> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cocoondata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# <access-service>/api/v1/objects/{objectId}/keys

## URL structure&#x20;

```text theme={null}
https://access-service.xy-company.com/api/v1/objects/{objectId}/keys
```

where `{objectId}` is the ID of a Secure Object.

## Supported methods and overview&#x20;

* `GET` - used to retrieve the cryptographic key required to decrypt the encrypted data of a [Secure Object](/3.2/api/creating-files-and-folders.md#secure-object), based on the Secure Object's ID.

> [!NOTE]
>
> This method takes no parameters.

## Detailed description&#x20;

This API endpoint retrieves the cryptographic key required to decrypt the encrypted data of a Secure Object, using the Secure Object's ID.

This key is generated by:

1. Calling the [\<access-service>/api/v1/keys](/3.2/api/access-service-api-v1-keys.md) endpoint to obtain a cryptographic key and then
2. Associating this key with a new *Incomplete* or completed Secure Object (by subsequently calling the [\<access-service>/api/v1/organisations/\{orgGroupId}/objects](/3.2/api/access-service-api-v1-organisations-orggroupid-objects.md) endpoint).

A Secure Object's ID can be obtained by calling the [\<access-service>/api/v1/items](/3.2/api/access-service-api-v1-items.md) API endpoint, which retrieves a list of information associated with Secure Objects that can be filtered using various 'search' criteria.

## Supported roles and conditions&#x20;

This API endpoint supports the following Covata user [roles](/3.2/admin-org/administering-users-within-an-organisation.md#an-organisation-users-roles) (as described in the [Organization Administrator's Guide](/3.2/admin-org.md)), conditions and [permissions](/3.2/api/access-service-api-v1-permissions-sets.md) (where applicable):

* [Originator](/3.2/admin-org/administering-users-within-an-organisation.md#originator-role) - a Covata user with this role can call this endpoint on a Secure Object they own.
* **Originator**, [Collaborator](/3.2/admin-org/administering-users-within-an-organisation.md#collaborator-role) and [Ad hoc](/3.2/admin-org/administering-users-within-an-organisation.md#adhoc-role) - a Covata user with any of these roles can call this endpoint for a Secure Object they are a collaborator on (with the **Download** *permission*).

The Covata Platform's resources available to one of these Covata users (above) is determined by the access token passed in the [header](/3.2/api/access-service-api-v1-objects-objectid-keys.md#access-service-api-v1-objects-objectid-keys-required-headers) of requests to this endpoint.

## Required headers&#x20;

The appropriate access token as the `Bearer` token:

* `Authorization: Bearer a1b2c3d4-e5f6-g7h8-i9j0-k1l2m3n4o5p6`

## Returns&#x20;

A JSON-formatted response containing the following members:

* **keyValue** - .
* **cryptographicAlgorithm** - .
* **keyLength** - .
* **initializationVector** - .

  **Example:**

  ```json theme={null}
  {
    "keyValue": "2VCZkPeYPhvL4VkzrEqIVGaW2AGmRM1uwuXiPRbe8NU=",
    "cryptographicAlgorithm": "AES",
    "keyLength": 256,
    "initializationVector": "fpEIYIk+dnMw7rgFA+Bz8g=="
  }
  ```

<sup>\*</sup> The currently authenticated user is determined by the access token passed in the [header](/3.2/api/access-service-api-v1-objects-objectid-keys.md#access-service-api-v1-objects-objectid-keys-required-headers) of requests to this endpoint.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.