Reference

Java SDK

You can use our Java SDK to:

  • Encrypt data server-side
  • Invoke Functions
  • Decrypt data through Outbound Relay

Encrypting data with our backend SDKs instead of Inbound Relay may expose you to greater compliance burden because plaintext data touches your server before it is encrypted.

Instead you can:


Quickstart

Install SDK

First, let's install the Evervault SDK using either gradle or maven.

1
implementation 'com.evervault:lib:3.3.1'

Initialize SDK

Now, let's initialize the SDK using our App's API key. If you don't have one yet, you can get one by creating an App in the Evervault Dashboard.

1
import com.evervault.Evervault;
2
3
var evervault = new Evervault("<API_KEY>");

Encrypt a string

Now that the SDK is initialized, we can encrypt a string.

1
var encrypted = evervault.encrypt("Hello, world!");

Full example

Pulling all of this together leaves us with the following working example. You can copy and paste the code below (using a sandbox API key), run it in your own environment and run the encryption and decryption for yourself.

1
import com.evervault.Evervault;
2
3
var evervault = new Evervault("<API_KEY>");
4
5
var encrypted = evervault.encrypt("Hello, world!");
6
7
System.out.println(encrypted);

Reference

Evervault()

The SDK constructor accepts the following parameters:

  • Your App's API key
  • Optional configuration parameters
    • Domain names to route through Outbound Relay
    • Whether to enable Outbound Relay and fetch domain configuration from the Evervault API.

Example

1
import com.evervault.Evervault;
2
3
var evervault = new Evervault("<API_KEY>", "prime256v1", ["api.example.com"], true);
Parameters
apiKeyRequiredString

The API key of your Evervault App.

curveString

The elliptic curve used for cryptographic operations.

enableOutboundRelayBoolean, Default: false

Whether to enable Outbound Relay, and automatically intercept requests to Outbound Relay destinations.

decryptionDomainsString[]

Requests sent to any of the domains listed will be proxied through outbound interception. Wildcard domains may be included in this list. See Outbound Interception to learn more.


evervault.encrypt(data)

Encrypts data using Evervault Encryption. Evervault Strings can be used across all of our products.

To encrypt data using the Java SDK, simply pass a string or a map into the evervault.encrypt() function. encrypt() will encrypt your data and return an object which is a String in case you passed a literal type like boolStringintfloatcharbyte.

In case you pass a Map<literal, literal> then the key will be preserved and the value will be an encrypted string. If a value is another map, for example, it will follow the sample principle recursively.

In case you pass a Vector with literals the return will be a Vector with encrypted strings.

The encrypted data can be stored in your database as normal and can be used with any of Evervault’s other services.

1
import com.evervault.Evervault;
2
3
var evervault = new Evervault("<API_KEY>");
4
5
var result = evervault.encrypt("Hello, world!");
Parameters
dataRequiredString | Map | int | float | char | bool | byte

The data to encrypt.


evervault.run(functionName, data, options)

Lets you invoke an Evervault Function with a given payload.

1
import com.evervault.Evervault;
2
3
var evervault = new Evervault("<API_KEY>");
4
5
var result = evervault.run(
6
"hello-function",
7
{
8
"name": "Claude Shannon",
9
"ssn": "ev:encrypted_string"
10
}
11
);
Parameters
functionNameRequiredString

Name of the function the run token is for.

dataRequiredObject

Payload for the function.

optionsObject

Additional options for running the function.

asyncbool, Default: false

Run your Function in async mode. Asynchronous Function runs will be queued for processing and return a 200 OK response saying your run has been queued.

versionString, Default: null

Specify the version of your Function to run. By default, the latest version will be run.

Response

Function runs will return a POJO containing a Function Run ID (public String runId) and the result from your Function (public Object result).


evervault.createRunToken(functionName, data)

Creates a single use, time bound token (5 minutes) for invoking an Evervault Function with a given payload.

Run Tokens can be used to invoke an Evervault Function client-side without providing a sensitive API Key.

1
import com.evervault.Evervault;
2
3
var evervault = new Evervault("<API_KEY>");
4
5
var runToken = evervault.createRunToken(
6
"hello-function",
7
{
8
"name": "Claude Shannon",
9
"ssn": "ev:encrypted_string"
10
}
11
);
Parameters
functionNameRequiredString

Name of the function the run token is for.

payloadRequiredObject

Payload that the token can be used with.

Response

When you create a Run Token, a POJO containing 1 attribute is returned.

1
{
2
"token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsInZlciI6IjAuMCJ9.eyJhcHBVdWlkIjoiYXBwX2RmZGE3MmUwMTZiMCIsImZ1bmN0aW9uTmFtZSI6ImhlbGxvLWNhZ2UtdGFsbC13YWxscy10cmF2ZWwiLCJydW5JZCI6IjRiMjhmMzNlLWU3NjYtNDI2OC1iNmY2LTUyYzZkM2VmMGQzYyIsImV4cCI6MTY2Nzg3Njc2Nn0.gCiFw7UJ8gjZfeXNEaqX4H1Y9HBX9avjioZ4yDU8PTtmGT4QTzVOhnDV46v_yyXLxpO1BgzoBRpYbLciiW1_QXSLmx6cCuJy4vHUZwssHT13vB7AXIl_88Ab5R7w9vpOQIDoCjhPVWJsolwUiiGh_5yE4wGv6WPTIfSv249_hpJLMz3AAffXUckiLPxFporY73KXtTANQH_zniivB91KdBnyGhle7gTs1EXWLqpdMIrqOz9cmoXU31DGd-AgeMzM082s_XtdCFq7FNLLtg6Nx8Mx8Bjl0cKV41R-jbTpHSXxutLX-PSDmWn5wSqDhlQoEWdTLsoS6xp7qhZ2urYyYg"
3
}

Run Tokens can then be used to authenticate Function runs from the client-side.

bernstein:~$
curl -X POST https://run.evervault.com/hello-function \
-H 'Authorization: Bearer eyJ..Tg' \
-H 'Content-Type: application/json' \
--data '{"name": "Claude Shannon", "ssn": "ev:encrypted_string"}'

The payload used to invoke your Function must be identical to the payload used to create the Run Token.