Evervault APIs for AI Agents
SecuritySecrets ManagementJentic-Generated DocumentsBasic authAPI keyAgent Ready
For Agents
APIs2 in catalogue
Endpoints47 indexed
AuthBasic auth / API key
ProvenanceJentic-generated documents
Across Evervault's APIs, an agent can encrypt and decrypt sensitive fields, run Functions over encrypted inputs, inspect ciphertext, proxy outbound calls through Relays, tokenize payment cards, and mint client tokens for browser-side decryption. It can chain these into a full data-protection pipeline so plaintext never reaches the agent context or your stack.
Evervault focuses on field-level encryption-as-a-service rather than transport security or a general key-management system, so individual values stay unreadable inside your own infrastructure and reach partners only as tokens. The two APIs let a caller pick a slim four-endpoint encryption surface or the full platform with Relays, card tokenization, and webhooks.
Use for: Field-level encryption, decryption, encrypted serverless compute, card tokenization, and outbound Relay proxying of sensitive data
Not supported: payment processing, fraud scoring, transport-layer SSL, general-purpose KMS rotation, CRM data management
Credentials: Both APIs authenticate against api.evervault.com with your Evervault app credentials, so one Evervault account covers both surfaces, though the encryption surface is presented with an apiKey header while the full platform uses HTTP Basic with the app ID and API key.
All 2 Evervault OpenAPI documents are Jentic-generated and indexed by Jentic, kept validated and agent-ready.
Evervault provides encryption-as-a-service for sensitive data such as PII, payment card numbers, and health records. Its APIs let applications encrypt and decrypt payloads server-side, run serverless Functions over encrypted inputs, route outbound traffic through Relays that tokenize or encrypt data on the wire, mint network tokens for stored cards, issue short-lived client tokens for selective in-browser decryption, and configure webhooks for event-driven flows. Together the two published APIs cover both a slim core encryption surface and the full platform, so plaintext stays out of your database, logs, and downstream partners without rebuilding key management in-house.
Evervault API Catalog
2 APIs across 1 product group.
Security2
Evervault APIEncrypt and decrypt data, proxy outbound traffic through Evervault Relays, tokenize cards, run Functions, and manage webhooks via the full Evervault platform.~43 endpointsEvervault Encryption APIEncrypt and decrypt sensitive data, run encrypted serverless Functions, and mint client tokens through Evervault's encryption-as-a-service.~4 endpoints
Which Evervault API should I use?
| I want to... | Use |
|---|---|
| Core encrypt, decrypt, Functions, and client tokens only | Evervault Encryption API |
| Relays, card tokenization, inspect, webhooks, and custom domains | Evervault API |
Install Jentic One Beta
Connect the Evervault APIs to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Evervault APIs, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fevervault.com" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fevervault.com" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Once connected, ask your agent something like: “protect sensitive data with Evervault encryption and Relays”.
What AI Agents Can Do with Evervault
Each workflow spans multiple Evervault APIs. Jentic routes each operation to the right API automatically.
Encrypt PII then proxy it to partners as tokens
An application encrypts customer fields with the core encryption surface, then routes outbound calls to third-party vendors through an Evervault Relay so partners only ever receive tokenized representations. The slim surface handles the encrypt step while the full platform sets up the Relay and custom domain.
Example prompt:
Call POST /encrypt on the encryption surface for each PII field, then POST /relays on the full platform to tokenize outbound calls to the partner API
APIs used
Evervault Encryption API + Evervault API
Card vault with client-side selective reveal
A merchant encrypts payment cards and mints network tokens through the full platform, then issues a short-lived client token so a customer dashboard can reveal only the last four digits in the browser. The full surface handles storage and tokenization while either surface mints the client token.
Example prompt:
POST /encrypt with the card number and store the ciphertext, then POST /client-tokens scoped to that record so the browser decrypts only the last four digits
APIs used
Evervault API + Evervault Encryption API
Encrypted compute triggered by webhooks
A background workflow runs an Evervault Function over encrypted inputs and reacts when the run completes. The core surface invokes the Function while the full platform registers the webhook that fires on the function-run.completed event.
Example prompt:
POST /functions/{functionName}/runs on the encryption surface, then register a webhook on the full platform to call a downstream service when the run completes
APIs used
Evervault Encryption API + Evervault API
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring Evervault by hand means handling its auth against api.evervault.com and coding the encrypt, decrypt, Function-run, and Relay calls across two surfaces yourself. With Jentic One installed, your agent finds and adds either Evervault API from the Jentic directory, stores the credentials once, and calls it.
Permission scoping
Evervault takes data in the request body and resource ids such as the relay id in the URL path, so your own rules in Jentic One can pin the agent to specific operations. Decrypt or Relay creation are not available to the agent unless you add them to the allowed set.
Credential isolation
Your Evervault credentials are stored encrypted by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context window.
Intent-based discovery
Agents search the Jentic directory by intent such as 'encrypt cardholder data with Evervault' or 'create an Evervault relay', and Jentic returns the matching operation with its input schema so the agent calls the right endpoint without reading the reference docs.
FAQs
Specific to using Evervault APIs through Jentic.
What is the difference between the two Evervault APIs?
The encryption surface is a slim four-endpoint API covering encrypt, decrypt, Functions, and client tokens. The full Evervault API is a 43-endpoint surface that adds Relays, card and network tokenization, ciphertext inspection, webhooks, and custom domains. Choose the slim surface for core encryption primitives and the full one when you need proxying or platform operations.
Does one Evervault account work across both APIs?
Yes. Both APIs call api.evervault.com and use your Evervault app credentials, so a single account covers both. The encryption surface is presented with an apiKey header while the full platform uses HTTP Basic auth with the app ID as username and the API key as password.
Why does Jentic publish these specs?
Evervault does not publish an official OpenAPI specification. Jentic generates and maintains both specs so agents and developers can call Evervault through structured tooling. They are validated against the live API and kept up to date.
How do the APIs keep plaintext out of my stack?
Encrypt returns opaque ciphertext that is safe to store, Functions compute over encrypted inputs without the host seeing plaintext, and Relays tokenize or encrypt data on the way to partners. Decryption happens only inside trusted code paths or briefly in the browser via short-lived client tokens.
Can these APIs help reduce PCI scope?
Yes. You can encrypt raw card numbers into ciphertext, mint network tokens from that ciphertext through a Function, and route outbound payment-partner traffic through a Relay, so plaintext PANs never sit in your infrastructure. Confirm your compliance requirements independently before relying on this for an audit.
What are the rate limits?
Neither generated spec declares quantitative rate limits. Evervault applies plan-based throttling, so watch for 429 responses and Retry-After headers and confirm your account ceiling with Evervault support before high-throughput workloads.
If you need a different Security vendor
All 3 are in the Jentic catalogue with the same one-credential, intent-search pattern.
BOOK A DEMO
Start Connecting APIs to Your AI Agents
Browse thousands of APIs and connect them all to your agent with Jentic One. One layer, one credential — every API your agent needs.