Dotenvx
Dotenvx does not have an API of its own. Its core encrypt, decrypt, get, set, and run workflows stay local—simple, private, and independent of a hosted service.
When you want more—off-device private keys, team access, Guard approvals, Enclave decryption, audit logs, and an API your agents can control—that is what Armor adds. Every endpoint below belongs to Armor, and Dotenvx becomes its secure command-line client when Armor is enabled.
Armor
The Armor API is served from https://armor.dotenvx.com. Authenticate with Authorization: Bearer TOKEN, or use dotenvx curl after running dotenvx login to supply your Armor credentials automatically.
Requests and responses use JSON unless an endpoint returns a plain value. List endpoints accept page and per; per must be between 1 and 100.
Account
| Method | Endpoint | Description |
|---|---|---|
GET |
/api/account |
Return the authenticated Armor account. |
Armored keys
| Method | Endpoint | Description |
|---|---|---|
GET |
/api/armor/keypairs |
List armored keys available to the authenticated account. Paginate with page and per. Set sort to name_asc, name_desc, public_key_asc, or public_key_desc. |
GET |
/api/armor/keypairs/:public_key |
Return one armored key. |
POST |
/api/armor/keypairs/:public_key/name |
Set or clear an armored key's name. |
POST |
/api/armor/keypairs/:public_key/members/:member_id/grant |
Grant a team member access to an armored key. |
POST |
/api/armor/keypairs/:public_key/members/:member_id/revoke |
Revoke a team member's access to an armored key. |
POST |
/api/armor/keypairs/:public_key/settings/guard |
Turn Guard on or off for an armored key. |
POST |
/api/armor/keypairs/:public_key/settings/enclave |
Turn Enclave on or off for an armored key. |
Teams
| Method | Endpoint | Description |
|---|---|---|
GET |
/api/teams |
List teams available to the authenticated account. |
GET |
/api/teams/:team |
Return one team. |
GET |
/api/teams/:team/members |
List a team's members. |
POST |
/api/teams/:team/members/:member_id/keypairs/:public_key/grant |
Grant a member access to an armored key. |
POST |
/api/teams/:team/members/:member_id/keypairs/:public_key/revoke |
Revoke a member's access to an armored key. |
GET |
/api/teams/:team/invitations |
List a team's invitations. |
POST |
/api/teams/:team/invitations |
Invite a member by email or username. |
POST |
/api/teams/:team/invitations/:id/cancel |
Cancel a pending invitation. |
GET |
/api/teams/:team/join_requests |
List a team's pending join requests. |
POST |
/api/teams/:team/join_requests/:id/accept |
Accept a join request and optionally assign a role. |
POST |
/api/teams/:team/join_requests/:id/decline |
Decline a join request. |
POST |
/api/armor/:team/settings/join_requests |
Turn join requests on or off for a team. |
Your join requests
| Method | Endpoint | Description |
|---|---|---|
GET |
/api/join_requests |
List your join requests. |
POST |
/api/join_requests |
Request to join a team. |
POST |
/api/join_requests/:id/cancel |
Cancel one of your pending join requests. |
Logs
| Method | Endpoint | Description |
|---|---|---|
GET |
/api/logs?team=:team |
List team activity logs. Account events such as user/create, device/create, and oauth_token/* are omitted. Filter with events, user, keypair, page, and per. user accepts usernames, missing, none, or a comma list. keypair accepts keypair ids, public keys, missing (no keypair), none, or a comma list. |
Dotenvx command protocol
Dotenvx uses these Armor endpoints to implement Armor-backed commands. Prefer the corresponding Dotenvx command unless you are building an Armor client.
| Method | Endpoint | Description |
|---|---|---|
GET / POST
|
/api/keypair |
Create or retrieve a keypair. |
GET / POST
|
/api/armor/keyring |
Retrieve an armored private key, subject to its access settings. |
POST |
/api/armor/decrypt |
Decrypt encrypted values inside Enclave. |
GET / POST
|
/api/armor/up |
Move a private key into Armor. |
GET / POST
|
/api/armor/down |
Remove a private key from Armor. |
GET / POST
|
/api/armor/push |
Push a private key to Armor. |
GET / POST
|
/api/armor/pull |
Pull a private key from Armor. |
GET / POST
|
/api/armor/move |
Move an armored key to another team. |
GET / POST
|
/api/backup |
Back up an encrypted project snapshot. |
GET / POST
|
/api/sync |
Synchronize an encrypted project snapshot. |
GET / POST
|
/api/synchronization/:id |
Return one synchronization. |
GET / POST
|
/api/get |
Read the value referenced by a Dotenvx URI. |
GET / POST
|
/api/set |
Write the value referenced by a Dotenvx URI. |
GET / POST
|
/api/rotate |
Run a passcard rotation. |
POST |
/api/rotate/connect |
Connect credentials used by a passcard rotation. |
GET / POST / DELETE
|
/api/logout |
Revoke the current Armor token. |
GET / POST
|
/api/observe |
Deprecated observation endpoint; retained as a no-op for older clients. |
Example
dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs"
dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs?sort=name_asc"
dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs?sort=public_key_desc"
dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs/PUBLIC_KEY/name" \
--data '{"name":"Production"}'See Errors for Armor error codes and Events for activity names recorded by these operations.