Server — decrypt a Token-2022 confidential token account's balances
Decrypts the wallet’s stored confidential seed inside the enclave and uses the derived ElGamal key to decrypt the available and pending confidential balance ciphertexts on the token account. Stateless — nothing is signed and no transaction is produced. The caller supplies the token account’s raw on-chain state; the enclave is offline and cannot reach Solana RPC.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Headers
Request proof: a compact ES256 JWS, signed with the server's registered key, binding this request to a single-use nonce from GET /nonces. The JWS header is ServerSignerProofHeader and its payload is ServerSignerProofPayload. Required when the request carries a DYN API token and no JWT, and a server signer with a registered key controls the resource. A proof that is present is always verified.
4096^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$Path Parameters
ID of the environment
36^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"95b11417-f18f-457f-8804-68e361f9164f"
UUID of the wallet
36^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"95b11417-f18f-457f-8804-68e361f9164f"
Body
Solana address (base58 public key) whose stored confidential seed decrypts the balances. The seed must already exist (see POST /waas/{walletId}/confidentialSeed or the PUT variant).
^[1-9A-HJ-NP-Za-km-z]{32,44}$The confidential-capable token account to read.
^[1-9A-HJ-NP-Za-km-z]{32,44}$The Token-2022 mint.
^[1-9A-HJ-NP-Za-km-z]{32,44}$Raw on-chain state of a Token-2022 account, read via getAccountInfo (base64 encoding) and relayed to the enclave, which is offline and cannot reach Solana RPC.
Version of the stored seed to decrypt with. Defaults to the newest stored version; must match the version active on the confidential token account.
x >= 1Response
The decrypted confidential balances
The decrypted available confidential balance of the token account, in base units, decimal-encoded (u64).
^[0-9]+$The decrypted pending confidential balance of the token account, in base units, decimal-encoded (u64).
^[0-9]+$