Request context
These inputs identify the wallet, policy version, requirement or page a method reads.PermissionsV2WalletContext
The wallet a user-scoped read applies to. Client SDK methods require a wallet the signed-in user owns. REST SDK methods require a wallet connected to your app.
PermissionsV2ConsentListContext
Consent discovery for a wallet. Pass pendingTransactionId to include the consent request raised by that pending transaction.
PermissionsV2ApprovalRequirementReference
Identifies one approval requirement in one immutable policy version, inside one authorization scope.
PermissionsV2UsageContext
Selects the wallet, network, optional token and optional Safe for a spend usage read.
Usage reads need
chainId even though the type marks it optional. Use a bare decimal chain ID such as "8453" for EVM, or a prefixed network ID such as solana:mainnet, sui:mainnet, cosmos:cosmoshub-4 or stellar:testnet for other wallet types. tokenAddress is an EVM token address, or the exact asset identity the policy names on other wallet types. safeAddress is a Safe’s EVM address; pass it to add the policy’s Safe spend meters for that Safe. For client reads, the meters appear only after one of the user’s wallets has a Safe payment recorded for that Safe on this network.PermissionsV2PolicyUsageContext
The REST SDK usage context. Set userId to read a user-owned wallet; leave it out to read a wallet your app owns.
PermissionsV2HistoryOptions
Pages back through a revision history. Pass the nextBeforeRevision from the previous page.
PermissionsV2CaseListOptions
Pages through approval cases, newest first. limit is 1 to 100 and defaults to 50. Pass the nextBeforeCaseId from the previous page as beforeCaseId.
PermissionsV2AuthorizationScopeMemberListOptions
Pages through authorization scope members in user ID order. limit is 1 to 100 and defaults to 50. Pass the nextAfterUserId from the previous page as afterUserId.
Policies
Policy reads return a view of an active policy version. The authored JSON is described in the policy JSON reference.PermissionsV2PolicyView
binding is present on Request policies, which need the wallet owner’s consent. On user-scoped reads, a userId or walletId selector is narrowed to the caller.
PermissionsV2PolicyListResponse
A list response contains the policy views in policies.
PermissionsV2PolicyResponse
A single-policy response contains one view in policy.
PermissionsV2PolicyVersionsResponse
Versions that are active or were active before, newest published first. Drafts are excluded.
Consent
Consent reads report whether a wallet owner has consented to a Request policy.PermissionsV2DelegationConsentView
The view identifies consent state for one user, wallet and policy version, with optional grant, expiry and revocation timestamps.
PermissionsV2DelegationConsentDiscoveryResponse
Each request pairs the authored policy definition with the wallet’s consent state.
Adjustable parameters
These types carry a user’s personal values for a policy’s adjustable parameters. Amounts use the fact’s units, including base units where the fact uses them.PermissionsV2UserParameterSave
values maps each declared parameter ID to its value as a string. Send the full set.
PermissionsV2UserParameterReset
A reset identifies the policy version and hash and supplies the current parameter revision.
PermissionsV2UserParameterView
needs_confirmation means the stored values belong to an earlier policy version. previousValues are not confirmed for the current version. Each parameter’s min is "0" when the policy declares no minimum, and max is present only when the policy declares a maximum.
PermissionsV2UserAdjustablePolicyListResponse
Each entry in policies is a parameter view for one adjustable policy.
PermissionsV2UserParameterHistory
Saved revisions include their policy identity, values, provenance and change time, with an optional cursor for older revisions.
Approval configuration and authority
Writes in this group carryexpectedRevision. Read the resource first and send its current revision, or 0 when nothing is stored yet. A stale revision is refused, so a write never overwrites a newer change.
Configuration, assignment and binding writes also take force.
