API
Jose
JOSE keys, and a playground for testing JWS and JWE signing and encryption.
Operations
Every route this entity exposes. Each route links to its own reference on this page.
| Method | Route | SDK operation | Returns |
|---|---|---|---|
POST |
/auth/jose/playground/jwsjwe |
create |
Signed and encrypted response |
POST |
/auth/jose/playground/jwe |
create |
Encrypted response |
POST |
/auth/jose/playground/jwe-direct-encryption |
create |
Encrypted response using direct encryption |
POST |
/auth/jose/playground/jws |
create |
Signed response |
POST |
/auth/jose/request/public-keys |
create |
Public key created successfully |
GET |
/auth/jose/response/public-keys |
load |
Public key object |
GET |
/auth/jose/playground/jwe |
load |
Encrypted response |
GET |
/auth/jose/playground/jwsjwe |
load |
Signed and encrypted response |
Examples
One example per SDK, generated from the API model. The argument names are the parameters and fields of this entity, and the values are placeholders. The examples are not compiled or executed.
Golang
Construct client as shown in the Golang setup, then call the operations:
jose, err := client.Jose(nil).Load(map[string]any{"algorithm": "example", "scope": "example"}, nil)
if err != nil {
panic(err)
}
fmt.Println(jose)
created, err := client.Jose(nil).Create(map[string]any{"keyId": "example", "publicKeyMaterial": map[string]any{}, "scope": "example"}, nil)
if err != nil {
panic(err)
}
fmt.Println(created)
Lua
Construct client as shown in the Lua setup, then call the operations:
local jose, err = client:Jose():load({ algorithm = "example", scope = "example" })
local created, err = client:Jose():create({ keyId = "example", publicKeyMaterial = {}, scope = "example" })
PHP
Construct client as shown in the PHP setup, then call the operations:
$jose = $client->Jose()->load(["algorithm" => "example", "scope" => "example"]);
$created = $client->Jose()->create(["keyId" => "example", "publicKeyMaterial" => [], "scope" => "example"]);
Python
Construct client as shown in the Python setup, then call the operations:
jose = client.Jose().load({"algorithm": "example", "scope": "example"})
created = client.Jose().create({ "keyId": "example", "publicKeyMaterial": {}, "scope": "example" })
Ruby
Construct client as shown in the Ruby setup, then call the operations:
jose = client.Jose.load({ "algorithm" => "example", "scope" => "example" })
created = client.Jose.create({ "keyId" => "example", "publicKeyMaterial" => {}, "scope" => "example" })
TypeScript
Construct client as shown in the TypeScript setup, then call the operations:
const jose = await client.Jose().load({ algorithm: "example", scope: "example" })
const created = await client.Jose().create({ keyId: "example", publicKeyMaterial: {}, scope: "example" })
Fields
| Field | Type | Required | Description |
|---|---|---|---|
keyId |
string |
No | ID of the key in UUID format. |
keyMaterial |
object |
No | Key Material |
publicKeyMaterial |
object |
No | Public Key Material |
scope |
string |
No | Scope of the key. |
validFrom |
string |
No | The key is valid from this date. |
validTill |
string |
No | The key is valid until this date. |
version |
integer |
No | Version of the public key issued. |
create
POST /auth/jose/playground/jwsjwe
Operation ID: josePlaygroundJwsJwePost.
Authentication: bearer token (ClientCredentialsToken).
Parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
x-tw-jose-method |
header |
enum: jws+jwe |
Yes | JOSE method identifier. |
Accept-Encoding |
header |
enum: identity |
No | Disables response compression so the encrypted response can be processed correctly. |
X-TW-JOSE-Encryption-kid |
header |
string (uuid) |
Yes | ID of the public JWE key uploaded to Wise for encrypting the response. |
X-External-Correlation-Id |
header |
string (uuid) |
No | Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more. |
Request body
application/jose+json
The request body is string.
Example request body:
"eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.W0fuxaZOoyaBcxWwgtjEPkOnLdVNyH9ncZi5Y9xQbjD4sYJn8vEQmxKHDw5s14sWhdexSNAPTVMSyzwJaA-LRL0tZTEuQ.ohD4LLjImiKOV4Tu.Rgp9mc2JD6m9Zm5htSqrejwWYy0_hIylYdLD39ZCR-VnQ2VX-Tot8kKGeNncnv7hJ_ApANWiJpKJbiM.5hNt-uaxuOkOraGGZSmsig"
Responses
200: Signed and encrypted response
application/jose+json
The response is string.
