---
title: "POST /v1/{+name}:decrypt"
method: POST
path: "/v1/{+name}:decrypt"
tags: ["projects"]
---

# POST /v1/{+name}:decrypt

`POST /v1/{+name}:decrypt`

Decrypts data that was protected by Encrypt. The CryptoKey.purpose must be ENCRYPT_DECRYPT.

## Path parameters

- `name` string, required

## Request body

- DecryptRequest — Request message for KeyManagementService.Decrypt.
  - `ciphertext` string, byte — Required. The encrypted data originally returned in EncryptResponse.ciphertext.
  - `ciphertextCrc32c` string, int64 — Optional. An optional CRC32C checksum of the DecryptRequest.ciphertext. If specified, KeyManagementService will verify the integrity of the received DecryptRequest.ciphertext using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(DecryptRequest.ciphertext) is equal to DecryptRequest.ciphertext_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
  - `additionalAuthenticatedDataCrc32c` string, int64 — Optional. An optional CRC32C checksum of the DecryptRequest.additional_authenticated_data. If specified, KeyManagementService will verify the integrity of the received DecryptRequest.additional_authenticated_data using this checksum. KeyManagementService will report an error if the checksum verification fails. If you receive a checksum error, your client should verify that CRC32C(DecryptRequest.additional_authenticated_data) is equal to DecryptRequest.additional_authenticated_data_crc32c, and if so, perform a limited number of retries. A persistent mismatch may indicate an issue in your computation of the CRC32C checksum. Note: This field is defined as int64 for reasons of compatibility across different languages. However, it is a non-negative integer, which will never exceed 2^32-1, and can be safely downconverted to uint32 in languages that support this type.
  - `additionalAuthenticatedData` string, byte — Optional. Optional data that must match the data originally supplied in EncryptRequest.additional_authenticated_data.

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/cloudkms.md) · [All operations](https://skmtc.net/google/apis/cloudkms/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/cloudkms/versions/576b283e53dd/schema)