An approval case is open while it is
pending, and after it completes until it is used to sign or expires. Para refuses a change that would invalidate open cases until you confirm it. A confirmed change ends those cases as invalidated, and their requests need a new attempt.Through the API, a refused change returns 409 with code APPROVAL_CASES_AFFECTED and the case IDs in affectedCaseIds, and nothing changes. To confirm it, send the same change again with force: true.PermissionsV2ConditionalRequirementView
requirement is the authored approval requirement. Its fields are described in Approval requirements.
PermissionsV2ConditionalRequirementList
The response groups authored requirement views in requirements.
PermissionsV2AuthorizationConfigurationWrite
values sets the requirement’s declared settings, up to 25 entries. An empty object restores the authored defaults.
A minimum_amount setting must stay inside the range the requirement declares. Unless the policy sets a max, the published threshold is the upper bound, so the setting can lower the threshold but not raise it. A value outside the range fails with safe_knob_value_invalid.
PermissionsV2ApprovalConfigurationReset
The object form of the resetApprovalConfiguration argument. Pass a plain revision number when you do not need force.
PermissionsV2ApprovalCasesAffectedError
Client SDK configuration writes throw this error for APPROVAL_CASES_AFFECTED. Every client SDK package exports it. The REST SDK throws ParaRestError with the same code and affectedCaseIds instead.
PermissionsV2AuthorizationConfigurationView
Stored settings include their scope and requirement identity, revision, configuration hash and who last changed them.
PermissionsV2EffectiveAuthorizationConfiguration
The requirement view plus the stored configuration, or null before the first write, and the requirement with that configuration applied.
PermissionsV2AuthorizationConfigurationHistory
The history contains the stored configuration views in configurations.
PermissionsV2AuthoritySetWrite
Replaces a user’s full set of roles and attributes in one authorization scope. Each role or attribute must be declared by an active policy, and a user can hold at most 25 assignments across your app. A non-empty list needs a user with a wallet connected to your app.
PermissionsV2AuthoritySetView
An assignment view combines the user’s roles and attributes with their scope, revision and last change.
PermissionsV2AuthoritySetHistory
The history contains saved assignment views in assignments.
PermissionsV2AuthorizationScopeMembers
Users with at least one assignment in the scope.
PermissionsV2AuthorizationScopeBindingWrite
A binding write names the scope, supplies the expected revision and can confirm invalidation with force.
PermissionsV2AuthorizationScopeBindingView
The binding view identifies the wallet and its scope, along with its revision and last change.
PermissionsV2AuthorizationScopeBindingHistory
Up to 50 revisions per page, newest first.
PermissionsV2AuthorizationScopeCapabilities
The requirements the signed-in user can configure in the scope. requirements is empty when the user has no assignments there, when none of their assignments match a configurable requirement’s configuration managers, or when conditional approvals are not enabled for your API key.
Approval cases
An approval case tracks the approvals one request needs before it can sign.PermissionsV2ConditionalApprovalCaseView
The view combines request details, approval stages and progress, and the caller’s decision options.
