Skip to main content
POST
Server — build and sign a Token-2022 confidential transfer

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

x-dyn-server-signing-proof
string

Request proof: a compact ES256 JWS, signed with the server's registered key, binding this request to a single-use nonce from GET /nonces. The JWS header is ServerSignerProofHeader and its payload is ServerSignerProofPayload. Required when the request carries a DYN API token and no JWT, and a server signer with a registered key controls the resource. A proof that is present is always verified.

Maximum string length: 4096
Pattern: ^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$

Path Parameters

environmentId
string
required

ID of the environment

Required string length: 36
Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
Example:

"95b11417-f18f-457f-8804-68e361f9164f"

walletId
string
required

UUID of the wallet

Required string length: 36
Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
Example:

"95b11417-f18f-457f-8804-68e361f9164f"

Body

application/json
solanaAddress
string
required

Solana address (base58 public key) whose confidential seed signs the operation. The seed must already exist (see POST /waas/{walletId}/confidentialSeed or the PUT variant).

Pattern: ^[1-9A-HJ-NP-Za-km-z]{32,44}$
operation
enum<string>
required

The Token-2022 confidential-transfer operation to build and sign.

Available options:
configureAccount,
deposit,
transfer,
applyPendingBalance,
withdraw
mint
string
required

The Token-2022 mint.

Pattern: ^[1-9A-HJ-NP-Za-km-z]{32,44}$
tokenAccount
string
required

The source confidential-capable token account.

Pattern: ^[1-9A-HJ-NP-Za-km-z]{32,44}$
lamportsPerByte
string
required

Current cluster rent constant in lamports per byte (e.g. 6333), used to compute rent exemption for the proof accounts. This is the per-byte rate, not the per-account total returned by getMinimumBalanceForRentExemption.

Pattern: ^[0-9]+$
chainId
string
required

SVM cluster identifier (genesis hash), binding the transaction to one cluster.

recentBlockhash
string
required

A recent blockhash (or durable-nonce value) fetched moments before invoking, since the enclave is offline and cannot reach Solana RPC.

lastValidBlockHeight
string
required

The last valid block height paired with recentBlockhash.

Pattern: ^[0-9]+$
derivationVersion
integer

Version of the stored seed to sign with. Defaults to the newest stored version; must match the version active on the confidential token account.

Required range: x >= 1
destinationTokenAccount
string

Required for transfer: the recipient's confidential-capable token account for the same mint.

Pattern: ^[1-9A-HJ-NP-Za-km-z]{32,44}$
amount
string

Required for deposit, transfer and withdraw: the token amount in base units, decimal-encoded (u64).

Pattern: ^[0-9]+$
decimals
integer

The mint's decimals, required for deposit and withdraw. Read from the mint account by the caller.

Required range: 0 <= x <= 255
auditorElgamalPubkey
string

The mint's confidential-transfer auditor ElGamal public key, when configured. Read from the mint account by the caller; omit when the mint has no auditor.

Pattern: ^[1-9A-HJ-NP-Za-km-z]{32,44}$
feePayer
string

The account that pays transaction fees. Defaults to solanaAddress.

Pattern: ^[1-9A-HJ-NP-Za-km-z]{32,44}$
accountState
object

Raw on-chain state of a Token-2022 account, read via getAccountInfo (base64 encoding) and relayed to the enclave, which is offline and cannot reach Solana RPC.

destinationAccountState
object

Raw on-chain state of a Token-2022 account, read via getAccountInfo (base64 encoding) and relayed to the enclave, which is offline and cannot reach Solana RPC.

Response

Signed transactions, ready to broadcast

serializedTransactions
string[]
required

Base64-encoded signed transactions in broadcast order: proof verification, execution, then proof-account closures.

Minimum array length: 1
signatures
string[]
required

Base58-encoded ed25519 signature over each transaction — the transaction id once confirmed, in the same order as serializedTransactions.

Minimum array length: 1