Overview
Vaults are HD seed containers. Every wallet belongs to exactly one vault. Dedicated vaults map 1:1 to a single wallet per chain; pool vaults hold unlimited wallets.
Create Vault
Use Case
Creates a new vault. The Bitnob Secure Enclave infrastructure is provisioned lazily on the first vault.
Request Body
Display name shown in the dashboard and audit logs. 2-100 characters.
`dedicated` (default) — one wallet per chain. `pool` — unlimited wallets. Upgrading dedicated → pool is irreversible.
Client-generated key (1-64 chars) that deduplicates retries so the same request never creates two vaults.
Create Vault Response
`true` when the vault was created without errors.
Human-readable status message for display or logging.
Unique identifier for the new vault. Use it to scope wallet creation and exports.
Display name as supplied on creation.
`dedicated` (1 wallet per chain) or `pool` (unlimited).
Lifecycle status — `active` immediately after creation.
Number of wallets in this vault. Zero at creation time.
Enclave-internal seed identifier. Opaque — only used by Bitnob's signing pipeline.
Arbitrary key-value metadata you set on the vault.
Timestamp when the vault was created.
Timestamp of the most recent update.
List Vaults
Use Case
Returns a paginated list of vaults in the organization.
Query Parameters
Page size. Default 20, max 100. Use this with `offset` to paginate through large vault counts.
Number of items to skip from the start of the result set. Default 0. Pair with `limit` for cursor-style paging.
Restrict results to a single vault type. `dedicated` returns treasury/operational vaults; `pool` returns exchange-style vaults that hold many wallets.
Filter by lifecycle status. `active` is the default working set; pass `archived` to surface vaults you've previously taken out of rotation.
List Vaults Response
Unique identifier for the vault. Use it to scope wallet creation, exports, and audit lookups.
Display name as supplied on creation, shown in dashboards and audit logs.
`dedicated` (one wallet per chain) or `pool` (unlimited wallets per chain).
Lifecycle status. `active` is in-use; `archived` is taken out of rotation but kept for audit purposes.
Number of wallets currently derived from this vault's seed.
Opaque Enclave-internal seed identifier. Used by Bitnob's signing pipeline; you don't need to act on it.
Arbitrary key-value metadata you set on the vault for your own bookkeeping.
Timestamp when the vault was created.
Timestamp of the most recent change (name, type, or metadata).
Get Vault
Use Case
Retrieves a single vault by ID.
Get Vault Response
The response payload uses the same VaultResponse object as Create Vault Response. Refer there for the per-field explanations.
Update Vault
Use Case
Updates a vault's name or type. Upgrading a dedicated vault to a pool vault is irreversible.
Request Body
2-100 characters.
`dedicated` or `pool`. Upgrading dedicated to pool is irreversible.
Update Vault Response
The response payload uses the same VaultResponse object as Get Vault Response. Refer to Create Vault Response for per-field explanations.
Create Wallet in Vault
Use Case
Creates a wallet inside an existing vault. Dedicated vaults allow one wallet per chain; pool vaults allow unlimited.
Request Body
Display name for the wallet (2-100 characters). Shown in the dashboard and audit logs — use something that identifies the customer or purpose at a glance.
Blockchain the wallet targets (e.g., `ethereum`, `bitcoin`). Determines which key curve and address format the Enclave derives.
Your own external customer/account identifier. Mainly useful inside pool vaults so you can map this wallet back to a user in your system.
`hot` (online, actively signs), `cold` (offline, requires elevated approval), or `operational` (system-managed, e.g., gas stations). Defaults to `hot` when omitted.
Assets this wallet should support up front (e.g., `["ETH", "USDC_ETH"]`). Determines which initial balance entries are tracked; extra assets can be added later by deriving addresses.
Network for the initial address derivation (e.g., `mainnet`, `sepolia`, `testnet`). Falls back to the environment's default network when omitted.
Arbitrary key-value JSON you set on the wallet for your own bookkeeping (tags, team, region, etc.). Returned back on every wallet read.
Client-generated key (1-64 chars) used to deduplicate retries. If two requests arrive with the same key, only the first creates a wallet and subsequent retries return the same response.
Create Wallet in Vault Response
`true` when the wallet was created without errors.
Human-readable status message for display or logging.
The newly created wallet, with derived addresses and an initialised balances array.
Unique identifier for the new wallet. Use it for transfers, address derivation, and exports.
Parent vault this wallet was created under.
Display name as supplied in the request, shown in dashboards and audit logs.
Primary blockchain the wallet targets (e.g., `ethereum`, `bitcoin`).
External customer reference you passed in; lets you link this wallet to your own user/account ID.
`hot` (online signing), `cold` (offline, elevated approval), or `operational` (system-managed).
Lifecycle status — `active` immediately after creation.
Primary address per chain, derived from the wallet's HD path on creation. Hand the `address` to customers as a deposit destination.
Per-asset balance entries. Empty / zeroed at creation; gets populated as funds arrive.
Timestamp when the wallet was created.
List Wallets in Vault
Use Case
Returns all wallets in the vault with primary addresses and balances included.
Query Parameters
Restrict results to a single blockchain (e.g., `ethereum`, `bitcoin`). Useful when a pool vault holds wallets across multiple chains and you only want one.
Look up the wallets belonging to a single external customer/account ID. Most common way to find a specific customer's wallet inside a pool vault.
List Wallets in Vault Response
Each entry in data[] uses the same WalletResponse object as Create Wallet in Vault Response. Refer there for the per-field explanations.
Export Vault Seed
Use Case
Exports the BIP-39 mnemonic for the vault's seed. The mnemonic can recover all wallets and addresses derived from this vault.
The export payload is encrypted to a one-time exchange key supplied in the request. Treat the recovered mnemonic as root credential material.
Export Wallet Private Key (Vault)
Use Case
Exports the private key for a specific wallet within a vault. Only the key for this wallet's derivation path is exported, not the vault seed.