{ "info": { "_postman_id": "aecd07ea-8bbd-49bc-884c-e3840e3a6fb4", "name": "Grid Agent Management Embedded Wallet Auth API", "description": "API for managing global payments on the open Money Grid. Built by Lightspark. See the full documentation at https://docs.lightspark.com/.\n\n\nContact Support:\n Name: Lightspark Support\n Email: support@lightspark.com", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "lastUpdatedBy": "35240", "uid": "35240-aecd07ea-8bbd-49bc-884c-e3840e3a6fb4" }, "item": [ { "name": "auth", "item": [ { "name": "credentials", "item": [ { "name": "{id}", "item": [ { "name": "verify", "item": [ { "name": "Verify an authentication credential", "id": "16dbf14e-9173-48aa-afb7-708bc607c6a0", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}", "type": "string" }, { "key": "password", "value": "{{basicAuthPassword}}", "type": "string" } ] }, "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the TEK (Target Encryption Key) keypair the client generated for this login. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification. Not used by `OAUTH` or `PASSKEY` verification, which complete in a single call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response from this endpoint, echoed back exactly here so the server can correlate the signed retry with the issued challenge. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification; must be paired with `Grid-Wallet-Signature`. For `PASSKEY` verification, the `requestId` issued from `POST /auth/credentials/{id}/challenge` is echoed here instead so the server can correlate the assertion with the pending challenge.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"encryptedOtpBundle\": \"\",\n \"type\": \"PASSKEY\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials/:id/verify", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id", "verify" ], "variable": [ { "id": "342a2519-e65c-4573-892a-aaae341e2af9", "key": "id", "value": "", "description": "(Required) The id of the authentication credential to verify (the `id` field of the `AuthMethod` returned from `POST /auth/credentials`)." } ] }, "description": "Complete the verification step for a previously created authentication credential and issue a session.\n\nFor `EMAIL_OTP` and `SMS_OTP` credentials, submit the `encryptedOtpBundle` produced by HPKE-encrypting `{otp_code, public_key}` under the `otpEncryptionTargetBundle` returned from registration when present, or from `POST /auth/credentials/{id}/challenge` when registration omitted it or the OTP must be reissued. The server is a pass-through and never sees the plaintext OTP code. On success the response is `202` with a `payloadToSign` carrying the `verificationToken` bound to the client's TEK public key \u2014 sign that token with the matching TEK private key, then retry the same request with the full stamp in `Grid-Wallet-Signature` and the `requestId` echoed in `Request-Id`. The signed retry returns `200` with the issued `AuthSession`. The TEK public key becomes the session API key on successful completion.\nIn sandbox mode, the OTP flow runs real HPKE end-to-end against a sandbox enclave keypair \u2014 clients build a real `encryptedOtpBundle` against the sandbox `otpEncryptionTargetBundle` and sign a real `verificationToken` with their TEK keypair. The only sandbox shortcut is the magic OTP code (`\"000000\"`) the user \"receives\" instead of a real email or SMS delivery.\n\nFor `OAUTH` credentials, supply a fresh OIDC token (`iat` must be less than 60 seconds before the request) along with the client-generated public key; this is also the reauthentication path after a prior session expired. The token identity (`iss`, `aud`, and `sub`) must match the OAuth credential being verified. In sandbox, the token's `nonce` must equal `sha256(clientPublicKey)`. For `PASSKEY` credentials, the client completes a WebAuthn assertion (`navigator.credentials.get()`) against the Grid-issued `challenge` returned from `POST /auth/credentials/{id}/challenge`, and submits the resulting `assertion` with the `Request-Id` header. The `clientPublicKey` for `PASSKEY` credentials is supplied on the challenge call, where it is bound into the pending session-creation request.\n\nOn success for `OAUTH` and `PASSKEY`, and on the signed retry for OTP credentials, the response contains an `AuthSession`. For `OAUTH` and `PASSKEY` the session signing key is delivered as `encryptedSessionSigningKey` (HPKE-sealed to the supplied `clientPublicKey`); for OTP credentials the client already holds the session signing key (the TEK private key it generated) and that field is omitted from the response. The `expiresAt` timestamp marks when the session expires.\n" }, "response": [ { "id": "031bb97d-b676-46ce-b849-8736353ccc63", "name": "Authentication credential verified and session issued", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the TEK (Target Encryption Key) keypair the client generated for this login. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification. Not used by `OAUTH` or `PASSKEY` verification, which complete in a single call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response from this endpoint, echoed back exactly here so the server can correlate the signed retry with the issued challenge. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification; must be paired with `Grid-Wallet-Signature`. For `PASSKEY` verification, the `requestId` issued from `POST /auth/credentials/{id}/challenge` is echoed here instead so the server can correlate the assertion with the pending challenge.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"encryptedOtpBundle\": \"\",\n \"type\": \"PASSKEY\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials/:id/verify", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id", "verify" ], "variable": [ { "key": "id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"accountId\": \"\",\n \"createdAt\": \"\",\n \"expiresAt\": \"\",\n \"id\": \"\",\n \"nickname\": \"\",\n \"type\": \"OAUTH\",\n \"updatedAt\": \"\",\n \"credentialId\": \"\",\n \"encryptedSessionSigningKey\": \"\"\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-031bb97d-b676-46ce-b849-8736353ccc63" }, { "id": "ecb3c055-fd53-47c0-a6b4-cbe4657a1d82", "name": "Verification challenge issued. Returned only for OTP credentials, on the first leg of the secure OTP login flow. Build an API-key stamp over `payloadToSign` (the `verificationToken`) with the TEK keypair the client generated for this login, then resubmit ", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the TEK (Target Encryption Key) keypair the client generated for this login. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification. Not used by `OAUTH` or `PASSKEY` verification, which complete in a single call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response from this endpoint, echoed back exactly here so the server can correlate the signed retry with the issued challenge. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification; must be paired with `Grid-Wallet-Signature`. For `PASSKEY` verification, the `requestId` issued from `POST /auth/credentials/{id}/challenge` is echoed here instead so the server can correlate the assertion with the pending challenge.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"encryptedOtpBundle\": \"\",\n \"type\": \"PASSKEY\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials/:id/verify", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id", "verify" ], "variable": [ { "key": "id" } ] } }, "status": "Accepted", "code": 202, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"expiresAt\": \"\",\n \"payloadToSign\": \"\",\n \"requestId\": \"\",\n \"type\": \"EMAIL_OTP\"\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-ecb3c055-fd53-47c0-a6b4-cbe4657a1d82" }, { "id": "3f47fd90-9351-4e07-9be6-27f8abaa78a7", "name": "Bad request", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the TEK (Target Encryption Key) keypair the client generated for this login. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification. Not used by `OAUTH` or `PASSKEY` verification, which complete in a single call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response from this endpoint, echoed back exactly here so the server can correlate the signed retry with the issued challenge. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification; must be paired with `Grid-Wallet-Signature`. For `PASSKEY` verification, the `requestId` issued from `POST /auth/credentials/{id}/challenge` is echoed here instead so the server can correlate the assertion with the pending challenge.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"encryptedOtpBundle\": \"\",\n \"type\": \"PASSKEY\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials/:id/verify", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id", "verify" ], "variable": [ { "key": "id" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 400,\n \"code\": \"INVITATION_ALREADY_CLAIMED\",\n \"details\": {\n \"labore56\": -49913018.2180405,\n \"dolor1\": -19111154.999864995,\n \"aute5f6\": 27210025\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-3f47fd90-9351-4e07-9be6-27f8abaa78a7" }, { "id": "4070991d-918c-43ea-ba15-02e1d45d6ddb", "name": "Unauthorized. Returned for an invalid or expired OTP (`EMAIL_OTP` or `SMS_OTP`), for an OIDC token whose signature, issuer, identity, nonce, or `iat` freshness check failed (`OAUTH`), or for a WebAuthn assertion whose signature, challenge, or credential m", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the TEK (Target Encryption Key) keypair the client generated for this login. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification. Not used by `OAUTH` or `PASSKEY` verification, which complete in a single call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response from this endpoint, echoed back exactly here so the server can correlate the signed retry with the issued challenge. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification; must be paired with `Grid-Wallet-Signature`. For `PASSKEY` verification, the `requestId` issued from `POST /auth/credentials/{id}/challenge` is echoed here instead so the server can correlate the assertion with the pending challenge.