Usage¶

As a library¶

import cryptography_manager as cm

config = cm.Config()
config.load_from_file("config.yaml")

dp = cm.adapters.DifferentialPrivacyAdapter(config)

result = dp.execute_query(
    query_type="BoundedMean",
    epsilon=0.1,
    data=[1, 2, 3, 4, 5],
    lower_bound=0,
    upper_bound=10,
)

from cryptography_manager.adapters import EncryptionAdapter

enc = EncryptionAdapter()
keyset = enc.generate_keyset()

ciphertext = enc.encrypt_bytes(b"sensitive", keyset, b"context")
plaintext = enc.decrypt_bytes(ciphertext, keyset, b"context")

# Rotation keeps old keys enabled, so existing ciphertext stays readable.
rotated = enc.rotate_keyset(keyset)

As a service¶

uv run uvicorn cryptography_manager.main:app --reload

curl -X POST http://127.0.0.1:8000/cryptography \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
        "operation": "differential_privacy",
        "backend": "pydp",
        "input_data": {"data": [1, 2, 3, 4, 5]},
        "parameters": {
          "query_type": "BoundedMean",
          "epsilon_cost": 0.1,
          "lower_bound": 0,
          "upper_bound": 10
        }
      }'

Interactive API documentation is served at /docs, and a liveness and capability report at /health.

Testing¶

We use pytest to ensure correctness of the Cryptography Manager.

To run the tests in your local environment, use the following command:

# Execute the test suite with uv
uv run pytest

The tests run against the real backends — real Tink keysets, real PyDP queries, a real local OpenID Connect provider, a real ASGI client. Nothing cryptographic is mocked, because a test that mocks the cryptography verifies only that the mock was called.

uv run pytest tests/test_auth.py    # one module
uv run pytest -k rotation -v        # anything matching a name
uv run pytest -m "not slow"         # skip tests that bind a real port

uv run ruff check src/ examples/ tests/
uv run basedpyright src/

Examples¶

Detailed workflow examples can be found in the /examples directory.

To execute an example script, use the following command:

# Execute the differential privacy example with uv
uv run examples/dp.py

Script	Demonstrates
`dp.py`	A configured plan of differentially private queries over a CSV
`encryption.py`	Encryption, tamper detection and key rotation
`api_client.py`	The REST API end to end, including budget exhaustion