Server — update the business account's account-Layer Rules

Applies a per-Rule upsert or remove, a batch, or a replace of the whole Rule list to the account-Layer, which applies to every wallet in the business account. Business-account owner or admin only. Creates the account-Layer if the account has none yet.

Governed accounts follow the same intent, 202 and proposalId flow as the SDK path.

PATCH /server/{environmentId}/businessAccounts/{businessAccountId}/policy-layer

Server — update the business account's account-Layer Rules

cURL

curl --request PATCH \
  --url https://app.dynamicauth.com/api/v0/server/{environmentId}/businessAccounts/{businessAccountId}/policy-layer \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "ruleId": "95b11417-f18f-457f-8804-68e361f9164f",
  "operations": [
    {
      "ruleId": "95b11417-f18f-457f-8804-68e361f9164f"
    }
  ],
  "rules": [
    {
      "name": "<string>",
      "ruleId": "95b11417-f18f-457f-8804-68e361f9164f",
      "address": "0xbF394748301603f18d953C90F0b087CBEC0E1834",
      "addresses": [
        "0xbF394748301603f18d953C90F0b087CBEC0E1834"
      ],
      "chainId": 123,
      "chainIds": [
        123
      ],
      "contractAbi": [
        {}
      ],
      "functionName": "<string>",
      "argumentConstraints": [
        {
          "value": "<unknown>",
          "index": 1
        }
      ],
      "valueLimit": {
        "asset": "0xbF394748301603f18d953C90F0b087CBEC0E1834",
        "maxPerCall": "<string>",
        "totalLimit": "<string>"
      },
      "operationRestrictions": {
        "blockExport": true,
        "blockRevocation": true,
        "blockClientSigning": true
      },
      "disableBlockaidSecurityChecks": true,
      "modifiableBySigner": true,
      "approvalRequirements": [
        {
          "v": 123,
          "id": "<string>",
          "requiredApprovals": 123,
          "when": {
            "minValue": {
              "asset": "0xbF394748301603f18d953C90F0b087CBEC0E1834",
              "amount": "<string>"
            },
            "initiatorRole": {
              "roles": [
                "<string>"
              ],
              "userIds": [
                "<string>"
              ]
            },
            "actionTypes": [
              "<string>"
            ]
          },
          "eligibleApproverRoles": [
            "<string>"
          ],
          "mandatoryApproverRoles": [
            "<string>"
          ],
          "completeWithinSeconds": 123
        }
      ]
    }
  ],
  "intent": {},
  "intentSignature": "<string>",
  "proposalId": "95b11417-f18f-457f-8804-68e361f9164f"
}
'

200

{
  "layerId": "<string>",
  "layerContent": {
    "rules": [
      {}
    ]
  },
  "updatedAt": "2023-11-07T05:31:56Z",
  "message": "<string>",
  "translatedFromLegacy": true,
  "translationWarnings": [
    {
      "kind": "approvals_not_translated",
      "ruleId": "<string>",
      "fields": [
        "<string>"
      ],
      "phase": "operation",
      "count": 123,
      "limit": 123
    }
  ]
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

x-dyn-server-signing-proof · string

Request proof: a compact ES256 JWS, signed with the server's registered key, binding this request to a single-use nonce from GET /nonces. The JWS header is RequestSigningProofHeader and its payload is RequestSigningProofPayload. Required when the request carries a DYN API token and no JWT, and a server signer with a registered key controls the resource. A proof that is present is always verified.

Maximum string length: 4096

Pattern: ^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$

Path Parameters

environmentId · string · required

ID of the environment

Required string length: 36

Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

Example:

"95b11417-f18f-457f-8804-68e361f9164f"

businessAccountId · string · required

ID of the business account

Required string length: 36

Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

Example:

"95b11417-f18f-457f-8804-68e361f9164f"

Body

application/json

The account-Layer update, plus the consent fields when the account governs updatePolicyLayer. All three added fields are optional: send none when it does not. intentSignature goes with intent, never alone.

op · enum<string> · required

The per-Rule operation to apply to the wallet-Layer, batch to apply multiple operations atomically in one enclave cycle, or replace to set the Layer's full Rule list

Available options: upsert, remove, batch, replace

rule · object

Show child attributes

declarativeRule · object

A Rule authored in the policy rule language, evaluated by the engine as stored rather than compiled from WaasPolicyRule. Shares identity and authorship with a legacy Rule so the Layer machinery — deletion markers, authorship stamping, the edit guard — keys on the same fields and needs no second code path for anything but evaluation. A Layer holds one syntax or the other: a write that would leave both in one Layer is refused.

Show child attributes

ruleId · string

Required string length: 36

Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

Example:

"95b11417-f18f-457f-8804-68e361f9164f"

operations · object[]

Only used when op is batch — applied atomically in one enclave cycle

Required array length: 1 - 100 elements

Show child attributes

rules · object[]

Only used when op is replace — the Layer's full Rule list, in either syntax. A declarative Rule sent without a ruleId is given one. Only admins and business-account admins may replace.

Maximum array length: 200

Option 1

Option 2

Show child attributes

intent · object

The initiator's proposal, signed with their session key. Built by the API, not the client — sign these exact bytes verbatim, because re-serializing can change them and invalidate the signature. autoExecute is inside the signed bytes, so an approver consents to it and nothing can flip it afterwards.

intentSignature · string

Hex-encoded ECDSA P-256 signature over the canonicalized payload, produced by the signer's session key — which never leaves their device, so consent cannot be given on their behalf. Exactly 128 hex characters. WebCrypto emits the raw r‖s form with both halves padded to 32 bytes, so unlike DER the length never varies. Constrained here so a malformed value is a 400 at the edge rather than an enclave round trip that returns INTENT_SIGNATURE_INVALID, and so an unbounded string cannot be persisted against a proposal.

Pattern: ^[0-9a-fA-F]{128}$

proposalId · string

The approved updatePolicyLayer proposal to redeem. Resend the same update with it; the stored proposal is what runs, and intent and intentSignature are not needed.

Required string length: 36

Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$

Example:

"95b11417-f18f-457f-8804-68e361f9164f"

Response

200

application/json

Account-Layer updated successfully

layerId · string · required

Unique identifier for the wallet-Layer

layerContent · object · required

The decrypted, mutated wallet-Layer document

Show child attributes

updatedAt · string<date-time> · required

ISO 8601 timestamp of when the wallet-Layer was last updated

message · string

Message describing the operation result

translatedFromLegacy · boolean

True when legacy rules are translated for this response without saving them.

translationWarnings · object[]

What the translation left out or could not translate.

Show child attributes