Cryptography

The Cryptography node provides encryption, decryption, hashing, HMAC, signing, verification, and secure random generation. Use it to protect sensitive data, verify data integrity, or meet compliance requirements for data handling within your automation workflows.

Before You Use This Node

What you may need	Where to set it up	Why it matters
Signing/verification key files	Files	sign and verify reference the private/public key by a Global Configurator file ID, not inline PEM.
Shared secret values or key names	Global Variables	Reuse secret references without typing them in every step.

Actions

Action	Description
cryptography:encrypt	Encrypt data using AES or RSA
cryptography:decrypt	Decrypt previously encrypted data
cryptography:hash	Generate a hash digest of the input data
cryptography:hmac	Generate an HMAC (Hash-based Message Authentication Code)
cryptography:sign	Create a digital signature
cryptography:verify	Verify a digital signature
cryptography:generate	Generate a random secure value

How Configuration Works

Every action is batched. The step configuration holds a list named after the action — encryptDetails, decryptDetails, signDetails, verifyDetails, generateDetails, hashDetails, or hmacDetails — where each entry is one item to process. The node processes the entries in order and returns them in a top-level results array, one result per input item.

Common fields across items include inputData (the value to operate on), key, secretKey, algorithm, encoding fields (outputEncoding/inputEncoding/encoding), type, privateKey, publicKey, and signature.

---

cryptography:encrypt

Encrypts each item in encryptDetails.

Field	Type	Required	Description
inputData	string	Yes	Data to encrypt
algorithm	string	Yes	AES or RSA only
key	string	Yes	AES: symmetric key. RSA: PEM public key

• AES uses AES/GCM/NoPadding. A fresh 12-byte IV is generated internally for each item and prepended to the ciphertext as base64(iv):base64(ciphertext). You do not supply an IV.
• RSA uses RSA/ECB/PKCS1Padding with the supplied PEM public key.

cryptography:decrypt

Decrypts each item in decryptDetails.

Field	Type	Required	Description
inputData	string	Yes	Encrypted data. For AES this must be the iv:ct form produced by encrypt
algorithm	string	Yes	AES or RSA
key	string	Yes	AES: symmetric key. RSA: PEM private key

cryptography:hash

Generates a cryptographic hash digest for each item in hashDetails (backed by BouncyCastle).

Field	Type	Required	Description
inputData	string	Yes	Data to hash
algorithm	string	Yes	JCA algorithm name, exact (e.g. SHA-256, SHA-512)
encoding	string	Yes	Output encoding. No default — must be supplied

cryptography:hmac

Generates an HMAC for each item in hmacDetails.

Field	Type	Required	Description
inputData	string	Yes	Data to authenticate
secretKey	string	Yes	HMAC secret key
algorithm	string	Yes	Hyphens are stripped, so Hmac-SHA256 resolves to HmacSHA256
encoding	string	Yes	Output encoding. No default — must be supplied

cryptography:sign

Creates a digital signature for each item in signDetails.

Field	Type	Required	Description
inputData	string	Yes	Data to sign
privateKey	string	Yes	File ID of the private key stored in Global Configurator Files; downloaded at runtime, not an inline PEM
algorithm	string	Yes	RSA only, e.g. SHA256withRSA
outputEncoding	string	Yes	Signature encoding: BASE64, HEX, UTF-8, or BASE32

cryptography:verify

Verifies a signature for each item in verifyDetails.

Field	Type	Required	Description
inputData	string	Yes	Original data
signature	string	Yes	Signature to verify
publicKey	string	Yes	File ID of the public key stored in Global Configurator Files
algorithm	string	Yes	Algorithm used to sign
inputEncoding	string	Yes	Signature encoding: BASE64, HEX, or BASE32 (not UTF-8)

Each result carries a verified boolean (results[].verified).

cryptography:generate

Generates a random, cryptographically secure 16-character value for each item in generateDetails.

Field	Type	Required	Description
type	string	Yes	Character set / encoding of the generated value: ASCII, BASE64, HEX, UTF-8, or BASE32

---

Connection

No connection required. Signing and verification key material is stored in Global Configurator Files and referenced by file ID; symmetric keys and secrets can be supplied via variables or Global Configurator secrets.

Output

Every action returns a top-level results array with one entry per input item:

{
  "results": [ /* one result object per item */ ]
}

A failed item is represented as { "status": "failure", "errorType": "...", "message": "..." }.

Error handling differs by action:

• encrypt, decrypt, generate, hash, and hmac swallow per-item errors — a failing item becomes a failure entry in results, and the step still completes.
• sign and verify re-throw a per-item error, which fails the whole step.