> ## Documentation Index
> Fetch the complete documentation index at: https://www.dynamic.xyz/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing layers

> Create, read, update, and remove policy rules on account, wallet, and signer layers through the Dynamic API.

<Note>
  Wallet and signer policy layers are in **early access**. [Talk to us](https://www.dynamic.xyz/talk-to-us) if you'd like to participate.
</Note>

Rules are composed in layers. Environment-wide rules are set in the [Developer Dashboard](/docs/overview/developer-dashboard/general) or through the [environment policy API](/docs/overview/wallets/embedded-wallets/mpc/policies/creating-rules). Account, wallet, and signer layers are set by calling the Dynamic SDK API directly.

For JavaScript SDK helpers, see the [business accounts policies guide](/docs/javascript/reference/business-accounts/policies/overview).

## Before you start

The examples below use `https://app.dynamicauth.com/api/v0` as the base URL, your environment ID, and a bearer token for an authorized user.

* For business-account layers, the caller must be a business-account owner or admin.
* For wallet and signer layers, the caller must be the wallet owner. A business-account owner or admin can also manage layers for wallets and signers in their account.

## Account-Layer

The account-Layer applies to every wallet in a business account. It is created on the first write.

### Read the account-Layer

```bash theme={"system"}
curl "https://app.dynamicauth.com/api/v0/sdk/<environment_id>/businessAccounts/<business_account_id>/policy-layer" \
  -H "Authorization: Bearer <your_token>"
```

### Add or update a rule

```bash theme={"system"}
curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/businessAccounts/<business_account_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Allow USDC on Ethereum mainnet",
    "ruleType": "allow",
    "chain": "EVM",
    "chainIds": [1],
    "addresses": ["0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"],
    "valueLimit": { "maxPerCall": "100000000000" }
  }
}'
```

### Remove a rule

```bash theme={"system"}
curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/businessAccounts/<business_account_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "remove",
  "ruleId": "<existing_rule_id>"
}'
```

## Wallet-Layer

The wallet-Layer applies to a single wallet.

### Read the wallet-Layer

```bash theme={"system"}
curl "https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
  -H "Authorization: Bearer <your_token>"
```

### Add or update a rule

```bash theme={"system"}
curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Block private key export",
    "ruleType": "deny",
    "chain": "EVM",
    "chainIds": [1],
    "operationRestrictions": { "blockExport": true }
  }
}'
```

### Remove a rule

```bash theme={"system"}
curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "remove",
  "ruleId": "<existing_rule_id>"
}'
```

## Signer-Layer

The signer-Layer applies to a single signer share set on a wallet. Omit `shareSetId` to target the caller's own active share set.

### Read the signer-Layer

```bash theme={"system"}
curl "https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/signers/self/policy-layer?shareSetId=<share_set_id>" \
  -H "Authorization: Bearer <your_token>"
```

### Add or update a rule

```bash theme={"system"}
curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/signers/self/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Deny transfers to flagged address",
    "ruleType": "deny",
    "chain": "EVM",
    "chainIds": [1, 8453],
    "addresses": ["0x..."]
  },
  "shareSetId": "<share_set_id>"
}'
```

### Remove a rule

```bash theme={"system"}
curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/signers/self/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "remove",
  "ruleId": "<existing_rule_id>",
  "shareSetId": "<share_set_id>"
}'
```

## Rule fields

For the fields used in the examples above, see [Rule fields](/docs/overview/wallets/embedded-wallets/mpc/policies/overview#rule-fields) on the Policies overview page.