Policy language

Grammar

The grammar has been designed for flexibility and expressiveness. We currently support the following operations:

Operation	Operators	Example	Types
logical	&&, \|\|	“true && false”	(bool, bool) -> bool
comparison	==, !=, <, >, <=, >=	“1 < 2”	(int, int) -> bool
comparison	==, !=	“‘a’ != ‘b’“	(string, string) -> bool
comparison	in	”1 in [1, 2, 3]“	(T, list<T>) -> bool
access	x[<index>]	[1,2,3][0]	(list<T>) -> T
access	x[<index>]	“‘abc’[0]“	(string) -> string
access	x[<start>..<end>]	[1,2,3][0..2]	(list<T>) -> (list<T>)
access	x[<start>..<end>]	“‘abc’[0..2]“	(string) -> string
access	x.<field>	“user.tags”	(struct) -> T
function	x.all(item, <predicate>)	“[1,1,1].all(x, x == 1)“	(list<T>) -> bool
function	x.any(item, <predicate>)	“[1,2,3].any(x, x == 1)“	(list<T>) -> bool
function	x.contains(<value>)	“[1,2,3].contains(1)“	(list<T>) -> bool
function	x.count()	“[1,2,3].count()“	(list<T>) -> int
function	x.filter(item, <predicate>)	“[1,2,3].filter(x, x == 1)“	(list<T>) -> (list<T>)
function	Timestamp(<rfc3339>)	“Timestamp(‘2025-01-01T00:00:00Z’)“	(string) -> timestamp
function	CronSpan(<cron>, <duration>, <tz>)	“CronSpan(‘0 9 * * 1-5’, ‘8h’, ‘America/New_York’)“	(string, string, string) -> bool

Operator precedence

If you use both && and || in a condition, use parentheses. The policy engine gives && and || the same precedence and groups them from left to right (many programming languages group && first).

For example, suppose that you want to match any transaction to address <A>, OR a zero-value transaction to address <B>. The following condition does not match these transactions.

eth.tx.to == '<A>' || eth.tx.to == '<B>' && eth.tx.value == 0

The policy engine evaluates this condition as (eth.tx.to == '<A>' || eth.tx.to == '<B>') && eth.tx.value == 0. As a result, the condition matches only zero-value transactions. A non-zero transaction to <A> does not match.To match the transactions that you want, use parentheses:

eth.tx.to == '<A>' || (eth.tx.to == '<B>' && eth.tx.value == 0)

The policy engine groups operators in this order, from first to last:

Order	Operators	Grouping
1 (first)	field access (`.`, `[]`) and function calls	left to right
2	`!`, `-`	no chaining (i.e. `!!x` is not valid)
3	`==`, `!=`, `<`, `>`, `<=`, `>=`, `in`	left to right
4 (last)	`&&`, `\|\|`	left to right

The policy engine groups comparisons before && and ||. For example, a == 1 && b == 2 means (a == 1) && (b == 2).
! and - apply only to the single operand immediately after them, so !x == y means (!x) == y. To negate a larger expression, use parentheses: !(x == y).
The policy engine always evaluates both operands of && and ||, even when the left operand already decides the result. See Policy evaluation.

Keywords

Keywords are reserved words that are dynamically interchanged for real values at evaluation time. Each field supports a different set of keywords.

Consensus

Keyword	Type	Description
approvers	list<User>	The users that have approved an activity
credentials	list<Credential>	The credentials that were used to approve an activity

Condition

Keyword	Type	Description
activity	Activity	The activity metadata of the request
eth.tx	EthereumTransaction	The parsed Ethereum transaction payload (see Appendix below)
eth.eip_712	Eip712TypedData	EIP-712 Typed Data (see Appendix below)
eth.eip_7702_authorization	Eip7702Authorization	An EIP-7702 authorization that the signing key signs (see EIP-7702 for supported activities)
solana.tx	SolanaTransaction	The parsed Solana transaction payload (see Appendix below)
tron.tx	TronTransaction	The parsed Tron transaction payload (see Appendix below)
bitcoin.tx	BitcoinTransaction	The parsed Bitcoin transaction payload (see Appendix below)
tempo.tx	TempoTransaction	The parsed Tempo transaction payload (see Appendix below)
wallet	Wallet	The target wallet used in sign + export requests
wallets	list<Wallet>	The target wallets associated with requests involving with multiple wallets
private_key	PrivateKey	The target private key used in sign + export requests
wallet_account	WalletAccount	The target wallet account used in sign + export requests
secret	Secret	The secret currently being evaluated in export secrets requests (see Secrets below)
request_context	map<string, string>	The request context bound to the secret currently being evaluated in export secrets requests (see Secrets below)

Time

Keyword	Type	Description
time.now	timestamp	The trusted server time at which the request is evaluated. A single value is used per request.

The optional top-level time field gates when a policy is active. See Time-based policies for the authoring guide, and Time expressions below for the Timestamp and CronSpan reference.The <tz> argument of CronSpan is an IANA time zone name (e.g. America/New_York) — see the IANA time zone list for the full set of names.

Types

The language is strongly typed which makes policies easy to author and maintain.

Primitive

Type	Example	Notes
bool	true
int	256	i128
uint	170141183460469231731687303715884105728	u256
string	’a’	only single quotes are supported
list<T>	[1, 2, 3]	a list of type T
struct	{ id: ‘abc’ }	a key-value map of { field: T } (defined below)
timestamp	Timestamp(‘2025-01-01T00:00:00Z’)	a point in time; construct with `Timestamp('<rfc3339>')`, zero UTC offset only (see Time expressions)

