> ## Documentation Index
> Fetch the complete documentation index at: https://developers.fireblocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Approve transactions

## Transaction Signing Callback Handler

`POST /v2/tx_sign_request`

This request is used for transaction signing and approval and expects a [CallbackResponse](/cosigners/callback-handler/response-object) object from the callback handler. `IGNORE` applies to approval requests only. If the callback handler does not respond within 30 seconds, Fireblocks fails the request. If your callback handler can't respond within 30 seconds, you can use the [retry mechanism](/cosigners/callback-handler/response-object) by responding with `RETRY`.

If both approval and signing are requested for a transaction, one callback handles both requests, but the two stages don't send an identical payload. Fields below that only appear in one stage are tagged **Approval only** or **Signing only**; untagged fields are sent in both.

***

## Request parameters

### Identifiers

<ResponseField name="txId" type="string">
  The transaction's internal ID in Fireblocks.
</ResponseField>

<ResponseField name="requestId" type="string">
  A unique identifier of this request is returned in the response. For a batched transaction, this retains the batch suffix that `txId` does not.
</ResponseField>

<ResponseField name="externalTxId" type="string">
  An optional but highly recommended parameter. Fireblocks will reject future transactions with same ID. You should set this to a unique ID representing the transaction, to avoid submitting the same transaction twice. This helps with cases where submitting the transaction responds with an error code due to Internet interruptions, but the transaction was actually sent and processed. To validate whether a transaction has been processed, Find a specific transaction by external transaction ID. There is no specific format required for this parameter.
</ResponseField>

### Signers

<ResponseField name="signerId" type="string">
  (Optional) The Fireblocks API user ID associated with the cosigner device that's signing. This identifies the cosigner, not necessarily the person who created the transaction.
</ResponseField>

<ResponseField name="players" type="array" post={["Signing only"]}>
  A list of the Co-signers that signed the transaction. (Two Fireblocks SaaS and at least one user device or one API Co-signer). Each signer is represented by a Device ID.
</ResponseField>

### Transaction details

<ResponseField name="operation" type="string">
  The [transaction operation](#transactionoperation) type. The default is `TRANSFER`.
</ResponseField>

<ResponseField name="asset" type="string">
  The asset ID in Fireblocks.
</ResponseField>

<ResponseField name="amount" type="number" deprecated>
  Use the **amountStr** field for accuracy. If the transfer is a withdrawal from an exchange, the actual transfer amount. Otherwise, the requested amount.
</ResponseField>

<ResponseField name="amountStr" type="string">
  The amount of the transfer in string format.
</ResponseField>

<ResponseField name="requestedAmount" type="number" deprecated>
  Use the **requestedAmountStr** field for accuracy. The requested transfer amount. In gross transactions, transaction fees are deducted from this amount.
</ResponseField>

<ResponseField name="requestedAmountStr" type="string">
  The requested transfer amount in string format. In gross transactions, transaction fees are deducted from this amount.
</ResponseField>

<ResponseField name="fee" type="string" post={["Signing only"]}>
  The transaction's estimated fee. Not included in the approval-stage payload at all.
</ResponseField>

<ResponseField name="changeIndex" type="number" post={["Signing only"]}>
  (Optional) The change output index, for UTXO-based blockchains that return change to a Fireblocks address.
</ResponseField>

<ResponseField name="note" type="string">
  (Optional) Custom note that describes this transaction in your Fireblocks workspace. The note isn't sent to the blockchain.
</ResponseField>

<ResponseField name="extraParameters" type="object">
  (Optional) Parameters that are specific to some transaction operation types and blockchain networks. Learn more [below](#transactionextraparameters).
</ResponseField>

<ResponseField name="rawTx" type="array" post={["Signing only"]}>
  An array of [RawTX](#rawtx) objects. Contains a list of the actual transaction payload sent to the blockchain. Note that some signing requests represent multiple transactions. When this occurs, the list contains more than one object. This parameter is not included in the CallbackResponse object when using a Fireblocks EU cloud environment.

