Canton Network docsWallet Gateway › Reference
User API
Updated 12-11-2026
The User API is a JSON-RPC 2.0 API for managing a user’s wallets, networks, identity
providers, sessions, and transactions. The User UI is built on it, and you can call it
directly from scripts, a backend, or a custom UI.
The following methods are available without authentication, so a client can bootstrap a
connection:
- Base path:
/api/v0/user(configurable viaserver.userPath) - Protocol: JSON-RPC 2.0
- Authentication: JWT bearer token, except where noted below
Methods
| Category | Method | Description |
|---|---|---|
| Sessions | addSession() | Create a new session (unauthenticated, used for the initial connection). |
removeSession() | End the current session. | |
listSessions() | List sessions for the current user. | |
| Networks | listNetworks() | List configured networks (public metadata only, no auth secrets). |
getNetwork() | Get the full network configuration including auth (admin only). | |
selfSignedAccessToken() | Mint a self-signed JWT for login (unauthenticated). | |
addNetwork() | Add a new network configuration. | |
removeNetwork() | Remove a network configuration. | |
| Identity providers | listIdps() | List all identity providers. |
addIdp() | Add a new identity provider. | |
removeIdp() | Remove an identity provider. | |
| Wallets | createWallet() | Create a new wallet (party) on a network. |
listWallets() | List all wallets for the current user. | |
setPrimaryWallet() | Set the primary wallet. | |
removeWallet() | Remove a wallet. | |
syncWallets() | Sync wallets with the ledger. | |
isWalletSyncNeeded() | Check whether a wallet sync is needed. | |
| Transactions | sign() | Sign a transaction. |
execute() | Execute a signed transaction. | |
getTransaction() | Get a transaction by ID. | |
listTransactions() | List transactions. |
Authentication
Most methods require a JWT in theAuthorization header:
Authorization: Bearer <jwt-token>
addSession()listNetworks()listIdps()selfSignedAccessToken()
Full specification
The complete OpenRPC specification is available at openrpc-user-api.json.Rate limiting
Requests are rate-limited to prevent abuse. Configure the limits in the server settings. Responses include:X-RateLimit-Limit: maximum requests per window.X-RateLimit-Remaining: remaining requests in the current window.X-RateLimit-Reset: when the limit resets.
CORS
Cross-origin access is controlled byserver.allowedOrigins. It defaults to ["*"]; in
production, restrict it to known origins. See
Configure the Wallet Gateway.