Skip to Content
DevelopersAPI ReferencePolicies

Policies

Policies — whitelists, transaction limits, and approval quorums — govern every transfer, including API-initiated ones.

Policy configuration (creating and editing rules, approving whitelist entries, setting limits) is performed in the dashboard, where changes go through the platform’s governance flow (second-admin approval, step-up MFA, audit logging). It is not part of the public Client API. See the Policy Engine documentation.

How policies affect API transfers

When you create a transfer via the API, the policy engine evaluates it before anything is signed:

  1. Address whitelist — the destination must be an approved address.
  2. Transaction limit — the amount must be within the per-transaction cap.
  3. Approval quorum — if the matching policy requires approvals, the required number of approvals is collected from eligible users before signing.

A transfer blocked by a policy is rejected with status REJECTED_BY_POLICY (or NO_POLICY_FOUND when nothing matches, under default-deny); nothing reaches the signers.

Temporary whitelist addresses

The one policy operation available via the API — add a temporary whitelist entry for a destination address:

POST /v1/profiles/{profile_id}/whitelists/temp-addresses

Requires an Idempotency_key header (UUID).

{
  "address": "0x1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b",
  "blockchain_id": "8b2e6f10-4c3d-4e5f-9a1b-2c3d4e5f6a7b"
}

Temporary entries follow the governance rules configured for your profile — depending on configuration they may still require an in-dashboard approval before becoming active, and they expire automatically.

TransfersUsers