  This field is included for the following blockchains: ADA, BTC, DASH, DOGE, LTC, BSV, BCH, XEC, ZEC, EVMs, all Cosmos based chains, SOL, XLM, XTZ, TRX, NEAR, XRP and TON.

  This is an opt-in feature. Please contact [Fireblocks Support](https://support.fireblocks.io/hc/en-us/requests/new) to include this feature in your workspace.
</ResponseField>

### Source and destination

<ResponseField name="sourceType" type="string">
  The [source](/reference/transaction-sources-destinations) of the transaction.
</ResponseField>

<ResponseField name="sourceId" type="string">
  The transaction's source vault account ID or exchange account UUID.
</ResponseField>

<ResponseField name="destType" type="string">
  The transaction's destination type: `VAULT`, `EXCHANGE`, `ONE_TIME`, `UNMANAGED`, `NETWORK_CONNECTION`, `COMPOUND`, `NONE`, `OEC_PARTNER`, `END_USER_WALLET`, `GLOBAL_WHITELIST`, `CONNECTED_ACCOUNT`, or `LEGACY_TO_NEW_VAULT`.
</ResponseField>

<ResponseField name="destId" type="string">
  The destination's vault account ID or exchange account UUID.
</ResponseField>

<ResponseField name="destAddress" type="string">
  The destination address of the transaction. Always present at the signing stage; only present at the approval stage when the destination has a resolvable address.
</ResponseField>

<ResponseField name="destAddressType" type="string" post={["Signing only"]}>
  The destination's address type: `WHITELISTED` (default) or `ONE_TIME`. Not included in the approval-stage payload.
</ResponseField>

<ResponseField name="destinations" type="array">
  An array of [TransactionRequestCallbackDestination](#transactionrequestcallbackdestination) objects with all details for all destination(s).
</ResponseField>

### Virtual sub-accounts

Present only at the approval stage, only when the transaction's source or destination is a virtual sub-account of a vault account. Not included in the signing-stage payload.

<ResponseField name="virtualSrcType" type="string" post={["Approval only"]}>
  The virtual (sub-account) type of the transaction source.
</ResponseField>

<ResponseField name="virtualSrcId" type="string" post={["Approval only"]}>
  The virtual (sub-account) identifier of the transaction source.
</ResponseField>

<ResponseField name="virtualDstType" type="string" post={["Approval only"]}>
  The virtual (sub-account) type of the transaction destination.
</ResponseField>

<ResponseField name="virtualDstId" type="string" post={["Approval only"]}>
  The virtual (sub-account) identifier of the transaction destination.
</ResponseField>

### Trading account and third-party routing

Present only at the approval stage, when the transaction has associated Fireblocks Network routing metadata. Not included in the signing-stage payload.

<ResponseField name="isThirdPartyRouting" type="boolean" post={["Approval only"]}>
  Present whenever network-routing metadata exists on the transaction; `true` when that routing is through a third party.
</ResponseField>

<ResponseField name="underlyingSrcType" type="string" post={["Approval only"]}>
  (Optional) The type of the underlying source account behind the third-party routing.
</ResponseField>

<ResponseField name="underlyingSrcId" type="string" post={["Approval only"]}>
  (Optional) The identifier of the underlying source account behind the third-party routing.
</ResponseField>

<ResponseField name="srcTradingAccount" type="string" post={["Approval only"]}>
  (Optional) The off-exchange trading account associated with the transaction source.
</ResponseField>

<ResponseField name="dstTradingAccount" type="string" post={["Approval only"]}>
  (Optional) The off-exchange trading account associated with the transaction destination.
</ResponseField>

### Protected tags

Only [protected tags](/docs/tags#protected-tags-and-the-approval-flow) reach the callback. Standard tags are not included. Use them to apply different signing logic to tagged vault accounts.

<ResponseField name="sourceTags" type="array">
  (Optional) A list of protected tags attached to the transaction source.

