---
title: "Whitelist address"
method: POST
path: "/api/travel-rule/v1/whitelist"
tags: ["Travel Rule"]
---

# Whitelist address

`POST /api/travel-rule/v1/whitelist`

Unified CaaS-facing endpoint that absorbs the multi-step compliance
orchestration (WP policy rule, VASP lookup or registration, PII storage)
into a single declarative request. The server branches internally across
policy-only, known-VASP and new-VASP flows.

## Request body

- object — Request body for the unified `POST /api/travel-rule/v1/whitelist` endpoint. `enterpriseId` is required so that the upstream `needsEnterpriseAccess` middleware (`src/util/needsEnterpriseAccess.ts`) can verify the caller has access to the targeted enterprise before the handler runs. `vaspId` and `newVasp` are mutually exclusive — exactly one (or neither, in the case of a BitGo-wallet-id `address` or a `restrictWhitelist=off` org) must be supplied. The XOR check lives in the handler so we can return a targeted 400 with a clear message instead of an opaque decode error.
  - `enterpriseId` string, required
  - `walletId` string, required
  - `coin` string, required
  - `address` string, required
  - `custodyType` 'hosted' | 'self', required
  - `label` string
  - `vaspId` string
  - `newVasp` object
    - `domain` string, required
    - `name` string, required
  - `pii` object — CaaS-facing PII payload. Optional on the request; the server skips storage entirely when the resolved VASP source is TRUST (TRUST handles PII out-of-band).
    - `address` string
    - `businessName` string
    - `country` string
    - `firstName` string
    - `lastName` string
    - `ownershipType` 'self' | 'individual' | 'business', required

## Response `200`

OK

- PostWhitelistResponse
  - `whitelistId` string, required
  - `status` 'approved' | 'pending_vasp' | 'pending_prodops_review', required

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `404` — Not Found
- `500` — Internal Server Error

## Changes

- **2026-09-03** `a7126d55243d` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/bitgo/apis/bitgo-api/changes/api/travel-rule/v1/whitelist/post.md)

---

[API](https://skmtc.dev/bitgo/apis/bitgo-api.md) · [All operations](https://skmtc.dev/bitgo/apis/bitgo-api/llms.txt) · [OpenAPI document](https://skmtc.dev/bitgo/apis/bitgo-api/revisions/292f619d7c1f?raw)