# /vault/unlock/{channel}

> Kind 9: a key unlocked; ok or an error, in exactly one message.

Canonical: https://provider.diverge.network/2.3.0/proxy/vault/unlock/
Specification revision: 2.3.0

The ask is kind `9` on [`/requests`](/2.3.0/proxy/requests/):

```text
[9][key …]
```

The server answers on `/vault/unlock/{channel}` by sending exactly one
message and closing the connection. A path that the proxy or the server closes cleanly with no message
before the close states that the ask was not served. An abrupt end of the
path leaves the operation failed, and the proxy does not ask it
again, as [Vault](/2.3.0/proxy/vault/) provides.

- **Only the holder unlocks.** An unlock of a key the container does
  not hold is refused, and the server sends `1` and a message.

The ask is defined by `diverge-provider-sdk/src/shared/containers/vault/unlock/request/request.rs`:

```rust
//! Release a key's lock early. Answered `Ok`, or `Error` when the

use std::convert::Infallible;

use super::super::super::RequestError;
use crate::encode::{Encode, Writer};

/// Release a key's lock early. Answered `Ok`, or `Error` when the
/// asking container does not hold it.
///
/// ```text
/// [key: utf8…]
/// ```
///
/// The key is the whole payload: nothing follows it, so nothing
/// delimits it. Answered with one
/// [`response::Frame`](super::super::response::Frame).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub struct Request<'a> {
    /// The key.
    pub key: &'a str,
}

impl Encode for Request<'_> {
    /// [`Infallible`]: bytes copied.
    type Error = Infallible;

    fn encode(&self, out: &mut Writer<'_>) -> Result<(), Infallible> {
        out.extend_from_slice(self.key.as_bytes());
        Ok(())
    }
}

impl<'a> Request<'a> {
    /// Decode from the bytes after the ask's kind. The key borrows
    /// from `bytes`.
    pub fn decode(bytes: &'a [u8]) -> Result<Self, RequestError> {
        std::str::from_utf8(bytes)
            .map(|key| Request { key })
            .map_err(|_| RequestError::KeyUtf8)
    }
}
```

The answer is the frame defined on [Vault](/2.3.0/proxy/vault/): a first byte of `0` states that the operation was done; a first byte of `1` is followed by a message stating why it was not.