> ## Documentation Index
> Fetch the complete documentation index at: https://developer.coincover.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Store secure encrypted data

> Stores base64-encoded encrypted data with optional checksum validation and padding type specification. The data is verified using the enclave before storage. Supplying the SHA-256 of the plaintext as the checksum is recommended.



## OpenAPI

````yaml /specs/institutional.openapi.json post /v1/secure/data
openapi: 3.0.0
info:
  title: Recover for Institutions API
  description: >-
    Direct integration for institutions backing up their own digital asset
    wallets. Uses the standard /v1/* endpoints: organisation and package are
    optional, and key_environment selects HOT (online) or COLD (offline)
    generation and storage. HOT vs COLD is a request parameter, not a URL path
    segment. Self-service verification endpoints are available for keys and
    backups. Key generation and storage use AWS Nitro Enclaves for
    hardware-isolated cryptographic operations.
  version: 1.0.0
servers:
  - url: https://service.uat-keys.coincover.com
    description: Sandbox (UAT)
  - url: https://service.keys.coincover.com
    description: Production — confirm host with your account manager
security:
  - bearerAuth: []
tags:
  - name: Keys
    description: Generate, assign, and verify cryptographic keys.
  - name: Backups
    description: Store and verify encrypted backup data and files.
paths:
  /v1/secure/data:
    post:
      tags:
        - Backups
      summary: Store secure encrypted data
      description: >-
        Stores base64-encoded encrypted data with optional checksum validation
        and padding type specification. The data is verified using the enclave
        before storage. Supplying the SHA-256 of the plaintext as the checksum
        is recommended.
      operationId: storeSecureData
      parameters:
        - name: Authorization
          in: header
          description: >-
            Bearer token for authentication. Can be either a JWT token or API
            key.
          required: true
          schema:
            $ref: '#/components/schemas/Authorization'
      requestBody:
        description: Secure data and metadata
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SecureDataRequest'
      responses:
        '200':
          description: Secure data successfully stored
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecureDataResponse'
        '400':
          description: Invalid request parameters or verification failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '404':
          description: Key or user not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    Authorization:
      type: string
    SecureDataRequest:
      type: object
      required:
        - public_key
        - data
      properties:
        public_key:
          type: string
          pattern: ^[0-9a-fA-F]+$
          minLength: 32
          maxLength: 4096
          description: Public key in hex format used to encrypt the data
        checksum:
          type: string
          pattern: ^[a-fA-F0-9]{64}$
          description: >-
            SHA-256 checksum of the original plaintext for verification
            (optional but recommended)
        data:
          type: string
          format: base64
          description: Base64-encoded encrypted data
        padding_type:
          type: string
          enum:
            - OAEP
          default: OAEP
          description: Padding type used for encryption
        metadata:
          type: object
          description: Optional metadata about the data
          properties:
            description:
              type: string
              description: Human-readable description of the data
            content_type:
              type: string
              description: MIME type of the original data
            original_filename:
              type: string
              description: Original filename of the data
    SecureDataResponse:
      type: object
      properties:
        backup_id:
          type: string
          format: uuid
          description: Unique identifier for the stored backup
        checksum:
          type: string
          description: SHA-256 checksum that was verified
        data_size:
          type: integer
          description: Size of the encrypted data in bytes
        backup_type:
          type: string
          enum:
            - data
          description: Type of backup (always 'data' for secure-data endpoint)
        metadata:
          type: object
          description: Combined metadata including original metadata
    ErrorResponse:
      type: object
      properties:
        message:
          type: string
          description: Error message
        error:
          type: string
          description: Error type
  securitySchemes:
    bearerAuth:
      description: Bearer token authentication. Can be either a JWT token or API key.
      type: http
      scheme: bearer

````