Example response:
"eyJraWQiOiJiMzc0ODE1MC0xNGQ0LTRlMDAtYjM5NC03YWUwYzkzYmUyNDUiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.VGhpcyBpcyB0aGUgZW5jcnlwdGVkIENFSw.aXZfdmFsdWU.ZW5jcnlwdGVkX3BheWxvYWQ.YXV0aF90YWc"
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header
application/json
The response is object.
500: Internal Server Error
application/json
POST /auth/jose/playground/jwe
Operation ID: josePlaygroundJwePost.
Authentication: bearer token (ClientCredentialsToken).
Parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
x-tw-jose-method |
header |
enum: jwe |
Yes | JOSE method identifier. |
X-External-Correlation-Id |
header |
string (uuid) |
No | Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more. |
Request body
application/jose+json
The request body is string.
Example request body:
"eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.W_WPBDXclMryaywqAB-_yC1hUYukKmZxByhE9d1G8hClc2HpewkryILGJW4uVTUeRdo1oVWd68TPIqi7bqMGUsrT-3MI4ggVSjC1rf8Lf1xTZ8-GHjSPso8tFBXnydOKzggi6fnfk98BIW76Rnxkn6sW79LH5NgN1spTOoh8-tI3i_wbHdqJOxTReaUNMYZobm7wxedZcRxhsaSrVqx2qdELeqkfwgvB1DRbHTF_PTe4W0ibMbcJivHjiDf6oAV9vXgVhYb66rhB43pgdFDv4nY1mkQC45R5T6CBdzv80EdAVOj1G4bktHyJWaJzHVsGozpxsNj3bt1AopyvDO8tsw.WLOO5WH4ZpBPi-8B.0g3eUpQPvRIaTbgUi6sH0WejsJ1nLWDGnDKTktZrkquLQlCMmIguj0I5UCyqXEo.URtTniRvfGxrKRLK63trug"
Responses
200: Encrypted response
application/jose+json
The response is string.
Example response:
"eyJraWQiOiI2ZGE0OTQ5NS0xNjMyLTQzY2QtOWEwMy1kZDMyNDYwM2VjZDciLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.qwMqgFXRI84THQdCHhxNe5yvKOuKp2rAMH62xQ1OioPatnLfxqPHJUX0as13B3g3JKaqGgF0qMi7r3QbJ_cXNFBIg1yenCwWv4192J73-kEkCSyS-FflDCNfih1z1mm95ftAE7FhHJVG5tcSm_B0-bPU3SbjB3SDhR3QlLX5o_sQmYkQay8PKSssyBS5tCjuKdz-9QNvZtNADPujKrJGe5hE5r7ShcNwVUS2vpMXANiQTzZnQ2L3j_m07Rru-PgMxHTD2uR621B87YfTHonWDJe4XogA_pMWD_hzHVQKT7Il--2YOtv8PTnLge-uVvRTgqUiYUdvq85nPyDKsOQMnQ.zprknKK9W4iAX7YA.LJWA6oRcYj0LruM3GLPtZ0CtVNpI0Zs9WFrARDd464kKxSlu15LBiFFCFwOHbeKoRudfp8Br7MfRIlaTLHxPEE1xoBB8jZN8fakAcApU.OlMATtfF9XMtYJtTsGuBGQ02"
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header
application/json
The response is object.
POST /auth/jose/playground/jwe-direct-encryption
Operation ID: josePlaygroundJweDirectEncryption.
Authentication: bearer token (ClientCredentialsToken).
Parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
x-tw-jose-method |
header |
enum: jwe |
Yes | JOSE method identifier. |
X-External-Correlation-Id |
header |
string (uuid) |
No | Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more. |
Request body
application/jose+json
The request body is string.
