> ## Documentation Index > Fetch the complete documentation index at: https://www.dynamic.xyz/docs/llms.txt > Use this file to discover all available pages before exploring further. # Update the environment-Layer's Rules by ruleId > Applies a single per-Rule upsert or remove operation, or, with op set to batch, an operations array of 1-100 upsert/remove entries applied atomically in one enclave cycle, or, with op set to replace, a full rules list that replaces the Layer's Rules, to the environment Composition Layer. ruleId may be omitted on an upsert; the enclave then mints one and returns it in the response's layerContent.rules. PUT remains the whole-list write. ## OpenAPI ````yaml https://app.dynamic.xyz/api-docs/public-api.yaml patch /environments/{environmentId}/waas/policies/env-layer openapi: 3.0.1 info: title: Dashboard API description: Dashboard API documentation version: 1.0.0 servers: - url: https://app.dynamicauth.com/api/v0 - url: https://app.dynamic.xyz/api/v0 - url: http://localhost:3333/api/v0 security: [] tags: - name: Analytics description: Query usage analytics and event counts for your environment. - name: SDK description: SDK-facing endpoints consumed by embedded Dynamic clients. - name: Server description: Server-side SDK endpoints authenticated by environment API tokens. - name: Organizations description: >- Manage organizations — the top-level container for all environments and projects. - name: Projects description: Manage projects that group related environments under an organization. - name: Environments description: >- Manage environments (live and sandbox) where your authentication configuration lives. - name: Users description: List, search, and manage authenticated users within an environment. - name: Invites description: >- Manage invitation links that grant specific external users access to your environment. - name: Tokens description: >- Create and manage API tokens used to authenticate requests to the Dynamic API. - name: Origins description: >- Configure allowed origins (CORS) for SDK and API access to your environment. - name: Allowlists description: >- Manage allowlists to control which wallet addresses or email addresses can access your environment. - name: Wallets description: View and manage wallets linked to users in your environment. - name: Members description: Manage team members and their roles within an organization. - name: Sessions description: View and revoke active user sessions within an environment. - name: Settings description: Read and update environment-level configuration settings. - name: Exchanges description: >- Configure exchange integrations (Coinbase, Binance, etc.) for fiat on-ramp within your environment. - name: Yield description: List yield vaults registered for your environment. - name: Providers description: >- List, enable, disable, and configure authentication providers (OAuth, email, wallet, SMS, etc.) for your environment. - name: Captcha description: >- Configure captcha verification (provider, site key, secret key) for your environment. - name: Gates description: >- Define access gates that restrict environment entry to users who meet specific criteria. - name: Chains description: >- Manage the blockchain networks available for wallet connection in your environment. - name: Exports description: Export user and wallet data from your environment as downloadable files. - name: Events description: Browse the event log of actions performed within your environment. - name: Webhooks description: >- Create and manage webhooks to receive real-time events (user.created, wallet.linked, etc.) at your endpoint. - name: Custom Fields description: >- Define and manage custom metadata fields collected from users at sign-up or login. - name: MfaSettings description: >- Configure multi-factor authentication (MFA) policies for your organization. - name: Mfa description: Manage MFA enrollment and verification for individual users. - name: CustomHostnames description: >- Configure custom hostnames for white-labeling the Dynamic authentication experience. - name: TestAccount description: >- Manage test accounts used for automated testing and QA within an environment. - name: NameServices description: >- Configure name service integrations (ENS, Unstoppable Domains, etc.) for human-readable wallet addresses. - name: GlobalWallets description: >- Manage global wallets shared across multiple environments in an organization. - name: GlobalWalletConnections description: Configure which environments can access and use global wallets. - name: GlobalWalletAccessControl description: Control which users and roles can access and operate global wallets. - name: UserApiTokens description: >- Create and manage user-scoped API tokens for programmatic access on behalf of a user. - name: Waas description: Wallet-as-a-Service endpoints for creating and managing embedded wallets. - name: WalletConnect description: Configure WalletConnect integration settings for your environment. - name: Checkout description: >- Accept crypto payments and deposits from any wallet. Settle in any token you choose. - name: Flow description: >- Accept crypto payments, deposits, and withdrawals. Amount and destination are fixed server-side at create; the post-create lifecycle is driven with a capability session token. - name: FlowAnalytics description: >- Query aggregated analytics and paginated transaction lists for the Flow product. - name: Gasless description: >- Query billing summaries and paginated transaction lists for sponsored (gasless) transactions. - name: Custom Networks description: >- Add and manage custom EVM-compatible