  <Expandable title="entry object">
    <ResponseField name="tagId" type="string">
      The tag's ID.
    </ResponseField>

    <ResponseField name="label" type="string">
      The tag's label.
    </ResponseField>

    <ResponseField name="color" type="string">
      (Optional) The tag's color.
    </ResponseField>

    <ResponseField name="description" type="string">
      (Optional) The tag's description.
    </ResponseField>

    <ResponseField name="tagType" type="string">
      (Optional) The tag's type.
    </ResponseField>
  </Expandable>
</ResponseField>

***

## TransactionOperation

<ResponseField name="operation" type="string">
  `TRANSFER`: Default. Transfers funds from one account to another. UTXO blockchains allow multi-input and multi-output transfers. All other blockchains allow transfers with one source address and one destination address.

  `MINT`: Mints new tokens. Supported for Stellar, Ripple, and EVM-based blockchains.

  `BURN`: Burns tokens. Supported for Stellar, Ripple, and EVM-based blockchains.

  `CONTRACT_CALL`: Calls a smart contract method for web3 operations on any EVM blockchain. The [Fireblocks development libraries](/reference/evm-web3-provider#convenience-libraries) are recommended for building contract call transactions.

  `TYPED_MESSAGE`: An off-chain message in either Ethereum Personal Message or EIP712 format. Use it to sign specific readable messages that are not actual transactions. [Learn more about typed messages](/docs/typed-message-signing-1).

  `RAW`: An off-chain message with no predefined format. Use it to sign any message with your private key, including protocols such as blockchains and custom transaction types that are not natively supported by Fireblocks. [Learn more about raw signing transactions](/docs/raw-signing).

  `ENABLE_ASSET`: Algorand, DigitalBits, Solana, and Stellar require an on-chain transaction to create an asset wallet and enable the deposit address. This transaction is automatically created when adding assets on these blockchains to a vault account.

  `STAKE`: Assign assets to a staking pool managed by a staking validator. [Learn more about staking transactions and supported blockchains](/reference/staking-overview). This transaction is automatically created when performing staking operations.

  `SUPPLY`, `REDEEM`, `APPROVE`, `ENTER_MARKET`, `EXIT_MARKET`: DeFi lending-protocol operations.

  `DEPLOYMENT`: Deploys a smart contract.

  `PROGRAM_CALL`: Calls a Solana program.

  `UPGRADE`: Upgrades a deployed program or contract.

  `OFFER_RESPONSE`: Responds to a trading offer.
</ResponseField>

### TransactionExtraParameters

<ResponseField name="inputsSelection" type="object">
  For UTXO-based blockchain multi-input selection, use the `inputsSelection` field with values set to the [InputsSelection object](/reference/transaction-objects#inputsselection). The inputs can be retrieved using the Retrieve Unspent Inputs endpoint.
</ResponseField>

<ResponseField name="rawMessageData" type="object">
  For `RAW` operations, use the rawMessageData field with the values set to the [RawMessageData object](/reference/raw-signing-objects#rawmessagedata).
</ResponseField>

<ResponseField name="contractCallData" type="string">
  For `CONTRACT_CALL` operations, use the contractCallData field with the value set to the Ethereum smart contract Application Binary Interface (ABI) payload. The [Fireblocks development libraries](/reference/evm-web3-provider#convenience-libraries) are recommended for building contract call transactions.
</ResponseField>

***

## TransactionRequestCallbackDestination

<ResponseField name="amountNative" type="number" deprecated>
  (Optional) The amount transferred to this destination as a number. Present when this destination carries its own amount metadata (multi-destination transfers). Use the amountNativeStr parameter for accurate precision.
</ResponseField>

<ResponseField name="amountNativeStr" type="string">
  (Optional) The amount transferred to this destination represented as a string. Same presence condition as `amountNative`.
</ResponseField>

<ResponseField name="amountUSD" type="number">
  (Optional) The USD value of the transfer to this destination. Same presence condition as `amountNative`.
</ResponseField>

