User API

The User API is a JSON-RPC 2.0 API for managing a user’s wallets, networks, identity providers, sessions, and transactions. The User UI is built on it, and you can call it directly from scripts, a backend, or a custom UI.

Base path: /api/v0/user (configurable via server.userPath)
Protocol: JSON-RPC 2.0
Authentication: JWT bearer token, except where noted below

Methods

Category	Method	Description
Sessions	`addSession()`	Create a new session (unauthenticated, used for the initial connection).
	`removeSession()`	End the current session.
	`listSessions()`	List sessions for the current user.
Networks	`listNetworks()`	List all configured networks.
	`addNetwork()`	Add a new network configuration.
	`removeNetwork()`	Remove a network configuration.
Identity providers	`listIdps()`	List all identity providers.
	`addIdp()`	Add a new identity provider.
	`removeIdp()`	Remove an identity provider.
Wallets	`createWallet()`	Create a new wallet (party) on a network.
	`listWallets()`	List all wallets for the current user.
	`setPrimaryWallet()`	Set the primary wallet.
	`removeWallet()`	Remove a wallet.
	`syncWallets()`	Sync wallets with the ledger.
	`isWalletSyncNeeded()`	Check whether a wallet sync is needed.
Transactions	`sign()`	Sign a transaction.
	`execute()`	Execute a signed transaction.
	`getTransaction()`	Get a transaction by ID.
	`listTransactions()`	List transactions.

Authentication

Most methods require a JWT in the Authorization header:

Authorization: Bearer <jwt-token>

The following methods are available without authentication, so a client can bootstrap a connection:

addSession()
listNetworks()
listIdps()

Full specification

The complete OpenRPC specification is available at openrpc-user-api.json.

Rate limiting

Requests are rate-limited to prevent abuse. Configure the limits in the server settings. Responses include:

X-RateLimit-Limit: maximum requests per window.
X-RateLimit-Remaining: remaining requests in the current window.
X-RateLimit-Reset: when the limit resets.

CORS

Cross-origin access is controlled by server.allowedOrigins. It defaults to ["*"]; in production, restrict it to known origins. See Configure the Wallet Gateway.

Overview

Wallet Gateway

Wallets and Exchanges

Ecosystem

Release Notes

Methods

Authentication

Full specification

Rate limiting

CORS

​Methods

​Authentication

​Full specification

​Rate limiting

​CORS

Methods

Authentication

Full specification

Rate limiting

CORS