Register an approval key

Register an approval public key for an API user, used to sign approval requests. Up to 2 active keys are supported per API user. Returns the server-generated key ID used for deletion.

The userId must be the authenticated API user’s own ID. Registering a key for another user is not supported and is rejected.

Registration may require approval. In that case the response carries ccrIdPendingRegistration, the key reads as APPROVAL_API_KEY_STATUS_PENDING_REGISTRATION and cannot sign until the request is approved. A rejected request removes the key.

Endpoint Permission: Owner, Admin, Non-Signing Admin, Approver, Signer, Security Admin.

POST

management

api_users

{userId}

approval_keys

TypeScript

const response: Promise<FireblocksResponse<RegisterApprovalApiKeyResponse>> = fireblocks.approvalsBeta.createApprovalKey(approvalsBetaApiCreateApprovalKeyRequest);

curl --request POST \
  --url https://api.fireblocks.io/v1/management/api_users/{userId}/approval_keys \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "primary signing key",
  "approvalApiPublicKey": {
    "algorithm": "ECDSA_SECP256R1",
    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQ...\n-----END PUBLIC KEY-----"
  }
}
'

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'primary signing key',
    approvalApiPublicKey: {
      algorithm: 'ECDSA_SECP256R1',
      publicKeyPem: '-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQ...\n-----END PUBLIC KEY-----'
    }
  })
};

fetch('https://api.fireblocks.io/v1/management/api_users/{userId}/approval_keys', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.fireblocks.io/v1/management/api_users/{userId}/approval_keys",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'primary signing key',
    'approvalApiPublicKey' => [
        'algorithm' => 'ECDSA_SECP256R1',
        'publicKeyPem' => '-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQ...
-----END PUBLIC KEY-----'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.fireblocks.io/v1/management/api_users/{userId}/approval_keys"

	payload := strings.NewReader("{\n  \"name\": \"primary signing key\",\n  \"approvalApiPublicKey\": {\n    \"algorithm\": \"ECDSA_SECP256R1\",\n    \"publicKeyPem\": \"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQ...\\n-----END PUBLIC KEY-----\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.fireblocks.io/v1/management/api_users/{userId}/approval_keys")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"primary signing key\",\n  \"approvalApiPublicKey\": {\n    \"algorithm\": \"ECDSA_SECP256R1\",\n    \"publicKeyPem\": \"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQ...\\n-----END PUBLIC KEY-----\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "keyId": "fab543c0-d6be-414c-aa05-5c6c84269d7a",
  "ccrIdPendingRegistration": "19331"
}

{
  "message": "<string>",
  "code": 123
}

{
  "message": "<string>",
  "code": 123
}

Headers

Idempotency-Key

string

A unique identifier for the request. If the request is sent multiple times with the same idempotency key, the server will return the same response as the first request. The idempotency key is valid for 24 hours.

Path Parameters

userId

string

required

The ID of the API user to register the approval key for.

Body

application/json

The approval API key to register.

name

string

required

A human-readable label for the key.

Example:

"primary signing key"

approvalApiPublicKey

object

required

The public key material and its signing algorithm.

Show child attributes

Response

The approval key was registered.

The result of registering an approval API key.

keyId

string

required

The server-generated ID of the registered key, used for deletion.

Example:

"fab543c0-d6be-414c-aa05-5c6c84269d7a"

ccrIdPendingRegistration

string

required

Always returned. An empty string when the key is active immediately. Otherwise, the ID of the approval request that must be approved before the key becomes active. The request appears in GET /v1/approvals.

Example:

"19331"

⌘I

TypeScript

const response: Promise<FireblocksResponse<RegisterApprovalApiKeyResponse>> = fireblocks.approvalsBeta.createApprovalKey(approvalsBetaApiCreateApprovalKeyRequest);

curl --request POST \
  --url https://api.fireblocks.io/v1/management/api_users/{userId}/approval_keys \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "primary signing key",
  "approvalApiPublicKey": {
    "algorithm": "ECDSA_SECP256R1",
    "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQ...\n-----END PUBLIC KEY-----"
  }
}
'

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'primary signing key',
    approvalApiPublicKey: {
      algorithm: 'ECDSA_SECP256R1',
      publicKeyPem: '-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQ...\n-----END PUBLIC KEY-----'
    }
  })
};

fetch('https://api.fireblocks.io/v1/management/api_users/{userId}/approval_keys', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.fireblocks.io/v1/management/api_users/{userId}/approval_keys",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'primary signing key',
    'approvalApiPublicKey' => [
        'algorithm' => 'ECDSA_SECP256R1',
        'publicKeyPem' => '-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQ...
-----END PUBLIC KEY-----'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.fireblocks.io/v1/management/api_users/{userId}/approval_keys"

	payload := strings.NewReader("{\n  \"name\": \"primary signing key\",\n  \"approvalApiPublicKey\": {\n    \"algorithm\": \"ECDSA_SECP256R1\",\n    \"publicKeyPem\": \"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQ...\\n-----END PUBLIC KEY-----\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.fireblocks.io/v1/management/api_users/{userId}/approval_keys")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"primary signing key\",\n  \"approvalApiPublicKey\": {\n    \"algorithm\": \"ECDSA_SECP256R1\",\n    \"publicKeyPem\": \"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQ...\\n-----END PUBLIC KEY-----\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "keyId": "fab543c0-d6be-414c-aa05-5c6c84269d7a",
  "ccrIdPendingRegistration": "19331"
}

{
  "message": "<string>",
  "code": 123
}

{
  "message": "<string>",
  "code": 123
}

Introduction

Errors & Statuses

Data Objects

API Endpoints

Register an approval key

Headers

Path Parameters

Body

Response