Unique IDs that retain all the essential information about the data without compromising its security.
openapi: 3.0.0
info:
title: Vault HTTP aliases API
description: "The VGS Vault HTTP API is used for storing, retrieving, and managing sensitive data (aka Tokenization) within a VGS Vault.\n\nThe VGS API is organized around REST. Our API is built with a predictable resource-oriented structure, uses JSON-encoded requests and responses, follows standard HTTP verbs/responses, and uses industry standard authentication.\n\n## What is VGS\n\nStoring sensitive data on your company’s infrastructure often comes with a heavy compliance burden. For instance, storing payments data yourself greatly increases the amount of work needed to become PCI compliant. It also increases your security risk in general. To combat this, companies will minimize the amount of sensitive information they have to handle or store.\n\nVGS provides multiple methods for minimizing the sensitive information that needs to be stored which allows customers to secure any type of data for any use-case.\n\n**Tokenization** is a method that focuses on securing the storage of data. This is the quickest way to get started and is free. [Get started with Tokenization](https://www.verygoodsecurity.com/docs/tokenization/getting-started).\n\n**Zero Data** is a unique method invented by VGS in 2016 that securely stores data like Tokenization, however it also removes the customer’s environment from PCI scope completely providing maximum security, and minimum compliance scope. [Get started with Zero Data](https://www.verygoodsecurity.com/docs/getting-started/before-you-start).\n\nAdditionally, for scenarios where neither technology is a complete solution, for instance with legacy systems, VGS provides a compliance product which guarantees customers are able to meet their compliance needs no matter what may happen. [Get started with Control](https://www.verygoodsecurity.com/docs/control).\n\n## Learn about Tokenization\n\n- [Create an Account for Free Tokenization](https://dashboard.verygoodsecurity.com/tokenization)\n- [Try a Tokenization Demo](https://www.verygoodsecurity.com/docs/tokenization/getting-started)\n- [Install a Tokenization SDK](https://www.verygoodsecurity.com/docs/tokenization/client-libraries)\n\n### Authentication\n\nThis API uses `Basic` authentication.\n\nCredentials to access the API can be generated on the\n[dashboard](https://dashboard.verygoodsecurity.com) by going to the Settings\nsection of the vault of your choosing.\n\n[Docs » Guides » Access credentials](https://www.verygoodsecurity.com/docs/settings/access-credentials)\n\n## Resource Limits\n\n### Data Limits\n\nThis API allows storing data up to 32MB in size.\n\n### Rate Limiting\n\nThe API allows up to 3,000 requests per minute. Requests are associated with\nthe vault, regardless of the access credentials used to authenticate the\nrequest.\n\nYour current rate limit is included as HTTP headers in every API response:\n\n| Header Name | Description |\n|-------------------------|----------------------------------------------------------|\n| `x-ratelimit-remaining` | The number of requests remaining in the 1-minute window. |\n\nIf you exceed the rate limit, the API will reject the request with HTTP\n[429 Too Many Requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/429).\n\n### Errors\n\nThe API uses standard HTTP status codes to indicate whether the request\nsucceeded or not.\n\nIn case of failure, the response body will be JSON in a predefined format.\nFor example, trying to create too many aliases at once results in the\nfollowing response:\n\n```json\n{\n \"errors\": [\n {\n \"status\": 400,\n \"title\": \"Bad request\",\n \"detail\": \"Too many values (limit: 20)\",\n \"href\": \"https://api.sandbox.verygoodvault.com/aliases\"\n }\n ]\n}\n```\n"
version: 1.0.0
contact:
email: support@verygoodsecurity.com
x-logo:
url: images/vgs-logo.png
href: https://www.verygoodsecurity.com
altText: VGS Logo
servers:
- url: https://api.sandbox.verygoodvault.com
description: Sandbox
- url: https://api.live.verygoodvault.com
description: Live
- url: https://api.live-eu-1.verygoodvault.com
description: Live EU
security:
- basicAuth: []
tags:
- name: aliases
x-displayName: Aliases
description: 'Unique IDs that retain all the essential information about the data
without compromising its security.
'
paths:
/aliases:
post:
operationId: createAliases
tags:
- aliases
summary: Create aliases
description: 'Stores multiple values at once & returns their aliases.
Alternatively, this endpoint may be used to associate additional (i.e.
secondary) aliases with the same underlying data as the reference
alias specified in the request body.
