV (Base64 encoded)"
          example: MTIzNDU2Nzg5MEFCQ0RFRg==
        ivEmbedded:
          type: boolean
          format: boolean
          description: "If true, the iv is prepended to the encrypted data"
          example: true
        timestamp:
          format: date-time
          description: Timestamp of the response
          example: 2025-08-25T16:56:15+0000
    Encrypt request:
      type: object
      description: POST Request to encrypt data
      properties:
        aesMode:
          type: string
          default: CTR
          description: "The AES mode to be used for processing - Default: CTR"
          enum:
          - CTR
          - GCM
        embedIv:
          type: boolean
          default: false
          description: "If true, the IV is prepended to the encrypted data"
        file:
          type: string
          format: binary
          description: Data to be processed
        iv:
          type: string
          description: "Base64-encoded IV (128 bits for CTR or 96 bits for GCM). If\
            \ not set, IV is generated randomly"
          example: MDEyMzQ1Njc4OUFCQ0RFRg==
        key:
          type: string
          description: Base64 encoded AES Key (128 or 256 bits)
          example: MDEyMzQ1Njc4OUFCQ0RFRg==
      required:
      - file
      - key
    Link:
      type: object
      properties:
        href:
          type: string
        templated:
          type: boolean
    Status:
      type: object
      description: Response to the status check
      properties:
        status:
          type: string
          description: Status of the system
          example: UP
        timestamp:
          format: date-time
          description: Timestamp of the check
          example: 2025-08-25T16:56:15+0000
  securitySchemes:
    apiKeyHeader:
      in: header
      name: x-api-key
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
