Documentation/canton-network-docs/Wallet GatewayReferenceView on canton-network-docs ↗
canton-network-docs/Wallet GatewayReference

User API

The User API is a JSON-RPC 2.0 API for managing a user’s wallets, networks, identity providers, sessions, and transactions. The User UI is built on it, and you can call it directly from scripts, a backend, or a custom UI.
  • Base path: /api/v0/user (configurable via server.userPath)
  • Protocol: JSON-RPC 2.0
  • Authentication: JWT bearer token, except where noted below

​
Methods

CategoryMethodDescription
SessionsaddSession()Create a new session (unauthenticated, used for the initial connection).
removeSession()End the current session.
listSessions()List sessions for the current user.
NetworkslistNetworks()List all configured networks.
addNetwork()Add a new network configuration.
removeNetwork()Remove a network configuration.
Identity providerslistIdps()List all identity providers.
addIdp()Add a new identity provider.
removeIdp()Remove an identity provider.
WalletscreateWallet()Create a new wallet (party) on a network.
listWallets()List all wallets for the current user.
setPrimaryWallet()Set the primary wallet.
removeWallet()Remove a wallet.
syncWallets()Sync wallets with the ledger.
isWalletSyncNeeded()Check whether a wallet sync is needed.
Transactionssign()Sign a transaction.
execute()Execute a signed transaction.
getTransaction()Get a transaction by ID.
listTransactions()List transactions.

​
Authentication

Most methods require a JWT in the Authorization header: 
Authorization: Bearer <jwt-token>
The following methods are available without authentication, so a client can bootstrap a connection:
  • addSession()
  • listNetworks()
  • listIdps()

​
Full specification

The complete OpenRPC specification is available at openrpc-user-api.json.

​
Rate limiting

Requests are rate-limited to prevent abuse. Configure the limits in the server settings. Responses include:
  • X-RateLimit-Limit: maximum requests per window.
  • X-RateLimit-Remaining: remaining requests in the current window.
  • X-RateLimit-Reset: when the limit resets.

​
CORS

Cross-origin access is controlled by server.allowedOrigins. It defaults to ["*"]; in production, restrict it to known origins. See Configure the Wallet Gateway.