Wallet layer

Wallet and signer policy layers are in early access. Talk to us if you’d like to participate.

Calls on this page go to /sdk/<environment_id>/... and authenticate with the signed-in end user’s JWT (<user_jwt>), not an environment API token. The caller must be the wallet owner, or a business-account owner or admin for a wallet in their account. For which kind of rules a layer holds and how declarative rules are enabled, see Managing layers. The wallet-Layer applies to a single wallet.

Read the wallet-Layer

curl "https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
  -H "Authorization: Bearer <user_jwt>"

Add or update a rule

For a declarative rule, the rule goes in declarativeRule instead of rule, and ruleId is optional: leave it out to create a rule, and the response returns the generated id. In the JavaScript SDK examples, walletAccount is the WaaS wallet account, for example one returned by getWalletAccounts().

Legacy rules (cURL)
Legacy rules (JavaScript SDK)
Declarative rules (cURL)
Declarative rules (JavaScript SDK)

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <user_jwt>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Block private key export",
    "ruleType": "deny",
    "chain": "EVM",
    "chainIds": [1],
    "operationRestrictions": { "blockExport": true }
  }
}'

import { createPolicy } from '@dynamic-labs-sdk/client/waas';
import { WaasChainEnum } from '@dynamic-labs/sdk-api-core';

const walletId = '<wallet_id>';

const layer = await createPolicy({
  scope: { walletId },
  chain: WaasChainEnum.Evm,
  chainIds: [1],
  rules: { blockExport: true },
});

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <user_jwt>" \
-d '{
  "op": "upsert",
  "declarativeRule": {
    "ruleId": "00000000-0000-4000-8000-000000000010",
    "name": "No client signing",
    "phase": "operation",
    "then": "DENY",
    "when": { "field": "operation.type", "op": "eq", "value": "clientSigning" }
  }
}'

import { upsertWalletPolicyRule } from '@dynamic-labs-sdk/client/waas';
import {
  WaasPolicyAction,
  WaasPolicyDeclarativeRuleInputPhaseEnum,
} from '@dynamic-labs/sdk-api-core';

const layer = await upsertWalletPolicyRule({
  walletAccount,
  rule: {
    ruleId: '00000000-0000-4000-8000-000000000010',
    name: 'No client signing',
    phase: WaasPolicyDeclarativeRuleInputPhaseEnum.Operation,
    then: WaasPolicyAction.Deny,
    when: { field: 'operation.type', op: 'eq', value: 'clientSigning' },
  },
});

Remove a rule

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <user_jwt>" \
-d '{
  "op": "remove",
  "ruleId": "<existing_rule_id>"
}'

The same request removes a legacy rule or a declarative rule. In the JavaScript SDK, use removeWalletPolicyRule({ walletAccount, ruleId }).

Replace the layer’s rules

op: "replace" sets the layer’s full rule list in one write, so any rule you leave out is removed. Keep the ruleId of every rule you are keeping. The examples use declarative rules. Only environment admins and business-account admins can replace a layer.

cURL
JavaScript SDK

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <user_jwt>" \
-d '{
  "op": "replace",
  "rules": [
    {
      "ruleId": "00000000-0000-4000-8000-000000000004",
      "name": "Blocked address",
      "phase": "transaction",
      "then": "DENY",
      "when": {
        "exists": {
          "in": "counterparties",
          "where": { "field": "address", "op": "in", "value": ["0x0000000000000000000000000000000000000bad"] }
        }
      }
    },
    {
      "ruleId": "00000000-0000-4000-8000-000000000010",
      "name": "No client signing",
      "phase": "operation",
      "then": "DENY",
      "when": { "field": "operation.type", "op": "eq", "value": "clientSigning" }
    }
  ]
}'

import { replacePolicyLayerRules } from '@dynamic-labs-sdk/client/waas';
import {
  WaasPolicyAction,
  WaasPolicyDeclarativeRuleInputPhaseEnum,
} from '@dynamic-labs/sdk-api-core';

const walletId = '<wallet_id>';

const layer = await replacePolicyLayerRules({
  scope: { walletId },
  rules: [
    {
      ruleId: '00000000-0000-4000-8000-000000000004',
      name: 'Blocked address',
      phase: WaasPolicyDeclarativeRuleInputPhaseEnum.Transaction,
      then: WaasPolicyAction.Deny,
      when: {
        exists: {
          in: 'counterparties',
          where: { field: 'address', op: 'in', value: ['0x0000000000000000000000000000000000000bad'] },
        },
      },
    },
    {
      ruleId: '00000000-0000-4000-8000-000000000010',
      name: 'No client signing',
      phase: WaasPolicyDeclarativeRuleInputPhaseEnum.Operation,
      then: WaasPolicyAction.Deny,
      when: { field: 'operation.type', op: 'eq', value: 'clientSigning' },
    },
  ],
});

Next steps

Signer layer

Rules that apply to a single signer share set.

Account layer

Rules that apply to every wallet in a business account.

Managing layers

Auth, which kind of rules a layer holds, and signer-modifiable rules.

Rule examples

Ready-made declarative rules.

Learn

Implement

Read the wallet-Layer

Add or update a rule

Remove a rule

Replace the layer’s rules

Next steps

Signer layer

Account layer

Managing layers

Rule examples

​Read the wallet-Layer

​Add or update a rule

​Remove a rule

​Replace the layer’s rules

​Next steps

Signer layer

Account layer

Managing layers

Rule examples

Read the wallet-Layer

Add or update a rule

Remove a rule

Replace the layer’s rules

Next steps