---
title: "Decrypt an asset for rendering"
method: GET
path: "/v1/vault/assets/{id}"
tags: ["Vault"]
---

# Decrypt an asset for rendering

`GET /v1/vault/assets/{id}`

## Request

- Base URL: `http://localhost:9998`
- URL: `http://localhost:9998/v1/vault/assets/{id}`
- Auth: HTTP bearer

Streams the asset's encrypted blob open chunk-by-chunk (uncapped
streaming readback, verified per frame and by final content hash) and
returns the exact plaintext bytes with the recorded `Content-Type`.
Answers `Cache-Control: no-store` — decrypted content must not be
cached past the render. Bearer-gated like every vault route.

## Path parameters

- `id` string, required

## Response `200`

The exact decrypted asset bytes

## Other responses

- `404`: Resource not found
- `423`: The vault is locked (no VMK loaded). Unlock natively in ToolPiper — there is no unlock route. The body is the standard nested error envelope with type `vault_locked`.
- `503`: Vault service unavailable

---

[API](https://skmtc.dev/modelpiper/apis/toolpiper-api.md) · [All operations](https://skmtc.dev/modelpiper/apis/toolpiper-api/llms.txt) · [OpenAPI document](https://skmtc.dev/modelpiper/apis/toolpiper-api/revisions/6722bf56385c?raw)