CCPEDIAby Unity Nodes
ReleasesSplice 0.5.5

Splice 0.5.5

Digital AssetSplice

Tightened authorization checks for all non-public API endpoints. All non-public endpoints now properly respect the current user rights defined in the participant user management service. Revoking user rights on the…

Open the release notes (opens in a new tab)docs.canton.network
  • API security
    • Tightened authorization checks for all non-public API endpoints. All non-public endpoints now properly respect the current user rights defined in the participant user management service. Revoking user rights on the participant will revoke access to the corresponding API endpoints. In general, endpoints that required authentication before will now check that the authenticated user is not deactivated on the participant and has actAs rights for the relevant party (wallet party for the wallet app API, SV operator party for the SV app API, etc).
    • Administrative SV app endpoints now require participant admin rights. The following SV app endpoints now require the user to have participant admin rights in the participant user management service.
      • /v0/admin/domain/pause
      • /v0/admin/domain/unpause
      • /v0/admin/domain/migration-dump
      • /v0/admin/domain/identities-dump
      • /v0/admin/domain/data-snapshot
      This allows for finer grained access control where users with actAs rights for the SV operator party but without participant admin rights may use the SV or wallet UIs, but may not perform administrative actions like hard synchronizer migrations. Note that only the service users of the SV and validator apps should automatically have participant admin rights. If you are using other users to access the above endpoints, check their rights.
    • Some endpoints will have changed authorization rules in an upcoming release.
      • SV app /v0/dso is currently public, but will require authorization as SV operator, similar to most other SV app endpoints. Use the public /v0/dso endpoint in the scan app if you need to fetch DSO info.
  • Validator
    • Added support for picking a custom name for new parties created when onboarding users via the /v0/admin/users API. See docs.
    • Added an optional excludeDebugFields`` boolean to the request body of allocation and transfer endpoints for the Token Standard component (``splice-api-token-allocation-v1`` and ``splice-api-token-transfer-instruction-v1`). Clients can now set this to true to omit debug information from the response in order to save on bandwidth.
← All Splice releases