curl --request GET \
--url https://{subdomain}.conveyour.com/api/contacts/{id}/reveal-secret \
--header 'x-conveyour-token: <api-key>'const options = {method: 'GET', headers: {'x-conveyour-token': '<api-key>'}};
fetch('https://{subdomain}.conveyour.com/api/contacts/{id}/reveal-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));const options = {method: 'GET', headers: {'x-conveyour-token': '<api-key>'}};
fetch('https://{subdomain}.conveyour.com/api/contacts/{id}/reveal-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://{subdomain}.conveyour.com/api/contacts/{id}/reveal-secret"
headers = {"x-conveyour-token": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{subdomain}.conveyour.com/api/contacts/{id}/reveal-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-conveyour-token: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"status": "ok",
"message": "success",
"data": {
"field_value": "123-45-6789"
}
}{
"status": "failed",
"message": "Lacking necessary permission add_contacts",
"data": {
"permission": "add_contacts"
}
}Reveal a secret field
Returns the decrypted value of a secret/encrypted contact field.
Requires the contacts permission on the service account that owns your API key. A key whose service account lacks it fails with "Lacking necessary permission contacts".
A missing record does not return 404. This handler reports the failure without a status code, and the error envelope defaults to HTTP 200 — you get 200 with status: "failed". Branch on status, not on the HTTP code.
curl --request GET \
--url https://{subdomain}.conveyour.com/api/contacts/{id}/reveal-secret \
--header 'x-conveyour-token: <api-key>'const options = {method: 'GET', headers: {'x-conveyour-token': '<api-key>'}};
fetch('https://{subdomain}.conveyour.com/api/contacts/{id}/reveal-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));const options = {method: 'GET', headers: {'x-conveyour-token': '<api-key>'}};
fetch('https://{subdomain}.conveyour.com/api/contacts/{id}/reveal-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://{subdomain}.conveyour.com/api/contacts/{id}/reveal-secret"
headers = {"x-conveyour-token": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{subdomain}.conveyour.com/api/contacts/{id}/reveal-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-conveyour-token: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}{
"status": "ok",
"message": "success",
"data": {
"field_value": "123-45-6789"
}
}{
"status": "failed",
"message": "Lacking necessary permission add_contacts",
"data": {
"permission": "add_contacts"
}
}Authorizations
Your API key token. Contacts endpoints require a Server-only — Full API key — see Authentication.
Path Parameters
The contact's internal ID.
Query Parameters
The name of the encrypted field to reveal.
Required only when your org has require_public_encryption_key enabled. Base64-encoded public key used for re-encryption.
Team scope for the request, as one or more team ObjectIds. The brackets are required: PHP keeps only the last value for a repeated plain key, so teams=A&teams=B silently resolves to B alone. On requests with a JSON body you may send teams (no brackets) in the body instead.
Values that are not valid ObjectIds are silently ignored — a mistyped team ID behaves as if no team was sent. See the teams section of the API conventions guide.
Response
The decrypted field value.
The common response envelope shared by all ConveYour endpoints.