openData Studio中文
Vault - Hide Pics, App Lock icon

Vault data API: cloud backup, restore, recovery email

Wafer Co. · Utilities

Open on Google Play

Vault - Hide Pics, App Lock is Wafer Co.'s Android privacy vault, the app originally built by Beijing-based NQ Mobile (formerly NetQin). Behind a single vault password it hides photos and videos from the phone's gallery, locks individual apps, moves private contacts together with their SMS threads and call logs into a hidden space, and keeps private browser bookmarks out of sight. A cloud backup screen with a storage meter carries the whole vault to a new handset and restores it there, and a recovery email bound in settings lets a user reset a forgotten vault password. Listed in Google Play's utilities category for the US market, it is used by people who share or lend their phones and want pictures, conversations and apps kept private, competing with photo lockers such as Keepsafe Photo Vault, LockMyPix and Private Photo Vault, calculator-disguised gallery locks, and app lockers like AppLock by DoMobile.

Vaulted SMS threads, contacts and call logs leave the phone as typed lists — smsList, contactList, calllogList and the private bookmarksList — next to a fileList of hidden photos and videos in which every row carries fileId, path, digest, size and optional meta. The backup answer reports a per-type outcome (smsResult, calllogResult, fileResult) plus a fileUrl and uploadSize for the file bytes; a restore names the slices to bring back and returns a mimeType per file, and media downloads resume by fileId over startPosition/endPosition byte ranges.

Around that content sit the account records: a cloud quota against bytes used, returned with the accessToken at sign-in and re-read before every backup or restore, and a recovery-email binding that ties an email to a deviceId and spaceId.

Device-migration services can move a user's contacts, SMS, call logs and vaulted photos between handsets through the backup/restore round trip, using each file's digest to verify nothing was lost; reseller dashboards can track quota versus used per account and alert or upsell before a nightly backup starts failing silently; support tooling can bind and check the recovery email to cut lockout tickets when users change phones or forget their vault password. openData Studio turns this vault backup, quota and recovery data into callable open data for those integrations.

Screenshots

  • Vault - Hide Pics, App Lock screenshot 1
  • Vault - Hide Pics, App Lock screenshot 2
  • Vault - Hide Pics, App Lock screenshot 3
  • Vault - Hide Pics, App Lock screenshot 4
  • Vault - Hide Pics, App Lock screenshot 5

API surface

The endpoints and request/response examples below are reconstructed from the app's interface — illustrative, not a live capture.

  • Cloud account sign-in

    POST /v1/auth/session osint

    Authenticates the Vault cloud account and returns accessToken plus storage quota/used counters used by every later backup call.

    Auth: Vault password in the JSON body; the returned session token is reused on later cloud calls.

    • command
    • userInfo
    • uid
    • userName
    • level
    • password
    • softwareInfo
    • version
    • os
    • partner
    • language
    • status
    • code
    • message
    • title
    • content
    • accessToken
    • quota
    • used
    • step
    • tag
    POST /v1/auth/session HTTP/1.1
Content-Type: application/json

{
  "command": "login",
  "userInfo": {
    "uid": "10086001",
    "userName": "vault_user",
    "level": "1"
  },
  "password": "<vault-password>",
  "softwareInfo": {
    "version": "6.8.12.80",
    "os": "android",
    "partner": "googleplay",
    "language": "en"
  }
}
    {
  "status": {
    "code": 0,
    "message": {
      "title": "OK",
      "content": "login success"
    }
  },
  "userInfo": {
    "accessToken": "<access-token>",
    "quota": 1073741824,
    "used": 24883200,
    "step": 0,
    "tag": 1
  }
}

  • Cloud storage quota

    POST /v1/account/storage opendata

    Reads the signed-in vault's cloud storage quota and used bytes before a backup or restore.

    Auth: userInfo.accessToken from sign-in, plus uid/userName/level.

    • command
    • uid
    • userName
    • level
    • accessToken
    • version
    • os
    • partner
    • language
    • status
    • code
    • title
    • content
    • quota
    • used
    • step
    • tag
    POST /v1/account/storage HTTP/1.1
Content-Type: application/json

{
  "command": "quota",
  "userInfo": {
    "uid": "10086001",
    "userName": "vault_user",
    "level": "1",
    "accessToken": "<access-token>"
  },
  "softwareInfo": {
    "version": "6.8.12.80",
    "os": "android",
    "partner": "googleplay",
    "language": "en"
  }
}
    {
  "status": {
    "code": 0,
    "message": {
      "title": "OK",
      "content": ""
    }
  },
  "userInfo": {
    "accessToken": "<access-token>",
    "quota": 1073741824,
    "used": 24883200,
    "step": 0,
    "tag": 1
  }
}

  • Cloud backup of vault contents

    POST /v1/vault/backup osint

    Uploads vault SMS, call logs, contacts, bookmarks and hidden-file metadata to the cloud; the file block returns a fileUrl used by the binary media transfer endpoint.

