Mesh contract
Mesh is Alloy's cryptographic execution boundary. This page renders the committed proto-derived OpenAPI artifact into a browsable contract reference so engineering teams can inspect endpoints, schemas, headers, and fail-closed receipts without opening raw spec files.
Every Mesh request must be supportable after the fact. Client identity, contract version, request ID, and correlation ID travel through receipts, response metadata, and logs.
| Header | Purpose |
|---|---|
| authorization | Bearer token for the calling service boundary. |
| x-alloy-client-name | SDK or service name used in receipts and logs. |
| x-alloy-client-version | SDK or service version used for support triage. |
| x-alloy-contract-version | Must match mesh-v2.0.0-m0 for the current M0 gate. |
| x-request-id | Stable customer support handle for a single request. |
| x-correlation-id | Trace handle across caller, VaultCore, WalletKit, and Mesh. |
This example shows the bank-grade HSM path: VaultCore authorizes the signer binding, while Mesh resolves backend profile and PKCS#11 key selectors from governed configuration.
curl -X POST https://mesh.sandbox.alloy.build/v1/signing/initiate \
-H "Authorization: Bearer $ALLOY_API_KEY" \
-H "Content-Type: application/json" \
-H "x-alloy-client-name: walletkit" \
-H "x-alloy-client-version: 0.1.0-m0" \
-H "x-alloy-contract-version: mesh-v2.0.0-m0" \
-H "x-request-id: req_demo_001" \
-H "x-correlation-id: corr_demo_001" \
-d '{
"session_id": "sig_hsm_001",
"wallet_id": "wallet_treasury_hot",
"message_hash": "base64url-message-hash",
"approval_mode": "DIRECT_ALLOWED",
"keystore_type": "KEYSTORE_TYPE_HSM_PKCS11",
"vaultcore_signer_authorization": {
"schema_version": "keystore-signing-reference.v1",
"key_reference_id": "hsm_key_ref_hot_001",
"signer_binding_id": "vc_binding_hot_001",
"mechanism": "CKM_ECDSA",
"key_control_evidence_hash": "key-control-evidence-001",
"approval_expires_at_epoch_ms": "4102444800000"
},
"context": {
"request_id": "req_demo_001",
"correlation_id": "corr_demo_001",
"contract_version": "mesh-v2.0.0-m0"
}
}'All current Mesh REST routes are POST operations generated from the canonical protobuf service and bound with `google.api.http` annotations.
/v1/dkg/initiateMpcWalletService_InitiateDkg
/v1/dkg/sharesMpcWalletService_ExchangeDkgShares
In M0 local simulation mode this can carry raw share bytes.
Feldman VSS commitments for the threshold ceremony.
/v1/key-material/provisionMpcWalletService_ProvisionKeyMaterial
Abstract governance label only. Mesh derives concrete provider selectors from governed backend profiles.
/v1/sessions/resumeMpcWalletService_ResumeSession
/v1/signing/initiateMpcWalletService_InitiateSigning
Upstream signing intent reference owned by VaultCore/WalletKit. Mesh uses it for idempotency, audit linkage, and signing_session_id derivation; it is not a blockchain transaction hash and is not generated by Mesh.
Opaque upstream approval evidence. Mesh treats this as execution evidence when approval_mode says governance has already been applied; Mesh does not evaluate business-policy semantics from this payload.
Upstream execution constraint decided by VaultCore/PolicyKit/WalletKit. Mesh enforces pause/resume behavior and receipt state from this value but does not decide whether a customer transaction needs approval.
Explicit M0-only override for deterministic local testing. Must not carry business-policy semantics.
VaultCore-issued signer authorization for HSM-backed keystore signing. VaultCore authorizes signer/key use; Mesh resolves provider execution details from governed signer bindings. Required when keystore_type is KEYSTORE_TYPE_HSM_PKCS11.
Provider-backed signature bytes when a keystore signing request completes synchronously, for example KEYSTORE_TYPE_HSM_PKCS11. Empty for denials, pending MPC ceremonies, and flows that complete via SubmitSignatureShare.
/v1/signing/shareMpcWalletService_SubmitSignatureShare