CCPEDIAby Unity Nodes
Documentation/Canton Network Docs/Wallet GatewayReferenceView on Canton Network Docs ↗

User API

The User API is a JSON-RPC 2.0 API for managing a user’s wallets, networks, identity providers, sessions, and transactions. The User UI is built on it, and you can call it directly from scripts, a backend, or a custom UI.
  • Base path: /api/v0/user (configurable via server.userPath)
  • Protocol: JSON-RPC 2.0
  • Authentication: JWT bearer token, except where noted below

​
Methods

CategoryMethodDescription
SessionsaddSession()Create a new session (unauthenticated, used for the initial connection).
removeSession()End the current session.
listSessions()List sessions for the current user.
NetworkslistNetworks()List configured networks (public metadata only, no auth secrets).
getNetwork()Get the full network configuration including auth (admin only).
selfSignedAccessToken()Mint a self-signed JWT for login (unauthenticated).
addNetwork()Add a new network configuration.
removeNetwork()Remove a network configuration.
Identity providerslistIdps()List all identity providers.
addIdp()Add a new identity provider.
removeIdp()Remove an identity provider.
WalletscreateWallet()Create a new wallet (party) on a network.
listWallets()List all wallets for the current user.
setPrimaryWallet()Set the primary wallet.
removeWallet()Remove a wallet.
syncWallets()Sync wallets with the ledger.
isWalletSyncNeeded()Check whether a wallet sync is needed.
Transactionssign()Sign a transaction.
execute()Execute a signed transaction.
getTransaction()Get a transaction by ID.
listTransactions()List transactions.

​
Authentication

Most methods require a JWT in the Authorization header: 
Authorization: Bearer <jwt-token>
The following methods are available without authentication, so a client can bootstrap a connection:
  • addSession()
  • listNetworks()
  • listIdps()
  • selfSignedAccessToken()

​
Full specification

The complete OpenRPC specification is available at openrpc-user-api.json.

​
Rate limiting

Requests are rate-limited to prevent abuse. Configure the limits in the server settings. Responses include:
  • X-RateLimit-Limit: maximum requests per window.
  • X-RateLimit-Remaining: remaining requests in the current window.
  • X-RateLimit-Reset: when the limit resets.

​
CORS

Cross-origin access is controlled by server.allowedOrigins. It defaults to ["*"]; in production, restrict it to known origins. See Configure the Wallet Gateway.