Output encryption

Both prompt and conversion request bodies accept output_encryption:

{
  "output_encryption": {
    "format": "jwe",
    "public_key_pem": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----"
  }
}

Supply an RSA SubjectPublicKeyInfo public PEM, 2048–8192 bits. Your application owns the private key; send only the public key. For read/comment prompts, output encryption requires export_document: true.

What is encrypted

Exported artifact bytes are compact JWE using RSA-OAEP-256 and A256GCM. Messages and receipt metadata remain ordinary JSON and may contain document content. Revise and the inference provider process plaintext inputs; output encryption is not end-to-end input encryption. The download endpoint returns application/jose and a .jwe filename. Artifact bytes and sha256 describe ciphertext; content_type and filename in the artifact metadata describe the original plaintext file. Verify ciphertext integrity before decrypting. Use a JWE implementation that allowlists the algorithms, authenticates the protected header and GCM tag, and binds the result to the expected key, job ID, artifact ID, and variant. OAEP uses SHA-256. A decoded header is not proof of authenticity.

Chaining encrypted output

Encrypted artifacts cannot be used directly as another input. Decrypt and authenticate locally, then upload the plaintext if another request needs it. Even a plaintext artifact cannot be submitted by artifact_id to a new encrypted-output prompt. Download and reupload it as a file instead. The TypeScript client handles this step, subject to the 18 MiB upload limit.

import { readFile } from "node:fs/promises";
import { ReviseClient, Source } from "@reviseio/api";

const revise = new ReviseClient({ apiKey: process.env.REVISE_API_KEY! });
const publicKey = await readFile("recipient-public.pem", "utf8");
const output = await revise.convert(
  Source.fromText("# Confidential report", { filename: "report.md" }),
  "pdf",
  { outputEncryption: { format: "jwe", public_key_pem: publicKey } },
);
const ciphertext = await output.bytes();
console.log(output.contentType); // application/jose
console.log(output.filename); // ends in .jwe

The client retrieves and verifies ciphertext. It does not generate keys or decrypt. Its Source reports ciphertext MIME and filenames, including tracked variants, while source.artifact retains the original format metadata.

Getting started

Guides

REST reference

What is encrypted

Chaining encrypted output

​What is encrypted

​Chaining encrypted output

What is encrypted

Chaining encrypted output