<ResponseField name="originalAmount" type="number">
  (Optional) Approval-stage only. The original (uncapped) requested amount for this destination, present only when the amount exceeds an internal display cap.
</ResponseField>

<ResponseField name="originalAmountStr" type="string">
  (Optional) Approval-stage only. String form of `originalAmount`, under the same condition.
</ResponseField>

<ResponseField name="dstAddressType" type="string">
  `WHITELISTED` or `ONE_TIME`.
</ResponseField>

<ResponseField name="dstId" type="string">
  The ID of the destination.
</ResponseField>

<ResponseField name="dstName" type="string">
  The name of the destination.
</ResponseField>

<ResponseField name="dstWalletId" type="string">
  (Optional) The ID of the destination's wallet container, when the destination is an unmanaged or dApp wallet.
</ResponseField>

<ResponseField name="dstSubType" type="string">
  The specific exchange, fiat account, or unmanaged wallet.

  For exchange accounts: `BINANCE`, `BINANCEUS`, `BITFINEX`, `BITHUMB`, `BITMEX`, `BITSO`, `BITSTAMP`, `BITTREX`, `BYBIT`, `CIRCLE`, `COINBASEEXCHANGE`, `COINBASEPRO`, `COINMETRO`, `COINSPRO`, `CRYPTOCOM`, `DERIBIT`, `GEMINI`, `HITBTC`, `HUOBI`, `INDEPENDENTRESERVE`, `KORBIT`, `KRAKEN`, `KRAKENINTL`, `KUCOIN`, `LIQUID`, `OKCOIN`, `OKEX`, `PAXOS`, `POLONIEX`

  For fiat accounts: `BLINC`

  For unmanaged wallets: `INTERNAL`, `EXTERNAL`, or `CONTRACT`
</ResponseField>

<ResponseField name="dstTag" type="string">
  (Optional) The blockchain-level destination tag or memo for this destination (for example, a Ripple destination tag). Distinct from `tags` below, which holds protected tags, not a blockchain memo.
</ResponseField>

<ResponseField name="dstType" type="string">
  `VAULT`, `EXCHANGE`, `ONE_TIME`, `UNMANAGED`, `NETWORK_CONNECTION`, `COMPOUND`, `NONE`, `OEC_PARTNER`, `END_USER_WALLET`, `GLOBAL_WHITELIST`, `CONNECTED_ACCOUNT`, or `LEGACY_TO_NEW_VAULT`.
</ResponseField>

<ResponseField name="displayDstAddress" type="string">
  (Optional) The address of this specific destination.
</ResponseField>

<ResponseField name="displayDstTag" type="string">
  (Optional) The display form of `dstTag`.
</ResponseField>

<ResponseField name="action" type="string">
  (Optional) The policy verdict for this specific destination: `ALLOW`, `BLOCK`, `2-TIER`, `SKIP`, `BYPASS`, or `ALLOW_NO_AUTHORIZER_DEFINED`.
</ResponseField>

<ResponseField name="actionInfo" type="object">
  (Optional) Present alongside `action`. Details about the policy rule that produced the verdict.

  <Expandable title="properties">
    <ResponseField name="ruleType" type="string">
      The type of policy that produced this verdict: `GLOBAL`, `PRE_TENANT`, or `TENANT`.
    </ResponseField>

    <ResponseField name="byGlobalPolicy" type="boolean">
      Whether the matched policy is the workspace-wide global policy, as opposed to a tenant-specific one.
    </ResponseField>

    <ResponseField name="byRule" type="boolean">
      Whether a specific numbered rule (rather than a policy-type-level match) produced this verdict.
    </ResponseField>

    <ResponseField name="capturedRuleV2" type="string">
      Present when `byRule` is `true`. A JSON-encoded string of the matched rule, in the current (v2) policy engine's format.
    </ResponseField>

    <ResponseField name="capturedRuleNumV2" type="string">
      Present when `byRule` is `true`. The matched rule's index, as a string, in the v2 policy engine.
    </ResponseField>

