Vultisig: Seedless Wallet API integration (TSS / MPC OpenFinance)

Deliverables checklist

• OpenAPI / Swagger specification of every endpoint
• Protocol & auth-flow report (vault descriptor, share custody boundaries, MCP/CLI surface)
• Runnable source for vault descriptor parsing, balance and transaction APIs (Python & Node.js)
• Test harness with stubbed devnet vaults and recorded chain fixtures
• Compliance guidance: FATF Travel Rule mapping, MiCA reporting hints, OFAC screening hooks
• Optional hosted gateway with pay-per-call billing instead of source-code delivery

Engagement at a glance

Two ways to engage. Source-code delivery from $300 hands you the runnable codebase plus full documentation; you only pay after the build passes acceptance testing. Pay-per-call gives you a managed endpoint with metered billing — suitable for teams that want to ship fast and avoid running infrastructure for a single integration. We can mix the two: deliver a source-code core, then host the heavy multi-chain indexer on our side.

1. Vault auth & address derivation

POST /api/v1/vultisig/vault/connect
Content-Type: application/json
Authorization: Bearer <ACCESS_TOKEN>

{
  "vault_descriptor": "<public-share-bundle>",
  "consent_id": "consent_2026_05_02_01",
  "chains": ["BTC","ETH","SOL","ATOM","TRX"]
}

200 OK
{
  "vault_id": "v_8f9c…",
  "addresses": {
    "BTC": "bc1q…",
    "ETH": "0x9b…",
    "SOL": "9XW7…"
  },
  "scheme": "DKLS23",
  "expires_at": "2026-05-02T18:00:00Z"
}

2. Multi-chain statement query

POST /api/v1/vultisig/statement
Authorization: Bearer <ACCESS_TOKEN>

{
  "vault_id": "v_8f9c…",
  "from": "2026-04-01",
  "to":   "2026-04-30",
  "assets": ["BTC","ETH","USDC","SOL"],
  "include": ["transfers","swaps","staking_rewards"]
}

200 OK -> { "txs": [
  { "hash":"0xabc…", "chain":"ETH", "ts":"2026-04-12T10:21:03Z",
    "asset":"USDC", "amount":"-250.00",
    "counterparty":"0x77…", "fee":"0.00031 ETH",
    "category":"transfer" },
  { "hash":"…", "chain":"MAYA", "category":"swap",
    "in":{"asset":"BTC","amount":"0.0125"},
    "out":{"asset":"ETH","amount":"0.41"} }
]}

3. Inbound transfer webhook

POST https://your-app.example.com/hooks/vultisig
X-Signature: sha256=…
Content-Type: application/json

{
  "event": "vault.balance.changed",
  "vault_id": "v_8f9c…",
  "chain": "SOL",
  "asset": "USDC",
  "delta": "+1200.00",
  "tx_hash": "5oR3…",
  "ts": "2026-05-02T07:14:55Z",
  "risk_score": 0.04
}

// Verify with HMAC-SHA256 over the raw body, retry with
// exponential backoff on 5xx, idempotency key = tx_hash.

Regulatory framing

Crypto data integrations sit under multiple regimes. We design for the EU's Markets in Crypto-Assets Regulation (MiCA) for service-provider obligations, the FATF Travel Rule for cross-VASP transfers, OFAC and EU sanctions screening for counterparties, and GDPR for any pseudonymous identifier we touch. For US-facing clients we additionally align with FinCEN MSB guidance and state-level money-transmission rules where a hosted endpoint is consumed.

Privacy posture

• Read-only vault access; we never request, transmit or store TSS shares
• Consent-scoped tokens with explicit chain and time-window bounds
• Field-level minimisation: addresses are pseudonymous, fiat valuations stripped on export when not requested
• Configurable retention windows; deletion APIs for data-subject requests
• Structured logs to support suspicious-activity reporting without leaking unrelated history

About OpenFinance Lab

We are an independent studio focused on mobile-app protocol analysis and authorized API integration. Our team includes engineers from custody platforms, exchanges and protocol teams who have shipped MPC, multi-sig, OAuth and OpenBanking flows in production.

• Wallets, custody, exchanges, payment rails, OpenBanking and OpenFinance
• Enterprise API gateways, security reviews and compliance scaffolding
• Custom Python / Node.js / Go / Rust SDKs and test harnesses
• Full pipeline: protocol analysis → build → validation → compliance handoff
• Source-code delivery from $300 — runnable code plus full docs; pay after acceptance
• Pay-per-call hosted API — usage-based billing, no upfront cost

Contact

For quotes, scoping, or to submit your target app and integration requirements, open our contact page:

Contact page

Engagement workflow

1. Scope confirmation: chains, data types, signing flows, hosting model
2. Protocol analysis & API design (2–5 business days, complexity-dependent)
3. Build, indexer wiring, and internal validation against devnet vaults (3–8 business days)
4. Documentation, sample code, and acceptance test cases (1–2 business days)
5. Typical first delivery: 5–15 business days; multi-chain dashboards or AML pipelines extend timelines.

FAQ

Do I need vault share private keys to integrate Vultisig data?

Which chains can you read balances and transactions from?

How long does delivery take?

How do you handle compliance?