Struct

Struct	Field	Type	Description
User	id	string	The identifier of the user
	tags	list<string>	The IDs of the tags attached to the user. `tags.contains()` matches tag IDs, never tag names
	email	string	The email address of the user
	alias	string	The alias of the user
Credential	id	string	The identifier of the API key or authenticator that was used to approve the request
	user_id	string	The identifier of the user who owns this request and approved the request
	type	string	The credential type, a full list can be found here
	credential_id	string	The credential ID of a passkey. Note: this is only populated for passkeys (also known as Authenticators within Turnkey resources), not API keys
	public_key	string	The public key of the credential that approved the request
Activity	type	string	The type of the activity (e.g. ACTIVITY_TYPE_SIGN_TRANSACTION_V2)
	kind	string	A version-agnostic grouping that matches every version of an activity. For example, `SIGN_TRANSACTION` matches both `ACTIVITY_TYPE_SIGN_TRANSACTION` and `ACTIVITY_TYPE_SIGN_TRANSACTION_V2`. See Activity kinds for the full mapping.
	resource	string	The resource type the activity targets. See Activity resources and actions for the complete list.
	action	string	The action performed on the resource. See Activity resources and actions for the complete list.
	params	struct	The parameters of the activity. See here for more details.
Wallet	id	string	The identifier of the wallet
	imported	bool	Boolean indicating whether or not this wallet has been imported
	exported	bool	Boolean indicating whether or not this wallet has been exported
	label	string	The label of this wallet
Wallet Account	address	string	The wallet account address
	path_indexes	list<int>	The account’s BIP32 derivation path indexes. The hardening bit is stripped (e.g. `m/44'/60'/0'/0/0` → `[44, 60, 0, 0, 0]`). This field is set only for wallet account exports (`EXPORT_WALLET_ACCOUNT`). A policy that uses this field does not match other activities
	path_hardened	list<bool>	Whether each component of the account’s derivation path is hardened (e.g. `m/44'/60'/0'/0/0` → `[true, true, true, false, false]`). This field is set only for wallet account exports (`EXPORT_WALLET_ACCOUNT`). A policy that uses this field does not match other activities
PrivateKey	id	string	The identifier of the private key
	tags	list<string>	The IDs of the tags attached to the private key. `tags.contains()` matches tag IDs, never tag names
	imported	bool	Boolean indicating whether or not this private key has been imported
	exported	bool	Boolean indicating whether or not this private key has been exported
	label	string	The label of this private key
Secret	id	string	The identifier of the secret
	static_properties	map<string, string>	The static properties bound to the secret at import. Access via `secret.static_properties['key']`
EthereumTransaction	from	string	The sender address of the transaction
	to	string	The receiver address of the transaction (can be an EOA or smart contract)
	data	string	The arbitrary calldata of the transaction (hex-encoded). Prefer `function_name` / `contract_call_args` when an ABI is available — see Smart Contract Interfaces.
	value	int	The amount being sent (in wei)
	gas	int	The maximum allowed gas for the transaction
	gas_price	int	The price of gas for the transaction (Note: this field was used in legacy transactions and was replaced with max_fee_per_gas in EIP 1559 transactions, however when evaluating policies on EIP 1559 transactions, this field will be populated with the same value as max_fee_per_gas)
	chain_id	int	The chain identifier for the transaction
	nonce	int	The nonce for the transaction
	max_fee_per_gas	int	EIP 1559 field specifying the max amount to pay per unit of gas for the transaction (Note: This is the sum of the gas for the transaction and the priority fee described below)
	max_priority_fee_per_gas	int	EIP 1559 field specifying the max amount of the tip to be paid to miners for the transaction
	max_fee_per_blob_gas	int	EIP 4844 field specifying the maximum fee users are willing to pay per unit of blob gas, akin to the tip in EIP 1559
	type	string	The EVM transaction type. This should be one of the following: “LEGACY”, “TYPE_1” (EIP 2930), “TYPE_2” (EIP 1559), “TYPE_3” (EIP 4844), “TYPE_4” (EIP 7702)
	function_name	string	ABI field specifying the function name that the transaction call data is calling. Populated only when a matching Smart Contract Interface has been uploaded for `eth.tx.to`.
	function_signature	string	ABI field specifying the leading bytes which denote the function being called in the call data. Populated only when a matching Smart Contract Interface has been uploaded for `eth.tx.to`.
	contract_call_args	Option<Map<String, ContractArgument>>	ABI field specifying all contract arguments parsed from the contract call data. It is a mapping of the string representations of the arg name to the argument itself. Populated only when a matching Smart Contract Interface has been uploaded for `eth.tx.to`. Access via `eth.tx.contract_call_args['arg_name']`.
Eip712TypedData	primary_type	string	The type of the primary (i.e. outermost) structure in the `message` JSON
	domain	Eip712Domain	The `Domain` of the payload
	message	Map<string, Value>	JSON serializaiton of the message payload
Eip7702Authorization	address	string	The delegate contract that the account delegates to
	chain_id	number	The EVM chain ID
	nonce	number	The nonce of the authority
SolanaTransaction	account_keys	list<string>	The accounts (public keys) involved in the transaction
	version	string	Solana wire version of `unsignedTransaction`: `LEGACY`, `V0`, or `V1`. Independent of the activity version.
	priority_fee_lamports	int	V1 only: total priority fee in lamports. Zero when absent in V1. See V1 config.
	compute_unit_limit	int	V1 only: explicit compute unit limit in CU. Unavailable when absent.
	loaded_accounts_data_size_limit	int	V1 only: explicit loaded accounts data size limit in bytes. Unavailable when absent.
	heap_size	int	V1 only: explicit heap size in bytes. Unavailable when absent.
	program_keys	list<string>	The programs (public keys) involved in the transaction
	instructions	list<Instruction>	A list of Instructions (see below). Each instruction exposes a `parsed_instruction_data` field (with `instruction_name`, `named_accounts`, `program_call_args`) when a matching Smart Contract Interface (IDL) has been uploaded for that program.
	transfers	list<Transfer>	A list of Transfers (see below)
	recent_blockhash	string	The transaction blockhash. For non-sponsored sends, this is the blockhash in `unsignedTransaction`, or the blockhash Turnkey filled before policy evaluation. For sponsored sends, this is the blockhash in `unsignedTransaction`, not the one selected during execution.
	spl_transfers	list<SPLTransfer>	A list of SPLTransfers (see below)
	address_table_lookups	list<AddressTableLookup>	A list of AddressTableLookups (see below)
TronTransaction	ref_block_bytes	string	The height of the transaction reference block
	ref_block_hash	string	The hash of the transaction reference block
	expiration	int	Transaction expiration time in milliseconds
	timestamp	int	Transaction timestamp in milliseconds
	data	string	Transaction memo (not the call data!)
	fee_limit	int	The maximum energy cost allowed for the execution of smart contract transactions
	contract	list<TronContract>	A list of TronContract. This is the main content of a Tron transaction. This determines the type of transaction being executed and its parameters (see below)
BitcoinTransaction	version	string	The version of the Bitcoin transaction
	inputs	list<BitcoinTxInput>	All inputs to this Bitcoin transaction
	outputs	list<BitcoinTxOutput>	All outputs created by this Bitcoin transaction
	locktime	BitcoinTxLocktime	The locktime of this bitcoin transaction
	fee	int	The total fee for this Bitcoin transaction in satoshis (computed as sum of input values minus sum of output values)
TempoTransaction	chain_id	int	The chain identifier for the transaction
	from	string	The signer address of the transaction
	nonce	int	The nonce for the transaction
	gas_limit	int	The maximum allowed gas for the transaction
	max_fee_per_gas	int	The maximum fee per unit of gas for the transaction
	max_priority_fee_per_gas	int	The maximum priority fee (tip) per unit of gas
	fee_token	string	The token address used to pay transaction fees
	valid_before	int	Upper validity bound (timestamp). Defaults to 0 when not set
	valid_after	int	Lower validity bound (timestamp). Defaults to 0 when not set
	calls	list<TempoCall>	The list of calls in the transaction. Tempo transactions natively support batched calls — a single transaction can contain multiple calls that execute atomically

The ContractArgument type, used in documentation for ABI and IDL arguments represents an enum indicating this type could be any one of the string, number, array or struct types listed in our Primitives section.