**NOTE:** You cannot reference the same alias more than once in a
single request.
'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CreateAliasesRequest'
examples:
A:
summary: Create a new alias
value:
data:
- value: 122105155
classifiers:
- bank-account
format: UUID
storage: PERSISTENT
B:
summary: Reference an existing alias
value:
data:
- alias: tok_sandbox_bhtsCwFUzoJMw9rWUfEV5e
format: RAW_UUID
storage: PERSISTENT
responses:
'201':
description: Created
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
$ref: '#/components/schemas/RevealedData'
description: List of stored values along with their aliases.
default:
$ref: '#/components/responses/ApiErrorsResponse'
x-codeSamples:
- lang: Shell
label: cURL
source: "curl https://api.sandbox.verygoodvault.com/aliases \\\n -X POST \\\n -u \"$USERNAME:$PASSWORD\" \\\n -H 'Content-Type: application/json' \\\n -d '{\n \"data\": [\n {\n \"value\": \"test@example.com\",\n \"classifiers\": [\n \"email_address\"\n ],\n \"format\": \"UUID\"\n \"storage\": \"VOLATILE\"\n }\n ]\n }'\n"
get:
operationId: revealMultipleAliases
tags:
- aliases
summary: Reveal multiple aliases
description: 'Given a list of aliases, retrieves all associated values stored in the
vault.
**NOTE:** This endpoint may expose sensitive data. Therefore, it is
disabled by default. To enable it, please contact your VGS account
manager or drop us a line at
[support@verygoodsecurity.com](mailto:support@verygoodsecurity.com).
'
parameters:
- name: q
in: query
required: true
description: Comma-separated list of aliases to reveal.
example:
- tok_sandbox_5UpnbMvaihRuRwz5QXwBFw,tok_sandbox_9ToiJHedw1nE1Jfx1qYYgz
schema:
type: string
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
data:
type: object
additionalProperties:
x-additionalPropertiesName: alias
$ref: '#/components/schemas/RevealedData'
example:
tok_sandbox_5UpnbMvaihRuRwz5QXwBFw:
value: '476673481'
classifiers:
- bank-account
aliases:
- value: tok_sandbox_5UpnbMvaihRuRwz5QXwBFw
format: UUID
created_at: '2019-08-10T11:45:30Z'
storage: VOLATILE
tok_sandbox_9ToiJHedw1nE1Jfx1qYYgz:
value: '750360025'
classifiers:
- bank-account
aliases:
- value: tok_sandbox_9ToiJHedw1nE1Jfx1qYYgz
format: UUID
created_at: '2019-08-10T11:45:30Z'
storage: VOLATILE
default:
$ref: '#/components/responses/ApiErrorsResponse'
x-codeSamples:
- lang: Shell
label: cURL
source: "curl https://api.sandbox.verygoodvault.com/aliases?q={{alias1}},{{alias2}} \\\n -u \"$USERNAME:$PASSWORD\"\n"
/aliases/{alias}:
parameters:
- $ref: '#/components/parameters/alias'
get:
operationId: revealAlias
tags:
- aliases
summary: Reveal single alias
description: 'Retrieves a stored value along with its aliases.
**NOTE:** This endpoint may expose sensitive data. Therefore, it is
disabled by default. To enable it, please contact your VGS account
manager or drop us a line at
[support@verygoodsecurity.com](mailto:support@verygoodsecurity.com).
'
parameters:
- $ref: '#/components/parameters/alias'
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
data:
type: array
items:
$ref: '#/components/schemas/RevealedData'
description: The retrieved value.
minItems: 1
maxItems: 1
default:
$ref: '#/components/responses/ApiErrorsResponse'
x-codeSamples:
- lang: Shell
label: cURL
source: "curl https://api.sandbox.verygoodvault.com/aliases/{{alias}} \\\n -u \"$USERNAME:$PASSWORD\"\n"
put:
operationId: updateAlias
tags:
- aliases
summary: Update data classifiers
description: 'Apply new classifiers to the value that the specified alias is
associated with.
'
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateAliasRequest'
responses:
'204':
description: No Content
default:
$ref: '#/components/responses/ApiErrorsResponse'
x-codeSamples:
- lang: Shell
label: cURL
source: "curl https://api.sandbox.verygoodvault.com/aliases/{{alias}} \\\n -X PUT \\\n -u \"$USERNAME:$PASSWORD\" \\\n -H 'Content-Type: application/json' \\\n -d '{\n \"data\": {\n \"classifiers\": [\n \"credit-cards\", \"PII\"\n ]\n }\n }'\n"
delete:
operationId: deleteAlias
tags:
- aliases
summary: Delete alias
description: 'Removes a single alias.
