> ## Documentation Index > Fetch the complete documentation index at: https://www.dynamic.xyz/docs/llms.txt > Use this file to discover all available pages before exploring further. # Server — export a WAAS wallet private key > Exports the private key of a WAAS wallet through an MPC ceremony. ## OpenAPI ````yaml https://app.dynamic.xyz/api-docs/public-api.yaml post /server/{environmentId}/waas/{walletId}/privateKey/export openapi: 3.0.1 info: title: Dashboard API description: Dashboard API documentation version: 1.0.0 servers: - url: https://app.dynamicauth.com/api/v0 - url: https://app.dynamic.xyz/api/v0 - url: http://localhost:3333/api/v0 security: [] tags: - name: Analytics description: Query usage analytics and event counts for your environment. - name: SDK description: SDK-facing endpoints consumed by embedded Dynamic clients. - name: Server description: Server-side SDK endpoints authenticated by environment API tokens. - name: Organizations description: >- Manage organizations — the top-level container for all environments and projects. - name: Projects description: Manage projects that group related environments under an organization. - name: Environments description: >- Manage environments (live and sandbox) where your authentication configuration lives. - name: Users description: List, search, and manage authenticated users within an environment. - name: Invites description: >- Manage invitation links that grant specific external users access to your environment. - name: Tokens description: >- Create and manage API tokens used to authenticate requests to the Dynamic API. - name: Origins description: >- Configure allowed origins (CORS) for SDK and API access to your environment. - name: Allowlists description: >- Manage allowlists to control which wallet addresses or email addresses can access your environment. - name: Wallets description: View and manage wallets linked to users in your environment. - name: Members description: Manage team members and their roles within an organization. - name: Sessions description: View and revoke active user sessions within an environment. - name: Settings description: Read and update environment-level configuration settings. - name: Exchanges description: >- Configure exchange integrations (Coinbase, Binance, etc.) for fiat on-ramp within your environment. - name: Yield description: List yield vaults registered for your environment. - name: Providers description: >- List, enable, disable, and configure authentication providers (OAuth, email, wallet, SMS, etc.) for your environment. - name: Captcha description: >- Configure captcha verification (provider, site key, secret key) for your environment. - name: Gates description: >- Define access gates that restrict environment entry to users who meet specific criteria. - name: Chains description: >- Manage the blockchain networks available for wallet connection in your environment. - name: Exports description: Export user and wallet data from your environment as downloadable files. - name: Events description: Browse the event log of actions performed within your environment. - name: Webhooks description: >- Create and manage webhooks to receive real-time events (user.created, wallet.linked, etc.) at your endpoint. - name: Custom Fields description: >- Define and manage custom metadata fields collected from users at sign-up or login. - name: MfaSettings description: >- Configure multi-factor authentication (MFA) policies for your organization. - name: Mfa description: Manage MFA enrollment and verification for individual users. - name: CustomHostnames description: >- Configure custom hostnames for white-labeling the Dynamic authentication experience. - name: TestAccount description: >- Manage test accounts used for automated testing and QA within an environment. - name: NameServices description: >- Configure name service integrations (ENS, Unstoppable Domains, etc.) for human-readable wallet addresses. - name: GlobalWallets description: >- Manage global wallets shared across multiple environments in an organization. - name: GlobalWalletConnections description: Configure which environments can access and use global wallets. - name: GlobalWalletAccessControl description: Control which users and roles can access and operate global wallets. - name: UserApiTokens description: >- Create and manage user-scoped API tokens for programmatic access on behalf of a user. - name: Waas description: Wallet-as-a-Service endpoints for creating and managing embedded wallets. - name: WalletConnect description: Configure WalletConnect integration settings for your environment. - name: Checkout description: >- Accept crypto payments and deposits from any wallet. Settle in any token you choose. - name: Flow description: >- Accept crypto payments, deposits, and withdrawals. Amount and destination are fixed server-side at create; the post-create lifecycle is driven with a capability session token. - name: FlowAnalytics description: >- Query aggregated analytics and paginated transaction lists for the Flow product. - name: Gasless description: >- Query billing summaries and paginated transaction lists for sponsored (gasless) transactions. - name: Custom Networks description: >- Add and manage custom EVM-compatible networks beyond the built-in chain list. - name: Chainalysis description: >- Configure Chainalysis integration for blockchain address screening and risk assessment. - name: Visits description: Track and query user visit activity within your environment. - name: ExternalJwt description: >- Configure external JWT providers so existing auth tokens can