networks beyond the built-in chain list. - name: Chainalysis description: >- Configure Chainalysis integration for blockchain address screening and risk assessment. - name: Visits description: Track and query user visit activity within your environment. - name: ExternalJwt description: >- Configure external JWT providers so existing auth tokens can be used with Dynamic. - name: SDK Views description: >- Manage SDK view configurations that customize the appearance of Dynamic modals and flows. - name: DeeplinkUrls description: Configure deep link URLs for mobile app integration with the Dynamic SDK. - name: OrganizationSettings description: >- Read and update organization-level settings such as approval workflow configuration. - name: AdminActions description: >- Manage admin action requests that require approval from another administrator. - name: ClientGrant description: | OAuth 2.0 Device Authorization Grant flow (RFC 8628) used by first-party Dynamic clients (CLI, MCP server, demo apps, IDE plugins) to obtain a revocable, 30-day client JWT without ever seeing the user's dashboard session token. - name: AuthorizedClients description: | Manage first-party clients (CLI / MCP / demo / IDE plugins) authorized to act as a dashboard user. Surfaced under Profile → Authorized Clients. - name: Kyb description: >- Verify a business's identity via AI Prise passthrough and check KYB tier status. - name: BusinessAccounts description: >- Administer the business accounts (multi-operator wallet containers) that end users create in an environment. - name: ScreeningPolicies description: > Author per-provider address screening policies that map TRM and Chainalysis signals to block, alert, or allow, plus per-address exceptions. The sanctions floor sits underneath every policy and is not configurable. paths: /environments/{environmentId}/waas/policies/env-layer: patch: tags: - Waas summary: Update the environment-Layer's Rules by ruleId description: >- Applies a single per-Rule upsert or remove operation, or, with op set to batch, an operations array of 1-100 upsert/remove entries applied atomically in one enclave cycle, or, with op set to replace, a full rules list that replaces the Layer's Rules, to the environment Composition Layer. ruleId may be omitted on an upsert; the enclave then mints one and returns it in the response's layerContent.rules. PUT remains the whole-list write. operationId: updateWaasEnvPolicyLayerRules parameters: - $ref: '#/components/parameters/environmentId' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/WaasPolicyLayerUpdateRequest' responses: '200': description: Environment-Layer updated content: application/json: schema: $ref: '#/components/schemas/WaasPolicyLayerResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalServerError' components: parameters: environmentId: in: path name: environmentId required: true description: ID of the environment schema: $ref: '#/components/schemas/uuid' schemas: WaasPolicyLayerUpdateRequest: type: object required: - op properties: op: type: string enum: - upsert - remove - batch - replace description: >- The per-Rule operation to apply to the wallet-Layer, batch to apply multiple operations atomically in one enclave cycle, or replace to set the Layer's full Rule list rule: $ref: '#/components/schemas/WaasPolicyRule' declarativeRule: $ref: '#/components/schemas/WaasPolicyDeclarativeRuleInput' ruleId: $ref: '#/components/schemas/uuid' operations: type: array minItems: 1 maxItems: 100 description: Only used when op is batch — applied atomically in one enclave cycle items: $ref: '#/components/schemas/WaasPolicyLayerRuleOperation' rules: type: array maxItems: 200 description: >- Only used when op is replace — the Layer's full Rule list, in either syntax. A declarative Rule sent without a ruleId is given one. Only admins and business-account admins may replace. items: $ref: '#/components/schemas/WaasPolicyLayerRuleInput' WaasPolicyLayerResponse: type: object required: - layerId - layerContent - updatedAt properties: message: type: string description: Message describing the operation result layerId: type: string description: Unique identifier for the wallet-Layer layerContent: type: object description: The decrypted, mutated wallet-Layer document properties: rules: type: array description: >- The Layer's Rules, in whichever syntax it holds — legacy (WaasPolicyLayerResponseRule) or the policy rule language (WaasPolicyDeclarativeRule). Free-form for the same reason the request side is: which syntax a Layer may hold, and that it holds only one, are the enclave's checks, not this contract's. Pinning the legacy shape here would make a successful write of a declarative Layer return a body that violates its own response schema. items: type: object updatedAt: description: ISO 8601 timestamp of when the wallet-Layer was last updated type: string format: date-time uuid: type: string pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ minLength: 36 maxLength: 36 example: 95b11417-f18f-457f-8804-68e361f9164f WaasPolicyRule: type: object required: - name - ruleType - chain properties: ruleId: $ref: '#/components/schemas/uuid' name: type: string description: Human-readable name for the rule ruleType: $ref: '#/components/schemas/WaasPolicyRuleType' address: description: Target address EVM or SVM (legacy field) anyOf: - $ref: '#/components/schemas/WalletPublicKey' - $ref: '#/components/schemas/SolanaPublicKey' deprecated: true addresses: description: Target address(es) EVM or SVM type: array items: anyOf: - $ref: '#/components/schemas/WalletPublicKey' - $ref: '#/components/schemas/SolanaPublicKey' chain: $ref: '#/components/schemas/WaasChainEnum' chainId: type: number description: Chain ID for the policy rule (legacy field) chainIds: description: Chain IDs for the policy rule type: array items: type: number contractAbi: type: array description: Contract ABI interface items: type: object functionName: type: string description: Specific function name to permit/deny argumentConstraints: type: array items: $ref: '#/components/schemas/WaasPolicyArgumentConstraint' description: Validation rules for function arguments valueLimit: type: object description: Value limits for the policy rule properties: asset: description: >- Target asset address. If undefined, refers to native token (e.g., ETH) anyOf: - $ref: '#/components/schemas/WalletPublicKey' - $ref: '#/components/schemas/SolanaPublicKey' maxPerCall: type: string description: Maximum value per function call (as string to handle bigint) pattern: ^[0-9]+$ totalLimit: type: string description: Cumulative value limit (as string to handle bigint) pattern: ^[0-9]+$ operationRestrictions: type: object description: Operation-level restrictions for the wallet properties: blockExport: type: boolean description: Block private key export blockRevocation: type: boolean description: Block end-user revocation of delegated access blockClientSigning: type: boolean description: Block all end-user signing (not delegated) disableBlockaidSecurityChecks: type: boolean description: >- When true, disables Blockaid security enforcement for this rule. Blockaid simulation will still run for policy evaluation, but security verdicts (e.g., malicious transactions) will not block execution. Transaction approval will be determined solely by customer-defined policy rules. Use with caution as this bypasses automated security protections. modifiableBySigner: type: boolean description: >- When true, a Signer is permitted to modify this Rule. Cannot be combined with operationRestrictions or disableBlockaidSecurityChecks on the same Rule. approvalRequirements: type: array description: >- Multi-party approval requirements for this Rule. Enforced only for accounts that support them; ignored for other accounts. when.initiatorRole and when.actionTypes are not yet resolved — until they are, a requirement that sets either field applies to all approvers, not just the named role. items: type: object required: - v - id - requiredApprovals properties: v: type: number description: >- Schema version for this requirement. An unknown value rejects the Composition. id: type: string description: >- Stable handle for this requirement, carried as requirementId in the deny reason. when: type: object description: >- All present conditions AND together. Omit for an unconditional requirement. properties: minValue: type: object description: The amount at which this requirement starts to apply. properties: asset: description: >- Target asset address. If undefined, refers to native token (e.g., ETH) anyOf: - $ref: '#/components/schemas/WalletPublicKey' - $ref: '#/components/schemas/SolanaPublicKey' amount: type: string description: Threshold amount (as string to handle bigint) pattern: ^[0-9]+$ initiatorRole: type: object description: >- Matches on the user who starts the action. Not yet resolved — until it is, a requirement that sets this field applies to all initiators. properties: roles: type: array items: type: string userIds: type: array items: type: string actionTypes: type: array description: >- Matches on the operation type. Not yet resolved — until it is, a requirement that sets this field applies to all operation types. items: type: string eligibleApproverRoles: type: array items: type: string description: >- Names of the roles whose holders may satisfy this requirement. A holder of any listed role may approve. An empty array means no restriction. mandatoryApproverRoles: type: array items: type: string description: >- Names of the roles that must each be represented among the approvers, regardless of eligibleApproverRoles. An empty array means none. requiredApprovals: type: number description: Total approvals required. Never counts the Initiator. completeWithinSeconds: type: number description: How long a collected-approvals proposal remains valid. WaasPolicyDeclarativeRuleInput: type: object description: >- A Rule authored in the policy rule language, evaluated by the engine as stored rather than compiled from WaasPolicyRule. Shares identity and authorship with a legacy Rule so the Layer machinery — deletion markers, authorship stamping, the edit guard — keys on the same fields and needs no second code path for anything but evaluation. A Layer holds one syntax or the other: a write that would leave both in one Layer is refused. required: - phase - when - then properties: ruleId: $ref: '#/components/schemas/uuid' name: type: string description: Human-readable name for the rule phase: type: string description: >- Which question this Rule answers. A Layer is one flat list, so the phase travels on the Rule rather than being implied by its position. enum: - transaction - operation when: type: object description: >- Condition in the policy rule language, validated against the field catalog on write and again on read then: $ref: '#/components/schemas/WaasPolicyAction' approvalRequirements: type: array description: >- The approvals a matching transaction needs. Required when then is REQUIRE_APPROVAL and refused on any other action. A deny in the same Layer wins first; otherwise every REQUIRE_APPROVAL Rule whose when holds, or cannot be decided, applies. A message or raw sign has no transaction to test, so every such Rule applies. Enforced only for business-account