Skip to main content

decryptBotRunnerConfigOnce

Strict / airgapped strictness only. Verifies the supplied passphrase against the org's stored verifier, derives the KEK in-process, decrypts every runner.SecretConfigPaths leaf in the row's config, zeros the KEK, emits a secrets.passphrase.decrypt_once audit event, and returns the decrypted config map.

Returns errors:

  • STRICTNESS_DOES_NOT_REQUIRE_PER_ACTION — caller's org is on convenience or standard strictness; dashboard should fall back to UnlockModal.
  • NO_PASSPHRASE_VERIFIER — the org has no passphrase configured.
  • WRONG_PASSPHRASE — the supplied passphrase does not match.
decryptBotRunnerConfigOnce(
  runnerID: ID!
  passphrase: String!
): DecryptedBotRunner!

Arguments​

decryptBotRunnerConfigOnce.runnerID ● ID! non-null scalar​

BotRunner ID to decrypt.

decryptBotRunnerConfigOnce.passphrase ● String! non-null scalar​

Plaintext passphrase. Never logged. Zeroed after the operation.

Type​

DecryptedBotRunner object​

Plaintext payload returned by decryptBotRunnerConfigOnce.