Unlink a box from its account
Ends a box's link to its account. The box gets a fresh allowance from this moment, at least the deployment's box grant: it expires no sooner than the grant's days from now, and an allowance the box paid for that runs longer keeps its expiry. Its own units pay for its hits again.
- Cost: Free. Any one of these authorizes it: the box's own signature over method DELETE, path /agent/v1/<address lowercased>/box/link and no body (the hash of no bytes); the linked account's owner's AccountRequest over the same, in ACCOUNT-SIGNATURE, ACCOUNT-NONCE and ACCOUNT-EXPIRY; or a key of the linked account in ARCGATE-KEY.
- Inputs: address (path), the box. No body.
- Returns: address, the accountId it was linked to and its fresh allowance.
- Errors:
- 404 link_not_found: the box is linked to no account.
- Next:
- boxStatus: read the allowance.
- boxLink: link it again.
Request
- Base URL: https://api.arcgate.dev
- URL: https://api.arcgate.dev/agent/v1/{address}/box/link
- Auth: none required
Path parameters
The box's address: the agent's own address (an EOA or an EIP-7702 account), any letter case. The box is keyed by it, and a signed request must be signed by it.
Headers
A key of the account the box is linked to, in place of a signature. Another account's key, or any key for a box that is not linked, does not apply to the box: the call is checked as if no key were sent, so it needs the box's or the owner's signature. A key nobody holds is a 401 key_invalid.
The EIP-712 signature (0x hex) over the AgentRequest typed data (the AccountRequest typed data on /account/v1, which also begins with origin, the API's base URL with no trailing slash): the box's address (the owner's on /account/v1), this request's method and path with every parameter filled in (the address lowercased), the keccak256 of its canonical-JSON body (of no bytes when there is none), the nonce and the expiry. Domain {name: "arcgate", version: "1"}, no chainId; a wallet that can only sign with one (such as Circle's) may add the chainId of the chain this deployment serves (5042 on Arc mainnet), and no other. A missing header is a 401 signature_required.
A fresh random 32-byte value (0x hex), the signed nonce. Each is accepted once per box (per owner on /account/v1): a repeat is a 401 nonce_reused.
The signed expiry, unix seconds: in the future, and no further ahead than 300 seconds from now. Otherwise 401 signature_expired.
The account owner's EIP-712 signature (0x hex) over the AccountRequest typed data, on a box link or unlink: the same method, path and body the box signs, with the owner's address as address and the API's base URL with no trailing slash as origin, under the same domain. Send all three ACCOUNT-* headers, or an ARCGATE-KEY of the account instead.
A fresh random 32-byte value (0x hex), the owner's signed nonce. Each is accepted once per owner: a repeat is a 401 nonce_reused.
The owner's signed expiry, unix seconds: in the future, and no further ahead than 300 seconds from now. Otherwise 401 signature_expired.
Response
The box is unlinked, with a fresh allowance.
Changes
No recorded changes to this operation across all 1 revision of this API.