> ## Documentation Index > Fetch the complete documentation index at: https://developers.fireblocks.com/llms.txt > Use this file to discover all available pages before exploring further. # Approve configuration changes ## Configuration Approval Callback `POST /v2/config_change_sign_request` This request expects a [CallbackResponse](/cosigners/callback-handler/response-object) object from the callback handler. If the callback handler does not respond within 30 seconds, Fireblocks fails the request. If your callback handler can't respond within 30 seconds, you can use the [retry mechanism](/cosigners/callback-handler/response-object) by responding with `RETRY`. *** ## Request parameters A unique identifier of this request. It must be returned in the response. (Optional) The Fireblocks API user ID associated with the cosigner device that's signing this approval. The type of configuration request. See [Configuration types](#configuration-types) for the full list of values and their fields. Additional information about the request. The shape depends on `type`. See [Configuration types](#configuration-types). *** ## Configuration types Each type below lists the fields Fireblocks sends in `extraInfo` for that specific configuration change. ### Wallets and external accounts #### UNMANAGED\_WALLET An event that involves address whitelisting. This type also covers the `UNMANAGED_V2` internal request type — both surface as `UNMANAGED_WALLET` in the callback. `INTERNAL` - Internal Wallets are addresses you control outside your Fireblocks workspace. Internal addresses display their current balance and are included in your workspace's total billable address count. `EXTERNAL` - External Wallets are addresses managed by your clients and counterparties. `CONTRACT` - Contract Wallets are addresses of smart contracts you want to interact with. Currently, this only applies to smart contracts on EVM-compatible blockchains. The name of the internal, external, or contract wallet you want to approve adding an address to. The ID of the internal, external, or contract wallet that you want to approve adding an address to. The ID of the asset to add to this wallet. Use [GET supported assets](/api-reference/blockchains-&-assets/list-assets-legacy) request to retrieve more information about an asset. The asset deposit address requested to be added to the wallet. Destination address tag for Ripple; destination memo for EOS, Stellar, Hedera, & DigitalBits; destination note for Algorand; bank transfer description for fiat providers. **Note:** For Stellar, the memo must be a string representation of an integer between "0" and "2147483647". Setting the memo to other values for Stellar assets will result in a failed request with an error message. (Optional) Extra address metadata, present only when the whitelisting request originated from certain workspace flows. #### UNMANAGED\_DAPP An event that involves adding an unmanaged dApp connection to your workspace. The name of the dApp connection's wallet container. The ID of the dApp connection's wallet container. The name of the dApp. The URL of the dApp. The dApp connection subtype. #### EXCHANGE, FIAT\_ACCOUNT, and CONNECTED\_ACCOUNT An event that involves adding an exchange account, fiat account, or connected account to your workspace. All three types share the same fields. The specific exchange, fiat account, or connected account provider. The account's name. The account's ID. The third-party service's API key. Blank for certain provider subtypes. (Optional) A JSON-formatted "key":"value" string, where "key" is an asset symbol and "value" is its address. There can be multiple entries in the JSON. Only populated for `FIAT_ACCOUNT`. Use [supported\_assets](/api-reference/blockchains-&-assets/list-assets-legacy) to retrieve asset symbols. ### Users and devices #### ADD\_USER An event that involves adding a user to your workspace. The UUID of the user being added. The type of the added user: `CONSOLE` or `API`. The user's assigned role. The user's first and last name. The user's email address. #### DELETE\_USER An event that involves removing a user from your workspace. The ID of the user who initiated the request. The workspace ID. The configuration request type. The ID of the user being removed. The user's first name. The user's last name. The user's email address. The user's role. A newline-separated list of alerts related to deleting this user (for example, pending requests or owned resources), if any. #### EDIT\_USER\_INFO An event that involves editing a user's name, email, or role. The user's first name before the change. The user's last name before the change. The user's email before the change. The user's role before the change. The requested first name. The requested last name. The requested email. The requested role. #### RE\_ENROLL\_DEVICE An event where an admin re-enrolls a mobile device for one of the users. Unlike `ADD_USER`, this type has no CONSOLE/API field: the `role` value here is deliberately stripped of the `API USER:` prefix, so you can't recover whether the user is a console or API user from this payload. The UUID of the user whose device is being reset. The user's role, without any console/API user prefix. The user's first and last name. The user's email address. ### Cosigner and device pairing #### COSIGNER\_CHANGE\_CALLBACK and PAIR\_VIRTUAL\_DEVICE `COSIGNER_CHANGE_CALLBACK` changes the callback configuration (URL, certificate, JWT public key) of a device that's