    Auth: userInfo.accessToken from sign-in.

    • command
    • uid
    • userName
    • level
    • accessToken
    • smsList
    • calllogList
    • contactList
    • bookmarksList
    • fileList
    • fileId
    • path
    • digest
    • size
    • currentPath
    • meta
    • contact_result
    • smsResult
    • calllogResult
    • bookmarkResult
    • fileResult
    • fileUrl
    • fileInfo
    • uploadSize
    POST /v1/vault/backup HTTP/1.1
Content-Type: application/json

{
  "command": "backup",
  "userInfo": {
    "uid": "10086001",
    "userName": "vault_user",
    "level": "1",
    "accessToken": "<access-token>"
  },
  "softwareInfo": {
    "version": "6.8.12.80",
    "os": "android",
    "partner": "googleplay",
    "language": "en"
  },
  "smsList": [],
  "calllogList": [],
  "contactList": [],
  "bookmarksList": [],
  "fileList": [
    {
      "fileId": "img-001",
      "path": "/vault/hidden/IMG_1001.jpg",
      "digest": "d41d8cd98f00b204e9800998ecf8427e",
      "size": 248832,
      "currentPath": "/vault/hidden/IMG_1001.jpg",
      "meta": "10002"
    }
  ]
}
    {
  "status": {
    "code": 0,
    "message": {
      "title": "OK",
      "content": ""
    }
  },
  "userInfo": {
    "accessToken": "<access-token>"
  },
  "contact": { "result": 0 },
  "sms": { "result": 0 },
  "calllog": { "result": 0 },
  "bookmarks": { "result": 0 },
  "file": {
    "result": 0,
    "url": "/v1/vault/media",
    "fileInfo": [
      {
        "fileId": "img-001",
        "path": "/vault/hidden/IMG_1001.jpg",
        "digest": "d41d8cd98f00b204e9800998ecf8427e",
        "size": 248832,
        "currentPath": "/vault/hidden/IMG_1001.jpg",
        "uploadSize": 0
      }
    ]
  }
}

  • Cloud restore of vault contents

    POST /v1/vault/restore osint

    Asks the cloud which vault slices to restore (contacts, SMS, call logs, bookmarks, files) and returns per-type result plus a fileUrl/fileInfo list for binary download.

    Auth: userInfo.accessToken from sign-in.

    • command
    • uid
    • userName
    • level
    • accessToken
    • contact
    • sms
    • calllog
    • bookmarks
    • file
    • fileList
    • fileId
    • path
    • digest
    • size
    • meta
    • fileUrl
    • fileInfo
    • mimeType
    • fileResult
    • calllogFileid
    • bookmarkFileid
    POST /v1/vault/restore HTTP/1.1
Content-Type: application/json

{
  "command": "restore",
  "userInfo": {
    "uid": "10086001",
    "userName": "vault_user",
    "level": "1",
    "accessToken": "<access-token>"
  },
  "softwareInfo": {
    "version": "6.8.12.80",
    "os": "android",
    "partner": "googleplay",
    "language": "en"
  },
  "contact": "true",
  "sms": "true",
  "calllog": "true",
  "bookmarks": "true",
  "file": "true",
  "fileList": [
    {
      "fileId": "img-001",
      "path": "/vault/hidden/IMG_1001.jpg",
      "digest": "d41d8cd98f00b204e9800998ecf8427e",
      "size": 248832
    }
  ]
}
    {
  "status": {
    "code": 0,
    "message": {
      "title": "OK",
      "content": ""
    }
  },
  "userInfo": {
    "accessToken": "<access-token>"
  },
  "contact": { "result": 0, "fileId": "contact-001" },
  "sms": { "result": 0 },
  "calllog": { "result": 0, "fileId": "calllog-001" },
  "bookmarks": { "result": 0, "fileId": "bookmark-001" },
  "file": {
    "result": 0,
    "url": "/v1/vault/media",
    "fileInfo": [
      {
        "fileId": "img-001",
        "path": "/vault/hidden/IMG_1001.jpg",
        "digest": "d41d8cd98f00b204e9800998ecf8427e",
        "size": 248832,
        "mimeType": "image"
      }
    ]
  }
}

  • Download vault media

    GET /v1/vault/media opendata

    Downloads a previously backed-up vault photo or video by fileId, with optional byte-range resume.

