curl --request POST \
--url https://api.citadel.example/api/v1/policy/publish \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"version": 4,
"signature": "dQhrBoRLDdj261cqTZkE1y3lLxq4fkEp/QrHPyFqMhSgkP4/iVx/xghGu3ExStse1SqOK/JMhlDvitcG0WQhBA=="
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
version: 4,
signature: 'dQhrBoRLDdj261cqTZkE1y3lLxq4fkEp/QrHPyFqMhSgkP4/iVx/xghGu3ExStse1SqOK/JMhlDvitcG0WQhBA=='
})
};
fetch('https://api.citadel.example/api/v1/policy/publish', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.citadel.example/api/v1/policy/publish"
payload = {
"version": 4,
"signature": "dQhrBoRLDdj261cqTZkE1y3lLxq4fkEp/QrHPyFqMhSgkP4/iVx/xghGu3ExStse1SqOK/JMhlDvitcG0WQhBA=="
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.citadel.example/api/v1/policy/publish"
payload := strings.NewReader("{\n \"version\": 4,\n \"signature\": \"dQhrBoRLDdj261cqTZkE1y3lLxq4fkEp/QrHPyFqMhSgkP4/iVx/xghGu3ExStse1SqOK/JMhlDvitcG0WQhBA==\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"version": 4,
"status": "pending",
"document": "---\nceiling:\n TRX/6: '100000000'\n USDT/6: '50000000'\nchains:\n tron:\n assets:\n TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t: USDT/6\n native: TRX/6\n chain_module_version: 1\n wallets: {}\n whitelist:\n - TGz2TZmabrZZowj7G8BbyMYg6HacJLuzaj\n - TVsjquD89kcRu2WTSWsoJhYMNLQbFt8xQ4\nreferences: {}\nversion: 4\n",
"key_id": "merchant-policy-admin",
"signature": "dQhrBoRLDdj261cqTZkE1y3lLxq4fkEp/QrHPyFqMhSgkP4/iVx/xghGu3ExStse1SqOK/JMhlDvitcG0WQhBA==",
"approval": {
"id": "0199f1a2-4b6c-7d8e-9f01-23456789abcd",
"status": "pending",
"required": 2,
"approved": 0,
"expires_at": "2026-10-18T13:00:00Z",
"decided_at": null
},
"rejected_reason": null,
"created_at": "2026-10-18T09:00:00Z",
"updated_at": "2026-10-18T09:01:00Z"
}Publish a signed policy draft
Hands in your policy key’s signature over a draft’s bytes. Citadel never signs a policy document: your engine installs only what your policy key (key B) signed. Citadel checks the signature against the policy key your engine registered when it joined.
The draft does not go to your engine yet. It becomes pending, and an approval request
opens in the console with the bar of your approval rules in force: as many approvals as
their strictest rule asks, from that rule’s group. When no approval rules are in force, or
they hold nothing, one member of your organization approves. Approvers confirm with their
passkeys and see every whitelist address added and removed, in full. Once approved, Citadel sends the document to your engine (published), which
verifies the signature again and installs it. Declined or not approved in time, it is
rejected and never sent.
A newer change replaces one still waiting, and so does a newer version published in the
console: the older one reads rejected, rejected_reason: superseded. A rejected version
number is never used again.
Sending the same version and signature again answers the change as it stands, so a retry
after a lost answer is safe. No network. Needs the policy.write scope. A key limited to
vaults is refused with 403 vault_limited.
curl --request POST \
--url https://api.citadel.example/api/v1/policy/publish \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"version": 4,
"signature": "dQhrBoRLDdj261cqTZkE1y3lLxq4fkEp/QrHPyFqMhSgkP4/iVx/xghGu3ExStse1SqOK/JMhlDvitcG0WQhBA=="
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
version: 4,
signature: 'dQhrBoRLDdj261cqTZkE1y3lLxq4fkEp/QrHPyFqMhSgkP4/iVx/xghGu3ExStse1SqOK/JMhlDvitcG0WQhBA=='
})
};
fetch('https://api.citadel.example/api/v1/policy/publish', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.citadel.example/api/v1/policy/publish"
payload = {
"version": 4,
"signature": "dQhrBoRLDdj261cqTZkE1y3lLxq4fkEp/QrHPyFqMhSgkP4/iVx/xghGu3ExStse1SqOK/JMhlDvitcG0WQhBA=="
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.citadel.example/api/v1/policy/publish"
payload := strings.NewReader("{\n \"version\": 4,\n \"signature\": \"dQhrBoRLDdj261cqTZkE1y3lLxq4fkEp/QrHPyFqMhSgkP4/iVx/xghGu3ExStse1SqOK/JMhlDvitcG0WQhBA==\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"version": 4,
"status": "pending",
"document": "---\nceiling:\n TRX/6: '100000000'\n USDT/6: '50000000'\nchains:\n tron:\n assets:\n TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t: USDT/6\n native: TRX/6\n chain_module_version: 1\n wallets: {}\n whitelist:\n - TGz2TZmabrZZowj7G8BbyMYg6HacJLuzaj\n - TVsjquD89kcRu2WTSWsoJhYMNLQbFt8xQ4\nreferences: {}\nversion: 4\n",
"key_id": "merchant-policy-admin",
"signature": "dQhrBoRLDdj261cqTZkE1y3lLxq4fkEp/QrHPyFqMhSgkP4/iVx/xghGu3ExStse1SqOK/JMhlDvitcG0WQhBA==",
"approval": {
"id": "0199f1a2-4b6c-7d8e-9f01-23456789abcd",
"status": "pending",
"required": 2,
"approved": 0,
"expires_at": "2026-10-18T13:00:00Z",
"decided_at": null
},
"rejected_reason": null,
"created_at": "2026-10-18T09:00:00Z",
"updated_at": "2026-10-18T09:01:00Z"
}Authorizations
An API key minted in the console (ctd_…). Authenticates; never authorizes funds. A key
carries scopes (read, wallets.write, transactions.write, events.write,
webhooks.write, policy.write) and may be limited to vaults, to IP addresses, and in
lifetime — see Authentication.
Body
Response
Signed and waiting for approval.
draft — to sign and publish; pending — signed, waits for approval; published — sent to your engine; rejected — never sent.
draft, pending, published, rejected The YAML document: the exact bytes your policy key signs.
The policy key that signed. null for a draft.
Your policy key's signature over document, in standard base64. null for a draft.
The approval a change published through the API waits for, or waited for. null for a draft, and for a version published in the console.
Show child attributes
Show child attributes
Why a rejected change was never sent: an approver declined it, it was not approved in time, or a newer change replaced it or a newer version came into force first.
approval_rejected, approval_expired, superseded, null