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"encryptedOtpBundle\": \"\",\n \"type\": \"PASSKEY\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials/:id/verify", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id", "verify" ], "variable": [ { "key": "id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 401,\n \"code\": \"REQUEST_ID_MISSING\",\n \"details\": {\n \"irureff7\": -18977771.539527938,\n \"laborum_fe\": -46448813.40391738\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-4070991d-918c-43ea-ba15-02e1d45d6ddb" }, { "id": "d0b1ff80-b7cc-4342-b4d5-02484d502834", "name": "Authentication credential not found", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the TEK (Target Encryption Key) keypair the client generated for this login. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification. Not used by `OAUTH` or `PASSKEY` verification, which complete in a single call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response from this endpoint, echoed back exactly here so the server can correlate the signed retry with the issued challenge. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification; must be paired with `Grid-Wallet-Signature`. For `PASSKEY` verification, the `requestId` issued from `POST /auth/credentials/{id}/challenge` is echoed here instead so the server can correlate the assertion with the pending challenge.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"encryptedOtpBundle\": \"\",\n \"type\": \"PASSKEY\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials/:id/verify", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id", "verify" ], "variable": [ { "key": "id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 404,\n \"code\": \"TOKEN_NOT_FOUND\",\n \"details\": {\n \"nostrud5ea\": \"Ut culpa anim laborum esse\",\n \"dolor2\": \"dolor dolore esse\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-d0b1ff80-b7cc-4342-b4d5-02484d502834" }, { "id": "9ab7b37e-31f5-4ecd-b47a-c461329a914c", "name": "Too many requests. Returned with `RATE_LIMITED` when verification attempts for this credential happen too frequently (for example, repeated bad OTPs or rapid-fire reauthentication retries). Clients should back off and retry after the interval indicated by", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the TEK (Target Encryption Key) keypair the client generated for this login. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification. Not used by `OAUTH` or `PASSKEY` verification, which complete in a single call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response from this endpoint, echoed back exactly here so the server can correlate the signed retry with the issued challenge. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification; must be paired with `Grid-Wallet-Signature`. For `PASSKEY` verification, the `requestId` issued from `POST /auth/credentials/{id}/challenge` is echoed here instead so the server can correlate the assertion with the pending challenge.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"encryptedOtpBundle\": \"\",\n \"type\": \"PASSKEY\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials/:id/verify", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id", "verify" ], "variable": [ { "key": "id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": false, "description": { "content": "Number of seconds to wait before retrying the request.", "type": "text/plain" }, "key": "Retry-After", "value": "" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 429,\n \"code\": \"RATE_LIMITED\",\n \"details\": {\n \"Lorem46\": \"laboris esse sed\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-9ab7b37e-31f5-4ecd-b47a-c461329a914c" }, { "id": "6750eb43-121c-4ff8-a16c-9f8c91b11c27", "name": "Internal service error", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the TEK (Target Encryption Key) keypair the client generated for this login. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification. Not used by `OAUTH` or `PASSKEY` verification, which complete in a single call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response from this endpoint, echoed back exactly here so the server can correlate the signed retry with the issued challenge. Required on the signed retry that completes an `EMAIL_OTP` or `SMS_OTP` verification; must be paired with `Grid-Wallet-Signature`. For `PASSKEY` verification, the `requestId` issued from `POST /auth/credentials/{id}/challenge` is echoed here instead so the server can correlate the assertion with the pending challenge.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"encryptedOtpBundle\": \"\",\n \"type\": \"PASSKEY\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials/:id/verify", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id", "verify" ], "variable": [ { "key": "id" } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 500,\n \"code\": \"GRID_SWITCH_ERROR\",\n \"details\": {\n \"eiusmodd97\": \"sit\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-6750eb43-121c-4ff8-a16c-9f8c91b11c27" } ], "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-16dbf14e-9173-48aa-afb7-708bc607c6a0" } ], "id": "bf4d17fb-49e1-4bf8-8c24-9b211093e42d", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-bf4d17fb-49e1-4bf8-8c24-9b211093e42d" }, { "name": "challenge", "item": [ { "name": "Re-issue an authentication credential challenge", "id": "04a40eb8-afc9-4407-abf1-4f33db19862a", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}", "type": "string" }, { "key": "password", "value": "{{basicAuthPassword}}", "type": "string" } ] }, "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"clientPublicKey\": \"04462e0ad0c2f43e4C8ef4D0fB74920104FF0df0ebE8Aa13Ab1BFAbcCff9ec19fEd7b9fd9B432997bF8AbdedDA454CC05acF7B61DeCaAdfC4Fb9BCBbBc8E46c3D3\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials/:id/challenge", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id", "challenge" ], "variable": [ { "id": "7ecdeb65-68aa-4a46-9ad1-d019b307be67", "key": "id", "value": "", "description": "(Required) The id of the authentication credential to re-challenge (the `id` field of the `AuthMethod` returned from `POST /auth/credentials`)." } ] }, "description": "Re-issue the challenge for an existing authentication credential.\n\nFor `EMAIL_OTP` and `SMS_OTP` credentials, this triggers a new one-time password to the contact on file and returns a fresh `otpEncryptionTargetBundle` for the client to HPKE-encrypt the OTP attempt against. After the user receives the new OTP, build the `encryptedOtpBundle` under the new target bundle and call `POST /auth/credentials/{id}/verify` to begin the secure OTP login flow.\n\n`OAUTH` credentials do not have a challenge step. To authenticate or reauthenticate an OAuth credential, call `POST /auth/credentials/{id}/verify` with a fresh OIDC token and a `clientPublicKey`.\n\nFor `PASSKEY` credentials, this issues a fresh Grid reauthentication challenge. The request body must carry the client's ephemeral `clientPublicKey` so Grid can bake it into the session-creation payload the returned challenge is computed from \u2014 this seals the resulting session signing key to the client. The response is a `PasskeyAuthChallenge` \u2014 the passkey auth method fields plus the WebAuthn `credentialId`, new `challenge`, `requestId`, and `expiresAt`. The `challenge` value is the lowercase hex-encoded SHA-256 digest of the canonical session-creation body, not a base64url string. The client base64url-decodes `credentialId` for `allowCredentials[].id` and UTF-8 encodes `challenge` (for example, `new TextEncoder().encode(challenge)`) as the WebAuthn challenge in `navigator.credentials.get()`, then submits the resulting assertion to `POST /auth/credentials/{id}/verify` with `Request-Id: ` to receive a session.\n" }, "response": [ { "id": "aed22836-e808-405f-be68-cfa3b2c11459", "name": "Challenge re-issued for the authentication credential. For `EMAIL_OTP` and `SMS_OTP` the body is a plain `AuthMethod` and a new OTP has been sent. For `PASSKEY` the body is a `PasskeyAuthChallenge` carrying the passkey `credentialId`, freshly issued `chal", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"clientPublicKey\": \"04462e0ad0c2f43e4C8ef4D0fB74920104FF0df0ebE8Aa13Ab1BFAbcCff9ec19fEd7b9fd9B432997bF8AbdedDA454CC05acF7B61DeCaAdfC4Fb9BCBbBc8E46c3D3\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials/:id/challenge", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id", "challenge" ], "variable": [ { "key": "id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"accountId\": \"\",\n \"type\": \"EMAIL_OTP\",\n \"nickname\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\",\n \"credentialId\": \"\",\n \"otpEncryptionTargetBundle\": \"\"\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-aed22836-e808-405f-be68-cfa3b2c11459" }, { "id": "b727f8f6-353a-424b-9eaf-b6f95572091a", "name": "Bad request", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"clientPublicKey\": \"04462e0ad0c2f43e4C8ef4D0fB74920104FF0df0ebE8Aa13Ab1BFAbcCff9ec19fEd7b9fd9B432997bF8AbdedDA454CC05acF7B61DeCaAdfC4Fb9BCBbBc8E46c3D3\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials/:id/challenge", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id", "challenge" ], "variable": [ { "key": "id" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 400,\n \"code\": \"INVITATION_ALREADY_CLAIMED\",\n \"details\": {\n \"labore56\": -49913018.2180405,\n \"dolor1\": -19111154.999864995,\n \"aute5f6\": 27210025\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-b727f8f6-353a-424b-9eaf-b6f95572091a" }, { "id": "dd276ca8-2475-4b7b-b55e-b2a805d98892", "name": "Unauthorized", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"clientPublicKey\": \"04462e0ad0c2f43e4C8ef4D0fB74920104FF0df0ebE8Aa13Ab1BFAbcCff9ec19fEd7b9fd9B432997bF8AbdedDA454CC05acF7B61DeCaAdfC4Fb9BCBbBc8E46c3D3\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials/:id/challenge", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id", "challenge" ], "variable": [ { "key": "id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 401,\n \"code\": \"REQUEST_ID_MISSING\",\n \"details\": {\n \"irureff7\": -18977771.539527938,\n \"laborum_fe\": -46448813.40391738\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-dd276ca8-2475-4b7b-b55e-b2a805d98892" }, { "id": "cefb3d91-5a11-4660-809e-78ed16a5f66b", "name": "Authentication credential not found", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"clientPublicKey\": \"04462e0ad0c2f43e4C8ef4D0fB74920104FF0df0ebE8Aa13Ab1BFAbcCff9ec19fEd7b9fd9B432997bF8AbdedDA454CC05acF7B61DeCaAdfC4Fb9BCBbBc8E46c3D3\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials/:id/challenge", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id", "challenge" ], "variable": [ { "key": "id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 404,\n \"code\": \"TOKEN_NOT_FOUND\",\n \"details\": {\n \"nostrud5ea\": \"Ut culpa anim laborum esse\",\n \"dolor2\": \"dolor dolore esse\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-cefb3d91-5a11-4660-809e-78ed16a5f66b" }, { "id": "bb0421b6-51a6-4d3e-8bd7-7f4bd42547b2", "name": "Too many requests. Returned with `RATE_LIMITED` when challenge re-issues are requested more frequently than the credential challenge rate limit allows. Clients should back off and retry after the interval indicated by the `Retry-After` response header.