Skip to content
Yagra

Report whether every stored credential can still be decrypted.

GET
/api/v1/credentials/health
curl --request GET \
  --url https://example.com/api/v1/credentials/health \
  --header 'Authorization: Bearer <token>'

This is the check a restore cannot skip. A database can come back whole — right row counts, healthy API — while the key-encryption key is a different one, in which case every credential is permanently unreadable and nothing says so until the next poll fails. scripts/yagra-restore-verify.sh asserts on this endpoint for exactly that reason, and it is worth looking at after any KEK rotation or restore.

It decrypts in memory and reports booleans; no secret value crosses this boundary.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

Per-credential decryptability. failures is empty on a healthy deployment

Media typeapplication/json

Whether the stored credentials can actually be decrypted with the KEK this process loaded.

object
decryptable
required

How many of them the current key opened successfully.

integer format: int32
failures
required

The ones that failed, if any. A non-empty list means polling with those credentials will fail until the correct key file is restored.

Array<object>

A credential the current KEK cannot open. Carries identity only — never a length, a key_id, or anything derived from the ciphertext.

object
id
required
string format: uuid
kind
required
string
name
required
string
total
required

How many credentials are stored.

integer format: int32
Examplegenerated
{
  "decryptable": 1,
  "failures": [
    {
      "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
      "kind": "example",
      "name": "example"
    }
  ],
  "total": 1
}

401

Section titled “401”

No valid bearer token

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object
error
required
object
code
required

Stable machine-readable code. Clients branch on this, never on the message.

string
message
required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example"
  }
}

403

Section titled “403”

Role lacks ManageCredentials

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object
error
required
object
code
required

Stable machine-readable code. Clients branch on this, never on the message.

string
message
required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example"
  }
}

503

Section titled “503”

Credential storage is unavailable (skeleton mode)

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object
error
required
object
code
required

Stable machine-readable code. Clients branch on this, never on the message.

string
message
required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example"
  }
}