Nested structs

Struct	Field	Type	Description
ApiKeyParams	expiration_seconds	int	The requested lifetime of the API key in seconds. A key with no expiration reads as the maximum value, so `expiration_seconds > N` matches it. Available only for `ACTIVITY_TYPE_CREATE_API_KEYS` and `ACTIVITY_TYPE_CREATE_API_KEYS_V2`. See the API key expiration example and scope warning
Eip712Domain	name	string	The name
	version	string	The version
	chain_id	uint	The chain ID
	verifying_contract	string	The address of the verifying contract
Instruction	program_key	string	The program (public key) involved in the instruction
	accounts	list<Account>	A list of Accounts involved in the instruction
	instruction_data_hex	string	Raw hex bytes corresponding to instruction data
	address_table_lookups	list<AddressTableLookup>	A list of AddressTableLookups used in the instruction.
	parsed_instruction_data	Option<SolanaParsedInstructionData>	IDL related field specifying all additional information for an instruction calling a program for which an IDL has been uploaded
Transfer	from	string	A Solana account (public key) representing the sender of the transfer
	to	string	A Solana account (public key) representing the recipient of the transfer
	amount	int	The native SOL amount for the transfer (lamports). Only transfers executed by direct calls to system programs are recognized, transfers performed indirectly inside other programs or via unsupported System Program instructions are not included.
SPLTransfer	from	string	A Solana account (public key) representing the token account that is sending tokens in this SPL transfer
	to	string	A Solana account (public key) representing the token account that is receiving tokens in this SPL transfer
	amount	int	The amount (noted in raw atomic units) of this SPL transfer. Only parsed for top-level SPL transfers using `Transfer`, `TransferChecked`, or `TransferCheckedWithFee`. Transfers performed through other Token / Token-2022 instructions are not included.
	owner	string	A Solana account (public key) representing the owner of the sending token account for this SPL transfer
	signers	list<string>	A list of Solana accounts (public keys) representing the multisig signers (if they exist) for this SPL transfer
	token_mint	string	A Solana account (public key) representing the token mint of the token being transferred in this SPL transfer
Account	account_key	string	A Solana account (public key)
	signer	boolean	An indicator of whether or not the account is a signer
	writable	boolean	An indicator of whether or not the account can perform a write operation
AddressTableLookup	address_table_key	string	A Solana address (public key) corresponding to the address table
	writable_indexes	list<int>	Indexes corresponding to accounts that can perform writes
	readonly_indexes	list<int>	Indexes corresponding to accounts that can only perform reads
SolanaParsedInstructionData	instruction_name	string	IDL related field specifying the name of the instruction being called
	discriminator	string	IDL related field specifying the byte discriminator denoting which instruction is being called by the instruction call data
	named_account	map<string, string>	IDL related field specifying a mapping of account names to the account string, with the names as defined by the program IDL
	program_call_args	map<string, ContractArgument>	IDL related field specifying a mapping of account names to the account string, with the names as defined by the program IDL
TronContract	type	string	The contract type, a complete list can be found in the Tron Protocol Documentation
	permission_id	int	The transaction permission type
	owner_address	string	The address of the caller of the transaction
	to_address	string	The address of the recipient (Only available for TransferContract’s)
	amount	int	The amount of TRX to send (Only available for TransferContract’s)
	contract_address	string	The address of the contract being called (Only available for TriggerSmartContract’s)
	call_value	int	The amount of TRX passed to the contract (Only available for TriggerSmartContract’s)
	data	string	The function selector, and the functions parameters of the contract (Only available for TriggerSmartContract’s)
	call_token_value	int	The amount of a TRC-10 token passed to the contract (Only available for TriggerSmartContract’s)
	token_id	int	The TRC-10 token id (Only available for TriggerSmartContract’s)
	resource	string	The resource to delegate/undelegate will be “ENERGY” or “BANDWIDTH” (Only available for Delegate, UnDelegate, FreezeBalanceV2, UnfreezeBalanceV2 contract’s)
	balance	int	The amount of sun (1,000,000 sun = 1 TRX) staked for resources to be delegated (Only available for DelegateContract and UnDelegateContract)
	receiver_address	string	The resource receiver address (Only available for DelegateContract and UnDelegateContract)
	lock	bool	Indicates if the delegated resources are locked or not. If true resources cannot be undelegated within the lock_period (Only available for DelegateContract’s)
	lock_period	int	The time, in blocks, of how long the delegation is locked, only valid when lock is true (Only available for DelegateContract’s)
	frozen_balance	int	The amount of sun (1,000,000 sun = 1 TRX) to be frozen (Only available for FreezeBalanceV2Contract’s)
	unfreeze_balance	int	The amount of sun (1,000,000 sun = 1 TRX) to unfreeze (Only available for UnfreezeBalanceV2Contract’s)
	owner	TronPermission	The owner permission of the account (Only available for AccountPermissionUpdateContract’s)
	witness	TronPermission	The witness permission of the account (Only available for AccountPermissionUpdateContract’s)
	actives	list<TronPermission>	A list of active permissions for the account (Only available for AccountPermissionUpdateContract’s)
TronPermission	type	string	The permission type either “Owner”, “Witness”, or “Active”
	id	int	The permission id Owner = 0, Witness = 1, Active = 2+n where n is the 0 indexed active permission number
	permission_name	string	The name of the permission
	threshold	int	The operation is allowed only when the sum of the weights of the participating signatures exceeds the domain value. Requires a maximum value less than the Long type (int64).
	parent_id	int	The parent id, currently always 0
	operations	String	Hex encoded 32 bytes (256 bits), each bit represents the authority of a contract, a 1 means the authority to own the contract
	keys	TronKey	A list of address’s and weight’s that jointly own the permission can be up to 5 keys.
TronKey	address	string	The address authorized for a specific TronPermission
	weight	int	The weight of this address’s signature for this permission, used to reach “threshold” in a TronPermission
BitcoinTxInput	tx_id	string	The transaction id of the Bitcoin transaction that created the output that is being spent by this input
	vout	int	The index in the output array on the Bitcoin transaction that created the output being spent by this input
	sequence	int	The sequence field on this input which is set whether the transaction can be replaced or when it can be mined
BitcoinTxOutput	value	int	The value of this output in Satoshis
	script_pubkey	string	The locking script for this output, as lowercase hex. It is the same on every network
	address	string	The address for this output, in the address format of the `signWith` account (for example `bc1...` on mainnet, `tb1...` on testnet)
	address_type	string	The address derivation type of the address for this transaction output
BitcoinTxLocktime	amount	int	The amount represented in this transaction’s locktime
	type	string	The type of locktime represented (either ‘Seconds’ or ‘Blocks’)
TempoCall	to	string	The destination address of the call (empty string for contract creation)
	input	string	The raw call data as a hex string (supports slicing, e.g. `tempo.tx.calls[0].input[34..74]`)
	function_signature	string	The 4-byte function selector derived from the call input (e.g. `0xa9059cbb` for ERC-20 `transfer`). Empty string when input is absent or too short

Time expressions

Two functions are available when authoring the top-level time field. This section is the reference for their signatures and constraints; see Time-based policies for the model behind them and worked examples.

Function	Signature	Description
`Timestamp(<rfc3339>)`	(string) -> timestamp	Constructs a `timestamp` from an RFC 3339 string.
`CronSpan(<cron>, <duration>, <tz>)`	(string, string, string) -> bool	Returns `true` when the trusted server time falls inside a scheduled window.

Timestamp

Timestamp('<rfc3339>') constructs a timestamp from an RFC 3339 string. Timestamps must have a zero UTC offset: the evaluator parses RFC 3339 and accepts any literal whose offset is zero — Z, z, +00:00, or -00:00. Non-zero offsets (e.g. -05:00) are rejected.timestamp values support the comparison operators (<, >, <=, >=, ==, !=), so they can be compared against time.now to bound when a policy is active:

time.now >= Timestamp('2025-01-01T00:00:00Z') && time.now < Timestamp('2025-02-01T00:00:00Z')

CronSpan

CronSpan('<cron>', '<duration>', '<tz>') returns true when time.now falls inside any window opened by the schedule. See Active time spans for the fire-plus-duration model and its daylight-saving behavior.

Argument	Type	Description
`<cron>`	string	A 5-field cron expression (`minute hour day-of-month month day-of-week`, with day-of-week `0-6` where `0` is Sunday) marking when each window opens.
`<duration>`	string	How long each window stays open, as a whole-number `d`/`h`/`m` duration.
`<tz>`	string	An IANA time zone name (e.g. `America/New_York`) that the cron fires are interpreted in.

Cron expressions use a strict 5-field subset: minute hour day-of-month month day-of-week, where day-of-week is numeric 0-6 and 0 is Sunday. Numeric fields, ranges (1-5), lists (1,3,5), and * are supported. The following are not supported: step values (*/n), macros (@daily, @hourly), month and day names (JAN, MON), and a seconds field.Day-of-month and day-of-week are OR’d, not AND’d: when both fields are restricted, the cron fires when either matches, and this subset has no modifier to force AND semantics. This can broaden the window in which a policy is active — see Active time spans for details.Durations use a custom whole-number format composed of days, hours, and minutes (d, h, m) — for example 8h, 90m, or 1d12h. Fractional values and a seconds component are not allowed, and the total duration must be greater than zero and no more than 7 days.The <tz> argument accepts any IANA time zone name — see the IANA time zone list for the full set of names.

