Skip to main content

Unseal System

This API submits a key share to unseal the system. The system is only unsealed once the number of submitted shares reaches the configured threshold.

Endpoint Details

URL/v1/sys/unseal
MethodPOST
AuthorizationBearer Token

Request Headers

HeaderTypeDescription
Content-TypeStringMust be application/json

Request Body

Use the following format to make a request:

JSON Request
{
"share": "015ca015d04d74ed301d5795c179a33ab869712d8d38baad3f430ba69dad1d668a"
}

Parameters

ParameterTypeDescription
shareStringOne of the key shares used to unseal the system

Response

Each request submits one key share. The response reports how many shares have been submitted so far against the threshold.

First share submitted:

Response
{
"sealed": true,
"shares_given": 1,
"threshold": 3
}

Second share submitted (a different key):

Response
{
"sealed": true,
"shares_given": 2,
"threshold": 3
}

Final share submitted (threshold reached, the system is unsealed):

Response
{
"shares_given": 3,
"threshold": 3
}

Field Descriptions

FieldTypeDescription
sealedBooleanIndicates whether the system is still sealed after submitting the share
shares_givenIntegerNumber of key shares that have been submitted so far
thresholdIntegerNumber of key shares required to unseal the system

info
  • A valid Bearer Token is required to access this endpoint.
  • Each request submits a single share. Submit the endpoint repeatedly with a different key share each time.
  • The system remains sealed (sealed: true) until shares_given reaches the threshold.
  • Once the number of submitted shares equals the threshold, the system is unsealed and the sealed field is no longer returned.
  • The threshold (the number of shares required) is configured during the initial setup of the system.