DocsAPI ReferenceLogin
Wallet

Rotate the on-chain authority to a registered replacement credential

Credential-lifecycle rotation: register the replacement credential first (approval flow), then the current key authorizes on-chain `update_authority` here. The old credential is revoked in DB only after the chain confirms the new authority.

POST
/wallet/rotate

Credential-lifecycle rotation: register the replacement credential first (approval flow), then the current key authorizes on-chain update_authority here. The old credential is revoked in DB only after the chain confirms the new authority.

Authorization

cookieAuth
pid_access<token>

JWT access token set by /auth/google/callback or /auth/refresh

In: cookie

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/wallet/rotate" \  -H "Content-Type: application/json" \  -d '{    "oldCredentialId": "string",    "newCredentialId": "string",    "nonce": "string",    "expiry": 0,    "assertion": {      "id": "string",      "signature": "string",      "authenticatorData": "string",      "clientDataJSON": "string"    }  }'
{  "signature": "string",  "status": "confirmed"}

Create a withdrawal intent POST

Validates and persists a desired withdrawal (WITHDRAW_SOL / WITHDRAW_TOKEN) for the authenticated PID's smart account. Policy: account + registered passkey required, amount > 0, valid destination, destination != the smart account. The intent is single-use and expires (PRD_v4 §22) — reusing or exceeding it is rejected.

Record a submitted on-chain transaction POST

Records the on-chain submission against a pending, unexpired intent and marks it executed (single-use replay protection). Submission itself happens through the SDK/adapter.