Example request body:
"eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.rVqOhX92u637hqwrw96rqA48e7NhMZVeWvUZwA4OAwOa_sBVcpXecd6qivPfZ-CuhRaD4gNKUlUJnTedBwOh5hcDZELRWThtwNiTZKaDS_ZNDjJf1r0VQPj65nT2ikfPAP-S6cYCy6JbWXivf7Jwq6lus-QydmxoLlVRvAuROFe-HzlH0-JhlwOdhPwbwl1AGx64qEir7oOn5VezJvpx3sscipm3w30mfoFc7pLlscMijMNFUwngXCLmgpno1rC_ZDzRcEycVbwvgKW75jO25UyEJif25MdE0UJUx4IT6MDviHqtBXO4OQpwhd_W6jVk-PlZ1WkZyOZqpi8HLKGo8Q.eFHqPV-mcBC82Ga2.W9o2BT7Q-vEUA2u3n4gaSdfQY_4svVj0-jwjcXmlBraZEKmtTW_A1ygvr8b9iHfS9fkxL8H_6S_oEcqzFqTKmNTzwe2V0cRY-kvzsKI.lO2gETmo2WocPZoTpU-pkQ"
Responses
200: Encrypted response using direct encryption
application/jose+json
The response is string.
Example response:
"eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiZGlyIn0..gTnxA4uYrCTWVNp1.jQ3dDidM2Z8RuYkgQt1ydJ6xYy5uG3CH72-pioHlZPqucxPWeN1pWwmceQKgpGulJmw3nYLRNkgCa9yQHMofpFIlV5HQJS6mQDxZP4G2kj3bFKvByckRYQQ3v3W7TkjfVL4NAVlrDqxx3G29-qblRwbyneMP.mVY_uctEfEAleVVbHjcqdA04"
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header
application/json
The response is object.
POST /auth/jose/playground/jws
Operation ID: josePlaygroundJws.
Authentication: bearer token (ClientCredentialsToken).
Parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
x-tw-jose-method |
header |
enum: jws |
Yes | JOSE method identifier. |
X-External-Correlation-Id |
header |
string (uuid) |
No | Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more. |
Request body
application/jose+json
The request body is string.
Example request body:
"eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCIsInVybCI6Ii92MS9hdXRoL2pvc2UvcGxheWdyb3VuZC9qd3MifQ.eyJtZXNzYWdlIjoiVGhpcyBpcyBhbiBleGFtcGxlIGZyb20gZG9jcy53aXNlLmNvbSJ9.AS9QHdkWvUEn0LxQEMPRBzlceN78J-Le-Qm1XIkkSBpsGdc0WM0MZTIGFEAJEcWeUR2M-abtd5DRdar4hLzs9apPAQ-GT70SIDV6pX9-4UKfIfzJ4g305zCoHflTfn-ijvI7XrVR_yr7xO9GJo86bfBqAX_m5uuxyU7Jy9gM1epd8HcC"
Responses
200: Signed response
application/jose+json
The response is string.
Example response:
"eyJ2ZXJzaW9uIjoxLCJhbGciOiJFUzUxMiJ9.eyJtZXNzYWdlIjoiam9zZS1wbGF5Z3JvdW5kLXJlc3BvbnNlLVRoaXMgaXMgYW4gZXhhbXBsZSBmcm9tIGRvY3Mud2lzZS5jb20iLCJtZXRob2QiOiJQT1NUIn0.APYfoUySW_dPdBBVST3tJdaCBCMQZm0UR6g0vBqxjjX4WWkOdt6h045EXZKMT1m0JEMI5b7KpN14Mib9BxS7VWpLAPwYhTU5pJcQrtiK4fwaBMTT_DwipZk6ASXVevrMK_Tn9YSSkKDsv6X9qyBsnIXKy304Ex5QIHKmSGQT6wNSJ7Ye02"
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header
application/json
The response is object.
POST /auth/jose/request/public-keys
Operation ID: joseRequestPublicKeysCreate.
Authentication: bearer token (ClientCredentialsToken).
Parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
X-External-Correlation-Id |
header |
string (uuid) |
No | Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more. |
Request body
application/json
| Property | Type | Required | Description |
|---|---|---|---|
keyId |
string (uuid) |
No | Unique public key identifier in UUID format. |
publicKeyMaterial |
object |
No | |
publicKeyMaterial.algorithm |
enum: ES256, ES384, ES512, PS256, PS384, PS512, ... |
No | Algorithm to be used for: - Signature verification (Scope: PAYLOAD_SIGNING): ES256, ES384, ES512, PS256, PS384, PS512 - Payload encryption (Scope: PAYLOAD_ENCRYPTION): RSA_OAEP_256 |
publicKeyMaterial.keyMaterial |
string |
No | Public key material in DER (Distinguished Encoding Rules) format and base64 encoded. |
scope |
enum: PAYLOAD_SIGNING, PAYLOAD_ENCRYPTION |
No | Scope of the payload operation. |
validFrom |
string |
No | The key is valid from this date. Format: yyyy-MM-dd HH:mm:ss (UTC). |
validTill |
string |
No | The key is valid until this date. Format: yyyy-MM-dd HH:mm:ss (UTC). |
Example request body:
{
"keyId": "e87da464-8e5e-4380-8f2d-4e4e04052672",
"publicKeyMaterial": {
"algorithm": "ES512",
"keyMaterial": "MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBYAwVICxD0Paq7MOuO34omujHxSrQXZtiTQ/VMteqAeUfM4wE+vTSpbYCqb1pNhhcQpF+FJd2H8jB1H1zil7qLLcBw+yl4PrnLza1pmNLr+kqQVoVXVyVx/xxMK2WObLn8tHxXtW4k+bm1/ySF+0RQ265IZcw2i8YYX2FY59JkwE2Fac="
},
"scope": "PAYLOAD_SIGNING",
"validFrom": "2023-04-27 00:00:00",
"validTill": "2024-04-01 00:00:00"
}
Responses
201: Public key created successfully
application/json
| Property | Type | Required | Description |
|---|---|---|---|
clientId |
string,null |
No | This field is currently not in use and will always return null. |
deactivationTimestamp |
string,null |
No | This field is currently not in use and will always return null. |
keyId |
string (uuid) |
No | Unique public key identifier in UUID format. |
publicKeyMaterial |
object |
No | |
publicKeyMaterial.algorithm |
string |
No | Algorithm to be used for request signature verification or for response payload encryption. |
publicKeyMaterial.keyMaterial |
string |
No | Public key material in DER (Distinguished Encoding Rules) format and base64 encoded. |
scope |
enum: PAYLOAD_SIGNING, PAYLOAD_ENCRYPTION |
No | Scope of the payload operation. |
validFrom |
string |
No | The key is valid from this date. Format: yyyy-MM-dd HH:mm:ss (UTC). |
validTill |
string |
No | The key is valid until this date. Format: yyyy-MM-dd HH:mm:ss (UTC). |
Example response:
{
"clientId": null,
"deactivationTimestamp": null,
"keyId": "e87da464-8e5e-4380-8f2d-4e4e04052672",
"publicKeyMaterial": {
"algorithm": "ES512",
"keyMaterial": "MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBYAwVICxD0Paq7MOuO34omujHxSrQXZtiTQ/VMteqAeUfM4wE+vTSpbYCqb1pNhhcQpF+FJd2H8jB1H1zil7qLLcBw+yl4PrnLza1pmNLr+kqQVoVXVyVx/xxMK2WObLn8tHxXtW4k+bm1/ySF+0RQ265IZcw2i8YYX2FY59JkwE2Fac="
},
"scope": "PAYLOAD_SIGNING",
"validFrom": "2023-04-27 00:00:00",
"validTill": "2024-04-01 00:00:00"
}
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header
application/json
The response is object.
load
GET /auth/jose/response/public-keys
Operation ID: joseResponsePublicKeysGet.
Authentication: bearer token (ClientCredentialsToken).
Parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
version |
query |
integer (int32) |
No | Fetch a specific public key version. If omitted the most recent public key is provided. |
algorithm |
query |
enum: ES256, ES384, ES512, PS256, PS384, PS512, ... |
Yes | Algorithm to be used for signature verification or payload encryption. This must match the algorithm used during request. - Signature verification (Scope: PAYLOAD_SIGNING): ES256, ES384, ES512, PS256, PS384, PS512 - Payload encryption (Scope: PAYLOAD_ENCRYPTION): RSA_OAEP_256 |
scope |
query |
enum: PAYLOAD_SIGNING, PAYLOAD_ENCRYPTION |
Yes | Scope of the key. Must be PAYLOAD_SIGNING or PAYLOAD_ENCRYPTION. |
X-External-Correlation-Id |
header |
string (uuid) |
No | Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more. |
Responses
200: Public key object
application/json
| Property | Type | Required | Description |
|---|---|---|---|
keyId |
string (UUID) |
No | ID of the key in UUID format. |
keyMaterial |
object |
No | |
keyMaterial.algorithm |
enum: ES256, ES384, ES512, PS256, PS384, PS512, ... |
No | Algorithm to be used with the key. |
keyMaterial.keyMaterial |
string |
No | Public key material. |
scope |
enum: PAYLOAD_SIGNING, PAYLOAD_ENCRYPTION |
No | Scope of the key. |
version |
integer (int32) |
No | Version of the public key issued. |
Example response:
{
"keyMaterial": {
"algorithm": "ES512",
"keyMaterial": "MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBYAwVICxD0Paq7MOuO34omujHxSrQXZtiTQ/VMteqAeUfM4wE+vTSpbYCqb1pNhhcQpF+FJd2H8jB1H1zil7qLLcBw+yl4PrnLza1pmNLr+kqQVoVXVyVx/xxMK2WObLn8tHxXtW4k+bm1/ySF+0RQ265IZcw2i8YYX2FY59JkwE2Fac="
},
"scope": "PAYLOAD_SIGNING",
"version": 1
}
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header
application/json
The response is object.
GET /auth/jose/playground/jwe
Operation ID: josePlaygroundJweGet.
Authentication: bearer token (ClientCredentialsToken).
Parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
x-tw-jose-method |
header |
enum: jwe |
Yes | JOSE method identifier. |
x-tw-jose-encryption-kid |
header |
string |
Yes | Public Key ID of JWE Encryption Key |
X-External-Correlation-Id |
header |
string (uuid) |
No | Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more. |
Responses
200: Encrypted response
application/jose+json
The response is string.
Example response:
"eyJraWQiOiI2ZGE0OTQ5NS0xNjMyLTQzY2QtOWEwMy1kZDMyNDYwM2VjZDciLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.UC5mC6XSGZZuQzUALpM2QfDWyi-lcl4Wv3v8-9L04BFmqYTyiQMO-YMxiwzOdVbF-L01CaFcr_iuoM36fKp01onJAtsrvuGcnrHeh23kMwZ5k29ycGTckE0YYLe-WV9WtXguudfFC3Hri9v4FTPEE1_BbkrHACVufuhw_xWUWgYAekfm7dnmTI_3SmtExWZ_P-Xn6rkGXhsJ0Kq9LB-F3mnuvz_iglvZsW76RdLV_I4es-TfTnQgVOGO-N38SSS4wCF1qw2TWOkpNAe9kyAg6a8tWw8ZkpOxJlmGdp4jLuG_GDWlmtDrv9ntgeCLDRiTp4SLYL2MGYdmNXigZI5xrg.P_h3CuIiKxEzndER.Zf0wahZEHQSMcb4olkeT1NNzh3Alj34XbXVdREiqQH9CKDa-GnKvh1lXXYuvTO99vtBmNRM.iTzGQ3FNRIybDT_lJcnaeQ03"
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header
application/json
The response is object.
GET /auth/jose/playground/jwsjwe
Operation ID: josePlaygroundJwsJweGet.
Authentication: bearer token (ClientCredentialsToken).
Parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
x-tw-jose-method |
header |
enum: jws+jwe |
Yes | JOSE method identifier. |
X-TW-JOSE-Encryption-kid |
header |
string (uuid) |
Yes | ID of the public JWE key uploaded to Wise for encrypting the response. |
X-External-Correlation-Id |
header |
string (uuid) |
No | Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more. |
Responses
200: Signed and encrypted response
application/jose+json
The response is string.
Example response:
"eyJraWQiOiJiMzc0ODE1MC0xNGQ0LTRlMDAtYjM5NC03YWUwYzkzYmUyNDUiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.VGhpcyBpcyB0aGUgZW5jcnlwdGVkIENFSw.aXZfdmFsdWU.ZW5jcnlwdGVkX3BheWxvYWQ.YXV0aF90YWc"
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header
application/json
The response is object.
500: Internal Server Error
application/json