CronSpan('0 9 * * 1-5', '8h', 'America/New_York')

Activity breakdown

Activity resources and actions

Valid activity.resource values are AUTH, AUTH_PROXY, CONFIG, CREDENTIAL, FIAT_TRANSACTION, INVITATION, MFA_POLICY, ON_RAMP_CREDENTIALS, ORGANIZATION, OTP, PAYMENT_METHOD, POLICY, PRIVATE_KEY, RECOVERY, SESSION_PROFILE, SMART_CONTRACT_INTERFACE, SPONSORSHIP, SUBSCRIPTION, TVC_APP, TVC_DEPLOYMENT, TVC_OPERATOR, TVC_QUORUM_KEY, USER, WALLET, and WEBHOOK_ENDPOINT.Valid activity.action values are CREATE, UPDATE, DELETE, SIGN, EXPORT, IMPORT, VERIFY, and ENCRYPT.

Activity types by resource and action

Resource Type	Action	Activity Type
ORGANIZATION	CREATE	ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V8
	DELETE	ACTIVITY_TYPE_DELETE_ORGANIZATION
	DELETE	ACTIVITY_TYPE_DELETE_SUB_ORGANIZATION
	UPDATE	ACTIVITY_TYPE_UPDATE_ROOT_QUORUM
	UPDATE	ACTIVITY_TYPE_UPDATE_ORGANIZATION_NAME
	UPDATE	ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE
	UPDATE	ACTIVITY_TYPE_REMOVE_ORGANIZATION_FEATURE
INVITATION	CREATE	ACTIVITY_TYPE_CREATE_INVITATIONS
	DELETE	ACTIVITY_TYPE_DELETE_INVITATION
POLICY	CREATE	ACTIVITY_TYPE_CREATE_POLICY_V3
	CREATE	ACTIVITY_TYPE_CREATE_POLICIES
	UPDATE	ACTIVITY_TYPE_UPDATE_POLICY_V2
	DELETE	ACTIVITY_TYPE_DELETE_POLICY
	DELETE	ACTIVITY_TYPE_DELETE_POLICIES
SMART_CONTRACT_INTERFACE	CREATE	ACTIVITY_TYPE_CREATE_SMART_CONTRACT_INTERFACE
	DELETE	ACTIVITY_TYPE_DELETE_SMART_CONTRACT_INTERFACE
WALLET	CREATE	ACTIVITY_TYPE_CREATE_WALLET
	CREATE	ACTIVITY_TYPE_CREATE_WALLET_ACCOUNTS
	EXPORT	ACTIVITY_TYPE_EXPORT_WALLET
	EXPORT	ACTIVITY_TYPE_EXPORT_WALLET_ACCOUNT
	IMPORT	ACTIVITY_TYPE_INIT_IMPORT_WALLET
	IMPORT	ACTIVITY_TYPE_IMPORT_WALLET
	DELETE	ACTIVITY_TYPE_DELETE_WALLETS
	UPDATE	ACTIVITY_TYPE_UPDATE_WALLET
	DELETE	ACTIVITY_TYPE_DELETE_WALLET_ACCOUNTS
PRIVATE_KEY	CREATE	ACTIVITY_TYPE_CREATE_PRIVATE_KEYS_V2
	CREATE	ACTIVITY_TYPE_CREATE_PRIVATE_KEY_TAG
	UPDATE	ACTIVITY_TYPE_UPDATE_PRIVATE_KEY_TAG
	DELETE	ACTIVITY_TYPE_DISABLE_PRIVATE_KEY
	DELETE	ACTIVITY_TYPE_DELETE_PRIVATE_KEY_TAGS
	DELETE	ACTIVITY_TYPE_DELETE_PRIVATE_KEYS
	EXPORT	ACTIVITY_TYPE_EXPORT_PRIVATE_KEY
	IMPORT	ACTIVITY_TYPE_INIT_IMPORT_PRIVATE_KEY
	IMPORT	ACTIVITY_TYPE_IMPORT_PRIVATE_KEY
	SIGN	ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2
	SIGN	ACTIVITY_TYPE_SIGN_RAW_PAYLOADS
	SIGN	ACTIVITY_TYPE_SIGN_TRANSACTION_V2
	SIGN	ACTIVITY_TYPE_ETH_SEND_TRANSACTION
	SIGN	ACTIVITY_TYPE_SOL_SEND_TRANSACTION
USER	CREATE	ACTIVITY_TYPE_CREATE_USERS_V4
	CREATE	ACTIVITY_TYPE_CREATE_USER_TAG
	CREATE	ACTIVITY_TYPE_CREATE_API_ONLY_USERS
	UPDATE	ACTIVITY_TYPE_UPDATE_USER
	UPDATE	ACTIVITY_TYPE_UPDATE_USER_NAME
	UPDATE	ACTIVITY_TYPE_UPDATE_USER_EMAIL
	UPDATE	ACTIVITY_TYPE_UPDATE_USER_PHONE_NUMBER
	UPDATE	ACTIVITY_TYPE_UPDATE_USER_TAG
	DELETE	ACTIVITY_TYPE_DELETE_USERS
	DELETE	ACTIVITY_TYPE_DELETE_USER_TAGS
CREDENTIAL	CREATE	ACTIVITY_TYPE_CREATE_API_KEYS_V2
	CREATE	ACTIVITY_TYPE_CREATE_AUTHENTICATORS_V2
	DELETE	ACTIVITY_TYPE_DELETE_API_KEYS
	DELETE	ACTIVITY_TYPE_DELETE_AUTHENTICATORS
	CREATE	ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS_V2
	DELETE	ACTIVITY_TYPE_DELETE_OAUTH_PROVIDERS
PAYMENT_METHOD	UPDATE	ACTIVITY_TYPE_SET_PAYMENT_METHOD_V2
	DELETE	ACTIVITY_TYPE_DELETE_PAYMENT_METHOD
SUBSCRIPTION	CREATE	ACTIVITY_TYPE_ACTIVATE_BILLING_TIER
CONFIG	UPDATE	ACTIVITY_TYPE_UPDATE_ALLOWED_ORIGINS
RECOVERY	CREATE	ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY_V2
AUTH	CREATE	ACTIVITY_TYPE_EMAIL_AUTH_V3
	CREATE	ACTIVITY_TYPE_INIT_OTP_AUTH_V3
	CREATE	ACTIVITY_TYPE_OTP_AUTH
	CREATE	ACTIVITY_TYPE_OAUTH
	CREATE	ACTIVITY_TYPE_OAUTH_LOGIN
	CREATE	ACTIVITY_TYPE_OTP_LOGIN_V2
	CREATE	ACTIVITY_TYPE_STAMP_LOGIN
	CREATE	ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V2
	CREATE	ACTIVITY_TYPE_CREATE_OAUTH2_CREDENTIAL
	DELETE	ACTIVITY_TYPE_DELETE_OAUTH2_CREDENTIAL
	UPDATE	ACTIVITY_TYPE_UPDATE_OAUTH2_CREDENTIAL
	CREATE	ACTIVITY_TYPE_OAUTH2_AUTHENTICATE
OTP	CREATE	ACTIVITY_TYPE_INIT_OTP_V3
	VERIFY	ACTIVITY_TYPE_VERIFY_OTP_V2
AUTH_PROXY	CREATE	ACTIVITY_TYPE_ENABLE_AUTH_PROXY
	DELETE	ACTIVITY_TYPE_DISABLE_AUTH_PROXY
	UPDATE	ACTIVITY_TYPE_UPDATE_AUTH_PROXY_CONFIG
WEBHOOK_ENDPOINT	CREATE	ACTIVITY_TYPE_CREATE_WEBHOOK_ENDPOINT
	UPDATE	ACTIVITY_TYPE_UPDATE_WEBHOOK_ENDPOINT
	DELETE	ACTIVITY_TYPE_DELETE_WEBHOOK_ENDPOINT
TVC_APP	CREATE	ACTIVITY_TYPE_CREATE_TVC_APP
	UPDATE	ACTIVITY_TYPE_UPDATE_TVC_APP_LIVE_DEPLOYMENT
	DELETE	ACTIVITY_TYPE_DELETE_TVC_APP_AND_DEPLOYMENTS
TVC_DEPLOYMENT	CREATE	ACTIVITY_TYPE_CREATE_TVC_DEPLOYMENT
	UPDATE	ACTIVITY_TYPE_CREATE_TVC_MANIFEST_APPROVALS
	UPDATE	ACTIVITY_TYPE_RESTORE_TVC_DEPLOYMENT
	UPDATE	ACTIVITY_TYPE_POST_TVC_QUORUM_KEY_SHARE
	DELETE	ACTIVITY_TYPE_DELETE_TVC_DEPLOYMENT
TVC_OPERATOR	CREATE	ACTIVITY_TYPE_CREATE_TVC_OPERATOR
TVC_QUORUM_KEY	CREATE	ACTIVITY_TYPE_CREATE_TVC_QUORUM_KEY
	ENCRYPT	ACTIVITY_TYPE_RE_ENCRYPT_TVC_QUORUM_KEY_SHARE

** In the Activity breakdown table above, ** marks legacy features deprecated in the latest SDKs. This note applies only to that table.

