Managing layers

Create, read, update, and remove policy rules on account, wallet, and signer layers through the Dynamic API.

Wallet and signer policy layers are in early access. Talk to us if you’d like to participate.

Rules are composed in layers. Environment-wide rules are set in the Developer Dashboard or through the environment policy API. Account, wallet, and signer layers are set with the Dynamic SDK API or JavaScript SDK helpers.

For JavaScript SDK helpers, see the business accounts policies guide.

Before you start

The examples below use https://app.dynamicauth.com/api/v0 as the base URL, your environment ID, and a bearer token for an authorized user.

• For business-account layers, the caller must be a business-account owner or admin.
• For wallet and signer layers, the caller must be the wallet owner. A business-account owner or admin can also manage layers for wallets and signers in their account.

Account-Layer

The account layer applies to every wallet in a business account. It is created when you first write to it.

Read the account-Layer

curl "https://app.dynamicauth.com/api/v0/sdk/<environment_id>/businessAccounts/<business_account_id>/policy-layer" \
  -H "Authorization: Bearer <your_token>"

Add or update a rule

cURL

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/businessAccounts/<business_account_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Allow USDC on Ethereum mainnet",
    "ruleType": "allow",
    "chain": "EVM",
    "chainIds": [1],
    "addresses": ["0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"],
    "valueLimit": { "maxPerCall": "100000000000" }
  }
}'

JavaScript SDK

import { createPolicy } from '@dynamic-labs-sdk/client/waas';

const businessAccountId = '<business_account_id>';

const layer = await createPolicy({
  scope: { businessAccountId },
  chain: 'EVM',
  chainIds: [1],
  rules: {
    allowAddresses: ['0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48'],
    maxAmountPerTransaction: { amount: '100000000000' },
  },
});

Remove a rule

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/businessAccounts/<business_account_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "remove",
  "ruleId": "<existing_rule_id>"
}'

Wallet-Layer

The wallet-Layer applies to a single wallet.

Read the wallet-Layer

curl "https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
  -H "Authorization: Bearer <your_token>"

Add or update a rule

cURL

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Block private key export",
    "ruleType": "deny",
    "chain": "EVM",
    "chainIds": [1],
    "operationRestrictions": { "blockExport": true }
  }
}'

JavaScript SDK

import { createPolicy } from '@dynamic-labs-sdk/client/waas';

const walletId = '<wallet_id>';

const layer = await createPolicy({
  scope: { walletId },
  chain: 'EVM',
  chainIds: [1],
  rules: { blockExport: true },
});

Remove a rule

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "remove",
  "ruleId": "<existing_rule_id>"
}'

Signer-Layer

The signer-Layer applies to a single signer share set on a wallet. This includes the caller’s own share set, delegated access share sets, and additional signers on a business-account wallet. Omit shareSetId to target the caller’s own active share set. To find a share set id for another signer, use getWalletAccountShareSets from the JavaScript SDK; see the business accounts policies guide.

A shareSetId is the current identifier for a signer. It rotates when wallet shares are refreshed or reshared, so re-read it with getWalletAccountShareSets before each update. The policy is bound to a stable signerId that the enclave mints, so a rotated shareSetId still points to the same policy.

Read the signer-Layer

curl "https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/signers/self/policy-layer?shareSetId=<share_set_id>" \
  -H "Authorization: Bearer <your_token>"

Add or update a rule

cURL

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/signers/self/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Deny transfers to flagged address",
    "ruleType": "deny",
    "chain": "EVM",
    "chainIds": [1, 8453],
    "addresses": ["0x..."]
  },
  "shareSetId": "<share_set_id>"
}'

JavaScript SDK

import { createPolicy } from '@dynamic-labs-sdk/client/waas';

const walletId = '<wallet_id>';
const shareSetId = '<share_set_id>';

const layer = await createPolicy({
  scope: { walletId, shareSetId },
  chain: 'EVM',
  chainIds: [1, 8453],
  rules: { denyAddresses: ['0x...'] },
});

Remove a rule

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/signers/self/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "remove",
  "ruleId": "<existing_rule_id>",
  "shareSetId": "<share_set_id>"
}'

Signer-modifiable rules

To let a signer edit or remove a wallet or signer-layer rule later, set modifiableBySigner: true when you create or update the rule. The signer can only modify the rule’s constraint fields, such as addresses and valueLimit. They cannot change the rule type or security settings.

modifiableBySigner cannot be used on environment-scope rules, and it cannot be combined with disableBlockaidSecurityChecks or operationRestrictions.

Wallet-layer example

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Allow USDC with signer-editable limit",
    "ruleType": "allow",
    "chain": "EVM",
    "chainIds": [1],
    "addresses": ["0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"],
    "valueLimit": { "maxPerCall": "100000000000" },
    "modifiableBySigner": true
  }
}'

Signer-layer example

curl -X PATCH \
"https://app.dynamicauth.com/api/v0/sdk/<environment_id>/waas/<wallet_id>/signers/self/policy-layer" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer <your_token>" \
-d '{
  "op": "upsert",
  "rule": {
    "name": "Signer-editable allowlist",
    "ruleType": "allow",
    "chain": "EVM",
    "chainIds": [1],
    "addresses": ["0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"],
    "modifiableBySigner": true
  },
  "shareSetId": "<share_set_id>"
}'

Rule fields

For the fields used in the examples above, see Rule fields on the Policies overview page.