already paired. `PAIR_VIRTUAL_DEVICE` pairs a new virtual (non-mobile) device using a pairing token. The ID of the user who initiated the request. The workspace ID. The ID of the API user being paired. The type of the paired user: `CONSOLE` or `API`. The paired user's first name. The paired user's role, including any console/API user prefix. Always `null` in this payload for both types. The actual pairing token is generated after approval and delivered separately. Your customer server URL to pair with. Your customer server certificate. Your customer JWT public key. The physical device identifier. The device identifier. Always `null` in this payload for both types. Use the callback's top-level `requestId` instead. ### Quorum and MPC configuration #### CHANGE\_QUORUM\_THRESHOLD An event where the admin updates the quorum threshold. The quorum threshold before the change. The requested quorum threshold. #### CONFIGURE\_OWNER\_IN\_ADMIN\_QUORUM An event that changes whether the workspace owner counts toward the admin quorum. The ID of the user who initiated the request. The workspace ID. Whether the workspace owner counts toward the admin quorum. #### SET\_MPC\_PROVISIONER An event that designates a user as an MPC provisioner. Always `null` in this payload — no producer currently populates it. Whether the user is set as an MPC provisioner. ### IP allow list #### ACTIVATE\_IP\_ALLOW\_LIST An event that turns the IP allow list on or off. The ID of the user who initiated the request. The workspace ID. The configuration request type. Whether the IP allow list is being turned on or off. The ID of the allow list rule. #### ADD\_IP\_ADDRESS An event that adds an IP address to the allow list. The ID of the user who initiated the request. The workspace ID. The configuration request type. The label for this IP address entry. The IP address being added. The ID of this IP address entry. The ID of the allow list rule. When this entry was created. When this entry was last updated. #### DELETE\_IP\_ADDRESS An event that removes an IP address from the allow list. The ID of the user who initiated the request. The workspace ID. The configuration request type. The label for this IP address entry. The IP address being removed. The ID of this IP address entry. The ID of the allow list rule. When this entry was created. When this entry was last updated. The ID of the removed IP address. #### UPDATE\_IP\_ADDRESS An event that updates an existing IP address on the allow list. The ID of the user who initiated the request. The workspace ID. The configuration request type. The current label for this IP address entry. The requested label for this IP address entry. The current IP address. The requested IP address. The ID of this IP address entry. The ID of the allow list rule. When this entry was created. When this entry was last updated. The ID of the updated IP address. ### dApp connections and MEV protection #### ENABLE\_ONE\_TIME\_ADDRESS An event which involves enabling a particular transaction to a one-time address in the workspace. This type has no `extraInfo` fields. #### ENABLE\_NON\_EVM\_DAPPS\_CONNECTIONS An event that enables dApp connections for non-EVM blockchains. The ID of the user who initiated the request. The workspace ID. The configuration request type. #### ENABLE\_MEV\_DAPPS, DISABLE\_MEV\_DAPPS, ENABLE\_MEV\_API, and DISABLE\_MEV\_API An event that enables or disables MEV protection for dApp connections or API-initiated transactions. All four types share the same fields. The ID of the user who initiated the request. The workspace ID. The configuration request type. ### Fireblocks Network #### ADD\_NETWORK\_CONNECTION An event of adding a Fireblocks Network new connection. ID of network connection Connection note ID of local networkId ID of the remote peer's networkId ID of remote peer tenantId (Optional) JSON representation of routing policy object. Only included in the payload sent to the connection's initiating tenant, not the receiving tenant. #### SET\_NETWORK\_CONNECTION\_ROUTING\_POLICY An event where the admin configures the routing policy for each network connection. ID of network connection JSON representation of routing policy object #### SET\_NETWORK\_ID\_POLICY An event of setting up the Fireblocks Network *Network ID* in case its profile is not discoverable. ID of networkID JSON representation of routing policy object ### Policies and approval groups #### POLICY\_APPROVAL An event that involves updating the Transaction Authorization Policy. The ID of the user who originally edited the policy. The name of the user who originally edited the policy. The ID of the user who most recently edited the policy. The name of the user who most recently edited the policy. When the policy was edited, in Unix epoch time. The ID of the user who initiated the request. The name of the user who published the policy. When the policy was published, in Unix epoch time. (Optional) The number of allow rules in the policy. (Optional) The number of block rules in the policy. (Optional) The number of two-tier approval rules in the policy. #### POLICY\_CHANGE An event that involves a pending edit to the Transaction Authorization Policy before it's published. The ID of the user who originally edited the policy. The name of the user who originally edited the policy. The ID of the user who most recently edited the policy. The name of the user who most recently edited the policy. When the policy was edited, in Unix epoch time. The ID