DOCUMENTATIONv2

POST

Transfer compliance

Register wallet proof

/api/v2/transfer-compliance/wallet-control-proofs

AUTHENTICATIONBearer token · compliance:writeAUTHORITATIVE OWNERtransfer-compliance-serviceCONTRACT AUTHORITYGenerated Rust OpenAPISTATUSSource ready · production listed

PURPOSE + BUSINESS CONTEXT

Register externally completed signed-challenge commitments without accepting private keys.

WHEN THIS CALL IS USEFUL

Call this when a transfer originator, beneficiary integration, VASP, compliance reviewer, or disclosure agent needs to apply the documented wallet proof transition after re-reading the current authoritative state so it can satisfy the minimum applicable counterparty, credential, wallet-control, preparation, decision, and disclosure requirements for one transfer lifecycle.

OUTCOME · Create or advance

What changes

Creates or advances only the wallet proof resource described by this contract after authorization, validation, policy, and idempotency gates pass.

WHY IT MATTERS

Gives people and agents a contract-backed way to advance wallet proof.
Supports policy-compliant transfer coordination while minimizing personal data and separating compliance evidence from value movement.

ISOLATION + AUTHORITY

Owner, workspace, counterparty, VASP, credential issuer, wallet controller, transfer, reviewer, disclosure recipient, purpose, and retention boundaries remain distinct. A credential, preparation, decision, manifest, envelope, disclosure, or Explorer record neither moves value nor substitutes for wallet authorization, sanctions policy, rail admission, settlement, or finality.

BEFORE YOU CALL

Authenticate at the documented boundary: bearer+scope.
Supply the required wallet_reference (body), challenge_commitment (body), proof_commitment (body) exactly as defined by the live contract.
Use one Idempotency-Key only for retries of the same byte-equivalent logical mutation.
Resolve the transfer parties, network, policy jurisdiction, required credential and proof classes, disclosure purpose, recipient, and retention basis.

WHAT TO DO NEXT

Re-read wallet proof using the canonical identifier returned by this operation.
Reconcile an ambiguous response with the same idempotency key before attempting another mutation.
Re-read the transfer and credential state, verify purpose and recipient binding, and disclose only the fields required by the current policy stage.

AGENT GUIDANCE

Use wallet proof only for the purpose and lifecycle stage described by this operation; do not treat it as authority for an adjacent action.
Supply the required wallet_reference (body), challenge_commitment (body), proof_commitment (body) exactly as defined by the live contract.
Keep counterparty registration, credential validity, wallet-control proof, transfer intent, data preparation, review decision, disclosure authorization, delivery, value movement, and settlement as separate facts.
After a timeout or conflict, read authoritative state before deciding whether an equivalent retry is safe.

MACHINE CONTRACT

The exact deployed parameters, schemas, responses, security requirements, and Hybrid-Chain agent metadata are authoritative at this operation's production OpenAPI JSON Pointer. The readable tables below add integration guidance; the deployed OpenAPI controls if guidance and the machine contract ever differ.

Open the authoritative production contract ↗

EXTENDED INTEGRATION GUIDANCE

Readable request and response reference

Examples illustrate integration intent; the referenced OpenAPI operation and component schemas define the executable shape.

PARAMETERS

Headers, path, query, and body

NAMELOCATIONPRESENCETYPE / RULES / PURPOSE

AuthorizationheaderRequired

Bearer tokenCredential containing the compliance:write scope.EXAMPLEBearer hc_live_…

Idempotency-KeyheaderRequired

ASCII string · 1–128Caller-generated key reused for every retry of the same logical mutation.EXAMPLElaunch-treasury-v1-001

Content-TypeheaderRequired

application/jsonSigned mutations accept canonical JSON only.EXAMPLEapplication/json

Content-DigestheaderRequired

RFC 9530 SHA-256 digestDigest of the exact transmitted body bytes.EXAMPLEsha-256=:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=:

Signature-InputheaderRequired

RFC 9421 signature parametersCovers @method, @path, content-digest, content-type, and idempotency-key; includes keyid, nonce, created, and expires.EXAMPLEsig1=("@method" "@path" "content-digest" "content-type" "idempotency-key");created=1786582800;expires=1786583100;nonce="01J…";keyid="machine-prod"