Activity kinds

activity.kind groups all versions of an activity under one version-agnostic value. The table below lists each kind and the activity types it matches.

The kinds for root quorum activities can be matched by MFA policy conditions and session profile scopes, but a policy can’t allow those activities.

Kind	Matches Activity Types
DELETE_ORGANIZATION	ACTIVITY_TYPE_DELETE_ORGANIZATION
CREATE_SUB_ORGANIZATION	ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION, ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V2, ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V3, ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V4, ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V5, ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V6, ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V7, ACTIVITY_TYPE_CREATE_SUB_ORGANIZATION_V8
DELETE_SUB_ORGANIZATION	ACTIVITY_TYPE_DELETE_SUB_ORGANIZATION
CREATE_INVITATIONS	ACTIVITY_TYPE_CREATE_INVITATIONS
DELETE_INVITATION	ACTIVITY_TYPE_DELETE_INVITATION
CREATE_USERS	ACTIVITY_TYPE_CREATE_USERS, ACTIVITY_TYPE_CREATE_USERS_V2, ACTIVITY_TYPE_CREATE_USERS_V3, ACTIVITY_TYPE_CREATE_USERS_V4
CREATE_API_ONLY_USERS	ACTIVITY_TYPE_CREATE_API_ONLY_USERS
CREATE_USER_TAG	ACTIVITY_TYPE_CREATE_USER_TAG
UPDATE_USER	ACTIVITY_TYPE_UPDATE_USER
UPDATE_USER_NAME	ACTIVITY_TYPE_UPDATE_USER_NAME
UPDATE_USER_EMAIL	ACTIVITY_TYPE_UPDATE_USER_EMAIL
UPDATE_USER_PHONE_NUMBER	ACTIVITY_TYPE_UPDATE_USER_PHONE_NUMBER
UPDATE_USER_TAG	ACTIVITY_TYPE_UPDATE_USER_TAG
DELETE_USERS	ACTIVITY_TYPE_DELETE_USERS
DELETE_USER_TAGS	ACTIVITY_TYPE_DELETE_USER_TAGS
ENABLE_AUTH_PROXY	ACTIVITY_TYPE_ENABLE_AUTH_PROXY
DISABLE_AUTH_PROXY	ACTIVITY_TYPE_DISABLE_AUTH_PROXY
UPSERT_SWAP_CONFIG	ACTIVITY_TYPE_UPSERT_SWAP_CONFIG
CREATE_AUTHENTICATORS	ACTIVITY_TYPE_CREATE_AUTHENTICATORS, ACTIVITY_TYPE_CREATE_AUTHENTICATORS_V2
CREATE_API_KEYS	ACTIVITY_TYPE_CREATE_API_KEYS, ACTIVITY_TYPE_CREATE_API_KEYS_V2
DELETE_AUTHENTICATORS	ACTIVITY_TYPE_DELETE_AUTHENTICATORS
DELETE_API_KEYS	ACTIVITY_TYPE_DELETE_API_KEYS
CREATE_OAUTH_PROVIDERS	ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS, ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS_V2
DELETE_OAUTH_PROVIDERS	ACTIVITY_TYPE_DELETE_OAUTH_PROVIDERS
CREATE_PRIVATE_KEYS	ACTIVITY_TYPE_CREATE_PRIVATE_KEYS, ACTIVITY_TYPE_CREATE_PRIVATE_KEYS_V2
CREATE_PRIVATE_KEY_TAG	ACTIVITY_TYPE_CREATE_PRIVATE_KEY_TAG
UPDATE_PRIVATE_KEY_TAG	ACTIVITY_TYPE_UPDATE_PRIVATE_KEY_TAG
DISABLE_PRIVATE_KEY	ACTIVITY_TYPE_DISABLE_PRIVATE_KEY
DELETE_PRIVATE_KEY_TAGS	ACTIVITY_TYPE_DELETE_PRIVATE_KEY_TAGS
INIT_IMPORT_PRIVATE_KEY	ACTIVITY_TYPE_INIT_IMPORT_PRIVATE_KEY
IMPORT_PRIVATE_KEY	ACTIVITY_TYPE_IMPORT_PRIVATE_KEY
DELETE_PRIVATE_KEYS	ACTIVITY_TYPE_DELETE_PRIVATE_KEYS
SIGN_TRANSACTION	ACTIVITY_TYPE_SIGN_TRANSACTION, ACTIVITY_TYPE_SIGN_TRANSACTION_V2
SIGN_RAW_PAYLOAD	ACTIVITY_TYPE_SIGN_RAW_PAYLOAD, ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2
SIGN_RAW_PAYLOADS	ACTIVITY_TYPE_SIGN_RAW_PAYLOADS
SPARK_SIGN_FROST	ACTIVITY_TYPE_SPARK_SIGN_FROST
SPARK_PREPARE_TRANSFER	ACTIVITY_TYPE_SPARK_PREPARE_TRANSFER
SPARK_CLAIM_TRANSFER	ACTIVITY_TYPE_SPARK_CLAIM_TRANSFER
SPARK_PREPARE_LIGHTNING_RECEIVE	ACTIVITY_TYPE_SPARK_PREPARE_LIGHTNING_RECEIVE
ETH_SEND_TRANSACTION	ACTIVITY_TYPE_ETH_SEND_TRANSACTION, ACTIVITY_TYPE_ETH_SEND_TRANSACTION_V2
SOL_SEND_TRANSACTION	ACTIVITY_TYPE_SOL_SEND_TRANSACTION
EXECUTE_SWAP	ACTIVITY_TYPE_EXECUTE_SWAP, ACTIVITY_TYPE_EXECUTE_SWAP_V2, ACTIVITY_TYPE_EXECUTE_SWAP_V3
CREATE_SWAP_QUOTE	ACTIVITY_TYPE_CREATE_SWAP_QUOTE, ACTIVITY_TYPE_CREATE_SWAP_QUOTE_V2
CLAIM_EARN_FEES	ACTIVITY_TYPE_CLAIM_EARN_FEES
EARN_DEPLOY_WRAPPER	ACTIVITY_TYPE_EARN_DEPLOY_WRAPPER
EARN_DEPOSIT	ACTIVITY_TYPE_EARN_DEPOSIT
EARN_WITHDRAW	ACTIVITY_TYPE_EARN_WITHDRAW
EARN_SET_WRAPPER_STATE	ACTIVITY_TYPE_EARN_SET_WRAPPER_STATE
EARN_CLAIM_REWARDS	ACTIVITY_TYPE_EARN_CLAIM_REWARDS
EXPORT_PRIVATE_KEY	ACTIVITY_TYPE_EXPORT_PRIVATE_KEY
CREATE_WALLET	ACTIVITY_TYPE_CREATE_WALLET
CREATE_WALLET_ACCOUNTS	ACTIVITY_TYPE_CREATE_WALLET_ACCOUNTS
EXPORT_WALLET	ACTIVITY_TYPE_EXPORT_WALLET
