Skip to content

Playground JWS+JWE

Request

Send test signed and encrypted HTTP requests and receive signed and encrypted responses. Both signing and encryption are mandatory for this endpoint. The request must be a JSON Web Signature (JWS) wrapped in JSON Web Encryption (JWE) — any message that does not follow this format will be rejected.

The flow combines both JWS and JWE:

  1. Request: Sign payload (JWS) → Encrypt signed JWT (JWE) → Send to Wise
  2. Response: Receive encrypted response → Decrypt (JWE) → Verify signature (JWS)

Currently, the Wise API returns a generic 500 Internal Server Error for decryption failures across endpoints using JWE and JWS+JWE. For example, an invalid key can cause a decryption failure.

Our team is currently planning improvements for these types of error messages to make them more specific and clear. Thank you for your patience.

Security
ClientCredentialsToken
Headers
Acceptstringrequired
Value:"application/jose+json"
Example:application/jose+json
x-tw-jose-methodstringrequired

JOSE method identifier.

Value:"jws+jwe"
Example:jws+jwe
Accept-Encodingstring

Disables response compression so the encrypted response can be processed correctly.

Value:"identity"
Example:identity
X-TW-JOSE-Encryption-kidstring, (uuid)required

ID of the public JWE key uploaded to Wise for encrypting the response.

Example:2333836d-2e1c-4acd-8b52-234d379260aa
X-External-Correlation-Idstring, (uuid), <= 36 characters

Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more.

Example:f47ac10b-58cc-4372-a567-0e02b2c3d479
Bodyapplication/jose+jsonrequired
string

JWE-encoded string containing a signed JWS. The payload before signing and encryption should contain a message field with any text.

Original payload:

{"message": "This is an example from docs.wise.com"}

Encoded (JWS+JWE):

eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.W0fuxaZOoyaBcxWwgtjEPkOnLdVNyH9ncZi5Y9xQbjD4sYJn8vEQmxKHDw5s14sWhdexSNAPTVMSyzwJaA-LRL0tZTEuQ.ohD4LLjImiKOV4Tu.Rgp9mc2JD6m9Zm5htSqrejwWYy0_hIylYdLD39ZCR-VnQ2VX-Tot8kKGeNncnv7hJ_ApANWiJpKJbiM.5hNt-uaxuOkOraGGZSmsig
curl -i -X POST \
  https://api.wise-sandbox.com/v1/auth/jose/playground/jwsjwe \
  -H 'Accept: application/jose+json' \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>' \
  -H 'Content-Type: application/jose+json' \
  -H 'x-tw-jose-method: jws+jwe' \
  -d 'eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.W0fuxaZOoyaBcxWwgtjEPkOnLdVNyH9ncZi5Y9xQbjD4sYJn8vEQmxKHDw5s14sWhdexSNAPTVMSyzwJaA-LRL0tZTEuQ.ohD4LLjImiKOV4Tu.Rgp9mc2JD6m9Zm5htSqrejwWYy0_hIylYdLD39ZCR-VnQ2VX-Tot8kKGeNncnv7hJ_ApANWiJpKJbiM.5hNt-uaxuOkOraGGZSmsig'

Responses

Signed and encrypted response.

Headers
X-External-Correlation-Idstring, (uuid), <= 36 characters

Echoed back when X-External-Correlation-Id was included in the request. Learn more.

Example:"f47ac10b-58cc-4372-a567-0e02b2c3d479"
x-trace-idstring

Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.

Example:"fba501b6d453b96789f52338f019341f"
Bodyapplication/jose+json
string

JWE-encoded string containing a signed JWS. After decryption (JWE) and signature verification (JWS), the response contains:

  • message — The original message prefixed with jose-playground-response-. Message length is limited to 100 characters.
  • method — Original HTTP request method name: POST.

Example of decrypted and decoded response:

{
  "message": "jose-playground-response-This is an example from docs.wise.com",
  "method": "POST"
}
Response
"eyJraWQiOiJiMzc0ODE1MC0xNGQ0LTRlMDAtYjM5NC03YWUwYzkzYmUyNDUiLCJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiUlNBLU9BRVAtMjU2In0.VGhpcyBpcyB0aGUgZW5jcnlwdGVkIENFSw.aXZfdmFsdWU.ZW5jcnlwdGVkX3BheWxvYWQ.YXV0aF90YWc"