How-to

Decrypt a message

Goal

Take a wire envelope received from a transport, decrypt it, verify the sender, and obtain the body.

Code

.NET

using HexaEight.Bridge;
using HexaEight.Bridge.Authorization;

var client = new Client();
var msg = await client.DecryptEnvelopeAsync(envelope);

switch (msg.Authorized)
{
    case AuthorizationStatus.Allowed:
        Console.WriteLine($"From {msg.Sender}: {msg.Body}");
        break;
    case AuthorizationStatus.Denied:
        Console.WriteLine($"Blocked: {msg.DenialReason}");
        break;
    case AuthorizationStatus.Disabled:
        // AutoEnforce is off — body is the real content, no check ran
        Console.WriteLine($"From {msg.Sender}: {msg.Body}");
        break;
}

Node.js

import { HexaEight } from '@hexaeight/sdk';

const he = await HexaEight.connect();
const msg = await he.envelope.decrypt(envelope);

if (msg.authorized === 'Denied') {
    console.warn(`Blocked: ${msg.denialReason}`);
} else {
    console.log(`From ${msg.sender}: ${msg.body}`);
}

What you get back

What happens on a denied inbound message

When automatic enforcement is on (the default) and a policy rule denies the message, the SDK still returns a DecryptedEnvelope. The difference is:

• msg.Body contains the literal text "redacted due to authorization enforcement"
• msg.Authorized is Denied
• msg.DenialReason contains the matching rule

Your application can detect the denial and react (log, alert, queue for review) without ever seeing the original body.

Common issues