EXPORT_WALLET_ACCOUNT	ACTIVITY_TYPE_EXPORT_WALLET_ACCOUNT
INIT_IMPORT_WALLET	ACTIVITY_TYPE_INIT_IMPORT_WALLET
IMPORT_WALLET	ACTIVITY_TYPE_IMPORT_WALLET
DELETE_WALLETS	ACTIVITY_TYPE_DELETE_WALLETS
UPDATE_WALLET	ACTIVITY_TYPE_UPDATE_WALLET
DELETE_WALLET_ACCOUNTS	ACTIVITY_TYPE_DELETE_WALLET_ACCOUNTS
INIT_FIAT_ON_RAMP	ACTIVITY_TYPE_INIT_FIAT_ON_RAMP
CREATE_FIAT_ON_RAMP_CREDENTIAL	ACTIVITY_TYPE_CREATE_FIAT_ON_RAMP_CREDENTIAL
DELETE_FIAT_ON_RAMP_CREDENTIAL	ACTIVITY_TYPE_DELETE_FIAT_ON_RAMP_CREDENTIAL
UPDATE_FIAT_ON_RAMP_CREDENTIAL	ACTIVITY_TYPE_UPDATE_FIAT_ON_RAMP_CREDENTIAL
CREATE_POLICY	ACTIVITY_TYPE_CREATE_POLICY, ACTIVITY_TYPE_CREATE_POLICY_V2, ACTIVITY_TYPE_CREATE_POLICY_V3
CREATE_POLICIES	ACTIVITY_TYPE_CREATE_POLICIES
UPDATE_POLICY	ACTIVITY_TYPE_UPDATE_POLICY, ACTIVITY_TYPE_UPDATE_POLICY_V2
DELETE_POLICY	ACTIVITY_TYPE_DELETE_POLICY
DELETE_POLICIES	ACTIVITY_TYPE_DELETE_POLICIES
ACTIVATE_BILLING_TIER	ACTIVITY_TYPE_ACTIVATE_BILLING_TIER
SET_PAYMENT_METHOD	ACTIVITY_TYPE_SET_PAYMENT_METHOD, ACTIVITY_TYPE_SET_PAYMENT_METHOD_V2
DELETE_PAYMENT_METHOD	ACTIVITY_TYPE_DELETE_PAYMENT_METHOD
UPDATE_ALLOWED_ORIGINS	ACTIVITY_TYPE_UPDATE_ALLOWED_ORIGINS
CREATE_WEBHOOK_ENDPOINT	ACTIVITY_TYPE_CREATE_WEBHOOK_ENDPOINT
UPDATE_WEBHOOK_ENDPOINT	ACTIVITY_TYPE_UPDATE_WEBHOOK_ENDPOINT
DELETE_WEBHOOK_ENDPOINT	ACTIVITY_TYPE_DELETE_WEBHOOK_ENDPOINT
INIT_USER_EMAIL_RECOVERY	ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY, ACTIVITY_TYPE_INIT_USER_EMAIL_RECOVERY_V2
EMAIL_AUTH	ACTIVITY_TYPE_EMAIL_AUTH, ACTIVITY_TYPE_EMAIL_AUTH_V2, ACTIVITY_TYPE_EMAIL_AUTH_V3
INIT_OTP_AUTH	ACTIVITY_TYPE_INIT_OTP_AUTH, ACTIVITY_TYPE_INIT_OTP_AUTH_V2, ACTIVITY_TYPE_INIT_OTP_AUTH_V3
OTP_AUTH	ACTIVITY_TYPE_OTP_AUTH
OAUTH	ACTIVITY_TYPE_OAUTH
CREATE_READ_WRITE_SESSION	ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION, ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION_V2
OAUTH_LOGIN	ACTIVITY_TYPE_OAUTH_LOGIN
OTP_LOGIN	ACTIVITY_TYPE_OTP_LOGIN, ACTIVITY_TYPE_OTP_LOGIN_V2
STAMP_LOGIN	ACTIVITY_TYPE_STAMP_LOGIN
UPDATE_AUTH_PROXY_CONFIG	ACTIVITY_TYPE_UPDATE_AUTH_PROXY_CONFIG
CREATE_OAUTH2_CREDENTIAL	ACTIVITY_TYPE_CREATE_OAUTH2_CREDENTIAL
UPDATE_OAUTH2_CREDENTIAL	ACTIVITY_TYPE_UPDATE_OAUTH2_CREDENTIAL
DELETE_OAUTH2_CREDENTIAL	ACTIVITY_TYPE_DELETE_OAUTH2_CREDENTIAL
OAUTH2_AUTHENTICATE	ACTIVITY_TYPE_OAUTH2_AUTHENTICATE
INIT_OTP	ACTIVITY_TYPE_INIT_OTP, ACTIVITY_TYPE_INIT_OTP_V2, ACTIVITY_TYPE_INIT_OTP_V3
VERIFY_OTP	ACTIVITY_TYPE_VERIFY_OTP, ACTIVITY_TYPE_VERIFY_OTP_V2
CREATE_SMART_CONTRACT_INTERFACE	ACTIVITY_TYPE_CREATE_SMART_CONTRACT_INTERFACE
DELETE_SMART_CONTRACT_INTERFACE	ACTIVITY_TYPE_DELETE_SMART_CONTRACT_INTERFACE
UPSERT_GAS_USAGE_CONFIG	ACTIVITY_TYPE_UPSERT_GAS_USAGE_CONFIG
CREATE_TVC_APP	ACTIVITY_TYPE_CREATE_TVC_APP
CREATE_TVC_DEPLOYMENT	ACTIVITY_TYPE_CREATE_TVC_DEPLOYMENT
CREATE_TVC_MANIFEST_APPROVALS	ACTIVITY_TYPE_CREATE_TVC_MANIFEST_APPROVALS
CREATE_TVC_OPERATOR	ACTIVITY_TYPE_CREATE_TVC_OPERATOR
UPDATE_TVC_APP_LIVE_DEPLOYMENT	ACTIVITY_TYPE_UPDATE_TVC_APP_LIVE_DEPLOYMENT
DELETE_TVC_DEPLOYMENT	ACTIVITY_TYPE_DELETE_TVC_DEPLOYMENT
DELETE_TVC_APP_AND_DEPLOYMENTS	ACTIVITY_TYPE_DELETE_TVC_APP_AND_DEPLOYMENTS
RESTORE_TVC_DEPLOYMENT	ACTIVITY_TYPE_RESTORE_TVC_DEPLOYMENT
POST_TVC_QUORUM_KEY_SHARE	ACTIVITY_TYPE_POST_TVC_QUORUM_KEY_SHARE
CREATE_TVC_QUORUM_KEY	ACTIVITY_TYPE_CREATE_TVC_QUORUM_KEY
RE_ENCRYPT_TVC_QUORUM_KEY_SHARE	ACTIVITY_TYPE_RE_ENCRYPT_TVC_QUORUM_KEY_SHARE
CREATE_MFA_POLICY	ACTIVITY_TYPE_CREATE_MFA_POLICY
UPDATE_MFA_POLICY	ACTIVITY_TYPE_UPDATE_MFA_POLICY
DELETE_MFA_POLICY	ACTIVITY_TYPE_DELETE_MFA_POLICY
CREATE_SESSION_PROFILE	ACTIVITY_TYPE_CREATE_SESSION_PROFILE
UPDATE_ROOT_QUORUM	ACTIVITY_TYPE_UPDATE_ROOT_QUORUM
UPDATE_ORGANIZATION_NAME	ACTIVITY_TYPE_UPDATE_ORGANIZATION_NAME
SET_ORGANIZATION_FEATURE	ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE
REMOVE_ORGANIZATION_FEATURE	ACTIVITY_TYPE_REMOVE_ORGANIZATION_FEATURE

Prefer activity.kind over activity.type when you want a policy to apply across all versions of an activity. activity.type targets one exact version and will not match newer versions introduced later.

