Decrypt a Token-2022 confidential token account's balances
Decrypts the wallet’s stored confidential seed inside the enclave and uses the derived ElGamal key to decrypt the available and pending confidential balance ciphertexts on the token account. Stateless — nothing is signed and no transaction is produced.
The enclave is offline: the caller supplies the token account’s raw on-chain state (accountState) read via getAccountInfo moments before invoking.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
ID of the environment
36^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"95b11417-f18f-457f-8804-68e361f9164f"
UUID of the wallet
36^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"95b11417-f18f-457f-8804-68e361f9164f"
Body
Solana address (base58 public key) whose stored confidential seed decrypts the balances. The seed must already exist (see POST /waas/{walletId}/confidentialSeed or the PUT variant).
^[1-9A-HJ-NP-Za-km-z]{32,44}$The confidential-capable token account to read.
^[1-9A-HJ-NP-Za-km-z]{32,44}$The Token-2022 mint.
^[1-9A-HJ-NP-Za-km-z]{32,44}$Raw on-chain state of a Token-2022 account, read via getAccountInfo (base64 encoding) and relayed to the enclave, which is offline and cannot reach Solana RPC.
Version of the stored seed to decrypt with. Defaults to the newest stored version; must match the version active on the confidential token account.
x >= 1Response
The decrypted confidential balances
The decrypted available confidential balance of the token account, in base units, decimal-encoded (u64).
^[0-9]+$The decrypted pending confidential balance of the token account, in base units, decimal-encoded (u64).
^[0-9]+$