be used with Dynamic. - name: SDK Views description: >- Manage SDK view configurations that customize the appearance of Dynamic modals and flows. - name: DeeplinkUrls description: Configure deep link URLs for mobile app integration with the Dynamic SDK. - name: OrganizationSettings description: >- Read and update organization-level settings such as approval workflow configuration. - name: AdminActions description: >- Manage admin action requests that require approval from another administrator. - name: ClientGrant description: | OAuth 2.0 Device Authorization Grant flow (RFC 8628) used by first-party Dynamic clients (CLI, MCP server, demo apps, IDE plugins) to obtain a revocable, 30-day client JWT without ever seeing the user's dashboard session token. - name: AuthorizedClients description: | Manage first-party clients (CLI / MCP / demo / IDE plugins) authorized to act as a dashboard user. Surfaced under Profile → Authorized Clients. - name: Kyb description: >- Verify a business's identity via AI Prise passthrough and check KYB tier status. - name: BusinessAccounts description: >- Administer the business accounts (multi-operator wallet containers) that end users create in an environment. - name: ScreeningPolicies description: > Author per-provider address screening policies that map TRM and Chainalysis signals to block, alert, or allow, plus per-address exceptions. The sanctions floor sits underneath every policy and is not configurable. paths: /server/{environmentId}/waas/{walletId}/privateKey/export: post: tags: - Server summary: Server — export a WAAS wallet private key description: Exports the private key of a WAAS wallet through an MPC ceremony. operationId: exportPrivateKeyServer parameters: - $ref: '#/components/parameters/environmentId' - $ref: '#/components/parameters/walletId' - $ref: '#/components/parameters/serverSignerProofHeader' requestBody: description: Export Private Key Request required: true content: application/json: schema: $ref: '#/components/schemas/ExportWaasWalletPrivateKeyRequest' responses: '200': description: > Successfully created a room for wallet private key export ceremony. Streamed as `text/event-stream` (NOT JSON) by default; the JSON body is returned only when the HTTP transport is selected. content: application/json: schema: $ref: '#/components/schemas/OpenRoomResponseWithServerKeygenIds' text/event-stream: schema: type: string '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '409': $ref: '#/components/responses/Conflict' '500': $ref: '#/components/responses/InternalServerError' components: parameters: environmentId: in: path name: environmentId required: true description: ID of the environment schema: $ref: '#/components/schemas/uuid' walletId: in: path name: walletId schema: $ref: '#/components/schemas/uuid' required: true description: UUID of the wallet serverSignerProofHeader: in: header name: x-dyn-server-signing-proof required: false description: >- Request proof: a compact ES256 JWS, signed with the server's registered key, binding this request to a single-use `nonce` from `GET /nonces`. The JWS header is `ServerSignerProofHeader` and its payload is `ServerSignerProofPayload`. Required when the request carries a DYN API token and no JWT, and a server signer with a registered key controls the resource. A proof that is present is always verified. schema: type: string pattern: ^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$ maxLength: 4096 schemas: ExportWaasWalletPrivateKeyRequest: type: object required: - exportId properties: exportId: description: Unique identifier for the export session type: string addressType: description: Address derivation type of the wallet to export type: string proposalId: allOf: - $ref: '#/components/schemas/uuid' description: >- The approved export proposal being redeemed. Required when the wallet's policy requires approvals to export; the export call returns it once the proposal is open. approvalQuorum: $ref: '#/components/schemas/WaasExportApprovalQuorum' shareSetId: allOf: - $ref: '#/components/schemas/uuid' description: | Optional identifier of the share set this operation targets. When omitted, the active rootUser share set for `walletId` is resolved server-side (backwards-compat fallback for older SDKs). OpenRoomResponseWithServerKeygenIds: allOf: - $ref: '#/components/schemas/OpenRoomResponse' - type: object required: - serverKeygenIds properties: accountAddress: description: Public address of the wallet produced by this ceremony. type: string encryptedWalletApiKey: allOf: - $ref: '#/components/schemas/EncryptedWalletApiKey' description: > Present only on a create that set `delegateToProjectEnvironment`. Inherited by RefreshKeySharesResponse through this schema, where it is never set. shareSetId: allOf: - $ref: '#/components/schemas/uuid' description: Identifier of the new share set produced by this ceremony. shareSetType: $ref: '#/components/schemas/WaasWalletShareSetType' uuid: type: string pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ minLength: 36 maxLength: 36 example: 95b11417-f18f-457f-8804-68e361f9164f WaasExportApprovalQuorum: type: object description: >- The initiator's signed export Intent, sent with the export call. When the wallet's policy needs approvals, the call answers with a proposal to approve instead of starting the export. required: - intent - intentSignature properties: intent: $ref: '#/components/schemas/WaasExportIntent' intentSignature: $ref: '#/components/schemas/BusinessAccountIntentSignature' OpenRoomResponse: type: object required: - roomId properties: roomId: description: Unique identifier of the