Authorize a Vault policy

curl --request POST \
  --url https://prod-api.stableyard.fi/v2/accounts/{accountId}/vault/policies/{policyId}/authorize \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '
{
  "method": "eip712_signature",
  "signerAddress": "0xdFD4ab80E163D6864E26F37540563cBf2E52A582",
  "signature": "0x..."
}
'

{
  "id": "vault_policy_123",
  "vaultId": "vault_123",
  "version": 1,
  "policySchemaVersion": 1,
  "status": "draft",
  "ownershipMode": "external",
  "allowedTokens": [
    {
      "symbol": "USDC",
      "chainId": 42161,
      "tokenAddress": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
      "decimals": 6
    }
  ],
  "spendLimits": {
    "spendLimitAtomic": "500000000",
    "currency": "USD",
    "decimals": 6,
    "period": "fixed_30_day",
    "periodSeconds": 2592000,
    "enforcement": "zodiac_allowance_plus_inflight_database_reservations"
  },
  "yieldRules": {
    "provider": "none",
    "mode": "disabled"
  },
  "authorization": {},
  "resourceVersion": 1,
  "createdAt": "2026-08-28T10:00:00.000Z",
  "updatedAt": "2026-08-28T10:00:00.000Z"
}

{
  "error": {
    "code": "bad_request",
    "message": "The request is invalid",
    "details": "example"
  }
}

{
  "error": {
    "code": "bad_request",
    "message": "The request is invalid",
    "details": "example"
  }
}

{
  "error": {
    "code": "bad_request",
    "message": "The request is invalid",
    "details": "example"
  }
}

{
  "error": {
    "code": "bad_request",
    "message": "The request is invalid",
    "details": "example"
  }
}

{
  "error": {
    "code": "bad_request",
    "message": "The request is invalid",
    "details": "example"
  }
}

{
  "error": {
    "code": "bad_request",
    "message": "The request is invalid",
    "details": "example"
  }
}

{
  "error": {
    "code": "bad_request",
    "message": "The request is invalid",
    "details": "example"
  }
}

POST

accounts

{accountId}

vault

policies

{policyId}

authorize

curl --request POST \
  --url https://prod-api.stableyard.fi/v2/accounts/{accountId}/vault/policies/{policyId}/authorize \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --data '
{
  "method": "eip712_signature",
  "signerAddress": "0xdFD4ab80E163D6864E26F37540563cBf2E52A582",
  "signature": "0x..."
}
'

{
  "id": "vault_policy_123",
  "vaultId": "vault_123",
  "version": 1,
  "policySchemaVersion": 1,
  "status": "draft",
  "ownershipMode": "external",
  "allowedTokens": [
    {
      "symbol": "USDC",
      "chainId": 42161,
      "tokenAddress": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
      "decimals": 6
    }
  ],
  "spendLimits": {
    "spendLimitAtomic": "500000000",
    "currency": "USD",
    "decimals": 6,
    "period": "fixed_30_day",
    "periodSeconds": 2592000,
    "enforcement": "zodiac_allowance_plus_inflight_database_reservations"
  },
  "yieldRules": {
    "provider": "none",
    "mode": "disabled"
  },
  "authorization": {},
  "resourceVersion": 1,
  "createdAt": "2026-08-28T10:00:00.000Z",
  "updatedAt": "2026-08-28T10:00:00.000Z"
}

{
  "error": {
    "code": "bad_request",
    "message": "The request is invalid",
    "details": "example"
  }
}

{
  "error": {
    "code": "bad_request",
    "message": "The request is invalid",
    "details": "example"
  }
}

{
  "error": {
    "code": "bad_request",
    "message": "The request is invalid",
    "details": "example"
  }
}

{
  "error": {
    "code": "bad_request",
    "message": "The request is invalid",
    "details": "example"
  }
}

{
  "error": {
    "code": "bad_request",
    "message": "The request is invalid",
    "details": "example"
  }
}

{
  "error": {
    "code": "bad_request",
    "message": "The request is invalid",
    "details": "example"
  }
}

{
  "error": {
    "code": "bad_request",
    "message": "The request is invalid",
    "details": "example"
  }
}

Send method: eip712_signature with the external owner’s signerAddress and signature, or method: managed_email_otp with the managed Vault’s email code. Idempotency-Key is required. For an external-signer Vault, the off-chain EIP-712 signature alone does not modify the Safe. Authorization is followed by an execute_safe_transaction action, returned by Get an account Vault, which the Safe owner or owner multisig must execute before Stableyard can verify the Zodiac module and mark the policy active. Record that transaction with Submit an external Vault action transaction.

Authorizations

Authorization

string

header

required

HTTP Basic auth. Username is the Stableyard app ID. Password is the app secret. The optional Stableyard-Version request header must match the environment pin.

Headers

Idempotency-Key

string

required

Use this for retry-safe payment operations from your backend.

Example:

"payment-request-001"

Stableyard-Version

enum<string>

Optional contract-version assertion. Omit it to use the app environment's pinned version. A different supported version is accepted only after that environment is explicitly migrated.

Available options:

2026-09-09

Path Parameters

accountId

string

required

Canonical account id returned by the Accounts API.

Example:

"acct_123"

policyId

string

required

Body

application/json

External signer signature
Managed vault email code

method

enum<string>

required

Available options:

eip712_signature

signerAddress

string

required

Example:

"0xdFD4ab80E163D6864E26F37540563cBf2E52A582"

signature

string

required

Example:

"0x..."

Response

Authorized policy

string

required

Example:

"vault_policy_123"

vaultId

string

required

Example:

"vault_123"

version

integer

required

Required range: x >= 1

policySchemaVersion

integer

required

Required range: x >= 1

status

enum<string>

required

Available options:

draft,

pending_authorization,

authorized,

installing,

active,

superseded,

revoked,

failed

ownershipMode

enum<string>

required

Available options:

external,

stableyard

allowedTokens

object[]

required

Show child attributes

spendLimits

object

required

Show child attributes

yieldRules

object

required

Show child attributes

resourceVersion

integer

required

Required range: x >= 1

createdAt

string<date-time>

required

updatedAt

string<date-time>

required

authorization

object

Present on single-policy responses while authorization is pending.

nextAction

Vault action required · object | null

Show child attributes

reason

string | null

failureCode

string | null

Introduction

Onboarding

Accounts

Money movement

Activity

Vaults

Client & checkout

Platform

Authorize a Vault policy

Authorizations

Headers

Path Parameters

Body

Response