Moov End to End Encryption API

openapi: 3.2.0
info:
  title: Moov End to End Encryption API
  version: v2026.01.00
  contact:
    name: Moov Developer Support
    email: help@moov.io
    url: https://moov.io
  license:
    name: Unlicensed
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  description: 'Operations tagged End to End Encryption across 2 of this provider''s published API definitions: moov-api-v2026.01.00-openapi.yml, moov-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.moov.io
  description: Production API host
  variables: {}
security:
- BasicAuth: []
tags:
- name: End to End Encryption
paths:
  /debug/end-to-end-token:
    post:
      operationId: testEndToEndToken
      description: 'Allows for testing a JWE token to ensure it''s acceptable by Moov.


        To access this endpoint using an access token

        you''ll need to specify the `/ping.read` scope.'
      parameters:
      - $ref: '#/components/parameters/VersionHeader'
      responses:
        '204':
          description: The request completed successfully, but there is no content to return.
          headers:
            x-request-id:
              required: true
              description: A unique identifier used to trace requests.
              schema:
                type: string
        '400':
          description: The server could not understand the request due to invalid syntax.
          headers:
            x-request-id:
              required: true
              description: A unique identifier used to trace requests.
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericError'
        '429':
          description: Request was refused due to rate limiting.
          headers:
            x-request-id:
              required: true
              description: A unique identifier used to trace requests.
              schema:
                type: string
        '500':
          description: The request failed due to an unexpected error.
          headers:
            x-request-id:
              required: true
              description: A unique identifier used to trace requests.
              schema:
                type: string
        '504':
          description: The request failed because a downstream service failed to respond.
          headers:
            x-request-id:
              required: true
              description: A unique identifier used to trace requests.
              schema:
                type: string
      tags:
      - End to End Encryption
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/E2EEToken'
      x-speakeasy-name-override: testEncryptedToken
      summary: Test end to end token
      x-summary-source: derived
    servers:
    - url: https://api.moov.io
      description: Production API host
      variables: {}
  /end-to-end-keys:
    post:
      operationId: generateEndToEndKey
      description: Generates a public key used to create a JWE token for passing secure authentication data through non-PCI compliant intermediaries.
      parameters:
      - $ref: '#/components/parameters/VersionHeader'
      responses:
        '200':
          description: The request completed successfully.
          headers:
            x-request-id:
              required: true
              description: A unique identifier used to trace requests.
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONWebKey'
        '429':
          description: Request was refused due to rate limiting.
          headers:
            x-request-id:
              required: true
              description: A unique identifier used to trace requests.
              schema:
                type: string
      tags:
      - End to End Encryption
      x-speakeasy-name-override: generateKey
      summary: Generate end to end key
      x-summary-source: derived
    servers:
    - url: https://api.moov.io
      description: Production API host
      variables: {}
components:
  schemas:
    GenericError:
      type: object
      required:
      - error
      properties:
        error:
          type: string
    JSONWebKey:
      type: object
      required:
      - kty
      properties:
        kty:
          type: string
          description: The cryptographic algorithm family used with the key (e.g., 'RSA', 'EC', 'oct').
        use:
          type: string
          enum:
          - sig
          - enc
          description: The intended use of the key. 'sig' for signature, 'enc' for encryption.
        key_ops:
          type: array
          items:
            type: string
          description: The permitted operations for the key, e.g., 'sign', 'verify', 'encrypt', 'decrypt'.
        alg:
          type: string
          description: The algorithm intended for use with the key, e.g., 'RS256' or 'ES256'.
        kid:
          type: string
          description: A unique identifier for the key.
        crv:
          type: string
          description: 'The curve for Elliptic Curve keys, e.g., ''P-256'', ''P-384'', or ''P-521''.


            This field is required when `kty` is ''EC''.'
        x:
          type: string
          description: 'The x coordinate for Elliptic Curve keys.


            This field is required when `kty` is ''EC''.'
        y:
          type: string
          description: 'The y coordinate for Elliptic Curve keys.


            This field is required when `kty` is ''EC''.'
        n:
          type: string
          description: 'The modulus value for RSA keys.