'
parameters:
- $ref: '#/components/parameters/alias'
responses:
'204':
description: No Content
default:
$ref: '#/components/responses/ApiErrorsResponse'
x-codeSamples:
- lang: Shell
label: cURL
source: "curl https://api.sandbox.verygoodvault.com/aliases/{{alias}} \\\n -X DELETE \\\n -u \"$USERNAME:$PASSWORD\"\n"
components:
schemas:
CreateAliasesRequest:
type: object
properties:
data:
type: array
items:
oneOf:
- $ref: '#/components/schemas/CreateAliasesRequestNew'
- $ref: '#/components/schemas/CreateAliasesRequestReference'
minItems: 1
maxItems: 20
required:
- data
CreateAliasesRequestNew:
type: object
properties:
value:
type: string
description: Raw value to encrypt & store in the vault.
example: 122105155
classifiers:
type: array
items:
type: string
example: bank-account
description: List of tags to classify the value with.
format:
$ref: '#/components/schemas/AliasFormat'
storage:
type: string
enum:
- PERSISTENT
- VOLATILE
default: PERSISTENT
description: 'Storage medium to use.
VOLATILE results in data being persisted into an in-memory data store for one hour which is required for PCI compliant storage of card security code data.
'
required:
- value
- format
UpdateAliasRequest:
type: object
properties:
data:
type: object
properties:
classifiers:
type: array
items:
type: string
example: bank-account
description: List of tags to classify the value with.
required:
- classifiers
required:
- data
AliasFormat:
type: string
enum:
- FPE_ACC_NUM_T_FOUR
- FPE_ALPHANUMERIC_ACC_NUM_T_FOUR
- FPE_SIX_T_FOUR
- FPE_SSN_T_FOUR
- FPE_T_FOUR
- NUM_LENGTH_PRESERVING
- PFPT
- RAW_UUID
- UUID
description: 'Format of the generated alias string.
See [Alias Formats](#section/Introduction/Alias-Formats) for details.
'
example: UUID
CreateAliasesRequestReference:
type: object
properties:
alias:
type: string
description: Existing alias to use as a reference.
example: tok_sandbox_bhtsCwFUzoJMw9rWUfEV5e
format:
$ref: '#/components/schemas/AliasFormat'
required:
- alias
- format
ApiError:
type: object
properties:
status:
type: integer
description: HTTP status code.
title:
type: string
description: High-level reason of why the request failed.
detail:
type: string
description: Explanation of what exactly went wrong.
href:
type: string
description: Request URL.
RevealedData:
type: object
properties:
value:
type: string
description: Decrypted value stored in the vault.
example: 122105155
classifiers:
type: array
items:
type: string
example: bank-account
description: List of tags the value is classified with.
aliases:
type: array
items:
$ref: '#/components/schemas/Alias'
description: List of aliases associated with the value.
created_at:
type: string
format: date-time
description: Creation time, in UTC.
example: '2019-05-15T12:30:45Z'
storage:
type: string
enum:
- PERSISTENT
- VOLATILE
default: PERSISTENT
description: 'Storage medium to use.
VOLATILE results in data being persisted into an in-memory data store for one hour which is required for PCI compliant storage of card security code data.
'
Alias:
type: object
properties:
alias:
type: string
example: tok_sandbox_bhtsCwFUzoJMw9rWUfEV5e
description: Opaque string used to substitute the raw value.
format:
$ref: '#/components/schemas/AliasFormat'
parameters:
alias:
name: alias
in: path
required: true
description: Alias to operate on.
schema:
type: string
example: tok_sandbox_bhtsCwFUzoJMw9rWUfEV5e
responses:
ApiErrorsResponse:
description: Something went wrong
content:
application/json:
schema:
type: object
properties:
errors:
type: array
items:
$ref: '#/components/schemas/ApiError'
description: List of errors that occurred while processing the request.
minItems: 1
securitySchemes:
basicAuth:
type: http
scheme: basic
description: The default authentication schema.
externalDocs:
description: Find out more about VGS
url: https://www.verygoodsecurity.com/
x-tagGroups:
- name: Data Management
tags:
- aliases