Overview

An API User with a registered ECDSA P-256 public key can satisfy policy approval steps without ApproverApp. Your service polls Vault, evaluates each intent, and posts approve or reject with that user's cwp_ key. Human initiators still confirm in ApproverApp when policy requires it.

📘

Deprecated webhook integration

wallet.yaml automated_approvers (Vault pushing to POST {url}/confirm) is deprecated. Use fetch-based polling only. Do not use the same public key for both.

Setup

1. Create an API User and cwp_ API key. See API User.
2. Generate an ECDSA P-256 key pair in your service. Register the public key with [POST /api/cwp/operations/start/setUserPublicKey](https://vault.docs.blockdaemon.com/reference/cwpstartsetuserpublickey) (UserID = email, PublicKey = base64 uncompressed 65-byte key). Poll GET /api/cwp/operations/id/{operationID}/status until the operation succeeds.
3. Add the API User to an approver group and require that group in a Transaction Restriction.

The pending queue is per API User, not per group. Run one service identity per approver slot in policy. Group or restriction changes may still need confirmation in ApproverApp under your Config or Policy Restrictions.

Approvals API

Base URL: https://<your-vault-host>/api/cwp. Authenticate with Authorization: Bearer cwp_.... Vault derives the approver from the API key; do not send UserID in request bodies.

List entries contain OperationID, OperationType, and base64 Intent. To approve: base64-decode Intent, run your policy checks, P-256-sign the exact decoded bytes, then post:

{
  "OperationID": "<operation-id>",
  "IntentSignature": "<base64 signature>"
}

Poll on an interval or wake on GET /api/cwp/events WebSocket hints when enabled.

Reference implementation

automated-approver-service polls list, signs make transaction and legacy transfer intents, and exposes checkMakeTransactionIntent in approval-service/server.go for custom policy hooks. Configure cwp_base_url, api_key, and private_key (base64 ASN.1 DER). Extend checks before production use.