Policies API

Manage policies for individual agents. Supported transaction-signing routes evaluate these policies before invoking the Vault. Compatibility routes such as message and raw-hash signing use separate MFA, signer-permission, and unsafe-feature gates.

Get Policies

Returns all policies for an agent.

GET /agents/:agentId/policies

Auth: Tenant API key or agent JWT Response:

{
  "ok": true,
  "data": [
    {
      "id": "spending-limit-1",
      "type": "spending-limit",
      "enabled": true,
      "config": {
        "maxPerTransaction": "100000000000000000",
        "maxPerDay": "500000000000000000"
      }
    },
    {
      "id": "approved-addrs-1",
      "type": "approved-addresses",
      "enabled": true,
      "config": {
        "addresses": ["0x1111111254EEB25477B68fb85Ed929f73A960582"]
      }
    }
  ]
}

const policies = await steward.getPolicies("my-agent");

curl http://localhost:3200/agents/my-agent/policies \
  -H "X-Steward-Key: your-key"

Set Policies

Replaces all policies for an agent.

PUT /agents/:agentId/policies

Auth: Tenant API key or agent JWT

This endpoint replaces the entire policy set. Always send the complete list of policies you want the agent to have.

Request Body:

Array<{
  id?: string;        // Unique ID (auto-generated if omitted)
  type: string;       // Policy type
  enabled: boolean;   // Active or inactive
  config: object;     // Type-specific configuration
}>

Valid policy types:

Type	Description
`spending-limit`	Max value per tx, per day, per week
`approved-addresses`	Whitelist of allowed destination addresses
`auto-approve-threshold`	Auto-approve below this value; queue above
`time-window`	Restrict to specific hours
`rate-limit`	Max transactions per minute/hour
`allowed-chains`	Restrict to specific chain IDs

Response:

{
  "ok": true,
  "data": [
    {
      "id": "spending-limit-1",
      "type": "spending-limit",
      "enabled": true,
      "config": { "maxPerTransaction": "100000000000000000" }
    }
  ]
}

await steward.setPolicies("my-agent", [
  {
    id: "spending-limit",
    type: "spending-limit",
    enabled: true,
    config: {
      maxPerTransaction: "100000000000000000",
      maxPerDay: "500000000000000000",
    },
  },
  {
    id: "approved-addrs",
    type: "approved-addresses",
    enabled: true,
    config: {
      addresses: ["0x1111111254EEB25477B68fb85Ed929f73A960582"],
    },
  },
]);

curl -X PUT http://localhost:3200/agents/my-agent/policies \
  -H "X-Steward-Key: your-key" \
  -H "Content-Type: application/json" \
  -d '[
    {
      "id": "spending-limit",
      "type": "spending-limit",
      "enabled": true,
      "config": {
        "maxPerTransaction": "100000000000000000",
        "maxPerDay": "500000000000000000"
      }
    }
  ]'

Validation

The API validates each policy:

type must be one of the valid types listed above
enabled must be a boolean
config must be a non-null object

Invalid policies return 400:

{
  "ok": false,
  "error": "Unknown policy type \"invalid-type\" — supported types: spending-limit, approved-addresses, auto-approve-threshold, time-window, rate-limit, allowed-chains"
}

Policy Engine Concepts — How evaluation works
Policies Guide — Step-by-step configuration
Vault API — Where policies are enforced

​Policies API

​Get Policies

​Set Policies

​Validation

​Related

Policies API

Get Policies

Set Policies

Validation

Related