Managing layers

Create, read, update, and remove policy rules on account, wallet, and signer layers through the Dynamic API.

Wallet and signer policy layers are in early access. Talk to us if you’d like to participate.

Rules are composed in layers. Environment-wide rules are set in the Developer Dashboard or through the environment policy API. Account, wallet, and signer layers are set by calling the Dynamic SDK API directly.

For JavaScript SDK helpers, see the business accounts policies guide.

Before you start

The examples below use https://app.dynamicauth.com/api/v0 as the base URL, your environment ID, and a bearer token for an authorized user.

• For business-account layers, the caller must be a business-account owner or admin.
• For wallet and signer layers, the caller must be the wallet owner. A business-account owner or admin can also manage layers for wallets and signers in their account.

Account-Layer

The account-Layer applies to every wallet in a business account. It is created on the first write.

Read the account-Layer

curl "https://app.dynamicauth.com/api/v0/sdk/<environment_id>/businessAccounts/<business_account_id>/policy-layer" \
  -H "Authorization: Bearer <your_token>"

Add or update a rule

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/businessAccounts/<business_account_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Allow USDC on Ethereum mainnet",
    "ruleType": "allow",
    "chain": "EVM",
    "chainIds": [1],
    "addresses": ["0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"],
    "valueLimit": { "maxPerCall": "100000000000" }
  }
}'

Remove a rule

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/businessAccounts/<business_account_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "remove",
  "ruleId": "<existing_rule_id>"
}'

Wallet-Layer

The wallet-Layer applies to a single wallet.

Read the wallet-Layer

curl "https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
  -H "Authorization: Bearer <your_token>"

Add or update a rule

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Block private key export",
    "ruleType": "deny",
    "chain": "EVM",
    "chainIds": [1],
    "operationRestrictions": { "blockExport": true }
  }
}'

Remove a rule

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "remove",
  "ruleId": "<existing_rule_id>"
}'

Signer-Layer

The signer-Layer applies to a single signer share set on a wallet. Omit shareSetId to target the caller’s own active share set.

Read the signer-Layer

curl "https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/signers/self/policy-layer?shareSetId=<share_set_id>" \
  -H "Authorization: Bearer <your_token>"

Add or update a rule

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/signers/self/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Deny transfers to flagged address",
    "ruleType": "deny",
    "chain": "EVM",
    "chainIds": [1, 8453],
    "addresses": ["0x..."]
  },
  "shareSetId": "<share_set_id>"
}'

Remove a rule

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/signers/self/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "remove",
  "ruleId": "<existing_rule_id>",
  "shareSetId": "<share_set_id>"
}'

Signer-modifiable rules

To let a signer edit or remove a wallet or signer-layer rule later, set modifiableBySigner: true when you create or update the rule. The signer can only modify the rule’s constraint fields, such as addresses and valueLimit. They cannot change the rule type or security settings.

modifiableBySigner cannot be used on environment-scope rules, and it cannot be combined with disableBlockaidSecurityChecks or operationRestrictions.

Wallet-layer example

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Allow USDC with signer-editable limit",
    "ruleType": "allow",
    "chain": "EVM",
    "chainIds": [1],
    "addresses": ["0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"],
    "valueLimit": { "maxPerCall": "100000000000" },
    "modifiableBySigner": true
  }
}'

Signer-layer example

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/signers/self/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Signer-editable allowlist",
    "ruleType": "allow",
    "chain": "EVM",
    "chainIds": [1],
    "addresses": ["0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"],
    "modifiableBySigner": true
  },
  "shareSetId": "<share_set_id>"
}'

Rule fields

For the fields used in the examples above, see Rule fields on the Policies overview page.