    Auth: accessToken query parameter from sign-in.

    • action
    • accessToken
    • fileId
    • range
    • saveFilePath
    • startPosition
    • endPosition
    GET /v1/vault/media?action=download&accessToken=<access-token>&fileId=img-001&range=bytes=0-248831 HTTP/1.1
    <binary octet-stream of the vault file; Range writes into saveFilePath from startPosition>

  • Bind recovery email

    POST /v1/account/recovery-email osint

    Binds a recovery (safe) email to the vault space so a forgotten lock can be reset from the password-recovery flow.

    Auth: userInfo.uid and level; deviceId identifies the vault space.

    • deviceId
    • spaceId
    • email
    • uid
    • level
    • version
    • os
    • partner
    • language
    • result
    • userInfo
    • softwareInfo
    POST /v1/account/recovery-email HTTP/1.1
Content-Type: application/json

{
  "deviceId": "a1b2c3d4e5f6",
  "spaceId": "space-001",
  "email": "[email protected]",
  "userInfo": {
    "uid": "10086001",
    "level": "1"
  },
  "softwareInfo": {
    "version": "6.8.12.80",
    "os": "android",
    "partner": "googleplay",
    "language": "en"
  }
}
    {
  "result": "ok",
  "spaceId": "space-001"
}

Data categories

  • cloud-backup
  • contacts
  • sms
  • call-logs
  • photos
  • account-recovery

Where teams use this data

  • Device-migration services

    Phone-switching tools move a user's contacts, SMS, call logs and vaulted photos between handsets through the cloud backup/restore round trip, with digests verifying nothing was lost.

  • Backup quota management

    Reseller dashboards watch cloud storage quota versus usage per account, alerting or upselling before a customer's nightly backup starts failing silently.

  • Account-recovery flows

    Support tooling binds a recovery email to the vault account, cutting lockout tickets when users change phones or forget their vault password.

Frequently asked questions

What data API does the Vault Android app use?

Cloud backup is a JSON command protocol: a sign-in call opens the session, and sibling calls handle quota, backup, restore and account maintenance under the same request envelope. Binary photo and video transfer runs through a separate media endpoint keyed by fileId, with byte-range resume on downloads. A recovery email is bound and queried through dedicated account calls.

How is the Vault cloud API authenticated?

Sign-in posts the vault password plus userInfo.uid/userName/level and returns userInfo.accessToken. Later cloud calls carry that token in userInfo; media download/upload pass it as an accessToken query parameter. Recovery-email calls send deviceId, spaceId and userInfo.uid/level instead of the token.

Which vault records does backup send?

The backup call serializes smsList, calllogList, contactList, bookmarksList and fileList. Each fileList row has fileId, path, digest, size, currentPath and optional meta. The response returns per-type result codes and a file URL plus fileInfo list used to push the actual bytes.

How does Vault recover a forgotten lock?

The settings flow posts deviceId, spaceId and an email address to bind a recovery address to the vault space. The password-recovery flow then queries whether that address is activated and uses it to reset the vault lock, cutting lockout tickets when users change phones or forget their vault password.

Apps similar to Vault - Hide Pics, App Lock

  • Keepsafe Photo Vault — Long-running photo vault (around since 2011) that locks pictures behind PIN, pattern or fingerprint and offers encrypted cloud backup and break-in alerts.
  • LockMyPix Photo Vault — Photo vault that encrypts each file individually with AES-256 and adds a fake-vault login plus screenshot blocking.
  • Calculator Vault - Gallery Lock — Gallery locker disguised as a working calculator that opens the hidden space only after a secret code is typed in.
  • AppLock by DoMobile — Locks whole apps and even system toggles like Wi-Fi and Bluetooth behind a password, covering the app-lock side of Vault rather than file hiding.
  • Vaulty — Minimalist Android-only vault with PIN-protected local storage, multiple vaults and an intruder-selfie feature.
  • Private Photo Vault — Cross-platform vault with a decoy password, per-album PIN locking and break-in reports, on the market since 2012.
  • 1Gallery — Combines a full gallery app with an encrypted vault, so hidden photos sit alongside built-in photo and video editors.

More Utilities apps

Topics

  • Vault Hide Pics API
  • vault cloud backup endpoint
  • accessToken vault sync
  • smsList contactList fileList
  • vault photo download API
  • recovery email deviceId spaceId

Need this app's data API integrated?

We deliver scoped integrations for any named app — from USD 500 with source-code handoff, or hosted access billed per call. Tell us the data you need.

  • NDA + SOW on every engagement
  • Delivery in 3–7 days
  • Payment only after acceptance
  • Work scoped to authorized use

Get a quote