# Get a sealed record Returns one record: its envelope and its sealed payload. A deleted record is returned as its envelope alone, with `deleted: true` and `wrapped_dek`, `payload` and `payload_bytes` set to `null`. `404 SEALED_RECORD_NOT_FOUND` when the id was never created in the caller's store, or its tombstone has passed the 30-day retention. A record of somebody else answers the same way. #### Path Parameters **`store`** string required The store: `aitronos-browser`. Up to 64 characters; an unknown store is `404 SEALED_STORE_NOT_FOUND`. **`record_id`** string required The record's id, as the client minted it: 16 to 128 characters of `A-Z a-z 0-9 _ -`. #### Headers **`Authorization`** string required `Bearer ` from the person's own sign-in. API keys and service accounts are refused with `403 SEALED_STORE_PERSONAL_SESSION_REQUIRED`. ## Returns `200 OK` with the record: - **`object`** string — `sealed_record`. - **`id`** string — the client's record id. - **`kind`** string — `session` or `favourites`. - **`schema_version`** integer — as the last accepted write sent it. - **`revision`** integer — server-assigned; rises by 1 on every accepted write. - **`created_at`** string — when the record was created (ISO 8601 UTC). - **`last_touched_at`** string — set by the server on every accepted write. Sort by it, ties by `id`. - **`deleted`** boolean — whether the record is a tombstone. - **`deleted_at`** string or null — when it was deleted. - **`device_id`** string — the device of the last accepted write. - **`wrapped_dek`** object or null — the data key that opens `payload`: `v`, `aead`, `nonce`, `ct`, `epk`. `v` is always the integer `1`. `null` for a tombstone. - **`payload`** string or null — the sealed bytes, standard padded base64. `null` for a tombstone. - **`payload_bytes`** integer or null — the decoded payload size. `null` for a tombstone. ## Errors | Status | Code | When | | --- | --- | --- | | 401 | `AUTHENTICATION_REQUIRED` | No access token, or one that is not valid. | | 403 | `SEALED_STORE_PERSONAL_SESSION_REQUIRED` | The call used an API key or a service account. Only a person's own sign-in session reaches a sealed store. | | 404 | `SEALED_STORE_NOT_FOUND` | No store with that name (`details.store`). | | 404 | `SEALED_RECORD_NOT_FOUND` | No record with that id in the caller's store, or its tombstone has passed the 30-day retention. | | 422 | `VALIDATION_ERROR` | `record_id` does not match its pattern. | ```bash cURL curl "https://api.aitronos.com/v1/sealed-stores/aitronos-browser/records/vSWmWbg9sDur336pnYgYzQ" \ -H "Authorization: Bearer $ACCESS_TOKEN" ``` ```python Python import os import requests response = requests.get( "https://api.aitronos.com/v1/sealed-stores/aitronos-browser/records/vSWmWbg9sDur336pnYgYzQ", headers={"Authorization": f"Bearer {os.environ['AITRONOS_TOKEN']}"}, timeout=30, ) record = response.json() if response.status_code == 200 and not record["deleted"]: # Open record["wrapped_dek"] with the account's identity key, then the payload. print("revision", record["revision"], "payload bytes", record["payload_bytes"]) elif response.status_code == 200: print("deleted at", record["deleted_at"], "- undelete it with revision", record["revision"]) else: print(response.status_code, record["error"]["code"]) ``` ```javascript JavaScript const response = await fetch("https://api.aitronos.com/v1/sealed-stores/aitronos-browser/records/vSWmWbg9sDur336pnYgYzQ", { headers: { Authorization: `Bearer ${process.env.AITRONOS_TOKEN}` }, }); const record = await response.json(); if (response.ok && !record.deleted) { // Open record.wrapped_dek with the account's identity key, then the payload. console.log("revision", record.revision, "payload bytes", record.payload_bytes); } else if (response.ok) { console.log("deleted at", record.deleted_at, "- undelete it with revision", record.revision); } else { console.log(response.status, record.error.code); } ``` **Response:** 200 OK ```json { "object": "sealed_record", "id": "vSWmWbg9sDur336pnYgYzQ", "kind": "session", "schema_version": 1, "revision": 2, "created_at": "2026-10-10T08:41:17.204913Z", "last_touched_at": "2026-10-10T09:02:44.918207Z", "deleted": false, "deleted_at": null, "device_id": "1aee2c02-ccac-4ede-b017-1334be895e2e", "wrapped_dek": { "v": 1, "aead": "aes-256-gcm", "nonce": "oxwDDz+SyxUEkitE", "ct": "UvORUdzuxuE3FMncUQgc4qOEz2QT8a5LarNYrATM0A4Zi1J0aJj9Yu+5ySIKPQHY", "epk": "fRXpvCBVDmU9kJ+PSkoqi7NU2Po3FQMK9SbJiz1gOGs=" }, "payload": "hWbThAu7J8u8jIcvARYROTja+vbbV4hlntXsIctvvcVdqWGMyTjVt2LgISSfrFORn+gjkJcDsT9l8dsHXoFFCaDLzP06FHLuixGaBMY3WOfWFex4l7SU0G5IKY7DABr74o0l20asWcd9gADrlQl4Zg==", "payload_bytes": 112 } ``` 200 Deleted record ```json { "object": "sealed_record", "id": "vSWmWbg9sDur336pnYgYzQ", "kind": "session", "schema_version": 1, "revision": 3, "created_at": "2026-10-10T08:41:17.204913Z", "last_touched_at": "2026-10-10T09:30:05.551390Z", "deleted": true, "deleted_at": "2026-10-10T09:30:05.551390Z", "device_id": "1f783def-2aa1-4b44-9c73-3c6b9102c06b", "wrapped_dek": null, "payload": null, "payload_bytes": null } ``` 404 Not found ```json { "success": false, "error": { "code": "SEALED_RECORD_NOT_FOUND", "message": "That item isn't synced.", "system_message": "no record with this id in this store", "type": "client_error", "status": 404, "details": {}, "trace_id": "e18d9726-57ad-464e-8dce-e59347add85e", "timestamp": "2026-10-10T09:12:40.318552Z" } } ``` ## Related Resources - [Sealed stores](/docs/api-reference/sealed-stores/introduction) - [Update a sealed record](/docs/api-reference/sealed-stores/update-record) - [Delete a sealed record](/docs/api-reference/sealed-stores/delete-record) - [List a sealed record's revisions](/docs/api-reference/sealed-stores/list-revisions) - [List sealed store changes](/docs/api-reference/sealed-stores/list-changes)