Identity: wallet request

Mint a CSR and open a single-use request for the wallet page to sign (onboarding/wallet design §1a)

POST /v1/identities/{slug}/wallet-request · operation openWalletRequest

Requires the batondeck:identities:manage permission (action cert:csr).

Requires a step-up: MFA enrolled and re-authenticated within 15 minutes. Not reachable with an API key — a key has no session and so can never step up.

Refused while the workspace is suspended or on deletion hold.

Parameters

Name	In	Type	Required	Notes
slug	path	string	yes

Request body (application/json)

Field	Type	Required	Notes
purpose	“signup” \	“renew” \	“move”
endpoint	string		≥ 1 chars, ≤ 512 chars

Request schema

{
  "type": "object",
  "properties": {
    "purpose": {
      "type": "string",
      "enum": [
        "signup",
        "renew",
        "move"
      ]
    },
    "endpoint": {
      "type": "string",
      "minLength": 1,
      "maxLength": 512
    }
  },
  "required": [
    "purpose"
  ],
  "additionalProperties": false
}

Responses

Status	Meaning
201	Mint a CSR and open a single-use request for the wallet page to sign (onboarding/wallet design §1a)
400	The arguments did not validate.
401	No portal session, and no live API key.
403	The policy refused, or the request was cross-site.
404	No such resource, or none this session may see.

201 response schema

{
  "type": "object",
  "properties": {
    "code": {
      "type": "string"
    },
    "url": {
      "type": "string"
    },
    "endpoint": {
      "type": "string"
    },
    "purpose": {
      "type": "string"
    },
    "expires_at": {
      "type": "number"
    }
  },
  "required": [
    "code",
    "url",
    "endpoint",
    "purpose",
    "expires_at"
  ],
  "additionalProperties": false
}

curl -X POST 'https://api.batondeck.com/v1/identities/:slug/wallet-request' \
  -H "Authorization: Bearer $BATONDECK_API_KEY" \
  -H 'content-type: application/json' \
  -d @body.json

What the wallet did with a request: still open, the chain it issued, or why it did not

GET /v1/identities/{slug}/wallet-request/{code} · operation readWalletRequest

Requires the batondeck:identities:read permission (action cert:read).

Parameters

Name	In	Type	Required	Notes
slug	path	string	yes
code	path	string	yes

Responses

Status	Meaning
200	What the wallet did with a request: still open, the chain it issued, or why it did not
401	No portal session, and no live API key.
403	The policy refused, or the request was cross-site.
404	No such resource, or none this session may see.

200 response schema

{
  "type": "object",
  "properties": {
    "state": {
      "type": "string",
      "enum": [
        "open",
        "answered",
        "cancelled",
        "failed",
        "expired"
      ]
    },
    "chain": {
      "anyOf": [
        {
          "minItems": 2,
          "maxItems": 2,
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        {
          "type": "null"
        }
      ]
    },
    "root_fingerprint": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ]
    },
    "credential_id": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ]
    },
    "backup_verified": {
      "type": "boolean"
    },
    "why": {
      "type": "string"
    }
  },
  "required": [
    "state",
    "chain",
    "root_fingerprint",
    "credential_id",
    "backup_verified",
    "why"
  ],
  "additionalProperties": false
}

curl -X GET 'https://api.batondeck.com/v1/identities/:slug/wallet-request/:code' \
  -H "Authorization: Bearer $BATONDECK_API_KEY"