Build Token-2022 confidential-transfer transactions
Decrypts the wallet’s stored confidential seed inside the enclave, generates the zero-knowledge proofs the requested operation requires, builds the Token-2022 confidential-transfer instructions and returns the transactions unsigned (the wallet’s signature slot is zeroed) in broadcast order, plus a transactionsTag binding them.
Signing is a separate step: submit the transactions and tag unchanged to POST /waas/{walletId}/signConfidentialTransactions, which co-signs inside caller-visible MPC rooms.
The enclave is offline: the caller supplies the token accounts’ raw on-chain state (accountState, destinationAccountState), the cluster rent constant (lamportsPerByte) and a fresh recentBlockhash/lastValidBlockHeight. Confidential amounts are opaque on-chain — policy screens the operation, mint and addresses but cannot evaluate the transferred amount.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
ID of the environment
36^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"95b11417-f18f-457f-8804-68e361f9164f"
UUID of the wallet
36^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"95b11417-f18f-457f-8804-68e361f9164f"
Body
Solana address (base58 public key) whose confidential seed signs the operation. The seed must already exist (see POST /waas/{walletId}/confidentialSeed).
^[1-9A-HJ-NP-Za-km-z]{32,44}$The Token-2022 confidential-transfer operation to build and sign.
configureAccount, deposit, transfer, applyPendingBalance, withdraw The Token-2022 mint.
^[1-9A-HJ-NP-Za-km-z]{32,44}$The source confidential-capable token account.
^[1-9A-HJ-NP-Za-km-z]{32,44}$Current cluster rent constant in lamports per byte (e.g. 6333), used to compute rent exemption for the proof accounts. This is the per-byte rate, not the per-account total returned by getMinimumBalanceForRentExemption.
^[0-9]+$SVM cluster identifier (genesis hash), binding the transaction to one cluster.
A recent blockhash (or durable-nonce value) fetched moments before invoking, since the enclave is offline and cannot reach Solana RPC.
The last valid block height paired with recentBlockhash.
^[0-9]+$Version of the stored seed to sign with. Defaults to the newest stored version; must match the version active on the confidential token account.
x >= 1Required for transfer: the recipient's confidential-capable token account for the same mint.
^[1-9A-HJ-NP-Za-km-z]{32,44}$Required for deposit, transfer and withdraw: the token amount in base units, decimal-encoded (u64).
^[0-9]+$The mint's decimals, required for deposit and withdraw. Read from the mint account by the caller.
0 <= x <= 255The mint's confidential-transfer auditor ElGamal public key, when configured. Read from the mint account by the caller; omit when the mint has no auditor.
^[1-9A-HJ-NP-Za-km-z]{32,44}$The account that pays transaction fees. Defaults to solanaAddress.
^[1-9A-HJ-NP-Za-km-z]{32,44}$Raw on-chain state of a Token-2022 account, read via getAccountInfo (base64 encoding) and relayed to the enclave, which is offline and cannot reach Solana RPC.
Raw on-chain state of a Token-2022 account, read via getAccountInfo (base64 encoding) and relayed to the enclave, which is offline and cannot reach Solana RPC.
Response
Unsigned transactions and their binding tag, ready for the sign step
Base64-encoded v1 transaction carrying the operation with its ZK proofs inlined. The wallet's signature slot is zeroed; sign it through POST /waas/{walletId}/signConfidentialTransactions.
1 elementEnclave-issued authentication tag binding the wallet, operation, mint, token accounts, amount and the hash of every emitted message, with a short expiry. Submit it unchanged with serializedTransactions to POST /waas/{walletId}/signConfidentialTransactions.