Protect one or more field values for a given role. The exact technique (encryption, tokenization, anonymization, masking) is server-configured per (className, propertyName). Returns each field's protected value joined to its original. Protect data as early as possible.

Reverse a protection to recover the original value, for a role permitted to do so. ⚠️ Returns CLEARTEXT sensitive data — treat the result as confidential, never log it, and only call when the caller is authorised. Depending on the role the engine may instead return a masked value or the stored protected value.

Run the Search operation for a value to obtain a search token you can compare against a stored protected column (availability and operators depend on the protection scheme).

Escape hatch: send a fully-formed Engine transform payload (rightsContexts, processingContexts, requests) for advanced cases (multiple contexts, dependency contexts). Prefer protect/unprotect/search.

Statically validate a transform payload before sending it: required fields, evidence shape, and that each request's rightsContext/processingContext references a declared context guid.

Fetch an access token and report the (non-sensitive) JWT claims — client id, scope, expiry — to confirm credentials and which environment is configured.

Verify the Identity API issues a token and the Engine API endpoint is reachable.

Return the data-model manifest: which (className, propertyName) fields are protectable, the roles and their behaviour, and the Action vocabulary. Use this to discover what you can protect.