---
title: "Wallet permissions check — who can move money out of an XRPL wallet (x402, $0.02 USDC on Base or RLUSD on XRPL)"
method: GET
path: "/api/x402/permissions"
tags: ["Agents"]
---

# Wallet permissions check — who can move money out of an XRPL wallet (x402, $0.02 USDC on Base or RLUSD on XRPL)

`GET /api/x402/permissions`

## Request

- Base URL: `https://www.xrplhub.io`
- URL: `https://www.xrplhub.io/api/x402/permissions`
- Auth: none declared

Read live from the ledger: signing power (master key on/off, regular key, multi-sign signer list, blackholed), permission delegations given and received (PermissionDelegation, live on mainnet since 2026-10-08), and money others can pull without a new approval (checks the wallet wrote, payment channels it funds, escrows it created, open DEX offers, NFT sell offers, tickets). Each finding has a level (danger | warning | info | ok), the account holding the power, a plain-English sentence, the raw ledger facts and, where one exists, a free fix (revoke_delegation, cancel_check). People: free page at /permissions. No signup.

## Query parameters

- `address` string, required

## Response `200`

{ address, exists, ledgerIndex, headline, canMoveMoney[{who,how}], findings[{kind,level,who,plain,detail,fix?}], truncated, notes[] }

## Other responses

- `400`: Malformed address — refused before any charge.
- `402`: Payment Required — x402 challenge on either rail (see /api/x402/usdc/mpt/{issuanceId}).

---

[API](https://skmtc.dev/xrplhub/apis/xrplhub-xrplscore-and-prebuilt-xrpl-transactions.md) · [All operations](https://skmtc.dev/xrplhub/apis/xrplhub-xrplscore-and-prebuilt-xrpl-transactions/llms.txt) · [OpenAPI document](https://skmtc.dev/xrplhub/apis/xrplhub-xrplscore-and-prebuilt-xrpl-transactions/revisions/a5d4e13aff32?raw)