All Classes and Interfaces
Class
Description
An external issuer that passed admission, together with the addresses it resolved to at that
moment.
Algorithm catalog operations facade.
Filter criteria for querying supported algorithms from the AnkaSecure platform.
Builder for constructing
AlgorithmFilter instances.Immutable value object representing a supported algorithm profile.
Category of the algorithm: classical vs. post-quantum vs. hybrid.
Lifecycle status as defined by the platform.
Immutable pair of classical and post-quantum algorithm identifiers.
Pure client-side conversion helpers between the JOSE Compact Serialization
(RFC 7516 §7.1 for JWE / RFC 7515 §7.1 for JWS) and the General JSON
Serialization (RFC 7516 §7.2 / RFC 7515 §7.2) used by ANKASecure on the
wire.
Factory for creating authenticated SDK instances.
A uniform, localization-ready exception thrown by all public AnkaSecure SDK APIs.
Factory for creating configured ApiClient instances.
Authenticated SDK instance with immutable JWT token.
The credential kind a
TokenSource presents at the ANKASecure token endpoint.Every configuration value the resolution chain reads, and the two names each one answers to.
A read-only view of the configuration the resolution chain consults.
Assembles an immutable
AuthSettings.Holder for a JWT bearer token represented as
char[] rather than String, with
a redacted BearerToken.toString() so accidental log statements do not leak the token verbatim.The caching, single-flight, fail-without-poisoning half of every
TokenSource, so the three
mechanisms differ in exactly one method and cannot drift apart in the parts that are not about
the credential at all.Mints the RFC 7523 §2.2 client assertion that proves an actor's identity with a registered
key pair instead of a shared secret.
A client-credentials exchange with an external authorization server failed, and this names the
PHASE it failed in.
Where in the exchange the failure happened.
Obtains an external token by performing the OAuth 2.0 client-credentials grant against the
workload's OWN authorization server, and hands it to the federated assertion path.
Combined cryptographic operations facade.
Thread-safe implementation of
CombinedOperationsService.Runs a command the operator configured and takes its standard output as the external token.
How the components of a composite (hybrid) key are combined.
Refuses any request bound for an origin other than the one the SDK was configured with.
Thrown when a cryptographic operation fails due to local processing errors.
Immutable representation of the
Crypto-Policy-Info response header.Fluent builder that mirrors the legacy API, preserving existing unit
tests and client code.
Decodes the Base64URL-encoded value of the
Crypto-Policy-Info
response header into a CryptoPolicyInfo.Centralized provider for cryptographically secure random number generation.
Thread-safe concrete implementation of
CryptoService.Represents a structured cryptographic operation warning.
Immutable result returned by decryption operations.
Builder for constructing immutable DecryptResult instances.
DecryptResultMetadataResult of a decrypt-then-verify combined operation.
Thrown when a file-output operation cannot commit its result because a file already exists at the
destination and
FAIL_IF_EXISTS (the default) is in effect.One-shot utility: encrypts a clientId + clientSecret using the same
PBKDF2 + AES-GCM scheme as
ExampleUtil and prints the four
lines that must be pasted into cli.properties.Encryption and decryption operations facade.
Immutable result returned by encryption operations.
Builder for constructing immutable EncryptResult instances.
Best-effort removal of an environment variable from the JVM's process environment map after
the variable has been read.
Runs all SDK example scenarios in sequence and provides a comprehensive summary.
Signals that an example scenario could not complete.
Console entry-point that lets you run any of the sample scenarios packaged
with the AnkaSecure SDK.
Resolves PRE-PROVISIONED playground key ids for the realigned data-plane
examples.
Scenario 1 — End-to-End ML-KEM-512 Encryption (Streaming).
Scenario 10 — ML-KEM-1024 Bulk Helpers (Compact JWE).
Scenario 11 — ML-DSA-87 Bulk Helpers (Compact JWS).
Scenario 12 — ML-DSA-65 → SLH-DSA-SHA2-128S Streaming Re-sign (Detached JWS).
Scenario 13 — Runtime Discovery of PQC Algorithms.
Scenario 14 — In-Memory Post-Quantum Crypto (Compact JWE/JWS).
Scenario 15 — Compact-Token Rotation (RSA-3072 → ML-KEM-768).
Scenario 16 — XMSS Streaming Detached JWS Verification.
Scenario 17 — Sign-Then-Encrypt Nested Operations, Compact (data-plane).
Scenario 18 — Use Composite Hybrid Keys for Quantum-Resistant Security (data-plane).
Scenario 19 — PKCS#7/CMS Structural Analysis (data-plane).
Scenario 2 — RSA-2048 Streaming Sign / Verify.
Scenario 20 — PKCS#7 → JOSE Conversion / Migration (data-plane).
Scenario 21 — Sign-Then-Encrypt Nested Operations, Streaming (data-plane).
Scenario 3 — AES-256 Streaming Encrypt / Decrypt.
Scenario 4 — Streaming Re-encrypt (RSA-3072 → ML-KEM-768).
Scenario 5 — ML-KEM-512 Bulk Helpers (Compact JWE).
Scenario 6 — ML-DSA-87 Bulk Helpers (Compact JWS).