Choosing between `type`, `kind`, and `resource` + `action`

There are three ways to target activities in a policy condition. Pick based on how broad you want the match to be:

Field(s)	Scope	Use when
`activity.type`	One exact activity version (e.g. `ACTIVITY_TYPE_SIGN_TRANSACTION_V2`)	You need to pin a specific version. Most precise, but brittle: it will not match when the activity is upgraded to a new version.
`activity.kind`	One logical activity, all versions (e.g. `SIGN_TRANSACTION`)	You want to allow/deny a specific activity and keep the policy working across future version upgrades. Recommended default for activity-specific policies.
`activity.resource` + `activity.action`	A group of activities sharing a resource and action (e.g. all `CREATE` on `CREDENTIAL`)	You want a coarse, category-level rule spanning many activities at once.

Rule of thumb: use activity.kind to target a single activity (version-agnostic), and activity.resource + activity.action to target a broad category. Reach for activity.type only when you deliberately need one exact version.

Evaluation errors and short-circuiting

A policy condition causes an evaluation error when it uses a keyword or field that the activity does not populate. For example, eth.eip_7702_authorization on ACTIVITY_TYPE_SIGN_TRANSACTION_V2, or an activity parameter that the activity does not expose.If a policy’s condition causes an evaluation error, the policy is skipped:

An ALLOW policy with an error does not allow the activity.
A DENY policy with an error does not deny the activity, so another ALLOW policy can still allow it.

Short-circuiting

Note that our policy engine does not short-circuit during evaluation. Specifically, the policy engine evaluates every clause of a condition, because && and || do not short-circuit. If any clause causes an error, the entire policy will error, even if another passes.For example, suppose you have a policy with the condition as wallet.id == '<WALLET_ID>' || private_key.id == '<PRIVATE_KEY_ID>'. This will, by construction, always cause an error, because a signing activity can use a wallet or a private key, but not both: when you sign with a private key, the wallet.id clause causes an error. When you sign with a wallet, the private_key.id clause causes an error. Short-circuiting in this scenario means that if the first clause passes, the second clause would not be evaluated, thereby preventing such an error — our policy engine does not behave in this way.

Example: one policy for two activities

This policy tries to allow two things: signing Type 2 transactions, and signing EIP-7702 authorizations for one trusted delegate contract:

{
  "policyName": "Allow Type 2 transactions and EIP-7702 Authorizations (does not work)",
  "effect": "EFFECT_ALLOW",
  "condition": "(activity.type == 'ACTIVITY_TYPE_SIGN_TRANSACTION_V2' && eth.tx.type == 'TYPE_2') || (activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2' && activity.params.encoding == 'PAYLOAD_ENCODING_EIP7702_AUTHORIZATION' && eth.eip_7702_authorization.address == '<CHECKSUMMED_ADDRESS>')"
}

This policy never allows either activity:

For ACTIVITY_TYPE_SIGN_TRANSACTION_V2, the policy engine also evaluates eth.eip_7702_authorization.address, which this activity does not populate.
For ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2, the policy engine also evaluates eth.tx.type, which this activity does not populate.

In both cases, the condition causes an evaluation error and the policy is skipped. We recommend writing one policy for each activity instead:

{
  "policyName": "Allow Type 2 transactions",
  "effect": "EFFECT_ALLOW",
  "condition": "activity.type == 'ACTIVITY_TYPE_SIGN_TRANSACTION_V2' && eth.tx.type == 'TYPE_2'"
}

{
  "policyName": "Allow signing of EIP-7702 Authorizations",
  "effect": "EFFECT_ALLOW",
  "condition": "activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2' && activity.params.encoding == 'PAYLOAD_ENCODING_EIP7702_AUTHORIZATION' && eth.eip_7702_authorization.address == '<CHECKSUMMED_ADDRESS>' && eth.eip_7702_authorization.chain_id == <CHAIN_ID>"
}

Guidelines

Keep related clauses for one activity, such as the address and chain_id limits of one allowlist, in one policy joined with &&.
Do not join clauses for different activities with ||. Write a separate policy for each activity.
A DENY policy that uses a keyword that only some activities populate has no effect on the other activities. For example, a DENY policy with the condition eth.eip_7702_authorization.chain_id == 0 does not deny anything that ACTIVITY_TYPE_SIGN_RAW_PAYLOADS signs.

Appendix

Activity parameters

The activity.params field exposes specific request parameters based on the activity type. An activity may have API request parameters without exposing them through activity.params; only the fields listed below are available to policy conditions.Absence from this table does not mean that an activity is unsupported or cannot be targeted with activity.type, activity.kind, or activity.resource and activity.action. It means that the policy evaluator exposes no request fields for that activity. Attempting to access an unavailable field produces a MissingField evaluation error. See Evaluation errors and short-circuiting for more details. To request an additional policy-exposed parameter, contact help@turnkey.com.

