Managed Signing
Managed Signing gives you signing wallets whose keys Knit holds, governed by policies you define. You submit a transaction, a piece of EIP-712 typed data, or a message; the policy is evaluated; and — if it passes — the payload is signed and, optionally, broadcast.
Provision a signing wallet on one or more networks.
Constrain what the wallet is allowed to sign.
Submit a transaction, typed data, or a message.
An end-to-end CPN integration guide.
Base path
All endpoints live under:
https://api-prod.useknit.io/api/v1/managed-signingAuthentication
Managed Signing uses the same OAuth 2.0 client credentials as the rest of the
API — send Authorization: Bearer <access-token>.
| Operation | Required scope |
|---|---|
GET — wallets, policies, requests, audit | managed-signing:read |
POST / PATCH — create, update, approve | managed-signing:write |
Requests must also originate from an IP on your business allow list. See Authentication for tokens, scopes, and allow-listing.
The X-API-KEY header is no longer a valid credential anywhere on the Knit
API, Managed Signing included. Use a bearer token.
Conventions
- Use the IDs this API returns. Every
idin a path parameter or a body filter such aswalletIdmust be an ID you received from a Managed Signing response. - camelCase in and out. Request bodies and response payloads both use
camelCase — except inside
payload.typedData, wheretypesandmessagemust match the EIP-712 schema exactly and are passed through untouched. - Shared envelope. Responses use the standard
statusCode/message/data/successenvelope. See Requests & responses.
Supported networks
| Network | Identifier |
|---|---|
| Ethereum | ETHEREUM_MAINNET (alias ETH_MAINNET) |
| Polygon | MATIC_MAINNET |
| BNB Smart Chain | BSC_MAINNET |
| Base | BASE_MAINNET |
| Polygon Amoy — sandbox only | MATIC_AMOY |
Endpoints
Wallets
| Method | Path | Purpose |
|---|---|---|
POST | /wallets | Create a wallet |
GET | /wallets | List wallets |
GET | /wallets/{walletId} | Retrieve a wallet |
GET | /wallets/{walletId}/balance | Get a token balance |
GET | /wallets/{walletId}/assets | List balances across networks |
Policies
| Method | Path | Purpose |
|---|---|---|
POST | /policies | Create a policy |
PATCH | /policies/{policyId} | Update a policy |
GET | /policies | List policies |
GET | /policies/{policyId} | Retrieve a policy |
Signing requests
| Method | Path | Purpose |
|---|---|---|
POST | /requests | Create a signing request |
POST | /requests/{requestId}/approve | Approve a request |
GET | /requests | List requests |
GET | /requests/{requestId} | Retrieve a request |
Audit
| Method | Path | Purpose |
|---|---|---|
GET | /audit | List audit events |
Common errors
| Status | Cause |
|---|---|
400 | Invalid request body, unsupported network, or the wallet is not active on the requested network |
401 | Missing or invalid token, IP not allow-listed, or the token lacks the required managed-signing scope |
404 | The wallet, policy, or request does not exist under your business |
400 | A field failed validation |
500 | The signing request could not be processed. Retry with backoff |
