Support

APIv1 was designed back in the late '00s when HTTPS was a rare and expensive commodity. TLS certificates cost a lot of money, and hosting companies usually charged extra for a dedicated IP address to serve your HTTPS site. Since running an API over plain HTTP was problematic, we had designed APIv1 with its own encryption layer. This layer was removed in 2014 when Padding Oracle attacks against it became practical.

Due to these historical reasons, version 1 requires that you encapsulate the data you send to the server and specifies that the returned data will also be returned encapsulated. Since the encryption layer was removed, the encapsulation essentially means that the actual data is passed as a string inside another, outer, JSON message.

For example, if you want to pass the message:

{
  foo: "bar"
}

You would need to encapsulate it like this:

{
  encapsulation: 1,
  body: {
    challenge: "foo:3858f62230ac3c915f300c664312c63f",
    method: "example",
    data: "{foo:\"bar\"}"
  }
}