# Method: privilegedprivatekeydecrypt

Decrypts without checking the wrapped private key ACL. It's used to decrypt the
data exported ([takeout](https://support.google.com/a/answer/100458)) from
Google.

### HTTP request

`POST https://KACLS_URL/privilegedprivatekeydecrypt`

Replace `KACLS_URL` with the Key Access Control List
Service (KACLS) URL.

### Path parameters

None.

### Request body

The request body contains data with the following structure:

| JSON representation ||
|---|---|
| ``` { "authentication": string, "algorithm": string, "encrypted_data_encryption_key": string, "rsa_oaep_label": string, "reason": string, "spki_hash": string, "spki_hash_algorithm": string, "wrapped_private_key": string } ``` |

| Fields ||
|---|---|
| `authentication` | `string` A JWT issued by the identity provider (IdP) asserting who the user is. See [authentication tokens](https://developers.google.com/workspace/cse/reference/authentication-tokens). |
| `algorithm` | `string` The algorithm that was used to encrypt the Data Encryption Key (DEK) in envelope encryption. |
| `encrypted_data_encryption_key` | `string (UTF-8)` Base64-encoded encrypted content encryption key, which is encrypted with the public key associated with the private key. Max size: 1 KB. |
| `rsa_oaep_label` | `string` Base64-encoded label L, if the algorithm is RSAES-OAEP. If the algorithm is not RSAES-OAEP, this field is ignored. |
| `reason` | `string (UTF-8)` A passthrough JSON string providing additional context about the operation. The JSON provided should be sanitized before being displayed. Max size: 1 KB. |
| `spki_hash` | `string` Standard base64-encoded digest of the DER-encoded `SubjectPublicKeyInfo` of the private key being accessed. |
| `spki_hash_algorithm` | `string` Algorithm used to produce `spki_hash`. Can be "SHA-256". |
| `wrapped_private_key` | `string` The base64-encoded wrapped private key. Max size: 8 KB. |

### Response body

If successful, this method returns the base64 data encryption key. This key is
used client-side to decrypt the message body.

If the operation fails, a
[structured error reply](https://developers.google.com/workspace/cse/reference/structured-errors)
is returned.

| JSON representation ||
|---|---|
| ``` { "data_encryption_key": string } ``` |

| Fields ||
|---|---|
| `data_encryption_key` | `string` A base64-encoded data encryption key. |

### Example

This example provides a sample request and response for the
`privilegedprivatekeydecrypt` method.

#### Request

    POST https://mykacls.example.org/v1/privilegedprivatekeydecrypt

    {
      "wrapped_private_key": "wHrlNOTI9mU6PBdqiq7EQA...",
      "encrypted_data_encryption_key": "dGVzdCB3cmFwcGVkIGRlaw...",
      "authentication": "eyJhbGciOi...",
      "spki_hash": "LItGzrmjSFD57QdrY1dcLwYmSwBXzhQLAA6zVcen+r0=",
      "spki_hash_algorithm": "SHA-256",
      "algorithm": "RSA/ECB/PKCS1Padding",
      "reason": "admin decrypt"
    }

#### Response

    {
      "data_encryption_key": "akRQtv3nr+jUhcFL6JmKzB+WzUxbkkMyW5kQsqGUAFc"
    }