Skip to content

Try an operation in the Cryptographic Playground

Prove that a flow your tenant configured works on Runtime: run one operation as the Actor the configuration names, run a round trip on the same text, or test a migration between two keys.

Who can do it

The tenant administrator or the key manager. Only those two roles carry the Playground permission: a custom role cannot include it.

You never handle the Actor's token or credential. For each run the platform issues a token for that Actor, valid for at most 60 seconds, and every run names you as the administrator who delegated it.

In a support-access session a platform super administrator runs the flows on a private cloud or on-premises deployment, and each run is recorded under their name; on a deployment ANKATech operates the flows are listed and every run is refused. A break-glass session never runs an operation.

Before you start

  • A STANDARD or SIMPLE tenant.
  • An Exchange or an Internal Use Case with operations on a key. A SIMPLE tenant works from Internal Use Cases only. A wildcard capability grant belongs to no configuration and is not listed: try it with the SDK or the CLI and that Actor's own credential.
  • The Actor that runs the operation is active.
  • An operation limited in uses asks you to confirm, because a run spends a use. Each person has a limit of run requests per minute.

Steps

  1. Open Cryptographic Playground from the tenant's navigation. Each card is one Exchange or Internal Use Case and names the parties in words. It has one section per key, and each section offers one action per leg, named after the operation and the Actor, for example "Decrypt as card-issuance-decryptor". Search by key, configuration, application, counterparty or Actor name; a card found keeps all its keys.
  2. To run one operation, select its action. A side panel shows the operation, the Actor and the key.
    • Encrypt and sign open with sample text you can change.
    • Decrypt, verify, re-encrypt and re-sign need an artifact: select the producing action the panel offers (for example "Encrypt as card-issuance-encryptor"), which places its output as the input, or select Paste my own.
    • Select the run button, which names the operation (for example "Run Decrypt").
  3. To prove the whole flow, select Run round trip in the key's section. It encrypts and decrypts, or signs and verifies, the same text as two runs, with the legs of that Exchange or Internal Use Case.
  4. To prove a migration, select Test migration (re-encrypt) or Test migration (re-sign) beside the re-encryption or re-signature, or between the source and target key sections when the target follows. It runs up to three steps on the same text, each as its own Actor: encrypt on the source key, re-encrypt to the target key, decrypt on the target key (or sign, re-sign, verify). No key version is created.
  5. To compare runs, for example before and after you rotate the key on the Keys screen, open Run history beside the filters, or select Compare with previous run on a result.

Exchanges and use cases with nothing you can run now are listed only when you choose to show those that cannot run, each with its reason.

What you see when it worked

The result shows the outcome in words, then the Key ID, the version, the algorithm and Runtime's status. A value Runtime did not report reads Not reported.

  • A round trip ends with The flow works: the text came back unchanged. or The flow works: the signature verified.
  • A migration test shows Keys, before and after and ends with The text came back unchanged, now protected by the target key, or The signature verified under it. When the target key has no decrypt or verify you can run, it runs two steps and reads The migration ran. … That is not a failure of the migration.

HTTP exchange and Copy as cURL are folded under the result; the token appears as $ACTOR_TOKEN. Each run has its own correlation id and appears in the audit trace as run by you as the Actor.

If it fails

What you see Cause What to do
Operation not authorized Runtime refused the run; a configured operation does not override it Check the grant, the key's state and the policy on the configuration
Refresh the flow; nothing ran The configuration changed after you read it, or its Exchange or Internal Use Case is suspended Refresh the flow, then run it again
… is not active, so nothing ran The Actor is suspended or disabled Reactivate the Actor, or use another flow
Not executed Runtime was never reached, or no token could be issued Run it again; nothing ran
Not available for this session Runtime did not accept the run's temporary access, or your session cannot run as an Actor Your console session is unaffected; run it from an ordinary session
Execution status unknown The run may have happened and no answer arrived Trace its correlation id before running it again; nothing is retried for you
The text that came back is not the text that went in. or The signature did not verify. The flow ran but does not work as configured Check the keys and algorithms of the two legs
Step 2 failed: … One step of a round trip or migration test failed Read the reason under it and fix that leg
The per-minute limit message You reached your run requests per minute Wait the time the message states
The list does not load, naming a bound of 10,000 readable grants The tenant holds more than 10,000 readable authorizations on its Exchanges and Internal Use Cases, the most the Playground lists Revoke the authorizations the tenant no longer uses; see Crypto Playground Catalog Too Large

Without the console

The SDK, cli-crypto and the API run the same operations as the Actor itself, with the Actor's own credential: see Encrypt and decrypt data.