{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/cipherhub-cloud/json-schema/cipherhub-cloud-encrypted-api-request-schema.json",
  "title": "EncryptedApiRequest",
  "description": "REST encrypted-channel request body. `encrypted_data` contains the ChaCha20-Poly1305 ciphertext.\nNew clients also send `nonce` as a separate 12-byte hex string. For legacy compatibility, `encrypted_data`\nmay contain `ciphertext || nonce`; the server accepts both forms.\n",
  "x-generated": "2026-11-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/cipherhub-cloud-openapi.yaml#/components/schemas/EncryptedApiRequest",
  "type": "object",
  "required": [
    "key_id",
    "encrypted_data",
    "encrypted_key",
    "signature",
    "timestamp",
    "request_id"
  ],
  "properties": {
    "key_id": {
      "type": "string",
      "description": "Protection key identifier returned by `/cipherhub/get_protection_key`."
    },
    "encrypted_data": {
      "type": "string",
      "pattern": "^[0-9a-fA-F]+$",
      "description": "ChaCha20-Poly1305 ciphertext as hex. Legacy clients append the 12-byte nonce to this field."
    },
    "nonce": {
      "type": [
        "string",
        "null"
      ],
      "pattern": "^[0-9a-fA-F]{24}$",
      "description": "12-byte ChaCha20-Poly1305 nonce as hex. If omitted, the server extracts nonce from the last 12 bytes of `encrypted_data`."
    },
    "encrypted_key": {
      "type": "string",
      "pattern": "^[0-9a-fA-F]+$",
      "description": "Client ephemeral ECC public key encoded as hex."
    },
    "signature": {
      "type": "string",
      "pattern": "^[0-9a-fA-F]{128}$",
      "description": "HMAC-SHA512 over the plaintext business JSON, encoded as hex."
    },
    "timestamp": {
      "type": "string",
      "format": "date-time",
      "description": "Client send time in ISO 8601 format."
    },
    "request_id": {
      "type": "string",
      "minLength": 8,
      "maxLength": 64,
      "description": "Client-generated request identifier. It should match the plaintext business request `request_id`."
    }
  }
}