    <ResponseField name="rulesSnapshotId" type="string">
      (Optional) Present when `byRule` is `true`. The ID of the policy snapshot the rule was matched against.
    </ResponseField>

    <ResponseField name="capturedRule" type="string">
      (Optional) A JSON-encoded string of the matched rule, translated to the legacy (v1) policy format for backward compatibility. Not always present, even when `capturedRuleV2` is.
    </ResponseField>

    <ResponseField name="capturedRuleNum" type="number">
      (Optional) The matched rule's index within the legacy (v1) policy array. Only present alongside `capturedRule` when a v1-equivalent rule was found.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="authorizationGroups" type="object">
  (Optional) Present only when `action` is `2-TIER`. Describes the approvers required for two-tier authorization, including a `logic` field (how the groups combine) and a `groups` array of approval groups. The exact shape varies by policy version; not fully enumerated here.
</ResponseField>

<ResponseField name="reverseAddressLookup" type="object">
  (Optional) Present when the destination address was resolved through a reverse lookup (for example, an on-chain naming service).

  <Expandable title="properties">
    <ResponseField name="resolvedAddress" type="string">
      (Optional) The resolved destination address.
    </ResponseField>

    <ResponseField name="resolvedTag" type="string">
      (Optional) The resolved destination tag.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="txAdditionalDetails" type="object">
  (Optional) Additional context about how this destination's transfer was initiated. Note the wire field name is `txAdditionalDetails`, not `additionalDetails`.

  <Expandable title="properties">
    <ResponseField name="originatingSessionToken" type="string">
      (Optional) The session token of the originating request.
    </ResponseField>

    <ResponseField name="partnerIntentId" type="string">
      (Optional) The ID of the partner intent that initiated this transfer, if applicable.
    </ResponseField>

    <ResponseField name="programCallDecoded" type="string">
      (Optional) The decoded Solana program call, for `PROGRAM_CALL` operations.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="networkTransferInfo" type="object">
  (Optional) Present when this destination is routed through a Fireblocks Network connection.

  <Expandable title="properties">
    <ResponseField name="concreteDstId" type="string">
      (Optional) The concrete (underlying) destination ID behind the network routing.
    </ResponseField>

    <ResponseField name="concreteDstType" type="string">
      (Optional) The concrete (underlying) destination type behind the network routing.
    </ResponseField>

    <ResponseField name="thirdPartyInfo" type="object">
      (Optional) Present only for third-party network transfers.

      <Expandable title="properties">
        <ResponseField name="warningTitle" type="string">
          (Optional) A warning title to display for this third-party transfer.
        </ResponseField>

        <ResponseField name="warningDescription" type="string">
          (Optional) A warning description to display for this third-party transfer.
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="enrichmentJson" type="object">
  (Optional) Enrichment data scoped to this specific destination. Unlike the transaction-level [trading account and third-party routing](#trading-account-and-third-party-routing) fields above (which only expose a curated subset), this is the full per-destination object, unfiltered.

  <Expandable title="properties">
    <ResponseField name="underlyingInfo" type="object">
      (Optional)

      <Expandable title="properties">
        <ResponseField name="underlyingSrcType" type="string">
          (Optional) The type of the underlying source account.
        </ResponseField>

        <ResponseField name="underlyingSrcId" type="string">
          (Optional) The ID of the underlying source account.
        </ResponseField>

        <ResponseField name="underlyingDstType" type="string">
          (Optional) The type of the underlying destination account.
        </ResponseField>

        <ResponseField name="underlyingDstId" type="string">
          (Optional) The ID of the underlying destination account.
        </ResponseField>

        <ResponseField name="underlyingContext" type="string">
          (Optional) Additional context about the underlying account relationship.
        </ResponseField>

        <ResponseField name="removeCollateralAddress" type="string">
          (Optional) The address collateral is being released to, for collateral-release transfers.
        </ResponseField>

        <ResponseField name="removeCollateralAddressTag" type="string">
          (Optional) The destination tag for `removeCollateralAddress`.
        </ResponseField>

        <ResponseField name="removeCollateralAddressSignature" type="string">
          (Optional) A signature authorizing the collateral release.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="slaInfo" type="object">
      (Optional) Present for transfers with an SLA-based signing deadline.