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"clientPublicKey\": \"04462e0ad0c2f43e4C8ef4D0fB74920104FF0df0ebE8Aa13Ab1BFAbcCff9ec19fEd7b9fd9B432997bF8AbdedDA454CC05acF7B61DeCaAdfC4Fb9BCBbBc8E46c3D3\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials/:id/challenge", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id", "challenge" ], "variable": [ { "key": "id" } ] } }, "status": "Too Many Requests", "code": 429, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": false, "description": { "content": "Number of seconds to wait before retrying the request.", "type": "text/plain" }, "key": "Retry-After", "value": "" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 429,\n \"code\": \"RATE_LIMITED\",\n \"details\": {\n \"Lorem46\": \"laboris esse sed\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-bb0421b6-51a6-4d3e-8bd7-7f4bd42547b2" }, { "id": "e601ed1c-f358-4973-83a0-7c1a9c86c0bc", "name": "Internal service error", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"clientPublicKey\": \"04462e0ad0c2f43e4C8ef4D0fB74920104FF0df0ebE8Aa13Ab1BFAbcCff9ec19fEd7b9fd9B432997bF8AbdedDA454CC05acF7B61DeCaAdfC4Fb9BCBbBc8E46c3D3\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials/:id/challenge", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id", "challenge" ], "variable": [ { "key": "id" } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 500,\n \"code\": \"GRID_SWITCH_ERROR\",\n \"details\": {\n \"eiusmodd97\": \"sit\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-e601ed1c-f358-4973-83a0-7c1a9c86c0bc" } ], "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-04a40eb8-afc9-4407-abf1-4f33db19862a" } ], "id": "0475a4e6-0658-4f46-9d04-145745b5e43d", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-0475a4e6-0658-4f46-9d04-145745b5e43d" }, { "name": "Revoke an authentication credential", "id": "597caa4c-1d1f-408a-8403-4235792b09aa", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}", "type": "string" }, { "key": "password", "value": "{{basicAuthPassword}}", "type": "string" } ] }, "method": "DELETE", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of an existing verified authentication credential on the same internal account (other than the one being revoked). Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/auth/credentials/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id" ], "variable": [ { "id": "8ba42dc5-8a0b-4941-b416-ed1b68782d49", "key": "id", "value": "", "description": "(Required) The id of the authentication credential to revoke (the `id` field of the `AuthMethod` returned from `POST /auth/credentials`)." } ] }, "description": "Revoke an authentication credential on an Embedded Wallet internal account.\n\nRevocation is a two-step flow because it must be authorized by a session on a *different* credential on the same internal account:\n\n1. Call `DELETE /auth/credentials/{id}` with no headers. The response is `202` with a `payloadToSign`, `requestId`, and `expiresAt`.\n\n2. Use the session API keypair of an existing verified credential on the same internal account \u2014 other than the one being revoked \u2014 to build an API-key stamp over `payloadToSign`, then retry the same `DELETE` request with that full stamp as the `Grid-Wallet-Signature` header and the `requestId` echoed back as the `Request-Id` header. The signed retry returns `204`.\n\nThe account must retain at least one authentication credential; an account with only a single credential cannot use this endpoint to revoke it.\n" }, "response": [ { "id": "726ad5fd-6844-4012-a0c7-d5333fe9d549", "name": "Challenge issued. The response contains `payloadToSign` plus a `requestId`. Build an API-key stamp over `payloadToSign` with the session API keypair of an existing verified credential on the same internal account (other than the one being revoked), then e", "originalRequest": { "method": "DELETE", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of an existing verified authentication credential on the same internal account (other than the one being revoked). Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/credentials/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Accepted", "code": 202, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"expiresAt\": \"\",\n \"payloadToSign\": \"\",\n \"requestId\": \"\",\n \"type\": \"EMAIL_OTP\"\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-726ad5fd-6844-4012-a0c7-d5333fe9d549" }, { "id": "1a7c5049-e700-4dff-8411-969f27f85a58", "name": "Authentication credential revoked successfully.", "originalRequest": { "method": "DELETE", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of an existing verified authentication credential on the same internal account (other than the one being revoked). Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/credentials/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "No Content", "code": 204, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-1a7c5049-e700-4dff-8411-969f27f85a58" }, { "id": "30a6a968-6a29-4e53-ad31-acd61fd23d4b", "name": "Bad request. Also returned when the target internal account has only a single authentication credential, which cannot be revoked via this endpoint.", "originalRequest": { "method": "DELETE", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of an existing verified authentication credential on the same internal account (other than the one being revoked). Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/credentials/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 400,\n \"code\": \"INVITATION_ALREADY_CLAIMED\",\n \"details\": {\n \"labore56\": -49913018.2180405,\n \"dolor1\": -19111154.999864995,\n \"aute5f6\": 27210025\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-30a6a968-6a29-4e53-ad31-acd61fd23d4b" }, { "id": "119038fc-0f88-487e-b93d-2713b9644993", "name": "Unauthorized. Returned when the provided `Grid-Wallet-Signature` is missing, malformed, or does not match a pending revocation challenge for this credential, or when the `Request-Id` does not match an unexpired pending challenge.", "originalRequest": { "method": "DELETE", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of an existing verified authentication credential on the same internal account (other than the one being revoked). Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/credentials/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 401,\n \"code\": \"REQUEST_ID_MISSING\",\n \"details\": {\n \"irureff7\": -18977771.539527938,\n \"laborum_fe\": -46448813.40391738\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-119038fc-0f88-487e-b93d-2713b9644993" }, { "id": "688b2881-bf80-49b6-a5e3-49ddf075a69c", "name": "Authentication credential not found", "originalRequest": { "method": "DELETE", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of an existing verified authentication credential on the same internal account (other than the one being revoked). Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/credentials/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 404,\n \"code\": \"TOKEN_NOT_FOUND\",\n \"details\": {\n \"nostrud5ea\": \"Ut culpa anim laborum esse\",\n \"dolor2\": \"dolor dolore esse\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-688b2881-bf80-49b6-a5e3-49ddf075a69c" }, { "id": "e50c7aa0-b78c-403d-8966-1b0a04fe2f96", "name": "Internal service error", "originalRequest": { "method": "DELETE", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of an existing verified authentication credential on the same internal account (other than the one being revoked). Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/credentials/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 500,\n \"code\": \"GRID_SWITCH_ERROR\",\n \"details\": {\n \"eiusmodd97\": \"sit\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-e50c7aa0-b78c-403d-8966-1b0a04fe2f96" } ], "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-597caa4c-1d1f-408a-8403-4235792b09aa" } ], "id": "179b1078-2860-47ad-9197-2a17a3c86634", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-179b1078-2860-47ad-9197-2a17a3c86634" }, { "name": "Create an authentication credential", "id": "db22c3a3-c5ca-4f46-a316-960e161a844b", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}", "type": "string" }, { "key": "password", "value": "{{basicAuthPassword}}", "type": "string" } ] }, "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of an existing verified authentication credential on the target internal account. Required on the signed retry.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry when registering a credential; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"accountId\": \"\",\n \"type\": \"EMAIL_OTP\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials" ] }, "description": "Register an authentication credential for an Embedded Wallet customer.\n\nEmbedded Wallet internal accounts are initialized with an `EMAIL_OTP` credential tied to the customer email on the account. Use this endpoint to add another credential (`SMS_OTP`, `OAUTH`, or `PASSKEY`), or to add `EMAIL_OTP` / `SMS_OTP` back after it has been removed. Only one `EMAIL_OTP` and one `SMS_OTP` credential are supported per internal account; multiple distinct `PASSKEY` credentials may be registered.