Server — update the business account's account-Layer Rules

Applies a per-Rule upsert or remove, a batch, or a replace of the whole Rule list to the account-Layer, which applies to every wallet in the business account. Business-account owner or admin only. Creates the account-Layer if the account has none yet.

PATCH /server/{environmentId}/businessAccounts/{businessAccountId}/policy-layer

Server — update the business account's account-Layer Rules

cURL

curl --request PATCH \
  --url https://app.dynamicauth.com/api/v0/server/{environmentId}/businessAccounts/{businessAccountId}/policy-layer \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "ruleId": "95b11417-f18f-457f-8804-68e361f9164f",
  "operations": [
    {
      "ruleId": "95b11417-f18f-457f-8804-68e361f9164f"
    }
  ],
  "rules": [
    {
      "name": "<string>",
      "ruleId": "95b11417-f18f-457f-8804-68e361f9164f",
      "address": "0xbF394748301603f18d953C90F0b087CBEC0E1834",
      "addresses": [
        "0xbF394748301603f18d953C90F0b087CBEC0E1834"
      ],
      "chainId": 123,
      "chainIds": [
        123
      ],
      "contractAbi": [
        {}
      ],
      "functionName": "<string>",
      "argumentConstraints": [
        {
          "value": "<unknown>",
          "index": 1
        }
      ],
      "valueLimit": {
        "asset": "0xbF394748301603f18d953C90F0b087CBEC0E1834",
        "maxPerCall": "<string>",
        "totalLimit": "<string>"
      },
      "operationRestrictions": {
        "blockExport": true,
        "blockRevocation": true,
        "blockClientSigning": true
      },
      "disableBlockaidSecurityChecks": true,
      "modifiableBySigner": true,
      "approvalRequirements": [
        {
          "v": 123,
          "id": "<string>",
          "requiredApprovals": 123,
          "when": {
            "minValue": {
              "asset": "0xbF394748301603f18d953C90F0b087CBEC0E1834",
              "amount": "<string>"
            },
            "initiatorRole": {
              "roles": [
                "<string>"
              ],
              "userIds": [
                "<string>"
              ]
            },
            "actionTypes": [
              "<string>"
            ]
          },
          "eligibleApproverRoles": [
            "<string>"
          ],
          "mandatoryApproverRoles": [
            "<string>"
          ],
          "completeWithinSeconds": 123
        }
      ]
    }
  ]
}
'

200

{
  "layerId": "<string>",
  "layerContent": {
    "rules": [
      {}
    ]
  },
  "updatedAt": "2023-11-07T05:31:56Z",
  "message": "<string>",
  "translatedFromLegacy": true,
  "translationWarnings": [
    {
      "kind": "approvals_not_translated",
      "ruleId": "<string>",
      "fields": [
        "<string>"
      ],
      "phase": "operation",
      "count": 123,
      "limit": 123
    }
  ]
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

x-dyn-server-signing-proof · string

Request proof: a compact ES256 JWS, signed with the server's registered key, binding this request to a single-use nonce from GET /nonces. The JWS header is RequestSigningProofHeader and its payload is RequestSigningProofPayload. Required when the request carries a DYN API token and no JWT, and a server signer with a registered key controls the resource. A proof that is present is always verified.

Maximum string length: 4096

Pattern: ^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$

Path Parameters

environmentId · string · required

ID of the environment

Required string length: 36

Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

Example:

"95b11417-f18f-457f-8804-68e361f9164f"

businessAccountId · string · required

ID of the business account

Required string length: 36

Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

Example:

"95b11417-f18f-457f-8804-68e361f9164f"

Body

application/json

op · enum<string> · required

The per-Rule operation to apply to the wallet-Layer, batch to apply multiple operations atomically in one enclave cycle, or replace to set the Layer's full Rule list

Available options: upsert, remove, batch, replace

rule · object

Show child attributes

declarativeRule · object

A Rule authored in the policy rule language, evaluated by the engine as stored rather than compiled from WaasPolicyRule. Shares identity and authorship with a legacy Rule so the Layer machinery — deletion markers, authorship stamping, the edit guard — keys on the same fields and needs no second code path for anything but evaluation. A Layer holds one syntax or the other: a write that would leave both in one Layer is refused.

Show child attributes

ruleId · string

Required string length: 36

Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

Example:

"95b11417-f18f-457f-8804-68e361f9164f"

operations · object[]

Only used when op is batch — applied atomically in one enclave cycle

Required array length: 1 - 100 elements

Show child attributes

rules · object[]

Only used when op is replace — the Layer's full Rule list, in either syntax. A declarative Rule sent without a ruleId is given one. Only admins and business-account admins may replace.

Maximum array length: 200

Option 1

Option 2

Show child attributes

Response

200

application/json

Account-Layer updated successfully

layerId · string · required

Unique identifier for the wallet-Layer

layerContent · object · required

The decrypted, mutated wallet-Layer document

Show child attributes

updatedAt · string<date-time> · required

ISO 8601 timestamp of when the wallet-Layer was last updated

message · string

Message describing the operation result

translatedFromLegacy · boolean

True when legacy rules are translated for this response without saving them.

translationWarnings · object[]

What the translation left out or could not translate.

Show child attributes