Regulated assets

Approval server

The approval server is the issuer-side service that turns a regulated asset into a zero-touch onboarding. It runs the compliance check, signs the issuer authorization, and records every action — and it never custodies user funds.

The endpoints

It implements a SEP-8-style approval interface plus the onboarding extensions. The hot path is a single endpoint:

POST /tx-approve              receive a base64 tx → run compliance → respond
GET  /.well-known/stellar.toml serve discovery (SEP-1)
GET  /info                     advertise mechanisms + asset profiles
POST /auth                     SEP-10 web auth → session token
POST /customer                 SEP-12 KYC hooks
POST /admin/freeze             authenticated: freeze a holder
POST /admin/clawback           authenticated: trigger a clawback
GET  /admin/audit              authenticated: read the append-only log

The approval result

POST /tx-approve responds with one of five SEP-8 results. The activation UI treats the response as untrusted input and validates it before the user signs.

success         approved as is
revised         server modified the tx (inserted + signed issuer auth / sponsorship)
pending         manual review
action_required the user must complete KYC first
rejected        not approved

Run one

The signer package gives you a server you wire to your compliance logic. Signing is isolated behind the Signer interface — a local key in dev, KMS or HSM in production.

approval.ts

import { createApprovalServer } from "@trustline-onboarder/signer";

const server = createApprovalServer({
  asset: "EURCV",
  signer,                 // local key (dev) or KMS/HSM adapter (prod)
});

server.onRequest(async (tx, holder) => {
  const kyc = await checkKyc(holder);
  if (!kyc.ok) return { status: "action_required", url: kyc.url };
  return { status: "success", tx: server.authorize(tx) };
});

server.listen(8080);

The approval server is the high-value signing component and is treated as audit scope. Every approval is idempotent and replay-protected by tying it to a specific transaction and nonce. Reserve sponsorship is bounded and only granted against a real pending onboarding.