---
title: "Rotate the user's wallet key for a chain"
method: POST
path: "/v1/treasury/wallets/{chain}/rotate"
tags: ["Treasury Wallets"]
---

# Rotate the user's wallet key for a chain

`POST /v1/treasury/wallets/{chain}/rotate`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/treasury/wallets/{chain}/rotate`
- Auth: HTTP bearer

Generates a new keypair, deactivates the old wallet, and creates a
new active wallet. The old private key version is retained in the
vault for audit. Counts toward wallet quota (does not require a paid plan).
Human users only.

Rotation generates a 1Claw-held (server) key, so a self-custody
(`client_tss`) wallet is refused with 409 (use a share refresh,
`POST /v1/keys/{key_id}/tss/refresh/begin`, to change its shares), and
the org's custody policy applies as it does on create (403 where new
server keys are no longer issued). Gated by control-plane consensus as
`treasury_wallet.rotate`: when the org requires it the call answers 202
with `pending_approval_id`; call again with `?approval_id=` once approved.
The approval is spent only after the new key is stored and escrowed.

## Path parameters

- `chain` string, required

## Query parameters

- `approval_id` string, uuid

## Response `200`

Wallet rotated

- TreasuryWalletResponse
  - `id` string, uuid
  - `chain` string
  - `curve` string: Cryptographic curve (e.g. secp256k1, ed25519)
  - `public_key_hex` string
  - `address` string
  - `is_active` boolean
  - `created_at` string, date-time
  - `custody` 'server' | 'client_tss' | 'client_multisig': `server` — 1claw holds the whole private key and can sign alone. `client_tss` — threshold key (2-of-3: 1Claw, the customer's passkey, the customer's offline recovery kit); 1Claw cannot sign alone. `client_multisig`: native 2-of-3 multisig (Tron), three ordinary keys (1Claw's, the passkey-held device key, the kit's recovery key) and the chain's own account permissions; the address is the device key's.
  - `owner_wraps` integer: `client_tss` only (list responses). Passkey wraps of the customer's share; runtime holder wraps are not counted. Superseded by `backup`.
  - `backup` object: `client_tss` only (list responses). Whether the key is backed up and what it still needs. A 2-of-3 key needs a passkey wrap and a recovery kit confirmed for its current share generation. Agents and runtimes refuse a key that is not backed up; the owner can always move funds out.
    - `threshold` '2of2' | '2of3'
    - `passkey_wraps` integer
    - `recovery_code_wraps` integer
    - `generation` integer
    - `kit_generation` integer, nullable
    - `kit_covered` boolean
    - `backed_up` boolean
    - `missing` string[]
  - `multisig_status` 'pending_activation' | 'active': `client_multisig` only. `pending_activation` until the 2-of-3 account permissions are confirmed on chain.
  - `multisig_keys` MultisigKeys
    - `threshold` integer, required: Always 2.
    - `vault` MultisigKeyInfo, required
      - `address` string, required: Base58check Tron address, or a lowercase 0x EVM address for a Safe's owners.
      - `public_key` string, required: Hex SEC1 public key (33 or 65 bytes).
    - `device` MultisigKeyInfo, required
      - `address` string, required: Base58check Tron address, or a lowercase 0x EVM address for a Safe's owners.
      - `public_key` string, required: Hex SEC1 public key (33 or 65 bytes).
    - `recovery` MultisigKeyInfo, required
      - `address` string, required: Base58check Tron address, or a lowercase 0x EVM address for a Safe's owners.
      - `public_key` string, required: Hex SEC1 public key (33 or 65 bytes).

## Other responses

- `202`: The org requires M-of-N consensus on `treasury_wallet.rotate`. Nothing was rotated.
- `400`: Invalid request
- `401`: Authentication required or invalid
- `403`: Insufficient permissions
- `404`: Resource not found
- `409`: The wallet is a self-custody (`client_tss`) wallet; rotating would replace it with a server key.

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)