# OpenTofu State Encryption Roundtrip Verifier

> OpenTofu State Encryption Roundtrip Verifier is a paid API for AI agents from agent.halowerk.com, paid per call via x402, $0.0035/call, status unknown (last checked 2026-10-29).

Encrypts an OpenTofu state snapshot with a passphrase using native OpenTofu state-encryption code and returns the encrypted artifact plus three cryptographic proofs: correct key decrypts successfully, wrong key is rejected, and tampered payload is rejected.

## Facts

- Endpoint: POST https://agent.halowerk.com/v1/oss-tofu-encrypted-state-roundtrip?utm_source=zero.xyz
- Price: $0.0035/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/opentofu-state-encryption-roundtrip-verifier-1b698553
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_kKfgUWa5cJSfRFFX-abBg

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability opentofu-state-encryption-roundtrip-verifier-1b698553 -d '<json body>'
```

Example prompt: Take this OpenTofu state JSON and encrypt it using the passphrase 'correct-horse-battery-staple-42xyz', then run the full roundtrip proof — confirm the right key recovers the state, a wrong key is rejected, and a tampered payload is detected, and tell me the resource instance count.

## When to prefer this

Choose this endpoint when you need cryptographic proof that OpenTofu state encryption is correctly implemented end-to-end — not just that encryption ran, but that the right key recovers the state, wrong keys fail, and tampered payloads are detected. Prefer this over generic encryption services when working specifically with OpenTofu/Terraform-compatible state format and needing the three-proof guarantee without ever exposing plaintext.

## Known failure modes

- Passphrase shorter than 32 characters returns a validation error
- state_json exceeding 2MB limit is rejected with a payload-too-large error
- Malformed or non-JSON state_json causes a parse error
- OpenTofu encryption engine failure returns an internal error with no artifact
- Network timeout on large state files may require retry

## How this service works

Takes an OpenTofu state snapshot and a passphrase, encrypts the snapshot through the pinned OpenTofu state-encryption code, then proves the result three ways: the authorized key recovers the state with an identical semantic hash, a wrong key is rejected, and a tampered payload is rejected. What comes back is the encrypted artifact plus those proofs and the resource-instance count, never the plaintext.

## Output

Returns the encrypted state artifact, a semantic hash of the recovered state, proof that the authorized passphrase recovers the state with matching hash, proof that a wrong key is rejected, proof that a tampered payload is rejected, and the resource instance count. Plaintext state is never returned.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "passphrase": {
   "type": "string",
   "maxLength": 1024,
   "minLength": 32
  },
  "state_json": {
   "type": "string",
   "maxLength": 2097152,
   "minLength": 1
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/opentofu-state-encryption-roundtrip-verifier-1b698553/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from agent.halowerk.com](https://www.zero.xyz/host/agent.halowerk.com/llms.txt)