Treasury Wallets

Rotate the user's wallet key for a chain

Generates a new keypair, deactivates the old wallet, and creates a new active wallet. The old private key version is retained in the vault for audit. Counts toward wallet quota (does not require a paid plan). Human users only.

Rotation generates a 1Claw-held (server) key, so a self-custody (client_tss) wallet is refused with 409 (use a share refresh, POST /v1/keys/{key_id}/tss/refresh/begin, to change its shares), and the org's custody policy applies as it does on create (403 where new server keys are no longer issued). Gated by control-plane consensus as treasury_wallet.rotate: when the org requires it the call answers 202 with pending_approval_id; call again with ?approval_id= once approved. The approval is spent only after the new key is stored and escrowed.

post/v1/treasury/wallets/{chain}/rotate

Request

  • Base URL: https://api.1claw.co
  • URL: https://api.1claw.co/v1/treasury/wallets/{chain}/rotate
  • Auth: HTTP bearer

Path parameters

chainstring required

Query parameters

approval_idstring uuid

An approved treasury_wallet.rotate consensus approval (from an earlier 202).

Response

Wallet rotated

idstring uuid
chainstring
curvestring

Cryptographic curve (e.g. secp256k1, ed25519)

public_key_hexstring
addressstring
is_activeboolean
created_atstring date-time
custody'server' | 'client_tss' | 'client_multisig'

server — 1claw holds the whole private key and can sign alone. client_tss — threshold key (2-of-3: 1Claw, the customer's passkey, the customer's offline recovery kit); 1Claw cannot sign alone. client_multisig: native 2-of-3 multisig (Tron), three ordinary keys (1Claw's, the passkey-held device key, the kit's recovery key) and the chain's own account permissions; the address is the device key's.

owner_wrapsinteger

client_tss only (list responses). Passkey wraps of the customer's share; runtime holder wraps are not counted. Superseded by backup.

multisig_status'pending_activation' | 'active'

client_multisig only. pending_activation until the 2-of-3 account permissions are confirmed on chain.

Changes

No recorded changes to this operation across all 1 revision of this API.