Scenario 7 — AES-256 Compact JWE Helpers.
Scenario 8 — ML-KEM-768 → ML-KEM-1024 Bulk Re-encryption (auto-detect / Compact JWE).
Scenario 9 — RSA-3072 → ML-DSA-87 Bulk Re-sign (Compact JWS).
Shared utilities for all ANKASecure© SDK example scenarios.
The token itself, held in memory.
Decides whether this process may talk to an external authorization server at all, and refuses
locally - before a socket exists - when it may not.
An external issuer was refused before any connection was opened, and this names the rule that
refused it.
The admission rules, one per way an issuer can be refused.
An externally minted token could not be obtained from its configured source.
Supplies an externally minted token that some OTHER authorization server issued to this workload.
Where an externally minted token comes from.
Presents a token some OTHER authorization server issued to this workload - Auth0, Entra, Okta,
Keycloak, Cognito, or anything else the deployment has declared it trusts.
Reads an externally minted token from a file the operator named.
Centralised UTF-8 file I/O utility for the ANKASecure SDK.
Generic warning for messages that don't match known patterns.
Utility class that converts the
Crypto-Policy-Info response header
emitted by all streaming endpoints into the immutable SDK metadata objects
required by client code.A streaming request that requires HTTP/2 was about to be sent over a connection that negotiated
something else, and was refused before any request byte was written.
Thrown when input validation fails for SDK operations.
The SECOND HTTP client: the one that talks to the external authorization server, and to nothing
else.
JWS serialization representation requested for an attached signing operation
(PRD §60).
Warning indicating that a cryptographic key is approaching expiration.
Server-side filters for the key listing endpoints.
Key management operations facade.
Thread-safe implementation of
KeyManagementService.Metadata for a cryptographic key in the ANKASecure platform.
Indicates how a cryptographic key was created or acquired.
One page of a key listing, mirroring the server's paginated envelope.
Immutable response model returned by combined PKCS#7 migration workflows.
One ANKASecure access token together with the lifetime the issuer stated for it.
Presents an ANKASecure-issued
client_secret - the platform's own credential, and the last
link of the resolution chain.NIST security levels for post-quantum cryptographic algorithms.
Governs how a file-output operation promotes its result onto an already-existing destination
(PRD §64).
Thrown by the auto-paginating
listAllKeys(filters) when the server reports
more pages than the SDK's defensive ceiling allows (ceil(totalElements/size)+1
iterations, hard-capped at 10000 pages).Classpath loader for the PKCS#7/CMS example fixture used by the data-plane
migration scenarios (
ExampleScenario19, ExampleScenario20).PqcClientCryptoUtil
A record containing both raw key objects (public, private) and their
Base64-encoded forms.
Immutable value object returned by PQC hybrid handshake endpoints.
Manages PQC transport sessions: generates PQC key pairs, performs
handshake, unwraps AES keys, and caches sessions until TTL expires.
Configuration holder for PQC transport encryption settings.
OkHttp Interceptor that transparently encrypts request bodies and decrypts
response bodies when PQC transport encryption is enabled.
Internal representation of a PQC transport session: holds sessionId,
AES key, and creation timestamp.
Signs an RFC 7523 §2.2 assertion with a key pair this process holds and presents that.
Informational view of an embedded RFC 3161 qualified timestamp
(JAdES
sigTst) reported by a verification operation (PRD §60).Result of a re-encryption
operation.
The addresses this SDK will never open a connection to, whatever names a configuration or a
response supplies.
Result of a re-signature
operation.
High-level, protocol-agnostic error categories recognised by the SDK.
Owning wrapper for a sensitive
byte[].Owning wrapper for a sensitive
char[] (typically passwords, passphrases, or other
character-secret material returned by System.console().readPassword() or by JCA
APIs that operate on char[]).Signature and verification operations facade.
Thread-safe implementation of
SignatureService.Result of a sign-then-encrypt combined operation.
Immutable result returned by signing operations.
Builder for constructing immutable SignResult instances.
Thrown when a streaming / atomic file-output operation cannot create its quarantine sidecar
(
<destination>.part) because a file already exists at the sidecar path — the signature of a
stale sidecar orphaned by a prior crashed or force-killed operation (the
CREATE_NEW sidecar is normally deleted on BOTH the success and the fail-closed paths, so a
surviving one indicates an earlier abnormal termination).Thrown when a streaming file-output operation cannot commit its result because the
server-emitted end-of-stream integrity verdict did not pass (fail-closed).
The request body could not be written to completion, so nothing was committed.
An ANKASecure access token the caller already holds, presented as a token source so that
everything above
TokenSource works identically whether the SDK obtained the token or was
handed one.Thrown when the server rejects a previously-issued access token with HTTP 401 on a data-plane
operation.
The one seam between "how this workload proves who it is" and "everything the SDK does".
Decides which credential the workload will present, from configuration alone.
One resolvable credential configuration, in the order they are considered.
Warning indicating that a cryptographic key is approaching its usage limit.
Utility operations facade for PKCS#7 analysis, conversion, and migration.
VerifySignatureResultSeverity levels for cryptographic warnings.
Centralized zeroization helpers for the ANKASecure secure-memory layer.