How to Decrypt Encrypted REST API Responses in Qlik Cloud?

[Priyankatchaudhari1]

Hi Team,

We are integrating Qlik Cloud with a Client REST API. The Client has informed us that the response data will be encrypted before being sent to us, and they have asked us which encryption method Qlik Cloud supports for decryption.

The encryption options they have shared are:

Our requirement is:

• Consume the REST API from Qlik Cloud.
• Receive the encrypted response.
• Decrypt the response within Qlik Cloud.
• Load the decrypted JSON into the Qlik application.

I have gone through the Qlik REST Connector but could not find any native functions or blocks for RSA or AES decryption.

1. Does Qlik Cloud support decryption of encrypted REST API responses?

2. Is there any native function, connector, or Qlik Automation capability to decrypt. If not, what is the recommended architecture?

3. If the client can choose the encryption method, which algorithm is recommended for compatibility with Qlik Cloud?

Any guidance or examples would be greatly appreciated.

Thank you!

[Shai_E]

Hi @Priyankatchaudhari1 

I dont see how this can be done using QAA, but i might be wrong maybe some one found a way.

The reason for this is, i dont see options in the blocks that are available, the only thing that i can think of is the custom code block which allows you to code your own solution (partially)

The only problem with the custom code block is that it doesn't allow internet connection which means you cant get all the crypto libraries needed in order to decrypt and encrypt.

Best Regards

[marksouzacosta · Accepted solution]

Hi @Priyankatchaudhari1,

Since neither the REST connector nor the Automate custom code block has access to crypto libraries or the internet, you'll need to handle the decryption outside of Qlik and hand it clean JSON afterward. A few options:

Option 1 - Batch/file-based: Write a Python script (using a library like cryptography or pycryptodome) that calls the client's API, decrypts the response, and writes the decrypted JSON to a file. Drop that file into cloud storage (S3, Azure Blob, etc.) or an on-prem location, and expose it to Qlik via the Qlik Data Gateway. This works well if the data doesn't need to be pulled in real time.

Option 2 - Real-time proxy: Deploy the same decryption logic as a small serverless function (e.g., AWS Lambda + API Gateway, or an Azure Function) that sits between Qlik and the client's API. It calls the client's endpoint, decrypts the payload, and returns plain JSON. From Qlik's side, you then just call this function via the REST connector or a Qlik Automate flow, it looks like a normal, unencrypted REST API.

Option 3 - Talend Job: If you have access to Talend, it can handle this natively since it runs on a full JVM rather than a sandboxed environment. Use tRESTClient or tHttpRequest to call the API, then tDataDecrypt to decrypt (it supports AES-GCM out of the box), or tJava with tLibraryLoad if you need a specific algorithm not covered by the built-in components, since it lets you pull in any third-party Java library (Bouncy Castle for RSA/PGP, for example). The job can then output clean JSON for Qlik to consume, the same way as options 1 and 2 - or store the data straight to your Qlik Cloud Tenant.

Either way, the key point is that Qlik's automation tools are built for orchestration, not for running arbitrary crypto code, so you need a lightweight external component to do the actual decryption and present Qlik with clean data.

Regards,

Mark Costa

[Priyankatchaudhari1]

Hi @marksouzacosta,

Thank you for the detailed explanation and the different implementation options.  I'll evaluate these approaches, particularly the Python-based solution. I appreciate your help!

Regards,

Priyanka C.