\n\nAdding a credential requires a signature from an existing verified credential on the same account. Call this endpoint with the new credential's details to receive `202` with `payloadToSign` and `requestId`. Use the session API keypair of an existing verified credential (decrypted client-side from its `encryptedSessionSigningKey`) to build an API-key stamp over `payloadToSign`, then retry the same request with that full stamp as the `Grid-Wallet-Signature` header and the `requestId` echoed back as the `Request-Id` header. The signed retry returns `201` with the created `AuthMethod`. For OTP credentials, the one-time password is triggered on the signed retry, and the credential must then be activated via `POST /auth/credentials/{id}/verify`.\n" }, "response": [ { "id": "43ece6d8-85df-4374-b9a4-1c0cfb59c176", "name": "Authentication credential created successfully. The body is the created `AuthMethod`. For `EMAIL_OTP`, the nickname is the customer email tied to the internal account; for `SMS_OTP`, it is the customer phone number. OTP responses that trigger a secure OTP", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of an existing verified authentication credential on the target internal account. Required on the signed retry.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry when registering a credential; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"accountId\": \"\",\n \"type\": \"EMAIL_OTP\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials" ] } }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"accountId\": \"\",\n \"type\": \"EMAIL_OTP\",\n \"nickname\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\",\n \"credentialId\": \"\",\n \"otpEncryptionTargetBundle\": \"\"\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-43ece6d8-85df-4374-b9a4-1c0cfb59c176" }, { "id": "85e00cfb-e038-4df6-ab31-aecd26dd36f0", "name": "Challenge issued. Build an API-key stamp over `payloadToSign` with the session API keypair of an existing verified credential on the same internal account, then send that full stamp as `Grid-Wallet-Signature` and echo `requestId` as `Request-Id` on the re", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of an existing verified authentication credential on the target internal account. Required on the signed retry.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry when registering a credential; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"accountId\": \"\",\n \"type\": \"EMAIL_OTP\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials" ] } }, "status": "Accepted", "code": 202, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"expiresAt\": \"\",\n \"payloadToSign\": \"\",\n \"requestId\": \"\",\n \"type\": \"EMAIL_OTP\"\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-85e00cfb-e038-4df6-ab31-aecd26dd36f0" }, { "id": "c199693d-b528-4405-8958-53bdcfcb1ef2", "name": "Bad request. Returned with `EMAIL_OTP_CREDENTIAL_ALREADY_EXISTS` when registering an email OTP credential while one already exists, `SMS_OTP_CREDENTIAL_ALREADY_EXISTS` when registering an SMS OTP credential while one already exists, `PASSKEY_CREDENTIAL_AL", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of an existing verified authentication credential on the target internal account. Required on the signed retry.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry when registering a credential; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"accountId\": \"\",\n \"type\": \"EMAIL_OTP\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 400,\n \"code\": \"INVITATION_ALREADY_CLAIMED\",\n \"details\": {\n \"labore56\": -49913018.2180405,\n \"dolor1\": -19111154.999864995,\n \"aute5f6\": 27210025\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-c199693d-b528-4405-8958-53bdcfcb1ef2" }, { "id": "160a4712-d029-4ff8-8f4d-7300a441d039", "name": "Unauthorized. Returned when the provided `Grid-Wallet-Signature` is missing, malformed, or does not match a pending challenge for an additional credential on the target internal account, when the `Request-Id` does not match an unexpired pending challenge,", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of an existing verified authentication credential on the target internal account. Required on the signed retry.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry when registering a credential; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"accountId\": \"\",\n \"type\": \"EMAIL_OTP\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 401,\n \"code\": \"REQUEST_ID_MISSING\",\n \"details\": {\n \"irureff7\": -18977771.539527938,\n \"laborum_fe\": -46448813.40391738\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-160a4712-d029-4ff8-8f4d-7300a441d039" }, { "id": "147e767b-41b2-4bbe-944c-8b5ed252af63", "name": "Internal account not found", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of an existing verified authentication credential on the target internal account. Required on the signed retry.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry when registering a credential; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"accountId\": \"\",\n \"type\": \"EMAIL_OTP\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials" ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 404,\n \"code\": \"TOKEN_NOT_FOUND\",\n \"details\": {\n \"nostrud5ea\": \"Ut culpa anim laborum esse\",\n \"dolor2\": \"dolor dolore esse\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-147e767b-41b2-4bbe-944c-8b5ed252af63" }, { "id": "94dc3683-94e6-4479-8a33-0b34d0ca2bdd", "name": "Internal service error", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of an existing verified authentication credential on the target internal account. Required on the signed retry.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry when registering a credential; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"accountId\": \"\",\n \"type\": \"EMAIL_OTP\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/credentials", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials" ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 500,\n \"code\": \"GRID_SWITCH_ERROR\",\n \"details\": {\n \"eiusmodd97\": \"sit\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-94dc3683-94e6-4479-8a33-0b34d0ca2bdd" } ], "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-db22c3a3-c5ca-4f46-a316-960e161a844b" }, { "name": "List authentication credentials", "id": "dcd50cad-e15b-42bd-8975-5d6c5d82231e", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}", "type": "string" }, { "key": "password", "value": "{{basicAuthPassword}}", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/auth/credentials?accountId=", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials" ], "query": [ { "description": "(Required) Internal account id whose authentication credentials to list.", "key": "accountId", "value": "" } ] }, "description": "Retrieve all authentication credentials registered on an Embedded Wallet internal account.\n\nThe response is not paginated: an internal account is expected to have a small, bounded number of credentials (typically 1\u20135), so all results are returned inline. Additional per-credential detail (such as active session expiry) is available on `GET /auth/sessions`." }, "response": [ { "id": "e51ce87f-db09-4513-9c39-d0c537561f39", "name": "Authentication credentials registered on the internal account. Returns an empty `data` array when the internal account has no credentials or when `accountId` does not match any internal account visible to the caller.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/credentials?accountId=", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials" ], "query": [ { "description": "(Required) Internal account id whose authentication credentials to list.", "key": "accountId", "value": "" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": [\n {\n \"id\": \"\",\n \"accountId\": \"\",\n \"type\": \"SMS_OTP\",\n \"nickname\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\",\n \"credentialId\": \"\"\n },\n {\n \"id\": \"\",\n \"accountId\": \"\",\n \"type\": \"SMS_OTP\",\n \"nickname\": \"\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\",\n \"credentialId\": \"\"\n }\n ]\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-e51ce87f-db09-4513-9c39-d0c537561f39" }, { "id": "0006be00-4320-48d3-bfb5-b9a06ff39f66", "name": "Bad request. Returned with `INVALID_INPUT` when the `accountId` query parameter is missing or not a valid `InternalAccount:` identifier.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/credentials?accountId=", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials" ], "query": [ { "description": "(Required) Internal account id whose authentication credentials to list.", "key": "accountId", "value": "" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 400,\n \"code\": \"INVITATION_ALREADY_CLAIMED\",\n \"details\": {\n \"labore56\": -49913018.2180405,\n \"dolor1\": -19111154.999864995,\n \"aute5f6\": 27210025\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-0006be00-4320-48d3-bfb5-b9a06ff39f66" }, { "id": "0b170d08-c517-4414-bf15-6d701e7e3fde", "name": "Unauthorized", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/credentials?accountId=", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials" ], "query": [ { "description": "(Required) Internal account id whose authentication credentials to list.", "key": "accountId", "value": "" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 401,\n \"code\": \"REQUEST_ID_MISSING\",\n \"details\": {\n \"irureff7\": -18977771.539527938,\n \"laborum_fe\": -46448813.40391738\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-0b170d08-c517-4414-bf15-6d701e7e3fde" }, { "id": "8fc05b23-6547-4fd3-8133-d7f11e059052", "name": "Internal service error", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/credentials?accountId=", "host": [ "{{baseUrl}}" ], "path": [ "auth", "credentials" ], "query": [ { "description": "(Required) Internal account id whose authentication credentials to list.", "key": "accountId", "value": "" } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 500,\n \"code\": \"GRID_SWITCH_ERROR\",\n \"details\": {\n \"eiusmodd97\": \"sit\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-8fc05b23-6547-4fd3-8133-d7f11e059052" } ], "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-dcd50cad-e15b-42bd-8975-5d6c5d82231e" } ], "id": "df0ff2b3-92cc-453d-9de1-8b85ac4f4187", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-df0ff2b3-92cc-453d-9de1-8b85ac4f4187" }, { "name": "sessions", "item": [ { "name": "{id}", "item": [ { "name": "refresh", "item": [ { "name": "Refresh an authentication session", "id": "03b0067c-070b-41e1-804c-c77b8356b442", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}", "type": "string" }, { "key": "password", "value": "{{basicAuthPassword}}", "type": "string" } ] }, "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the current session API keypair. Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in the prior `202` response, echoed back on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"clientPublicKey\": \"049fdDF18fAa1f9da6aD94af5aF7Bb043de5284e0c0FD4Fd71E3FcfCB2bF56FcA39Bbdffef7eCE825A7CC3Fdc25EbfBcCF2B046Ce7cF8bC108E070e0188D48d28e\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/sessions/:id/refresh", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions", ":id", "refresh" ], "variable": [ { "id": "baf4de22-7aa2-4e61-982e-b7e0391d5154", "key": "id", "value": "", "description": "(Required) The id of the active session to refresh." } ] }, "description": "Refresh an active Embedded Wallet auth session and create a new session signing key. Session refresh is a two-step signed-retry flow:\n\n1. Call `POST /auth/sessions/{id}/refresh` with the request body `{ \"clientPublicKey\": \"04...\" }` and no signature headers. Grid builds a Grid session-refresh payload, binds the supplied `clientPublicKey` into that payload, persists it as a pending request, and returns `202` with `payloadToSign`, `requestId`, and `expiresAt`.\n\n2. Sign `payloadToSign` with the current session signing key, then retry the same request with the full API-key stamp as `Grid-Wallet-Signature`, the `requestId` echoed back as `Request-Id`, and the same `clientPublicKey` in the request body. On success, Grid returns a new `AuthSession` with an `encryptedSessionSigningKey` sealed to that client public key.\n\nThe original session must still be active on both steps so it can authorize the refresh. If the session has already expired, use the credential reauthentication flow instead.\n" }, "response": [ { "id": "02128ff4-f84b-4fbf-bfbf-a6a6a0879be0", "name": "New authentication session created successfully.", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the current session API keypair. Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in the prior `202` response, echoed back on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"clientPublicKey\": \"049fdDF18fAa1f9da6aD94af5aF7Bb043de5284e0c0FD4Fd71E3FcfCB2bF56FcA39Bbdffef7eCE825A7CC3Fdc25EbfBcCF2B046Ce7cF8bC108E070e0188D48d28e\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/sessions/:id/refresh", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions", ":id", "refresh" ], "variable": [ { "key": "id" } ] } }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"accountId\": \"\",\n \"createdAt\": \"\",\n \"expiresAt\": \"\",\n \"id\": \"\",\n \"nickname\": \"\",\n \"type\": \"OAUTH\",\n \"updatedAt\": \"\",\n \"credentialId\": \"\",\n \"encryptedSessionSigningKey\": \"\"\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-02128ff4-f84b-4fbf-bfbf-a6a6a0879be0" }, { "id": "300e3040-97e2-46e3-b933-df0be1cb3f69", "name": "Challenge issued. The response contains `payloadToSign` plus a `requestId`. Build an API-key stamp over `payloadToSign` with the current session API keypair, then echo `requestId` on the signed retry.", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the current session API keypair. Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in the prior `202` response, echoed back on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"clientPublicKey\": \"049fdDF18fAa1f9da6aD94af5aF7Bb043de5284e0c0FD4Fd71E3FcfCB2bF56FcA39Bbdffef7eCE825A7CC3Fdc25EbfBcCF2B046Ce7cF8bC108E070e0188D48d28e\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/sessions/:id/refresh", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions", ":id", "refresh" ], "variable": [ { "key": "id" } ] } }, "status": "Accepted", "code": 202, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"payloadToSign\": \"\",\n \"requestId\": \"\",\n \"expiresAt\": \"\"\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-300e3040-97e2-46e3-b933-df0be1cb3f69" }, { "id": "f31bcdb3-1a22-4f06-9755-e275c1ddf57b", "name": "Bad request", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the current session API keypair. Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in the prior `202` response, echoed back on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"clientPublicKey\": \"049fdDF18fAa1f9da6aD94af5aF7Bb043de5284e0c0FD4Fd71E3FcfCB2bF56FcA39Bbdffef7eCE825A7CC3Fdc25EbfBcCF2B046Ce7cF8bC108E070e0188D48d28e\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/sessions/:id/refresh", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions", ":id", "refresh" ], "variable": [ { "key": "id" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 400,\n \"code\": \"INVITATION_ALREADY_CLAIMED\",\n \"details\": {\n \"labore56\": -49913018.2180405,\n \"dolor1\": -19111154.999864995,\n \"aute5f6\": 27210025\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-f31bcdb3-1a22-4f06-9755-e275c1ddf57b" }, { "id": "b2374291-4fcd-476c-99ed-d7b8f1a61bf2", "name": "Unauthorized. Returned when the `BasicAuth` credentials are missing or invalid, when the target session is no longer active and cannot be used for refresh, when the signed retry omits `Grid-Wallet-Signature`, when the provided signature is malformed or do", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the current session API keypair. Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in the prior `202` response, echoed back on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"clientPublicKey\": \"049fdDF18fAa1f9da6aD94af5aF7Bb043de5284e0c0FD4Fd71E3FcfCB2bF56FcA39Bbdffef7eCE825A7CC3Fdc25EbfBcCF2B046Ce7cF8bC108E070e0188D48d28e\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/sessions/:id/refresh", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions", ":id", "refresh" ], "variable": [ { "key": "id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 401,\n \"code\": \"REQUEST_ID_MISSING\",\n \"details\": {\n \"irureff7\": -18977771.539527938,\n \"laborum_fe\": -46448813.40391738\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-b2374291-4fcd-476c-99ed-d7b8f1a61bf2" }, { "id": "acd900ee-7034-43e3-81bf-5cbcc67ef26c", "name": "Session not found", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the current session API keypair. Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in the prior `202` response, echoed back on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"clientPublicKey\": \"049fdDF18fAa1f9da6aD94af5aF7Bb043de5284e0c0FD4Fd71E3FcfCB2bF56FcA39Bbdffef7eCE825A7CC3Fdc25EbfBcCF2B046Ce7cF8bC108E070e0188D48d28e\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/sessions/:id/refresh", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions", ":id", "refresh" ], "variable": [ { "key": "id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 404,\n \"code\": \"TOKEN_NOT_FOUND\",\n \"details\": {\n \"nostrud5ea\": \"Ut culpa anim laborum esse\",\n \"dolor2\": \"dolor dolore esse\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-acd900ee-7034-43e3-81bf-5cbcc67ef26c" }, { "id": "21838b08-b6f8-4a91-9e65-7360292e49ea", "name": "Internal service error", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the current session API keypair. Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in the prior `202` response, echoed back on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"clientPublicKey\": \"049fdDF18fAa1f9da6aD94af5aF7Bb043de5284e0c0FD4Fd71E3FcfCB2bF56FcA39Bbdffef7eCE825A7CC3Fdc25EbfBcCF2B046Ce7cF8bC108E070e0188D48d28e\"\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/sessions/:id/refresh", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions", ":id", "refresh" ], "variable": [ { "key": "id" } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 500,\n \"code\": \"GRID_SWITCH_ERROR\",\n \"details\": {\n \"eiusmodd97\": \"sit\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-21838b08-b6f8-4a91-9e65-7360292e49ea" } ], "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-03b0067c-070b-41e1-804c-c77b8356b442" } ], "id": "57d5fb6d-9e32-4576-bc45-de0d55ec4c8e", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-57d5fb6d-9e32-4576-bc45-de0d55ec4c8e" }, { "name": "Revoke an authentication session", "id": "cc0063ad-eb78-49f5-b0f2-951b62b539f4", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}", "type": "string" }, { "key": "password", "value": "{{basicAuthPassword}}", "type": "string" } ] }, "method": "DELETE", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of a verified session on the same internal account. Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/auth/sessions/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions", ":id" ], "variable": [ { "id": "c02d27ab-bf6c-4e4f-a332-48467372277b", "key": "id", "value": "", "description": "(Required) The id of the session to revoke." } ] }, "description": "Revoke an authentication session on an Embedded Wallet internal account. Revocation is a two-step signed-retry flow:\n\n1. Call `DELETE /auth/sessions/{id}` with no headers. The response is `202` with a `payloadToSign`, `requestId`, and `expiresAt`.\n\n2. Use the session API keypair of a verified session on the same internal account (this can be the session being revoked, for self-logout) to build an API-key stamp over `payloadToSign`, then retry the same `DELETE` request with that full stamp as the `Grid-Wallet-Signature` header and the `requestId` echoed back as the `Request-Id` header. The signed retry returns `204`.\n\nSessions also expire on their own. `404` is returned whenever the `id` does not match an active session \u2014 whether the session was never issued, was already revoked by a prior call, or has expired past its `expiresAt`. The response code reflects the resource state, not an error in the client's flow: re-revoking an already-revoked or expired session is safe and idempotent at the user intent level.\n" }, "response": [ { "id": "942c2e3f-c7ec-44e2-8d3d-e3c3f92843cb", "name": "Challenge issued. The response contains `payloadToSign` plus a `requestId`. Build an API-key stamp over `payloadToSign` with the session API keypair of a verified session on the same internal account, then echo `requestId` on the retry.", "originalRequest": { "method": "DELETE", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of a verified session on the same internal account. Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/sessions/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Accepted", "code": 202, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"expiresAt\": \"\",\n \"payloadToSign\": \"\",\n \"requestId\": \"\",\n \"type\": \"EMAIL_OTP\"\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-942c2e3f-c7ec-44e2-8d3d-e3c3f92843cb" }, { "id": "920cdead-b321-4ea2-95b5-529962a48203", "name": "Session revoked successfully.", "originalRequest": { "method": "DELETE", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of a verified session on the same internal account. Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/sessions/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "No Content", "code": 204, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-920cdead-b321-4ea2-95b5-529962a48203" }, { "id": "5484f05b-194a-47bd-b457-2348672535a3", "name": "Bad request", "originalRequest": { "method": "DELETE", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of a verified session on the same internal account. Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/sessions/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 400,\n \"code\": \"INVITATION_ALREADY_CLAIMED\",\n \"details\": {\n \"labore56\": -49913018.2180405,\n \"dolor1\": -19111154.999864995,\n \"aute5f6\": 27210025\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-5484f05b-194a-47bd-b457-2348672535a3" }, { "id": "b5804c9e-8410-4144-8d68-fd785a2b11d9", "name": "Unauthorized. Returned when the provided `Grid-Wallet-Signature` is missing, malformed, or does not match a pending revocation challenge for this session, or when the `Request-Id` does not match an unexpired pending challenge.", "originalRequest": { "method": "DELETE", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of a verified session on the same internal account. Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/sessions/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 401,\n \"code\": \"REQUEST_ID_MISSING\",\n \"details\": {\n \"irureff7\": -18977771.539527938,\n \"laborum_fe\": -46448813.40391738\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-b5804c9e-8410-4144-8d68-fd785a2b11d9" }, { "id": "d9085708-3c2c-417a-bcc6-f9b7ae51d771", "name": "Session not found", "originalRequest": { "method": "DELETE", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of a verified session on the same internal account. Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/sessions/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 404,\n \"code\": \"TOKEN_NOT_FOUND\",\n \"details\": {\n \"nostrud5ea\": \"Ut culpa anim laborum esse\",\n \"dolor2\": \"dolor dolore esse\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-d9085708-3c2c-417a-bcc6-f9b7ae51d771" }, { "id": "6356ddb3-1cfa-47b8-84cc-d5ad43c8fda4", "name": "Internal service error", "originalRequest": { "method": "DELETE", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of a verified session on the same internal account. Required on the signed retry; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in a prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/sessions/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 500,\n \"code\": \"GRID_SWITCH_ERROR\",\n \"details\": {\n \"eiusmodd97\": \"sit\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-6356ddb3-1cfa-47b8-84cc-d5ad43c8fda4" } ], "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-cc0063ad-eb78-49f5-b0f2-951b62b539f4" } ], "id": "8bb1f34f-65bd-468f-895c-d3209be94e08", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-8bb1f34f-65bd-468f-895c-d3209be94e08" }, { "name": "List active sessions", "id": "b7959b7b-e263-4b0f-9567-c3675648317f", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}", "type": "string" }, { "key": "password", "value": "{{basicAuthPassword}}", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/auth/sessions?accountId=", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions" ], "query": [ { "description": "(Required) Internal account id whose sessions to list.", "key": "accountId", "value": "" } ] }, "description": "Retrieve all active authentication sessions on an Embedded Wallet internal account. A session is created each time a credential is verified via `POST /auth/credentials/{id}/verify`, and remains active until its `expiresAt` passes or it is revoked via `DELETE /auth/sessions/{id}`.\n\nThe response is not paginated: an internal account is expected to have a small, bounded number of concurrent sessions (one per signed-in device, typically 1\u20134), so all results are returned inline." }, "response": [ { "id": "e3ed83f2-1590-48da-a62b-7ad519df325e", "name": "Active authentication sessions on the internal account. Returns an empty `data` array when the internal account has no active sessions or when `accountId` does not match any internal account visible to the caller.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/sessions?accountId=", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions" ], "query": [ { "description": "(Required) Internal account id whose sessions to list.", "key": "accountId", "value": "" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": [\n {\n \"accountId\": \"\",\n \"createdAt\": \"\",\n \"expiresAt\": \"\",\n \"id\": \"\",\n \"nickname\": \"\",\n \"type\": \"OAUTH\",\n \"updatedAt\": \"\",\n \"credentialId\": \"\",\n \"encryptedSessionSigningKey\": \"\"\n },\n {\n \"accountId\": \"\",\n \"createdAt\": \"\",\n \"expiresAt\": \"\",\n \"id\": \"\",\n \"nickname\": \"\",\n \"type\": \"SMS_OTP\",\n \"updatedAt\": \"\",\n \"credentialId\": \"\",\n \"encryptedSessionSigningKey\": \"\"\n }\n ]\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-e3ed83f2-1590-48da-a62b-7ad519df325e" }, { "id": "efc25c5b-c580-4bf1-8326-ac5f33f3d028", "name": "Bad request. Returned with `INVALID_INPUT` when the `accountId` query parameter is missing or not a valid `InternalAccount:` identifier.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/sessions?accountId=", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions" ], "query": [ { "description": "(Required) Internal account id whose sessions to list.", "key": "accountId", "value": "" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 400,\n \"code\": \"INVITATION_ALREADY_CLAIMED\",\n \"details\": {\n \"labore56\": -49913018.2180405,\n \"dolor1\": -19111154.999864995,\n \"aute5f6\": 27210025\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-efc25c5b-c580-4bf1-8326-ac5f33f3d028" }, { "id": "cbebb29c-3bb5-47c6-b0b2-c687ce9f8fc7", "name": "Unauthorized", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/sessions?accountId=", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions" ], "query": [ { "description": "(Required) Internal account id whose sessions to list.", "key": "accountId", "value": "" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 401,\n \"code\": \"REQUEST_ID_MISSING\",\n \"details\": {\n \"irureff7\": -18977771.539527938,\n \"laborum_fe\": -46448813.40391738\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-cbebb29c-3bb5-47c6-b0b2-c687ce9f8fc7" }, { "id": "f8df0296-380a-4278-a51b-c491d1f36788", "name": "Internal service error", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/sessions?accountId=", "host": [ "{{baseUrl}}" ], "path": [ "auth", "sessions" ], "query": [ { "description": "(Required) Internal account id whose sessions to list.", "key": "accountId", "value": "" } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 500,\n \"code\": \"GRID_SWITCH_ERROR\",\n \"details\": {\n \"eiusmodd97\": \"sit\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-f8df0296-380a-4278-a51b-c491d1f36788" } ], "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-b7959b7b-e263-4b0f-9567-c3675648317f" } ], "id": "6e3c6690-9ea1-463f-83f6-a1d2a3652ecf", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-6e3c6690-9ea1-463f-83f6-a1d2a3652ecf" }, { "name": "delegated-keys", "item": [ { "name": "{id}", "item": [ { "name": "Get a delegated signing key", "id": "d7eb7c94-973b-4b13-8f0c-20cdee4f80e8", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}", "type": "string" }, { "key": "password", "value": "{{basicAuthPassword}}", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys", ":id" ], "variable": [ { "id": "23bb7ac2-90e4-4037-854a-f80e0c8c5ead", "key": "id", "value": "", "description": "(Required) The id of the delegated key to retrieve (the `id` field of the `DelegatedKey` returned from `POST /auth/delegated-keys` or `GET /auth/delegated-keys`)." } ] }, "description": "Retrieve a delegated signing key by its system-generated id." }, "response": [ { "id": "496f4d0f-216e-46f1-9b5c-644678639dc6", "name": "Successful operation", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"cardId\": \"\",\n \"fundingSourceId\": \"\",\n \"accountId\": \"\",\n \"publicKey\": \"\",\n \"nickname\": \"\",\n \"status\": \"PENDING\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\",\n \"spendingLimits\": [\n {\n \"currencyCode\": \"060K6DV1\",\n \"maxPerTransaction\": \"\"\n },\n {\n \"currencyCode\": \"QURNC\",\n \"maxPerTransaction\": \"\"\n }\n ]\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-496f4d0f-216e-46f1-9b5c-644678639dc6" }, { "id": "ca107ff4-52c2-4607-b96a-3cb475be90c9", "name": "Unauthorized", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 401,\n \"code\": \"REQUEST_ID_MISSING\",\n \"details\": {\n \"irureff7\": -18977771.539527938,\n \"laborum_fe\": -46448813.40391738\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-ca107ff4-52c2-4607-b96a-3cb475be90c9" }, { "id": "1e878322-87b6-46b9-8c98-3fb1efa16fbf", "name": "Delegated key not found", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 404,\n \"code\": \"TOKEN_NOT_FOUND\",\n \"details\": {\n \"nostrud5ea\": \"Ut culpa anim laborum esse\",\n \"dolor2\": \"dolor dolore esse\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-1e878322-87b6-46b9-8c98-3fb1efa16fbf" }, { "id": "7e7d0e35-bc15-4dfd-866b-93fe4e98bbdd", "name": "Internal service error", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 500,\n \"code\": \"GRID_SWITCH_ERROR\",\n \"details\": {\n \"eiusmodd97\": \"sit\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-7e7d0e35-bc15-4dfd-866b-93fe4e98bbdd" } ], "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-d7eb7c94-973b-4b13-8f0c-20cdee4f80e8" }, { "name": "Revoke a delegated signing key", "id": "544b4a00-5e48-4d9d-9a86-dd03f7ba5a2a", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}", "type": "string" }, { "key": "password", "value": "{{basicAuthPassword}}", "type": "string" } ] }, "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys", ":id" ], "variable": [ { "id": "aa8cee3c-f51e-41d6-83df-5ed27364630d", "key": "id", "value": "", "description": "(Required) The id of the delegated key to revoke (the `id` field of the `DelegatedKey` returned from `POST /auth/delegated-keys`)." } ] }, "description": "Revoke an `ACTIVE` delegated signing key. Grid uses the custodied delegated key to authorize deleting its own signer identity. Deleting the identity also removes its API key, after which the delegated key can no longer sign. The response is `204` when revocation completes.