The Google Workspace Client-side Encryption (CSE) API lets you own the
encryption keys used to further encrypt Google Workspace data.

## Methods

| Methods ||
|---|---|
| `https://developers.google.com/workspace/cse/reference/delegate` | `POST https://KACLS_URL/delegate` Allows a first user to delegate a request to a second user. |
| `https://developers.google.com/workspace/cse/reference/digest` | `POST https://KACLS_URL/digest` Returns the checksum of an unwrapped DEK. |
| `https://developers.google.com/workspace/cse/reference/private-key-decrypt` | `POST https://KACLS_URL/privatekeydecrypt` Unwraps a wrapped private key and then decrypts the content encryption key that is encrypted to the public key. |
| `https://developers.google.com/workspace/cse/reference/private-key-sign` | `POST https://KACLS_URL/privatekeysign` Unwraps a wrapped private key and then signs the digest provided by the client. |
| `https://developers.google.com/workspace/cse/reference/privileged-private-key-decrypt` | `POST https://KACLS_URL/privilegedprivatekeydecrypt` Decrypts without checking the wrapped private key ACL. |
| `https://developers.google.com/workspace/cse/reference/privileged-unwrap` | `POST https://KACLS_URL/privilegedunwrap` Decrypts data exported from Google in a privileged context. |
| `https://developers.google.com/workspace/cse/reference/privileged-wrap` | `POST https://KACLS_URL/privilegedwrap` Returns a wrapped Data Encryption Key (DEK) and associated data. |
| `https://developers.google.com/workspace/cse/reference/rewrap` | `POST https://KACLS_URL/rewrap` Re-encrypts an encrypted DEK. |
| `https://developers.google.com/workspace/cse/reference/status` | `GET https://KACLS_URL/status` Checks the status of a Key Access Control List Service (KACLS). |
| `https://developers.google.com/workspace/cse/reference/unwrap` | `POST https://KACLS_URL/unwrap` Returns decrypted DEK. |
| `https://developers.google.com/workspace/cse/reference/wrap` | `POST https://KACLS_URL/wrap` Returns encrypted DEK and associated data. |
| `https://developers.google.com/workspace/cse/reference/wrap-private-key` | `POST https://KACLS_URL/wrapprivatekey` Wraps a user's private key. |

## Tokens

| Tokens ||
|---|---|
| `https://developers.google.com/workspace/cse/reference/authorization-tokens` | JWT issued by Google to verify that the caller is authorized to encrypt or decrypt a resource. |
| `https://developers.google.com/workspace/cse/reference/authentication-tokens` | JWT issued by the identity provider that attests user identity. |

## Other

- [Resource key hash](https://developers.google.com/workspace/cse/reference/resource-key-hash)
- [Structured error replies](https://developers.google.com/workspace/cse/reference/structured-errors)