Query Flow

How encrypted search queries are processed.

Query lifecycle

1. Query preparation (client)

POST /search/v1/query
{
  "index": "documents",
  "query": {
    "match": {"title": "confidential"}
  }
}

2. Token generation (client SDK)

SDK generates search tokens:

const tokens = await sdk.search.generateTokens(query);

3. Token submission

POST /search/v1/execute
{
  "index": "documents",
  "tokens": ["base64-token-1", "base64-token-2"]
}

4. Server-side matching

• Match tokens against encrypted index
• No decryption performed
• Return encrypted document references

5. Document retrieval

GET /storage/v1/objects/{objectId}

6. Client-side decryption

SDK decrypts returned documents.

Query types

Simple match

{ "match": { "field": "value" } }

Boolean query

{
	"bool": {
		"must": [{ "match": { "status": "active" } }],
		"should": [{ "match": { "priority": "high" } }]
	}
}

Range query

{ "range": { "created": { "gte": "2024-01-01" } } }

Pagination

{
  "query": {...},
  "limit": 20,
  "cursor": "opaque-cursor"
}