Generating JWE Credentials

Important:

This feature is under Public Preview. Please contact OneTrust Support to request early access.

You can configure a JSON Web Encryption (JWE) credentials and key pairs to associate on workflow webhooks and actions. This feature allows the system to encrypt or decrypt JSON body for calls that return a JSON response.

Many use cases may require both credential types in a single workflow. For example, a body can be encrypted before it is sent to an external system and when the system returns the call with an encrypted response, a decryption credential can then be used to decrypt the response. It is also true that encryption can be used for actions whose request contains a body.

Note:

For information about rotating key pairs, see Rotating Key Pairs for Integration Credentials.

Decryption Credentials

Creating a decryption credential

  1. On the Integrations menu, select Credentials. The Credentials screen appears.

  2. Click the Add credentials button. The Select existing system screen appears.

  3. Enter your system in the Select existing system field, then click the Next button. The Enter Credential Details screen appears.

  4. Provide a unique name and description for this credential.

  5. Specify the Connector Type as Decryption .

  6. Specify the Decryption Type as JWE .

  7. In the Key Pair selection field, select Create Key Pair.



  8. Provide a unique name for this key pair, a custom expiration in number of days, and your desired decryption algorithm.

    • RSA

    • Elliptic Curve (EC)



  9. Click the Create button. The Expiration Date will generate based on the provided number of days.



    Important:

    You can copy the public key from this screen to manually store in your external system so that the JSON payload can be encrypted before it is sent to us.

  10. Click the Save button. The Credentials screen appears.

  11. Search and locate your new credential to inspect or further modify. This credential can be used in OneTrust Integrations.

Associating Decryption Credentials to Actions

Decryption credentials are used in response to webhook triggers and system actions available in the Integration Builder. With decryption enabled, integrations can send an encrypted response, OneTrust will decrypt the supplied response. Note, they are not supported for OneTrust-based API actions.

  1. On the Integrations menu, select Connections. The Connections screen appears.

  2. Select an existing connection or create a new one.

  3. In the Integration Builder screen, you will need to enable the setting Enable JWE Decryption for your given webook trigger or system-based action. This will allow you to select an existing JWE decryption credential in the account.





  4. Click the Done button to close the action.

Manually Retrieving Expired Public Keys with JWKS URLs

If you need to manually update your public key value upon expiration, you can perform the following steps in the Integrations module. Alternatively, you can also instead dynamically retrieve the most recent key via the provided and static JWKS URL, as documented here.

  1. On the Integrations menu, select Credentials. The Credentials screen appears.

  2. Search and locate your new credential. The Credential Details screen appears.

  3. Copy the JWKS URL value.



  4. Navigate to Global Settings to generate a client credential or API key to use with your JWKS URL. For more information, see Managing OAuth 2.0 Client Credentials and Managing OAuth 2.0 API Keys.

    Ensure that INTEGRATIONS_JWKS scope is provided.



Making API Calls with JWKS URLs

  1. In your chosen developer tool, make an API call to your JWKS URL retrieved from the credential using the created client credential. The necessary headers can be set to:

    • Content-Type: application/json

    • Authorization: Bearer {API Key or Access Token}

  2. When the call is made, you should see a returned public key:



Encryption Credentials

Creating encryption credentials

  1. On the Integrations menu, select Credentials. The Credentials screen appears.

  2. Click the Add credential button. The Select existing system screen appears.

  3. Enter your system in the Select existing system field, then click the Next button. The Enter Credential Details screen appears.

  4. Provide a unique name and description for this credential.

  5. Specify the Connector Type as Encryption .

  6. Specify the Encryption Type as JWE .

  7. In the Key Pair selection field, select Create Key Pair.



  8. Provide a unique name for this key pair



  9. Click the Create button.

  10. Click the Save button. The Credentials screen appears.

  11. Search and locate your new credential to inspect or further modify. This credential can now be used in OneTrust Integrations.

Associating Encryption Credentials to Actions

Encryption credentials are used in response to system actions available in the Integration Builder and any action with HTTPS protocol so that OneTrust can encrypt payloads before they are sent. Unlike the decryption credential, the encryption connector type is not supported for webhook events.

  1. On the Integrations menu, select Connections. The Connections screen appears.

  2. Select an existing connection or create a new one.

  3. In the Integration Builder screen, you will need to enable the setting Enable JWE Encryption for your given action.



  4. Click the Done button to close the action.