opened MPC room type: string serverKeygenIds: description: List of existing server-side key generation identifiers type: array items: $ref: '#/components/schemas/NonEmptyBase58StringWith100MaxLength' newServerKeygenIds: description: List of newly generated server-side key generation identifiers type: array items: $ref: '#/components/schemas/NonEmptyBase58StringWith100MaxLength' walletId: $ref: '#/components/schemas/uuid' EncryptedWalletApiKey: type: object description: > A payload sealed by the enclave to the environment's delegated-access RSA public key (HYBRID-RSA-AES-256). Only the developer's private key opens it; redcoast stores and relays it without ever resolving the contents. Structurally identical to DelegatedShareDeliveryRequest's inline `encryptedDelegatedShare` below — the two should be merged into this one the next time the generated `DelegatedShareDeliveryRequestEncryptedDelegatedShare` type can be renamed across its call sites. required: - alg - iv - ct - tag - ek properties: alg: $ref: '#/components/schemas/NonEmptyStringWith255MaxLength' iv: $ref: '#/components/schemas/NonEmptyStringWith255MaxLength' ct: $ref: '#/components/schemas/NonEmptyStringWith4096MaxLength' tag: $ref: '#/components/schemas/NonEmptyStringWith255MaxLength' ek: $ref: '#/components/schemas/NonEmptyStringWith4096MaxLength' kid: $ref: '#/components/schemas/NonEmptyStringWith255MaxLength' WaasWalletShareSetType: type: string enum: - delegated - rootUser - server - businessAccountUser - offlineRecovery description: The role this share set plays for the wallet BadRequest: type: object properties: error: description: Human-readable error message type: string code: description: >- Machine-readable reason for the 400, set only by endpoints that distinguish rejections. Flow endpoints use exchange_not_supported and exchange_currency_unsupported. type: string example: exchange_currency_unsupported Unauthorized: type: object properties: error: description: Human-readable error message describing the authentication failure type: string example: No jwt provided! Forbidden: type: object properties: error: description: Human-readable error message type: string example: Access Forbidden code: description: >- Machine-readable reason for the 403, set only by endpoints that distinguish rejections. Flow endpoints use sanctions_blocked, session_token_invalid and risk_blocked. type: string example: sanctions_blocked Conflict: type: object properties: error: description: Human-readable error message type: string example: 'Conflict: invalid state transition' InternalServerError: type: object properties: error: description: Human-readable error message type: string example: Internal Server Error WaasExportIntent: type: object additionalProperties: true description: >- The client-created export Intent. The enclave checks it against the export request. required: - intentId - businessAccountId - accountAddress - actionType - initiatorUserId - createdAt - completeBy - operation properties: intentId: $ref: '#/components/schemas/uuid' businessAccountId: $ref: '#/components/schemas/uuid' accountAddress: $ref: '#/components/schemas/WalletPublicKey' actionType: type: string enum: - waasExportQuorumApprove initiatorUserId: $ref: '#/components/schemas/uuid' createdAt: type: string description: Signed timestamp preserved as an ISO string. completeBy: type: string description: Signed deadline preserved as an ISO string. operation: type: object additionalProperties: true required: - kind - restriction - exportId properties: kind: type: string enum: - export restriction: type: string enum: - blockExport exportId: type: string BusinessAccountIntentSignature: type: string pattern: ^[0-9a-fA-F]{128}$ description: > Hex-encoded ECDSA P-256 signature over the canonicalized payload, produced by the signer's session key — which never leaves their device, so consent cannot be given on their behalf. Exactly 128 hex characters. WebCrypto emits the raw r‖s form with both halves padded to 32 bytes, so unlike DER the length never varies. Constrained here so a malformed value is a 400 at the edge rather than an enclave round trip that returns INTENT_SIGNATURE_INVALID, and so an unbounded string cannot be persisted against a proposal. NonEmptyBase58StringWith100MaxLength: type: string pattern: ^[1-9A-HJ-NP-Za-km-z]+$ maxLength: 100 description: A base58 string with a max length of 100 characters NonEmptyStringWith255MaxLength: type: string pattern: ^(?=\S)[\p{L}\p{N}a-zA-Z _.,:!?&%@\/+\-'|]+(?<=\S)$ maxLength: 255 example: An example name NonEmptyStringWith4096MaxLength: type: string maxLength: 4096 description: A string with a max length of 4096 characters WalletPublicKey: type: string pattern: ^[A-Za-z0-9_-]{18,100}$ description: >- Valid blockchain wallet address, must be an alphanumeric string (underscores allowed for chains like Midnight, hyphens allowed for chains using base64url-encoded addresses like TON) example: '0xbF394748301603f18d953C90F0b087CBEC0E1834' maxLength: 255 responses: BadRequest: description: Bad Request content: application/json: schema: $ref: '#/components/schemas/BadRequest' Unauthorized: description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/Unauthorized' Forbidden: description: Forbidden content: application/json: schema: $ref: '#/components/schemas/Forbidden' Conflict: description: Conflict content: application/json: schema: $ref: '#/components/schemas/Conflict' InternalServerError: description: Internal Server Error content: application/json: schema: $ref: '#/components/schemas/InternalServerError' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.