of the user who initiated the request. The name of the user who published the policy. When the policy was published, in Unix epoch time. (Optional) A summary of pending rule changes. Keys combine the rule type and verdict action (for example, `transferALLOWRules`); values are display strings such as `"3 Rules"`, not numeric counts. For a change spanning multiple policies, only the last policy's counters are present. #### UPDATE\_APPROVAL\_GROUP\_MAPPING An event involving gathering a list of approvers for a particular admin operation. The first name of the user who initiated the request. The last name of the user who initiated the request. The admin operation type this approval group mapping applies to. Whether the workspace owner must be included in the approval group. The ID of the requested approval group. The requested approval threshold. The name of the requested approval group. The number of members in the requested approval group. When the request was created, in Unix epoch seconds. #### USERS\_GROUP\_APPROVAL An event that involves creating, editing, or deleting a user group in your workspace. The fields included depend on the `subType`. `CREATE_USERS_GROUP`, `EDIT_USERS_GROUP`, or `DELETE_USERS_GROUP`. The ID of the user who initiated the request. The ID of the user group. The name of the user group. A list of the pending changes to the group. `RENAMED_TITLE`, `ADDED_USER`, `REMOVED_USER`, or `DELETE_GROUP`. (Optional) The new group name. Present when `type` is `RENAMED_TITLE`. (Optional) The affected user's ID. Present when `type` is `ADDED_USER` or `REMOVED_USER`. A breakdown of the group's members by role, plus a `total` entry. A role name, or `total` for the overall member count. The number of members for this `key`. (Optional) The requested group name. Included when `subType` is `EDIT_USERS_GROUP`. (Optional) Users added to the group. Included when `subType` is `CREATE_USERS_GROUP` or `EDIT_USERS_GROUP`. The user's first and last name. The user's role. (Optional) Users removed from the group. Included when `subType` is `EDIT_USERS_GROUP`. Same entry shape as `addedUsers`. (Optional) The IDs of the group's members, as strings. Included when `subType` is `CREATE_USERS_GROUP` or `EDIT_USERS_GROUP`. (Optional) The group's members. Included when `subType` is `DELETE_USERS_GROUP`. Same entry shape as `addedUsers`. #### REGISTER\_EXTERNAL\_KEYS\_VALIDATOR\_KEY An event that registers a validator key for External Keys. The first name of the user who initiated the request. The last name of the user who initiated the request. The validator key being registered. ### Automation rules #### ADD\_ACTIVE\_AUTOMATION\_RULE, ADD\_INACTIVE\_AUTOMATION\_RULE, EDIT\_AUTOMATION\_RULE, DELETE\_AUTOMATION\_RULE, ACTIVATE\_AUTOMATION\_RULE, and DEACTIVATE\_AUTOMATION\_RULE An event that adds, edits, deletes, activates, or deactivates an automation rule. All six types share the same fields. The ID of the user who initiated the request. The workspace ID. The configuration request type. The full automation rule definition submitted for this change. Its schema is defined by the Automation Rules API. ### Protected tags Editing, deleting, attaching, and detaching a [protected tag](/docs/tags#protected-tags-and-the-approval-flow) requires quorum approval. These events carry those changes. #### EDIT\_PROTECTED\_TAG An event that edits a protected tag. The ID of the protected tag. The ID of the user who initiated the request. The requested changes to the tag, as `newTag` and `previousTag` objects with the same shape. The tag's state after the edit. The tag's ID. The tag's label. The tag's color. The tag's description. Whether the tag is protected. The tag's type. The tag's state before the edit. Same fields as `newTag`. #### DELETE\_PROTECTED\_TAG An event that deletes a protected tag. The ID of the protected tag. The ID of the user who initiated the request. (Optional) The tag being deleted. The tag's label. The tag's description. The tag's color. The tag's type. The tag type's display name. #### ATTACH\_AND\_DETACH\_PROTECTED\_TAGS An event that attaches or detaches protected tags on one or more entities. The ID of the user who initiated the request. (Optional) The entities being tagged or untagged. The entity's display name. The entity's ID. (Optional) The tags being attached. The tag's label. The tag's description. The tag's color. The tag's ID. The tag's type. (Optional) The tags being detached. Same entry shape as `attachedTags`. #### CREATE\_ENTITIES\_WITH\_TAG\_ATTACHMENTS An event that creates entities with protected tags attached. The ID of the user who initiated the request. The workspace ID. (Optional) The IDs of the tags being attached. (Optional) The type of entity being created: `1` for a vault account, `2` for a contact. (Optional) The number of entities being created. (Optional) The highest existing vault account ID at request time, used as a floor for the newly created IDs. Only present when `entityType` is `1` (vault account). (Optional) The tags being attached. Unlike `ATTACH_AND_DETACH_PROTECTED_TAGS`, this field isn't unwrapped to a plain array before being sent — the tag list is nested under `values`. A display label for this list, for Fireblocks' own UI. Not something a callback handler needs to act on. Singular form of the label. Always `"Tag"`. Plural form of the label. Always `"Tags"`. The tags being attached. The tag's label. The tag's description. The tag's color. The tag's ID. The tag's type.