\n\nThe underlying signing policies are left in place. Their consensus references the now-deleted signer identity, so they can never authorize anything, and deleting them is unnecessary for correctness or security.\n" }, "response": [ { "id": "be64ce6b-16c5-4acf-88bc-0ac7a8a051d4", "name": "Delegated key revoked. The key can no longer authorize signing.", "originalRequest": { "method": "DELETE", "header": [ { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "No Content", "code": 204, "_postman_previewlanguage": "text", "header": [], "cookie": [], "responseTime": null, "body": null, "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-be64ce6b-16c5-4acf-88bc-0ac7a8a051d4" }, { "id": "8d67b8d2-723f-4ec8-a3d8-8f5e1c429592", "name": "Bad request. Returned when the delegated key has already been revoked or is not `ACTIVE`.", "originalRequest": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 400,\n \"code\": \"INVITATION_ALREADY_CLAIMED\",\n \"details\": {\n \"labore56\": -49913018.2180405,\n \"dolor1\": -19111154.999864995,\n \"aute5f6\": 27210025\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-8d67b8d2-723f-4ec8-a3d8-8f5e1c429592" }, { "id": "54f33ace-b7ed-4188-a58a-c86ce34fea73", "name": "Unauthorized.", "originalRequest": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 401,\n \"code\": \"REQUEST_ID_MISSING\",\n \"details\": {\n \"irureff7\": -18977771.539527938,\n \"laborum_fe\": -46448813.40391738\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-54f33ace-b7ed-4188-a58a-c86ce34fea73" }, { "id": "cfc4f9e9-86bc-4515-8629-5355db27b9b0", "name": "Delegated key not found", "originalRequest": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 404,\n \"code\": \"TOKEN_NOT_FOUND\",\n \"details\": {\n \"nostrud5ea\": \"Ut culpa anim laborum esse\",\n \"dolor2\": \"dolor dolore esse\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-cfc4f9e9-86bc-4515-8629-5355db27b9b0" }, { "id": "f0c6fc10-9d0d-4b52-9e83-542f85eadd0f", "name": "Internal service error", "originalRequest": { "method": "DELETE", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys/:id", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys", ":id" ], "variable": [ { "key": "id" } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 500,\n \"code\": \"GRID_SWITCH_ERROR\",\n \"details\": {\n \"eiusmodd97\": \"sit\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-f0c6fc10-9d0d-4b52-9e83-542f85eadd0f" } ], "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-544b4a00-5e48-4d9d-9a86-dd03f7ba5a2a" } ], "id": "148ec4ee-abe4-4a9f-9eb6-19864e51c2f7", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-148ec4ee-abe4-4a9f-9eb6-19864e51c2f7" }, { "name": "Create a delegated signing key", "id": "b90b4895-406a-4b3e-bf88-a9c575f50147", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}", "type": "string" }, { "key": "password", "value": "{{basicAuthPassword}}", "type": "string" } ] }, "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of a verified credential on the same internal account. Required on the signed retries; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in the prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retries; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"cardId\": \"\",\n \"internalAccountId\": \"\",\n \"nickname\": \"\",\n \"spendingLimits\": [\n {\n \"currencyCode\": \"L9Y5O2PU\",\n \"maxPerTransaction\": \"\"\n },\n {\n \"currencyCode\": \"2YYU9PNP\",\n \"maxPerTransaction\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/delegated-keys", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys" ] }, "description": "Delegate Spark token-transaction signing authority for a card funding source backed by an Embedded Wallet internal account to a Grid-custodied P-256 API key. Grid uses the requested card and internal account to identify the wallet funding source, generates the keypair server-side, creates an isolated signer identity holding the public key, then policies granting that identity signing and self-revocation authority. The private key is custodied by Grid and never returned. Both activities must be authorized by the wallet owner, so creation is a three-leg signed-retry flow:\n\n1. Call `POST /auth/delegated-keys` with no signature headers. Grid generates the delegated keypair and the response is `202` with a `payloadToSign`, `requestId`, and `expiresAt`.\n\n2. Use the session API keypair of a verified credential on the requested Embedded Wallet internal account to build an API-key stamp over `payloadToSign`, then retry the same request with that full stamp as the `Grid-Wallet-Signature` header and the `requestId` echoed back as the `Request-Id` header. The response is a second `202` with a new `payloadToSign`, `requestId`, and `expiresAt`.\n\n3. Stamp the new `payloadToSign` with the same session keypair and retry once more with the new `Request-Id`. The signed retry returns `201` with the created `DelegatedKey` in `ACTIVE` status.\n\nThe same request body must be sent on all three legs. A flow abandoned after the second leg leaves the key in `PENDING` status: the signer identity exists but holds no policies, so it cannot sign or revoke itself. Abandoned `PENDING` keys do not block creating another delegated key. After activation, Grid uses the custodied key to authorize signing for the card's Embedded Wallet funding account in place of a session keypair; the platform never handles the key material.\n\nEach card funding source may have at most one `ACTIVE` delegated key for its Embedded Wallet funding account; revoke the existing active key before creating a new one. A delegated key authorizes raw-payload signing for the wallet and cannot be scoped to amounts or recipients by the public API. Revoke it with `DELETE /auth/delegated-keys/{id}` when no longer needed.\n" }, "response": [ { "id": "a72ab1c6-65b3-40ec-808f-5d63e6d9c252", "name": "Delegated key created and policy granted. The key is `ACTIVE` and Grid may use it to stamp card-payment quote executions for this card funding source's Embedded Wallet funding account.", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of a verified credential on the same internal account. Required on the signed retries; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in the prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retries; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"cardId\": \"\",\n \"internalAccountId\": \"\",\n \"nickname\": \"\",\n \"spendingLimits\": [\n {\n \"currencyCode\": \"L9Y5O2PU\",\n \"maxPerTransaction\": \"\"\n },\n {\n \"currencyCode\": \"2YYU9PNP\",\n \"maxPerTransaction\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/delegated-keys", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys" ] } }, "status": "Created", "code": 201, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"id\": \"\",\n \"cardId\": \"\",\n \"fundingSourceId\": \"\",\n \"accountId\": \"\",\n \"publicKey\": \"\",\n \"nickname\": \"\",\n \"status\": \"PENDING\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\",\n \"spendingLimits\": [\n {\n \"currencyCode\": \"060K6DV1\",\n \"maxPerTransaction\": \"\"\n },\n {\n \"currencyCode\": \"QURNC\",\n \"maxPerTransaction\": \"\"\n }\n ]\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-a72ab1c6-65b3-40ec-808f-5d63e6d9c252" }, { "id": "dbac1d5f-a563-47b0-9406-f36c97bfc402", "name": "Challenge issued for the next leg. Stamp `payloadToSign` and retry the same request with `Grid-Wallet-Signature` and `Request-Id`.", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of a verified credential on the same internal account. Required on the signed retries; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in the prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retries; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"cardId\": \"\",\n \"internalAccountId\": \"\",\n \"nickname\": \"\",\n \"spendingLimits\": [\n {\n \"currencyCode\": \"L9Y5O2PU\",\n \"maxPerTransaction\": \"\"\n },\n {\n \"currencyCode\": \"2YYU9PNP\",\n \"maxPerTransaction\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/delegated-keys", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys" ] } }, "status": "Accepted", "code": 202, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"payloadToSign\": \"\",\n \"requestId\": \"\",\n \"expiresAt\": \"\"\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-dbac1d5f-a563-47b0-9406-f36c97bfc402" }, { "id": "66a7e165-e606-4a95-b922-0ca65ed0446b", "name": "Bad request", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of a verified credential on the same internal account. Required on the signed retries; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in the prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retries; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"cardId\": \"\",\n \"internalAccountId\": \"\",\n \"nickname\": \"\",\n \"spendingLimits\": [\n {\n \"currencyCode\": \"L9Y5O2PU\",\n \"maxPerTransaction\": \"\"\n },\n {\n \"currencyCode\": \"2YYU9PNP\",\n \"maxPerTransaction\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/delegated-keys", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 400,\n \"code\": \"INVITATION_ALREADY_CLAIMED\",\n \"details\": {\n \"labore56\": -49913018.2180405,\n \"dolor1\": -19111154.999864995,\n \"aute5f6\": 