      <Expandable title="properties">
        <ResponseField name="slaTimeout" type="number">
          The SLA deadline, in Unix epoch time.
        </ResponseField>

        <ResponseField name="slaStartTime" type="number">
          (Optional) When the SLA period started, in Unix epoch time.
        </ResponseField>

        <ResponseField name="slaDeviceSigners" type="array">
          The device IDs expected to sign within the SLA window.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="oecInfo" type="object">
      (Optional) Present for off-exchange custody transfers.

      <Expandable title="properties">
        <ResponseField name="settlementId" type="string">
          (Optional) The off-exchange settlement ID.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="wallet_connect_service" type="object">
      (Optional) Present for WalletConnect-initiated transfers. Note the wire field name is `wallet_connect_service`, not camelCase like most other fields in this payload.

      <Expandable title="properties">
        <ResponseField name="dappUrl" type="string">
          (Optional) The URL of the connected dApp.
        </ResponseField>

        <ResponseField name="pairingTopic" type="string">
          (Optional) The WalletConnect pairing topic.
        </ResponseField>
      </Expandable>
    </ResponseField>

    <ResponseField name="srcTradingAccount" type="string">
      (Optional) The off-exchange trading account associated with the source, scoped to this destination.
    </ResponseField>

    <ResponseField name="dstTradingAccount" type="string">
      (Optional) The off-exchange trading account associated with this destination.
    </ResponseField>

    <ResponseField name="swapId" type="string">
      (Optional) The ID of the swap this transfer is part of, if applicable.
    </ResponseField>

    <ResponseField name="providerRampId" type="string">
      (Optional) The ID of the fiat on/off-ramp provider transaction, if applicable.
    </ResponseField>

    <ResponseField name="rampPaymentTx" type="object">
      (Optional) Present for on/off-ramp payment transfers.

      <Expandable title="properties">
        <ResponseField name="paymentId" type="string">
          The ramp provider's payment ID.
        </ResponseField>

        <ResponseField name="transactionId" type="string">
          The ramp provider's transaction ID.
        </ResponseField>

        <ResponseField name="messageType" type="number">
          The ramp payment message type.
        </ResponseField>

        <ResponseField name="esSignature" type="string">
          The signature over the ramp payment message.
        </ResponseField>

        <ResponseField name="signedAtMs" type="number">
          When the ramp payment message was signed, in Unix epoch milliseconds.
        </ResponseField>
      </Expandable>
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="tags" type="array">
  (Optional) A list of protected tags attached to this destination — the destination-side counterpart to the top-level `sourceTags`.

  <Expandable title="entry object">
    <ResponseField name="tagId" type="string">
      The tag's ID.
    </ResponseField>

    <ResponseField name="label" type="string">
      The tag's label.
    </ResponseField>

    <ResponseField name="color" type="string">
      (Optional) The tag's color.
    </ResponseField>

    <ResponseField name="description" type="string">
      (Optional) The tag's description.
    </ResponseField>

    <ResponseField name="tagType" type="string">
      (Optional) The tag's type.
    </ResponseField>
  </Expandable>
</ResponseField>

***

## RawTX

<ResponseField name="rawTx" type="string">
  Hex-encoded details of a transaction sent to the blockchain.
</ResponseField>

<ResponseField name="keyDerivationPath" type="string">
  Location of the encryption key within the customer's [HD Wallet URL](https://support.fireblocks.io/hc/en-us/articles/360014330819-Fireblocks-Vault-HD-Derivation-Paths) used to sign this transaction.
</ResponseField>

<ResponseField name="payload" type="string">
  The signing payload (typically a transaction hash) computed from `rawTx`.
</ResponseField>

***