AvailableStore KYC documents and exports without exposing vault capabilities.
Each end-user is isolated by your application and canonical tenant. Your backend calls DevSewa with its client secret; Authority Core signs the vault request, consumes any one-time Trusted capability and returns only the completed result. Contents are never readable from the console.
complete an upload from your backend
POST /v1/vault/files
Authorization: Bearer dsk_live_…
{
"owner_user_id": "u_1001",
"file_kind": "kyc_document",
"allowed_content_types": ["image/jpeg", "application/pdf"],
"max_size_bytes": 10485760,
"original_filename": "passport.pdf",
"content_type": "application/pdf",
"content_base64": "JVBERi0x…"
}
→ { "file_id": "file_…", "status": "active", "size_bytes": 842119 }What you get
User Vault, without running it.
Served from vault.api.devsewa.com and managed from the console. Backed by USER_VAULT_APP, mediated by the DevSewa control plane.
- Isolation by (application, tenant, end-user)
- Completed server-to-server upload and download routes
- One-time vault capabilities consumed inside Authority Core
- Revoke access instantly; delete purges ciphertext
- Cross-tenant file ids answer 404, never an action
- Delegated quotas and logical areas available in the lab
Isolation
How it stays yours.
- Scope
- (devsewa, canonical tenant, end-user) is signed on every call
- Capabilities
- Never returned to browsers or customer code
- Contents
- Encrypted at rest; console receives metadata only
Add User Vault to your application.
Create an account, register a test application and exchange your first ticket in under ten minutes.