STsteward-fi
Vault

Sign a Bitcoin PSBT with a scoped agent wallet

Changed on

Requires agent access plus owner/admin recent MFA or delegated signer credentials with sign_transaction. The route decodes standard Bitcoin PSBT destination outputs, computes input/output/fee totals before signing, rejects excessive fees, evaluates both destination outputs and aggregate destination+fee spend against the agent policy set, and records the signed spend for future policy counters. It also requires an enabled raw-signing-chain policy that explicitly allows bitcoin and secp256k1.

post/vault/{agentId}/sign-bitcoin-psbt

Request

Headers

X-Steward-Request-Timestampstring

Unix seconds, Unix milliseconds, or HTTP/ISO timestamp. Sensitive mutating routes require this or X-Steward-Request-Expires-At when request-expiry or request signatures are enforced.

X-Steward-Request-Expires-Atstring

Unix seconds, Unix milliseconds, or HTTP/ISO expiry time. Sensitive mutating routes require this or X-Steward-Request-Timestamp when request-expiry or request signatures are enforced.

X-Steward-Signaturestring

Authorization signature for sensitive mutating routes when STEWARD_REQUIRE_AUTH_SIGNATURE=true or production enforcement is enabled. Use v1=<hmac-sha256> or p256=<signature>.

X-Steward-Signing-Key-Idstring

Tenant request-signing key id used to select a managed HMAC signing key. Required when signing with a managed tenant key; omit only for static or app-client signing secrets.

Idempotency-Keystring

Required for signed sensitive requests and recommended for all sensitive mutating requests. Replays are scoped to authenticated or explicitly signed contexts.

Request body

walletScopestring required
psbtBase64string required

Base64-encoded PSBT

finalizeboolean

When true, finalize the signed PSBT and return raw transaction hex plus txid/fee metadata. No broadcast is performed.

referenceIdstring

Response

JSON response

oktrue required

Changes