wallets. Valid on business-account, wallet and signer Layers and refused on the environment Layer. Only admins and business-account admins may author one. May not read spendWindows. items: $ref: '#/components/schemas/WaasPolicyDeclarativeApprovalRequirement' modifiableBySigner: type: boolean description: When true, a Signer may adjust this Rule within its recognised shape WaasPolicyLayerRuleOperation: type: object required: - op properties: op: type: string enum: - upsert - remove description: The per-Rule operation to apply within a batch rule: $ref: '#/components/schemas/WaasPolicyRule' declarativeRule: $ref: '#/components/schemas/WaasPolicyDeclarativeRuleInput' ruleId: $ref: '#/components/schemas/uuid' WaasPolicyLayerRuleInput: anyOf: - $ref: '#/components/schemas/WaasPolicyRule' - $ref: '#/components/schemas/WaasPolicyDeclarativeRuleInput' BadRequest: type: object properties: error: description: Human-readable error message type: string code: description: >- Machine-readable reason for the 400, set only by endpoints that distinguish rejections. type: string example: exchange_currency_unsupported Unauthorized: type: object properties: error: description: Human-readable error message describing the authentication failure type: string example: No jwt provided! Forbidden: type: object properties: error: description: Human-readable error message type: string example: Access Forbidden code: description: >- Machine-readable reason for the 403, set only by endpoints that distinguish rejections. Flow endpoints use sanctions_blocked, session_token_invalid and risk_blocked. type: string example: sanctions_blocked NotFound: type: object required: - error - code properties: error: description: Human-readable error message type: string example: Not Found code: description: >- Machine-readable error code. Flow endpoints use exchange_not_configured when the requested exchange isn't set up for the environment. type: string example: not_found InternalServerError: type: object properties: error: description: Human-readable error message type: string example: Internal Server Error WaasPolicyRuleType: type: string enum: - allow - deny description: Whether the rule permits or denies the specified action WalletPublicKey: type: string pattern: ^[A-Za-z0-9_-]{18,100}$ description: >- Valid blockchain wallet address, must be an alphanumeric string (underscores allowed for chains like Midnight, hyphens allowed for chains using base64url-encoded addresses like TON) example: '0xbF394748301603f18d953C90F0b087CBEC0E1834' maxLength: 255 SolanaPublicKey: type: string pattern: ^[1-9A-HJ-NP-Za-km-z]{43,44}$ description: >- Valid Solana wallet address, must be a 44-character string using base58 characters example: vines1vzrYbzLMRdu58ou5XTby4qAqVRLmqo36NKPTg WaasChainEnum: type: string enum: - EVM - MIDNIGHT - SVM - SUI - BTC - TON - STELLAR - TEMPO - ALEO - TRON WaasPolicyArgumentConstraint: type: object required: - operator - value - index properties: operator: $ref: '#/components/schemas/WaasPolicyConstraintCondition' value: description: Reference value for comparison index: type: integer minimum: 0 description: Index of the function argument to validate WaasPolicyAction: type: string description: >- What a rule in the policy rule language decides when it matches. REQUIRE_APPROVAL neither allows nor denies; it applies the Rule's approvalRequirements to a matching transaction, and is valid in the transaction phase only. enum: - ALLOW - DENY - REQUIRE_APPROVAL WaasPolicyDeclarativeApprovalRequirement: type: object description: >- One approval requirement on a Rule in the policy rule language. It has no condition of its own: the Rule's own condition decides when it applies. required: - v - id - requiredApprovals properties: v: type: number description: >- Schema version for this requirement. An unknown value rejects the Composition. id: type: string description: >- Stable handle for this requirement, carried as requirementId in the deny reason. eligibleApproverRoles: type: array items: type: string description: >- Names of the roles whose holders may satisfy this requirement. A holder of any listed role may approve. An empty array means no restriction. mandatoryApproverRoles: type: array items: type: string description: >- Names of the roles that must each be represented among the approvers, regardless of eligibleApproverRoles. An empty array means none. eligibleApproverRole: type: string deprecated: true description: Deprecated. Use eligibleApproverRoles. Do not send both. mandatoryApproverRole: type: string deprecated: true description: Deprecated. Use mandatoryApproverRoles. Do not send both. requiredApprovals: type: number description: Total approvals required. Never counts the Initiator. completeWithinSeconds: type: number description: How long a collected-approvals proposal remains valid. WaasPolicyConstraintCondition: type: string enum: - equal - greater - less - greaterEqual - lessEqual - notEqual description: Comparison operator for argument validation responses: BadRequest: description: Bad Request content: application/json: schema: $ref: '#/components/schemas/BadRequest' Unauthorized: description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/Unauthorized' Forbidden: description: Forbidden content: application/json: schema: $ref: '#/components/schemas/Forbidden' NotFound: description: Not Found content: application/json: schema: $ref: '#/components/schemas/NotFound' InternalServerError: description: Internal Server Error content: application/json: schema: $ref: '#/components/schemas/InternalServerError' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.