Skip to content
/
Get a sealed record
Last updated

Get a sealed record

Returns one record: its envelope and its sealed payload. A deleted record is returned as its envelope alone, with deleted: true and wrapped_dek, payload and payload_bytes set to null.

404 SEALED_RECORD_NOT_FOUND when the id was never created in the caller's store, or its tombstone has passed the 30-day retention. A record of somebody else answers the same way.

GEThttps://api.aitronos.com/v1/sealed-stores/{store}/records/{record_id}

Path Parameters

store string required

The store: aitronos-browser. Up to 64 characters; an unknown store is 404 SEALED_STORE_NOT_FOUND.

record_id string required

The record's id, as the client minted it: 16 to 128 characters of A-Z a-z 0-9 _ -.

Headers

Authorization string required

Bearer <access token> from the person's own sign-in. API keys and service accounts are refused with 403 SEALED_STORE_PERSONAL_SESSION_REQUIRED.

Returns

200 OK with the record:

  • object string — sealed_record.
  • id string — the client's record id.
  • kind string — session or favourites.
  • schema_version integer — as the last accepted write sent it.
  • revision integer — server-assigned; rises by 1 on every accepted write.
  • created_at string — when the record was created (ISO 8601 UTC).
  • last_touched_at string — set by the server on every accepted write. Sort by it, ties by id.
  • deleted boolean — whether the record is a tombstone.
  • deleted_at string or null — when it was deleted.
  • device_id string — the device of the last accepted write.
  • wrapped_dek object or null — the data key that opens payload: v, aead, nonce, ct, epk. v is always the integer 1. null for a tombstone.
  • payload string or null — the sealed bytes, standard padded base64. null for a tombstone.
  • payload_bytes integer or null — the decoded payload size. null for a tombstone.

Errors

StatusCodeWhen
401AUTHENTICATION_REQUIREDNo access token, or one that is not valid.
403SEALED_STORE_PERSONAL_SESSION_REQUIREDThe call used an API key or a service account. Only a person's own sign-in session reaches a sealed store.
404SEALED_STORE_NOT_FOUNDNo store with that name (details.store).
404SEALED_RECORD_NOT_FOUNDNo record with that id in the caller's store, or its tombstone has passed the 30-day retention.
422VALIDATION_ERRORrecord_id does not match its pattern.
cURL
curl "https://api.aitronos.com/v1/sealed-stores/aitronos-browser/records/vSWmWbg9sDur336pnYgYzQ" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

Response:

{
  "object": "sealed_record",
  "id": "vSWmWbg9sDur336pnYgYzQ",
  "kind": "session",
  "schema_version": 1,
  "revision": 2,
  "created_at": "2026-10-10T08:41:17.204913Z",
  "last_touched_at": "2026-10-10T09:02:44.918207Z",
  "deleted": false,
  "deleted_at": null,
  "device_id": "1aee2c02-ccac-4ede-b017-1334be895e2e",
  "wrapped_dek": {
    "v": 1,
    "aead": "aes-256-gcm",
    "nonce": "oxwDDz+SyxUEkitE",
    "ct": "UvORUdzuxuE3FMncUQgc4qOEz2QT8a5LarNYrATM0A4Zi1J0aJj9Yu+5ySIKPQHY",
    "epk": "fRXpvCBVDmU9kJ+PSkoqi7NU2Po3FQMK9SbJiz1gOGs="
  },
  "payload": "hWbThAu7J8u8jIcvARYROTja+vbbV4hlntXsIctvvcVdqWGMyTjVt2LgISSfrFORn+gjkJcDsT9l8dsHXoFFCaDLzP06FHLuixGaBMY3WOfWFex4l7SU0G5IKY7DABr74o0l20asWcd9gADrlQl4Zg==",
  "payload_bytes": 112
}
Previous page
Next page