27210025\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-66a7e165-e606-4a95-b922-0ca65ed0446b" }, { "id": "78ea99ef-9f55-40b4-8556-9ee50d973b95", "name": "Unauthorized. Returned when the provided `Grid-Wallet-Signature` is missing on a retry, malformed, or does not match the pending challenge, or when the `Request-Id` does not match an unexpired pending challenge.", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of a verified credential on the same internal account. Required on the signed retries; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in the prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retries; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"cardId\": \"\",\n \"internalAccountId\": \"\",\n \"nickname\": \"\",\n \"spendingLimits\": [\n {\n \"currencyCode\": \"L9Y5O2PU\",\n \"maxPerTransaction\": \"\"\n },\n {\n \"currencyCode\": \"2YYU9PNP\",\n \"maxPerTransaction\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/delegated-keys", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 401,\n \"code\": \"REQUEST_ID_MISSING\",\n \"details\": {\n \"irureff7\": -18977771.539527938,\n \"laborum_fe\": -46448813.40391738\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-78ea99ef-9f55-40b4-8556-9ee50d973b95" }, { "id": "dc3d6b38-be2e-4b90-8d7a-e97ec8d2094a", "name": "Card, card funding source, or Embedded Wallet funding account not found", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of a verified credential on the same internal account. Required on the signed retries; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in the prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retries; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"cardId\": \"\",\n \"internalAccountId\": \"\",\n \"nickname\": \"\",\n \"spendingLimits\": [\n {\n \"currencyCode\": \"L9Y5O2PU\",\n \"maxPerTransaction\": \"\"\n },\n {\n \"currencyCode\": \"2YYU9PNP\",\n \"maxPerTransaction\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/delegated-keys", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys" ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 404,\n \"code\": \"TOKEN_NOT_FOUND\",\n \"details\": {\n \"nostrud5ea\": \"Ut culpa anim laborum esse\",\n \"dolor2\": \"dolor dolore esse\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-dc3d6b38-be2e-4b90-8d7a-e97ec8d2094a" }, { "id": "c5c31810-2524-4ada-8a23-65f858adc2c4", "name": "An `ACTIVE` delegated key already exists for this card funding source. Revoke it with `DELETE /auth/delegated-keys/{id}` before creating a new one.", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of a verified credential on the same internal account. Required on the signed retries; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in the prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retries; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"cardId\": \"\",\n \"internalAccountId\": \"\",\n \"nickname\": \"\",\n \"spendingLimits\": [\n {\n \"currencyCode\": \"L9Y5O2PU\",\n \"maxPerTransaction\": \"\"\n },\n {\n \"currencyCode\": \"2YYU9PNP\",\n \"maxPerTransaction\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/delegated-keys", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys" ] } }, "status": "Conflict", "code": 409, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 409,\n \"code\": \"PASSKEY_ALREADY_ENROLLED\",\n \"details\": {\n \"aliquipc\": 17702056,\n \"ut_d70\": \"officia\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-c5c31810-2524-4ada-8a23-65f858adc2c4" }, { "id": "ab57a1b9-e131-4dc5-8e49-4a7d33d483e0", "name": "Internal service error", "originalRequest": { "method": "POST", "header": [ { "description": "Full API-key stamp built over the prior `payloadToSign` with the session API keypair of a verified credential on the same internal account. Required on the signed retries; ignored on the initial call.", "key": "Grid-Wallet-Signature", "value": "" }, { "description": "The `requestId` returned in the prior `202` response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retries; must be paired with `Grid-Wallet-Signature`.", "key": "Request-Id", "value": "" }, { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "body": { "mode": "raw", "raw": "{\n \"cardId\": \"\",\n \"internalAccountId\": \"\",\n \"nickname\": \"\",\n \"spendingLimits\": [\n {\n \"currencyCode\": \"L9Y5O2PU\",\n \"maxPerTransaction\": \"\"\n },\n {\n \"currencyCode\": \"2YYU9PNP\",\n \"maxPerTransaction\": \"\"\n }\n ]\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/auth/delegated-keys", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys" ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 500,\n \"code\": \"GRID_SWITCH_ERROR\",\n \"details\": {\n \"eiusmodd97\": \"sit\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-ab57a1b9-e131-4dc5-8e49-4a7d33d483e0" } ], "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-b90b4895-406a-4b3e-bf88-a9c575f50147" }, { "name": "List delegated signing keys", "id": "0fcd7e3c-8381-4714-9aae-ad5b95f76d51", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}", "type": "string" }, { "key": "password", "value": "{{basicAuthPassword}}", "type": "string" } ] }, "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys?accountId=&fundingSourceId=", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys" ], "query": [ { "description": "The id of the internal account whose delegated keys to list.", "key": "accountId", "value": "" }, { "description": "The id of the card funding source whose delegated keys to list.", "key": "fundingSourceId", "value": "" } ] }, "description": "List delegated signing keys for an Embedded Wallet internal account, a card funding source, or both, including `PENDING` keys (user created but policy leg never completed) and `REVOKED` keys. At least one of `accountId` or `fundingSourceId` must be supplied." }, "response": [ { "id": "43f4f290-52a4-4470-a908-999e0df3fa30", "name": "Delegated keys matching the supplied filters. Returns an empty `data` array when no matching delegated keys are visible to the caller.", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys?accountId=&fundingSourceId=", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys" ], "query": [ { "description": "The id of the internal account whose delegated keys to list.", "key": "accountId", "value": "" }, { "description": "The id of the card funding source whose delegated keys to list.", "key": "fundingSourceId", "value": "" } ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"data\": [\n {\n \"id\": \"\",\n \"cardId\": \"\",\n \"fundingSourceId\": \"\",\n \"accountId\": \"\",\n \"publicKey\": \"\",\n \"nickname\": \"\",\n \"status\": \"REVOKED\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\",\n \"spendingLimits\": [\n {\n \"currencyCode\": \"PSEXDE\",\n \"maxPerTransaction\": \"\"\n },\n {\n \"currencyCode\": \"X37ZNSJYK8\",\n \"maxPerTransaction\": \"\"\n }\n ]\n },\n {\n \"id\": \"\",\n \"cardId\": \"\",\n \"fundingSourceId\": \"\",\n \"accountId\": \"\",\n \"publicKey\": \"\",\n \"nickname\": \"\",\n \"status\": \"ACTIVE\",\n \"createdAt\": \"\",\n \"updatedAt\": \"\",\n \"spendingLimits\": [\n {\n \"currencyCode\": \"F0AJWG\",\n \"maxPerTransaction\": \"\"\n },\n {\n \"currencyCode\": \"PUWN\",\n \"maxPerTransaction\": \"\"\n }\n ]\n }\n ]\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-43f4f290-52a4-4470-a908-999e0df3fa30" }, { "id": "630bfec5-7724-4a37-8876-de257fde8dca", "name": "Bad request", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys?accountId=&fundingSourceId=", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys" ], "query": [ { "description": "The id of the internal account whose delegated keys to list.", "key": "accountId", "value": "" }, { "description": "The id of the card funding source whose delegated keys to list.", "key": "fundingSourceId", "value": "" } ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 400,\n \"code\": \"INVITATION_ALREADY_CLAIMED\",\n \"details\": {\n \"labore56\": -49913018.2180405,\n \"dolor1\": -19111154.999864995,\n \"aute5f6\": 27210025\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-630bfec5-7724-4a37-8876-de257fde8dca" }, { "id": "36b2b372-8ce8-4f8c-bedc-5b962796850d", "name": "Unauthorized", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys?accountId=&fundingSourceId=", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys" ], "query": [ { "description": "The id of the internal account whose delegated keys to list.", "key": "accountId", "value": "" }, { "description": "The id of the card funding source whose delegated keys to list.", "key": "fundingSourceId", "value": "" } ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 401,\n \"code\": \"REQUEST_ID_MISSING\",\n \"details\": {\n \"irureff7\": -18977771.539527938,\n \"laborum_fe\": -46448813.40391738\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-36b2b372-8ce8-4f8c-bedc-5b962796850d" }, { "id": "10c26ca2-4a65-4322-8f24-07978a965e05", "name": "Internal service error", "originalRequest": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: basic", "key": "Authorization", "value": "Basic " } ], "url": { "raw": "{{baseUrl}}/auth/delegated-keys?accountId=&fundingSourceId=", "host": [ "{{baseUrl}}" ], "path": [ "auth", "delegated-keys" ], "query": [ { "description": "The id of the internal account whose delegated keys to list.", "key": "accountId", "value": "" }, { "description": "The id of the card funding source whose delegated keys to list.", "key": "fundingSourceId", "value": "" } ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"message\": \"\",\n \"status\": 500,\n \"code\": \"GRID_SWITCH_ERROR\",\n \"details\": {\n \"eiusmodd97\": \"sit\"\n }\n}", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-10c26ca2-4a65-4322-8f24-07978a965e05" } ], "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-0fcd7e3c-8381-4714-9aae-ad5b95f76d51" } ], "id": "467a9fc1-642e-415b-8e48-804096caf588", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-467a9fc1-642e-415b-8e48-804096caf588" } ], "id": "e57b5749-06b7-4bfa-ab3f-b07f38d53a17", "createdAt": "2026-07-28T02:07:37.000Z", "updatedAt": "2026-07-28T02:07:37.000Z", "uid": "35240-e57b5749-06b7-4bfa-ab3f-b07f38d53a17" } ], "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}", "type": "string" }, { "key": "password", "value": "{{basicAuthPassword}}", "type": "string" } ] }, "variable": [ { "key": "baseUrl", "value": "https://api.lightspark.com/grid/2025-10-13" } ] }