status and terminalReason
status and terminalReason
terminalReason values for invalidated cases include authority_revoked, authorization_stack_changed, authorization_scope_changed, requirement_configuration_changed, requirement_unavailable, request_or_requirement_changed, owner_review_changed, request_resubmitted and request_allowed_without_approval.decision
decision
decision is computed for the caller. Read it before showing approve and reject controls.request and stages
request and stages
request.requestType is one of evm_transaction, evm_message, evm_raw, evm_typed_data, evm_authorization, smart_account_user_operation, solana_transaction, cosmos_transaction, cosmos_message, stellar_transaction, sui_transaction or raw_message. value.baseUnits is a decimal string.On Solana, Cosmos, Stellar and Sui, request.value holds the total of a transaction’s transfers when every action is a transfer, Para reads every amount, and every transfer moves the same asset. request.to is set only when every transfer has the same recipient. On Cosmos, a transaction whose only message is a MsgExecuteContract also has the total of its funds in request.value when every coin is the same asset.request.safePayment is set when the request executes a payment from a Safe, including a Safe 4337 user operation that Para reads as a Safe payment. safe is the Safe address, to the recipient and baseUnits the amount as a decimal string in base units. asset identifies what is paid, such as eip155:8453:native for the native asset or eip155:8453:token: followed by the lowercase token address. For an ERC-20 transferFrom, from is the account the tokens are pulled from.request.safeCall is set when Para reads the call inside a Safe transaction as a Safe contract call. safe is the Safe address, contract the called contract and selector the four-byte function selector. method is the function name, and args lists up to 25 decoded arguments in order, each with its position in index, its ABI name in name when it has one, and its value as a string.request.sourceAccount is the account the request spends from, the same value as the request.sourceAccount fact. It is set only when Para reads one account for every action of the request.A case has 1 to 5 stages. Each stage needs 1 to 25 approvals from up to 100 eligible people, and currentStageIndex points at the active one.PermissionsV2ConditionalApprovalCaseSummary
The case view without decision. REST SDK case reads return this shape, because a backend is not an approver.
PermissionsV2ConditionalApprovalCaseList
A page contains case views with caller decision options and an optional cursor for the next page.
PermissionsV2ConditionalApprovalCaseSummaryList
A backend page contains case summaries and an optional cursor for the next page.
Reviews
These types are the REST SDK responses for an ordinary review, which arequire_approval rule without an approval requirement opens.
PermissionsV2ReviewApproval
approveReview returns the review’s current status. approvedAt is present once the review has been approved.
PermissionsV2ReviewRejection
rejectReview returns the review’s current status. rejectedAt is present once the review has been rejected.
Signature collection
These types collect signatures from approvers’ wallets for a transaction that needs them, such as a Safe multisig payment. Collected signatures are not broadcast; your integration assembles and submits the transaction.PermissionsV2TransactionSignatureCollection
walletId is the wallet the transaction belongs to. Para derives the signing payload from transaction.
PermissionsV2ApprovalSignatureCollectionResult
Opening a collection returns the case ID, its status and expiry time.
PermissionsV2ApprovalSigningPayload
The payload identifies the case and transaction and includes the digest and bytes to sign.
PermissionsV2ConditionalApprovalSignature
walletId is the signer’s own wallet, which can differ from the transaction wallet.
PermissionsV2ApprovalSignatures
The completed result adds each collected signature, wallet ID and actor ID to the signing payload.
SignApprovalTransactionParams
Choose the collection’s case and the approver’s wallet to sign its payload.
Signing
The approval context lets a client signing call refer to an earlier approval case or identify the requester.SigningApprovalContext
Optional approval fields on the client SDK signMessage and signTransaction parameters. Every client SDK package exports the type.
resumeApprovalCaseId is the approval case returned by an earlier attempt that needed review. Send it with the same request to sign once the case is approved. When the case expired, was cancelled or was invalidated, start a new request without it.
initiatorUserId applies to wallets your app owns. It names the linked Para user who asked for the signature, and that user cannot approve or reject the request’s approval case. The REST SDK signing and transfer requests take the same initiatorUserId field.
Usage
Usage reads return the current spend meters for a policy. They report what is already counted; they do not evaluate a new request.PermissionsV2PolicyUsage
For a user wallet, configuration reports the personal parameter revision in effect. For a wallet your app owns, it is null.
PermissionsV2PolicyUsageMeter
One meter per metered spend condition. Amounts are base-unit decimal strings, and usedBaseUnits is committedBaseUnits plus reservedBaseUnits. remainingBaseUnits is the headroom under an upper limit (lt or lte), and null when Para does not report headroom for the meter. Safe spend meters (safe.spend.native and safe.spend.erc20) carry the lowercase safeAddress they count; wallet spend meters do not. Stellar source account limits (sourceAccount.spend.native and sourceAccount.spend.token) have no meter.