STsteward-fi
Vault

Build, sign, and relay a Monero transfer

Changed on

Requires agent access plus owner/admin recent MFA or delegated signer credentials with sign_transaction, an enabled raw-signing-chain policy that explicitly allows monero and ed25519, and an Idempotency-Key header. Destinations are policy-evaluated first; the vault's wallet2 backend then builds the transaction without relaying so the exact fee is known, the fee-inclusive aggregate spend is re-evaluated, and only then is the transaction relayed. The vault never accepts a caller-built transaction blob. USD-denominated policy rules fail closed for Monero (no XMR price source) — use piconero-denominated limits.

post/vault/{agentId}/monero/transfer

Request

Headers

X-Steward-Request-Timestampstring

Unix seconds, Unix milliseconds, or HTTP/ISO timestamp. Sensitive mutating routes require this or X-Steward-Request-Expires-At when request-expiry or request signatures are enforced.

X-Steward-Request-Expires-Atstring

Unix seconds, Unix milliseconds, or HTTP/ISO expiry time. Sensitive mutating routes require this or X-Steward-Request-Timestamp when request-expiry or request signatures are enforced.

X-Steward-Signaturestring

Authorization signature for sensitive mutating routes when STEWARD_REQUIRE_AUTH_SIGNATURE=true or production enforcement is enabled. Use v1=<hmac-sha256> or p256=<signature>.

X-Steward-Signing-Key-Idstring

Tenant request-signing key id used to select a managed HMAC signing key. Required when signing with a managed tenant key; omit only for static or app-client signing secrets.

Idempotency-Keystring

Required for signed sensitive requests and recommended for all sensitive mutating requests. Replays are scoped to authenticated or explicitly signed contexts.

Request body

walletScopestring required

Monero wallet scope, e.g. monero:mainnet:0

priorityinteger

wallet2 fee priority: 0 default … 3 elevated

referenceIdstring

Response

JSON response

oktrue required

Changes