SignatureheaderRequired

Ed25519 HTTP Message SignatureSignature made by an active public key registered to the authenticated client.EXAMPLEsig1=:base64-signature:

vault_uuidbodyOptional

32-character identifierAuthenticated subject's primary vault. Omit to select it; any different vault is rejected.EXAMPLE2ec4cd41a4414292bb33f040605a6231

networkbodyOptional

network identifier · max 32Wallet network; defaults to HYBRID.EXAMPLEhybrid-testnet

wallet_referencebodyRequired

public wallet reference · max 255Public address or account reference only. Never provide a private key, seed, or secret.EXAMPLEwallet-ref-owner-01

verification_methodbodyOptional

identifier · max 64Externally completed proof method; defaults to SIGNED_CHALLENGE.EXAMPLESIGNED_CHALLENGE

challenge_commitmentbodyRequired

64-character SHA-256 digestCommitment to the issued possession challenge.EXAMPLEeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee

proof_commitmentbodyRequired

64-character SHA-256 digestCommitment to the externally verified source proof; raw proof material is never accepted.EXAMPLEffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff

validity_daysbodyOptional

integer · 1–365Proof lifetime; defaults to 90 days.EXAMPLE90

REQUEST

JSON body example

{
  "network": "hybrid-testnet",
  "wallet_reference": "wallet-ref-owner-01",
  "verification_method": "SIGNED_CHALLENGE",
  "challenge_commitment": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
  "proof_commitment": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
  "validity_days": 90
}

RESPONSES

Status and payload examples

201Current subject-owned wallet-control proof projection.Mutation completed · JSON RESPONSE+

{
  "proof_id": "dddddddddddddddddddddddddddddddd",
  "vault_id": "2ec4cd41a4414292bb33f040605a6231",
  "network": "HYBRID-TESTNET",
  "wallet_reference": "wallet-ref-owner-01",
  "verification_method": "SIGNED_CHALLENGE",
  "challenge_commitment": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
  "proof_commitment": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
  "status": "VALID",
  "valid_until": "2026-12-01T00:00:00Z",
  "created_at": "2026-09-01T16:00:00Z",
  "updated_at": "2026-09-01T16:00:00Z"
}

INTEGRATION DECISION

CALLER ACTION: Accept the returned representation or receipt, then re-read wallet proof using the canonical identifier returned by this operation.
RETRY SAFETY: Do not repeat a successful mutation merely to confirm it. For one logical mutation, retain the same Idempotency-Key and byte-equivalent request. Never reuse that key for changed instructions.
STATE RECONCILIATION: Persist returned identifiers, versions, commitments, and receipts. Re-read the wallet, intent, reservation, and transaction status on the same network; compare policy version, nonce, digest, and terminal receipt before another command.

400The JSON body or required signed headers are malformed.Request must change · JSON RESPONSE+

{
  "code": "invalid_json",
  "message": "The JSON body or required signed headers are malformed."
}

INTEGRATION DECISIONinvalid_json

CALLER ACTION: Rebuild the request from the live OpenAPI operation and correct the rejected method, media type, header, parameter, or body field.
RETRY SAFETY: Do not retry the same invalid request. For one logical mutation, retain the same Idempotency-Key and byte-equivalent request. Never reuse that key for changed instructions.
STATE RECONCILIATION: Compare the submitted values with the documented constraints before another call. Re-read the wallet, intent, reservation, and transaction status on the same network; compare policy version, nonce, digest, and terminal receipt before another command.
ESCALATE WHEN: Escalate when funds, reservations, transaction digests, or MPC state remain ambiguous after authoritative wallet and network reconciliation.

401The bearer credential or RFC 9421 request signature is missing, expired, replayed, or invalid.Authentication required · JSON RESPONSE+

{
  "code": "invalid_credentials",
  "message": "The bearer credential or RFC 9421 request signature is missing, expired, replayed, or invalid."
}

INTEGRATION DECISIONinvalid_credentials

CALLER ACTION: Discard the rejected credential, complete the documented authentication or reassertion flow, and rebuild any request signature with fresh timestamps and nonces.
RETRY SAFETY: Retry only with a newly valid credential and fresh replay-protection values. For one logical mutation, retain the same Idempotency-Key and byte-equivalent request. Never reuse that key for changed instructions.
STATE RECONCILIATION: Assume the outcome is unknown only when the connection failed after transmission; otherwise authentication failed before domain work. Re-read the wallet, intent, reservation, and transaction status on the same network; compare policy version, nonce, digest, and terminal receipt before another command.
ESCALATE WHEN: Escalate when funds, reservations, transaction digests, or MPC state remain ambiguous after authoritative wallet and network reconciliation.