            This field is required when `kty` is ''RSA''.'
        e:
          type: string
          description: 'The exponent value for RSA keys.


            This field is required when `kty` is ''RSA''.'
      description: Describes an [RFC7517](https://datatracker.ietf.org/doc/html/rfc7517) web key.
      example:
        use: enc
        kty: EC
        kid: bOaoOIgm-7dI_gBIvsr0jQrPyYp6H_od0Ok-hSYZQ-g=
        crv: P-521
        alg: ECDH-ES+A256KW
        x: ABcm3wzKpPzYYwjDC0HSrxxVM3ULbuMDUuzkR5wNciaMHkZvQ02gLFdqTL65evV7EWaQyC7zRc28eW20p5MVDdQr
        y: AVa-eQsoiltOcQYy1QEcrQ9NbWktl_D4ewfg8diOZ2_svLEgEu4T1PqNcLbBGozP_VqPkXOMwNCUNI7pxajVGiIP
    JSONWebEncryptionToken:
      type: string
      format: jwe
      description: An [RFC](https://datatracker.ietf.org/doc/html/rfc7516) compact-serialized JSON Web Encryption (JWE) token.
    E2EEToken:
      type: object
      required:
      - token
      properties:
        token:
          $ref: '#/components/schemas/JSONWebEncryptionToken'
      description: "Wraps a compact-serialized JSON Web Encryption (JWE) token used for secure transmission of sensitive data (e.g., PCI information) through intermediaries. \nThis token is encrypted using the public key from /end-to-end-keys and wraps an AES key. For details and examples, refer to our \n[GitHub repository](https://github.com/moovfinancial/moov-go/blob/main/examples/e2ee/e2ee_test.go)."
      example:
        token: eyJhbGciOiJFQ0RILUVTK0EyNTZLVyIsImVuYyI6IkEyNTZHQ00iLCJlcGsiOnsia3R5IjoiRUMiLCJjcnYiOiJQLTUyMSIsIngiOiJBS0NYVDM1WVdvTm8wbzExNy1SU0dqUGg3alN1NjFmLUhnYkx1dW0xVG1ueTRlcW5yX2hyU0hpY0w1d3gwODRCWDBRZjVTdEtkRUoydzY2ZUJqWHprRV9OIiwieSI6IkFIMEJfT2RaYTQtbG43dGJ4M3VBdlc1NDNQRE9HUXBCTDloRFFNWjlTQXNfOW05UWN3dnhRd1hrb1VrM3VzT1FnVV9ySVFrNFRoZ1NTUzV4UlhKcm5ZaTkifSwia2lkIjoiYmRvV3pLekpKUGw0TVFIaENDa05WYTZlZ1dmYi02V1haSjZKTFZqQ0hWMD0ifQ.HalyoHsfufBJEODd2lD9ThQvvVWw3b2kgWDLHGxmHhMv8rODyLL_Ug.rpQP178t8Ed_pUU2.Sn9UFeVoegAxiMUv11q7l3M0y9YHSLYi2n_JB7n7Pc777_47-icfaxstJemT0IC81w.akkq1EBxzWkBr4vEomSpWA
  parameters:
    VersionHeader:
      name: X-Moov-Version
      in: header
      required: false
      description: 'Set this header to v2026.01.00 to use the API described in this specification.

        When omitted, the server defaults to v2024.01.00, the earliest supported version, which may not match the behavior documented here.

        An unrecognized well-formed version uses the latest supported version that is not newer than the requested version, when one exists.

        For example, `v2026.08.00` uses `v2026.07.00`.

        A malformed value, such as `2022`, returns a `404` response.'
      schema:
        type: string
        enum:
        - v2026.01.00
        example: v2026.01.00
        x-speakeasy-ignore: true
      x-speakeasy-ignore: true
  securitySchemes:
    BasicAuth:
      type: http
      scheme: Basic
externalDocs:
  url: https://docs.moov.io/
  description: Moov Guides and API Documentation
x-refined-from:
- moov-api-v2026.01.00-openapi.yml
- moov-openapi.yml