REST API›Identity›Travel Rule

POST

Whitelist address

Unified CaaS-facing endpoint that absorbs the multi-step compliance orchestration (WP policy rule, VASP lookup or registration, PII storage) into a single declarative request. The server branches internally across policy-only, known-VASP and new-VASP flows.

Body Params

object

Request body for the unified POST /api/travel-rule/v1/whitelist endpoint.

enterpriseId is required so that the upstream needsEnterpriseAccess middleware (src/util/needsEnterpriseAccess.ts) can verify the caller has access to the targeted enterprise before the handler runs.

vaspId and newVasp are mutually exclusive — exactly one (or neither, in the case of a BitGo-wallet-id address or a restrictWhitelist=off org) must be supplied. The XOR check lives in the handler so we can return a targeted 400 with a clear message instead of an opaque decode error.

  • enterpriseId string required

    at least 1 characters

  • walletId string required

    at least 1 characters

  • coin string required

    at least 1 characters

  • address string required

    at least 1 characters

  • custodyType string enum required
    hostedself
  • label string
  • vaspId string

    at least 1 characters

  • newVasp object
    newVasp object
    • domain string required

      at least 1 characters

    • name string required

      at least 1 characters

  • pii object
    CaaS-facing PII payload. Optional on the request; the server skips storage entirely when the resolved VASP source is TRUST (TRUST handles PII out-of-band).
    pii object
    • address string
    • businessName string
    • country string
    • firstName string
    • lastName string
    • ownershipType string enum required
      selfindividualbusiness

Responses

200
OK

Response Body

object

  • whitelistId string required

    at least 1 characters

  • status string enum required
    approvedpending_vasppending_prodops_review
400
Bad Request

Response Body

object

  • name string
  • context map of objects required
    context object
    • <key> object
  • error string required
  • requestId string required
403
Forbidden

Response Body

object

  • name string
  • context map of objects required
    context object
    • <key> object
  • error string required
  • requestId string required
404
Not Found

Response Body

object

  • name string
  • context map of objects required
    context object
    • <key> object
  • error string required
  • requestId string required
500
Internal Server Error

Response Body

object

  • name string
  • context map of objects required
    context object
    • <key> object
  • error string required
  • requestId string required