403The credential lacks the required compliance:write or compliance:review scope.Authority or policy denied · JSON RESPONSE+

{
  "code": "insufficient_scope",
  "message": "The credential lacks the required compliance:write or compliance:review scope."
}

INTEGRATION DECISIONinsufficient_scope

CALLER ACTION: Verify the exact scope, tenant or workspace membership, owner boundary, step-up purpose, feature policy, and resource eligibility. Never broaden authority automatically.
RETRY SAFETY: Do not retry until the missing authority or policy condition has been deliberately resolved with least privilege.
STATE RECONCILIATION: Confirm the caller and resource resolve to the same authority boundary for owner-scoped wallet inventory, custody policy, balances, intents, reservations, transactions, and receipts.
ESCALATE WHEN: Escalate when funds, reservations, transaction digests, or MPC state remain ambiguous after authoritative wallet and network reconciliation.

409The Idempotency-Key conflicts with another request or the requested lifecycle transition is forbidden.State reconciliation required · JSON RESPONSE+

{
  "code": "transfer_compliance_conflict",
  "message": "The Idempotency-Key conflicts with another request or the requested lifecycle transition is forbidden."
}

INTEGRATION DECISIONtransfer_compliance_conflict

CALLER ACTION: Stop the mutation sequence and fetch the latest authoritative resource, lifecycle state, version, ETag, reservation, or existing idempotency result.
RETRY SAFETY: Retry only after reconciling the conflict. For one logical mutation, retain the same Idempotency-Key and byte-equivalent request. Never reuse that key for changed instructions.
STATE RECONCILIATION: Re-read the wallet, intent, reservation, and transaction status on the same network; compare policy version, nonce, digest, and terminal receipt before another command.
ESCALATE WHEN: Escalate when funds, reservations, transaction digests, or MPC state remain ambiguous after authoritative wallet and network reconciliation.

422An identifier, field, commitment, public key, evidence object, or Idempotency-Key is outside the documented contract.Request must change · JSON RESPONSE+

{
  "code": "invalid_transfer_compliance_command",
  "message": "An identifier, field, commitment, public key, evidence object, or Idempotency-Key is outside the documented contract."
}

INTEGRATION DECISIONinvalid_transfer_compliance_command

CALLER ACTION: Rebuild the request from the live OpenAPI operation and correct the rejected method, media type, header, parameter, or body field.
RETRY SAFETY: Do not retry the same invalid request. For one logical mutation, retain the same Idempotency-Key and byte-equivalent request. Never reuse that key for changed instructions.
STATE RECONCILIATION: Compare the submitted values with the documented constraints before another call. Re-read the wallet, intent, reservation, and transaction status on the same network; compare policy version, nonce, digest, and terminal receipt before another command.
ESCALATE WHEN: Escalate when funds, reservations, transaction digests, or MPC state remain ambiguous after authoritative wallet and network reconciliation.

503The authoritative Core transfer-compliance command boundary is unavailable.Dependency unavailable or outcome uncertain · JSON RESPONSE+

{
  "code": "transfer_compliance_unavailable",
  "message": "The authoritative Core transfer-compliance command boundary is unavailable."
}

INTEGRATION DECISIONtransfer_compliance_unavailable

CALLER ACTION: Preserve the exact request and treat the outcome as uncertain until authoritative state proves whether it committed.
RETRY SAFETY: Reconcile before retrying. For one logical mutation, retain the same Idempotency-Key and byte-equivalent request. Never reuse that key for changed instructions. Use bounded backoff with jitter.
STATE RECONCILIATION: Re-read the wallet, intent, reservation, and transaction status on the same network; compare policy version, nonce, digest, and terminal receipt before another command.
ESCALATE WHEN: Escalate when funds, reservations, transaction digests, or MPC state remain ambiguous after authoritative wallet and network reconciliation.

OPERATIONAL NOTES

Security and lifecycle guarantees

Complete and verify the possession challenge outside this endpoint, then submit only public references and commitments. The API cannot validate a raw signature because it deliberately never accepts one here.
A new valid proof supersedes the prior valid proof for the same primary vault and network. Re-read the portfolio before using proof_id in another workflow.
The returned proof_commitment is the canonical retained commitment and may differ from the supplied source commitment because Identity binds subject, vault, network, method, challenge, and source proof together.
Wallet-control posture proves neither beneficial ownership nor authority to transfer, trade, settle, publish, or activate traffic.

DOCUMENTATION STATUS

This route is implemented in canonical gateway source and appears in the production OpenAPI snapshot observed 2026-09-11T06:35:11.572Z. Authentication, tenant, feature, venue, and market policy still apply.

Verify the exact production OpenAPI operation ↗Return to the V2 directory ↗