STsteward-fi
Global Wallet

Create a one-time global wallet action confirmation

Changed on

Requires recent MFA. Write-capable global-wallet methods also require active consent for the exact origin/app, selected wallet index, wallet binding, explicit server-side enablement where applicable, and a one-time action confirmation. Confirmations are bound to consent, user, tenant app, origin, method, request hash, wallet agent id, wallet address, and wallet index and expire after five minutes.

post/global-wallet/rpc/confirm

Request

Headers

X-Steward-Request-Timestampstring

Unix seconds, Unix milliseconds, or HTTP/ISO timestamp. Sensitive mutating routes require this or X-Steward-Request-Expires-At when request-expiry or request signatures are enforced.

X-Steward-Request-Expires-Atstring

Unix seconds, Unix milliseconds, or HTTP/ISO expiry time. Sensitive mutating routes require this or X-Steward-Request-Timestamp when request-expiry or request signatures are enforced.

X-Steward-Signaturestring

Authorization signature for sensitive mutating routes when STEWARD_REQUIRE_AUTH_SIGNATURE=true or production enforcement is enabled. Use v1=<hmac-sha256> or p256=<signature>.

X-Steward-Signing-Key-Idstring

Tenant request-signing key id used to select a managed HMAC signing key. Required when signing with a managed tenant key; omit only for static or app-client signing secrets.

Idempotency-Keystring

Required for signed sensitive requests and recommended for all sensitive mutating requests. Replays are scoped to authenticated or explicitly signed contexts.

Request body

app_idstring required
appIdstring
originstring
method'eth_accounts' | 'personal_sign' | 'eth_signTypedData_v4' | 'eth_sendTransaction' required
paramsunknown
wallet_indexinteger
walletIndexinteger
confirmation_idstring
confirmationIdstring
idunknown
jsonrpcstring

Response

JSON response

oktrue required

Changes