---
title: "Submit an encrypted private-key import envelope"
method: POST
path: "/vault/{agentId}/import/submit"
tags: ["Vault"]
---

# Submit an encrypted private-key import envelope

`POST /vault/{agentId}/import/submit`

Consumes a one-time encrypted import session and imports the decrypted EVM or Solana private key into encrypted vault storage. Plaintext `privateKey` fields are rejected; audit metadata records only chain/session/address metadata.

## Headers

- `X-Steward-Request-Timestamp` string
- `X-Steward-Request-Expires-At` string
- `X-Steward-Signature` string
- `X-Steward-Signing-Key-Id` string
- `Idempotency-Key` string

## Request body

- object
  - `importSessionId` string, required
  - `ephemeralPublicKey` string, required — Base64url DER-encoded X25519 SPKI public key generated by the client.
  - `iv` string, required — Base64url AES-GCM nonce, 12 bytes before encoding.
  - `ciphertext` string, required — Base64url encrypted private key bytes. Plaintext privateKey is rejected.
  - `tag` string, required — Base64url AES-GCM authentication tag.

## Response `200`

JSON response

- object
  - `ok` true, required
  - `data` object, required
    - `agentId` string, required
    - `walletAddress` string, required
    - `chain` 'evm' | 'solana', required

## Other responses

- `400` — JSON response
- `401` — JSON response
- `403` — JSON response
- `404` — JSON response
- `408` — JSON response
- `409` — JSON response

## Changes

- **2026-08-17** `261a7c8070b2` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/steward-fi/apis/steward-api/changes/vault/:agentId/import/submit/post.md)

---

[API](https://skmtc.dev/steward-fi/apis/steward-api.md) · [All operations](https://skmtc.dev/steward-fi/apis/steward-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/steward-fi/steward-api/revisions/b88b4b97a664/schema)