> ## Documentation Index
> Fetch the complete documentation index at: https://headgate.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Explicitly reveal an encrypted payload through application policy.

> Optional, read-only inspection capability. An embedding application supplies one
callback that both authorizes the established request identity and decrypts the
complete stored job. Headgate never receives key material and the browser never
performs decryption. The route fetches payload bytes only after confirming the
capability is configured; it never edits, re-encrypts, retries, or otherwise
mutates the job. Every successful plaintext response is `Cache-Control: no-store`.
When the callback is absent, `/meta` omits `payload_reveal` and this route is 404.




## OpenAPI

````yaml /api/headgate.openapi.yaml get /jobs/{id}/payload/reveal
openapi: 3.1.0
info:
  title: headgate control API
  version: 0.1.0
  description: >
    The web UI is one client of this control API and gets no

    privileged access — asynqmon reads Redis directly, which is why its
    compatibility

    note is three minor versions stale.


    Both the Go and Rust implementations serve this spec, and the conformance
    suite

    asserts identical responses. Every list endpoint is bounded to prevent
    inspection

    from becoming an unbounded store operation: asynq's

    GetQueueInfo is O(number of groups) and has pinned Redis CPU for seconds in

    production. Monitoring caused the outage.


    DERIVED FROM THE ARCHITECTURE, NOT FROM A PREDECESSOR'S UI. The first draft
    of this

    spec was the asynq Inspector surface -- list by state, act on one job, pause
    a queue

    -- with new nouns bolted on. That inherited three problems: it omitted bulk

    operations, history, and enqueue (which asynq and apalis-board respectively
    DO have),

    and more importantly it had no endpoint for the question this system's own
    design

    creates. When dequeue is an admission decision, the operator's first
    question is not

    "what is in the queue" but "why is THIS job not running" -- see
    /jobs/{id}/admission.

    No predecessor needs that endpoint because no predecessor has a gate.
servers:
  - url: /api/v1
security: []
paths:
  /jobs/{id}/payload/reveal:
    get:
      summary: Explicitly reveal an encrypted payload through application policy.
      description: >
        Optional, read-only inspection capability. An embedding application
        supplies one

        callback that both authorizes the established request identity and
        decrypts the

        complete stored job. Headgate never receives key material and the
        browser never

        performs decryption. The route fetches payload bytes only after
        confirming the

        capability is configured; it never edits, re-encrypts, retries, or
        otherwise

        mutates the job. Every successful plaintext response is `Cache-Control:
        no-store`.

        When the callback is absent, `/meta` omits `payload_reveal` and this
        route is 404.
      parameters:
        - $ref: '#/components/parameters/Id'
      responses:
        '200':
          description: Application-authorized plaintext bytes. Never cache this response.
          headers:
            Cache-Control:
              schema:
                type: string
                enum:
                  - no-store
          content:
            application/json:
              schema:
                type: object
                required:
                  - plaintext
                properties:
                  plaintext:
                    type: string
                    contentEncoding: base64
        '403':
          description: The application reveal policy rejected the caller.
        '404':
          description: No such job, or payload reveal is not configured.
        '422':
          description: The stored payload cannot be decrypted or decoded.
        '500':
          description: The application reveal callback failed.
        '503':
          description: The application decryption service is unavailable.
components:
  parameters:
    Id:
      name: id
      in: path
      required: true
      schema:
        type: string

````