# HALOWERK sicherwerk CMS EnvelopedData Encrypt

> HALOWERK sicherwerk CMS EnvelopedData Encrypt is a paid API for AI agents from sicher.halowerk.com, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-29).

Wraps arbitrary bytes in a CMS EnvelopedData envelope using a pinned OpenSSL build, encrypting for one or more recipient certificates so only holders of matching private keys can decrypt.

## Facts

- Endpoint: POST https://sicher.halowerk.com/v1/oss-openssl-cms-envelope-encrypt?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/halowerk-sicherwerk-cms-envelopeddata-encrypt-f92efcf4
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_Bjxr2ambgzxoUBQJ1HLiU

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability halowerk-sicherwerk-cms-envelopeddata-encrypt-f92efcf4 -d '<json body>'
```

Example prompt: Encrypt this payload for the following two recipient certificates using CMS EnvelopedData — I need to know what cipher was used and how many recipients were wrapped, so I can log what was produced.

## When to prefer this

Choose this endpoint when you need deterministic, auditable CMS EnvelopedData encryption using a pinned OpenSSL build — particularly when you need multi-recipient encryption (one CEK per payload, one KEK per recipient), want the response to confirm the cipher and recipient count for logging, or are building PKI/S/MIME workflows that require a verifiable, reproducible cryptographic tool rather than a general-purpose library.

## Known failure modes

- Invalid or malformed recipient certificate causes envelope construction failure
- Unsupported certificate key type rejected by the pinned OpenSSL build
- Missing required input bytes or empty payload returns validation error
- Certificate not yet valid or expired may be rejected
- Mismatched or corrupted input encoding causes parsing error

## How this service works

Wraps the supplied bytes in a CMS EnvelopedData envelope using the pinned OpenSSL build, addressed to every recipient certificate you pass in. A single content-encryption key protects the payload and is itself encrypted once per recipient, so any one holder of a matching private key can decrypt, and nobody else can. The reply names the cipher actually used and the recipient count, so an agent can record what it produced rather than assume it.

## Output

A CMS EnvelopedData structure (envelope) containing the encrypted payload, along with the name of the symmetric cipher actually used for content encryption and the number of recipients the content-encryption key was wrapped for.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "bodyType"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "POST"
    },
    "bodyType": {
     "const": "json"
    },
    "schemaUrl": {
     "type": "string",
     "format": "uri"
    },
    "exampleUrl": {
     "type": "string",
     "format": "uri"
    }
   },
   "additionalProperties": true
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "const": "json"
    },
    "schemaUrl": {
     "type": "string",
     "format": "uri"
    },
    "exampleUrl": {
     "type": "string",
     "format": "uri"
    }
   },
   "additionalProperties": true
  }
 },
 "additionalProperties": true
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/halowerk-sicherwerk-cms-envelopeddata-encrypt-f92efcf4/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from sicher.halowerk.com](https://www.zero.xyz/host/sicher.halowerk.com/llms.txt)