One API surface, governed by the server.

Authentication and correlation

Send a bearer on protected requests. Persist the response X-Request-Id with your application operation so an investigator can join the client event to the audit chain.

Authorization: Bearer <service-token>
Content-Type: application/json
Idempotency-Key: <stable-operation-id>

Seal structured data

POST /v1/data

{
  "vault_id": "customer-data",
  "records": [{
    "email": "[email protected]",
    "phone": "+91-90000-00000"
  }]
}

Protect an AI request

Use the configured AI connection rather than passing a caller-selected arbitrary upstream. Securelay de-identifies configured classes before the pinned provider receives content and evaluates any requested rehydration.

POST /v1/ai/chat/completions

{
  "connection_id": "approved-support-model",
  "purpose": "support_resolution",
  "messages": [{
    "role": "user",
    "content": "Summarize this approved case context…"
  }]
}

Design for denial

Never treat a denied reveal as an exceptional reason to fetch plaintext from a shadow store. Render the safe fallback, ask for the missing consent or authorization through the proper workflow, or stop the action.