# Fetch a recipient-bound encrypted area

Returns the ciphertext and public decryption parameters for an encrypted area sealed to the
authenticated recipient. The response never contains a key the server can use or any plaintext —
your client unwraps the wrapped key with your own private key and decrypts on-device.

Refuses areas that have expired or, for burn-after-read areas, that were already opened.

This GET is a safe, repeatable **peek**. For a burn-after-read area it deliberately
**withholds** the ciphertext (`blob` is `null` and `requires_open` is `true`) so an
automated request — a browser prefetch, a link preview, or a scanner — can never destroy
it. To actually open (and consume) a burn-after-read area, send an explicit
[`POST /v1/encrypted-areas/{encbin_id}/open`](#open-a-recipient-bound-encrypted-area) on a
real user action. A non-burn area returns its `blob` directly from this GET.

## Path parameters

**`encbin_id`** string required

The encrypted-area id (`encbin_`-prefixed) from the message token.

## Returns

An encrypted-area fetch view.

**`encbin_id`** string · The area id.
**`audience`** string · `user` for a recipient-bound area.
**`crypto_mode`** string · `recipient_bound` — selects which parameters block is populated.
**`format_version`** string · The sealing format version.
**`blob`** object · `ciphertext_b64` (base64 ciphertext) and `content_kind`, which is always
`file` on this endpoint — a recipient-bound seal accepts binary payloads and does not report an
inline-text kind. `null` on a GET peek of a burn-after-read area (open it with `POST .../open`).
**`requires_open`** boolean · `true` on a GET peek of a burn-after-read area, meaning the
ciphertext was withheld and you must `POST .../open` to receive it. `false` otherwise.
**`recipient_bound`** object · `wrapped_dek` (the wrapped data-encryption key you unwrap with
your private key — the server cannot open it), plus the public parameters needed to open the
content. Present only for recipient-bound areas.
**`external`** object · `null` for recipient-bound areas.
**`expires_at`** string · Expiry timestamp (UTC) or `null`.
**`burn_after_read`** boolean · Whether the area self-destructs on first open.
**`password_required`** boolean · `false` for recipient-bound areas.

Example

```bash cURL
curl "https://api.aitronos.com/v1/encrypted-areas/encbin_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6" \
  -H "Authorization: Bearer $ACCESS_TOKEN"
```


```python Python SDK
# pip install aitronos-sdk
#
# The Python SDK does not expose a typed `encrypted_areas` namespace yet, and it
# has no generic request method, so call the endpoint directly with the same
# credential you would pass to `Aitronos(...)` — an API key or a bearer token,
# both sent as `Authorization: Bearer <value>`.
import httpx

API_KEY = "your-api-key"

area = httpx.get(
    "https://api.aitronos.com/v1/encrypted-areas/encbin_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
    headers={"Authorization": f"Bearer {API_KEY}"},
).json()
# Unwrap area["recipient_bound"]["wrapped_dek"] with your private key, then decrypt on-device.
print(area["blob"]["content_kind"], area["burn_after_read"])
```


```python Python
import requests

resp = requests.get(
    "https://api.aitronos.com/v1/encrypted-areas/encbin_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
    headers={"Authorization": f"Bearer {access_token}"},
)
area = resp.json()
print(area["audience"], area["crypto_mode"])
```


```javascript JavaScript
const resp = await fetch(
  'https://api.aitronos.com/v1/encrypted-areas/encbin_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6',
  { headers: { Authorization: `Bearer ${accessToken}` } }
);
const area = await resp.json();
console.log(area.audience, area.burn_after_read);
```

**Response:**


```json 200 OK
{
  "encbin_id": "encbin_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
  "audience": "user",
  "crypto_mode": "recipient_bound",
  "format_version": "rb1",
  "blob": { "ciphertext_b64": "k9Xa...==", "content_kind": "file" },
  "requires_open": false,
  "recipient_bound": {
    "wrapped_dek": { "v": "1", "aead": "aes-256-gcm", "nonce": "b64...", "ct": "b64...", "epk": "b64..." },
    "aead": "aes-256-gcm",
    "nonce_b64": "3n5f8c2a1b7d9e0f4a6c8b1d",
    "sender_binding": "c2VuZGVyOnVzcl8xMjM="
  },
  "external": null,
  "expires_at": "2026-07-30T09:00:00Z",
  "burn_after_read": false,
  "password_required": false
}
```

Errors

```json 403 Not Authorized
{ "success": false, "error": { "code": "ENCRYPTED_AREA_NOT_AUTHORIZED", "message": "You are not authorized to open this encrypted area.", "system_message": "Not the bound recipient of this encrypted area", "type": "authorization_error", "status": 403, "details": { "encbin_id": "encbin_..." }, "trace_id": "...", "timestamp": "..." } }
```


```json 404 Not Found
{ "success": false, "error": { "code": "ENCRYPTED_AREA_NOT_FOUND", "message": "Encrypted area not found.", "system_message": "Encrypted area not found", "type": "client_error", "status": 404, "details": { "encbin_id": "encbin_..." }, "trace_id": "...", "timestamp": "..." } }
```


```json 410 Expired
{ "success": false, "error": { "code": "ENCRYPTED_AREA_EXPIRED", "message": "This encrypted area has expired and can no longer be opened.", "system_message": "This encrypted area has expired", "type": "client_error", "status": 410, "details": { "encbin_id": "encbin_..." }, "trace_id": "...", "timestamp": "..." } }
```


```json 410 Already opened
{ "success": false, "error": { "code": "ENCRYPTED_AREA_BURNED", "message": "This encrypted area was already opened and destroyed.", "system_message": "This encrypted area was already opened and destroyed", "type": "client_error", "status": 410, "details": { "encbin_id": "encbin_..." }, "trace_id": "...", "timestamp": "..." } }
```

## Open a recipient-bound encrypted area

The non-idempotent counterpart of the fetch above. Use it to open (and, for
burn-after-read areas, consume) an area — call it only on an explicit user action, never on
page load. The response body is identical to a successful fetch, always with `blob` present
and `requires_open` `false`. For a burn-after-read area, the first call returns the
ciphertext and destroys the area; a second call returns `410 ENCRYPTED_AREA_BURNED`.

## Path parameters

**`encbin_id`** string required

The encrypted-area id (`encbin_`-prefixed).

## Returns

The same encrypted-area fetch view as the GET, with `blob` always present and
`requires_open` `false`.

Example

```bash cURL
curl -X POST "https://api.aitronos.com/v1/encrypted-areas/encbin_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6/open" \
  -H "Authorization: Bearer $ACCESS_TOKEN"
```

Errors

```json 410 Already opened
{ "success": false, "error": { "code": "ENCRYPTED_AREA_BURNED", "message": "This encrypted area was already opened and destroyed.", "system_message": "This encrypted area was already opened and destroyed", "type": "client_error", "status": 410, "details": { "encbin_id": "encbin_..." }, "trace_id": "...", "timestamp": "..." } }
```

## Related resources

- [Create an encrypted area](/docs/api-reference/encrypted-areas/create)
- [Fetch a secure-link encrypted area](/docs/api-reference/encrypted-areas/fetch-secure-link)
- [Encrypted areas overview](/docs/api-reference/encrypted-areas/introduction)