Category	Activity Type	Field	Type	Description
Signing	`ACTIVITY_TYPE_SIGN_RAW_PAYLOAD`	`hash_function`	string	The hash function used (e.g., `HASH_FUNCTION_NO_OP`, `HASH_FUNCTION_KECCAK256`)
		`encoding`	string	The payload encoding (e.g., `PAYLOAD_ENCODING_HEXADECIMAL`, `PAYLOAD_ENCODING_EIP712`)
	`ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2`	`hash_function`	string	The hash function used
		`encoding`	string	The payload encoding
	`ACTIVITY_TYPE_SIGN_RAW_PAYLOADS`	`hash_function`	string	The hash function used
		`encoding`	string	The payload encoding
	`ACTIVITY_TYPE_SIGN_TRANSACTION_V2`	`type`	string	The transaction type (one of `[TRANSACTION_TYPE_ETHEREUM, TRANSACTION_TYPE_SOLANA, TRANSACTION_TYPE_BITCOIN, TRANSACTION_TYPE_TRON, TRANSACTION_TYPE_TEMPO]`)
User Management	`ACTIVITY_TYPE_DELETE_USERS`	`user_ids`	list<string>	The list of user IDs being deleted
Authenticators	`ACTIVITY_TYPE_CREATE_AUTHENTICATORS_V2`	`user_id`	string	The ID of the user who will own the authenticators
API Key Management	`ACTIVITY_TYPE_CREATE_API_KEYS`	`user_id`	string	The ID of the user who will own the API keys
		`api_keys`	list<ApiKeyParams>	The API keys being created
	`ACTIVITY_TYPE_CREATE_API_KEYS_V2`	`user_id`	string	The ID of the user who will own the API keys
		`api_keys`	list<ApiKeyParams>	The API keys being created
	`ACTIVITY_TYPE_DELETE_API_KEYS`	`user_id`	string	The ID of the user who owns the API keys
		`api_key_ids`	list<string>	The IDs of the API keys being deleted
Export	`ACTIVITY_TYPE_EXPORT_WALLET`	`target_public_key`	string	The public key the export bundle is encrypted to
	`ACTIVITY_TYPE_EXPORT_WALLET_ACCOUNT`	`target_public_key`	string	The public key the export bundle is encrypted to
	`ACTIVITY_TYPE_EXPORT_PRIVATE_KEY`	`target_public_key`	string	The public key the export bundle is encrypted to
Wallet Management	`ACTIVITY_TYPE_UPDATE_WALLET`	`wallet_id`	string	The ID of the wallet being updated
Authentication	`ACTIVITY_TYPE_INIT_OTP_AUTH_V2`	`otp_length`	int	The length of the OTP code
	`ACTIVITY_TYPE_INIT_OTP_AUTH_V3`	`otp_length`	int	The length of the OTP code
	`ACTIVITY_TYPE_OTP_LOGIN`	`session_profile_id`	string	The session profile ID, or an empty string when omitted
	`ACTIVITY_TYPE_OTP_LOGIN_V2`	`session_profile_id`	string	The session profile ID, or an empty string when omitted
	`ACTIVITY_TYPE_STAMP_LOGIN`	`session_profile_id`	string	The session profile ID, or an empty string when omitted
	`ACTIVITY_TYPE_OAUTH_LOGIN`	`session_profile_id`	string	The session profile ID, or an empty string when omitted
Webhook Endpoint	`ACTIVITY_TYPE_UPDATE_WEBHOOK_ENDPOINT`	`endpoint_id`	string	The ID of the webhook endpoint being updated
	`ACTIVITY_TYPE_DELETE_WEBHOOK_ENDPOINT`	`endpoint_id`	string	The ID of the webhook endpoint being deleted
Spark	`ACTIVITY_TYPE_SPARK_SIGN_FROST`	`sign_with`	string	The Spark wallet account address identifying the wallet to sign with
		`signatures`	list<SparkSignatureRequest>	The FROST signature requests
	`ACTIVITY_TYPE_SPARK_PREPARE_TRANSFER`	`sign_with`	string	The Spark wallet account address identifying the wallet
		`transfer`	SparkTransferPackage	The transfer package
	`ACTIVITY_TYPE_SPARK_CLAIM_TRANSFER`	`sign_with`	string	The Spark wallet account address identifying the wallet
		`claim`	SparkClaimPackage	The claim package
	`ACTIVITY_TYPE_SPARK_PREPARE_LIGHTNING_RECEIVE`	`sign_with`	string	The Spark wallet account address identifying the wallet
		`lightning_receive`	SparkLightningReceivePackage	The Lightning receive package
Swaps	`ACTIVITY_TYPE_CREATE_SWAP_QUOTE`	`sign_with`	string	Wallet account or private key address used to price the quote
		`input_token`	string	CAIP-19 asset ID for the input asset
		`output_token`	string	CAIP-19 asset ID for the output asset
		`input_amount`	uint	Input amount in base units (decimal string in the API intent)
		`slippage_bps`	uint	Maximum slippage in basis points; omitted on the request yields a `FieldNotUsed` error (not zero)
	`ACTIVITY_TYPE_CREATE_SWAP_QUOTE_V2`	`sign_with`	string	Wallet account address used to price the quote
		`input_token`	string	CAIP-19 asset ID for the input asset
		`output_token`	string	CAIP-19 asset ID for the output asset
		`input_amount`	uint	Input amount in base units
		`slippage_bps`	uint	Maximum slippage in basis points; omitted on the request yields a `FieldNotUsed` error (not zero)
		`destination_address`	string	Raw output recipient address; EVM destinations are normalized to lowercase `0x` hex when `output_token` is an EVM CAIP-19 ID
	`ACTIVITY_TYPE_EXECUTE_SWAP`	`input_token`	string	CAIP-19 asset ID for the input asset (legacy execute path)
		`output_token`	string	CAIP-19 asset ID for the output asset
		`input_amount`	uint	Input amount in base units
		`min_output_amount`	uint	Minimum output in base units
		`wallet_account`	string	Wallet account used for the swap
		`sponsor`	bool	Whether the swap uses gas sponsorship
		`slippage`	uint	Slippage in basis points; omitted on the request yields a `FieldNotUsed` error (not zero)
		`provider`	string	Swap provider identifier when set on the intent
	`ACTIVITY_TYPE_EXECUTE_SWAP_V2`	`quote_id`	string	Quote identifier from create swap quote
		`input_token`	string	CAIP-19 asset ID for the input asset
		`input_amount`	uint	Input amount in base units committed by the quote
		`output_token`	string	CAIP-19 asset ID for the output asset
		`quoted_output_amount`	uint	Quoted output in base units
		`min_output_amount`	uint	Minimum output in base units
		`sponsor`	bool	Whether the quoted execution is sponsored
		`evm_nonce`	string	EVM sender nonce when supplied on the intent
		`recent_blockhash`	string	Solana recent blockhash when supplied on the intent
	`ACTIVITY_TYPE_EXECUTE_SWAP_V3`	`quote_id`	string	Quote identifier from create swap quote
		`input_token`	string	CAIP-19 asset ID for the input asset
		`input_amount`	uint	Input amount in base units committed by the quote
		`output_token`	string	CAIP-19 asset ID for the output asset
		`quoted_output_amount`	uint	Quoted output in base units
		`min_output_amount`	uint	Minimum output in base units
		`sponsor`	bool	Whether the quoted execution is sponsored
		`evm_nonce`	string	EVM sender nonce when supplied on the intent
		`recent_blockhash`	string	Solana recent blockhash when supplied on the intent
		`destination_address`	string	Raw output recipient address; EVM destinations are normalized to lowercase `0x` hex when `output_token` is an EVM CAIP-19 ID
Earn	`ACTIVITY_TYPE_CLAIM_EARN_FEES`	`wrapper_address`	string	Deployed Earn wrapper address (EVM addresses normalized to lowercase `0x` hex)
	`ACTIVITY_TYPE_EARN_CLAIM_REWARDS`	`sign_with`	string	Turnkey-managed wallet that signs the claim and receives rewards; normalized when `chain` is an EVM chain
		`chain`	string	CAIP-2 chain to claim rewards on (for example `eip155:8453`)
		`sponsor`	bool	Whether the claim uses gas sponsorship
	`ACTIVITY_TYPE_EARN_DEPLOY_WRAPPER`	`vault_address`	string	Underlying vault address from the Earn catalog; normalized on EVM chains
		`chain`	string	CAIP-2 chain ID (for example `eip155:8453`)
		`client_fee_bps`	uint	Client fee on gross yield, in whole basis points (decimal string in the API intent)
		`client_fee_wallet`	string	On-chain fee recipient wallet; normalized on EVM chains
	`ACTIVITY_TYPE_EARN_DEPOSIT`	`wrapper_address`	string	Target Earn wrapper address; normalized when `chain` is an EVM chain
		`sign_with`	string	Source wallet account or private key address for the deposit
		`assets`	uint	Deposit amount in raw on-chain units (decimal string in the API intent)
		`chain`	string	CAIP-2 chain ID for the vault
		`sponsor`	bool	Whether the deposit uses gas sponsorship
	`ACTIVITY_TYPE_EARN_SET_WRAPPER_STATE`	`wrapper_address`	string	Earn wrapper whose deposit state is changing (EVM normalization)
		`deposits_disabled`	bool	When true, deposits to the wrapper are disabled
	`ACTIVITY_TYPE_EARN_WITHDRAW`	`wrapper_address`	string	Earn wrapper to withdraw from; normalized when `chain` is an EVM chain
		`sign_with`	string	Wallet account or private key address for the withdrawal
		`chain`	string	CAIP-2 chain ID for the vault
		`amount_value`	string	Withdrawal amount in raw on-chain units, or the literal `MAX` to withdraw the full position
		`sponsor`	bool	Whether the withdrawal uses gas sponsorship

For swap and earn policies, prefer activity.kind (for example CREATE_SWAP_QUOTE, EXECUTE_SWAP, EARN_DEPOSIT) when you want version-stable conditions. Use activity.type when you must pin a specific API version—for example, destination_address is available on ACTIVITY_TYPE_CREATE_SWAP_QUOTE_V2 and ACTIVITY_TYPE_EXECUTE_SWAP_V3, not on the earlier quote or execute activity types. Swap and Earn numeric params (input_amount, slippage_bps, assets, client_fee_bps, and similar) compare as uint values; empty or non-decimal strings fail evaluation with a parse error rather than matching a cap as zero. Earn amount_value stays a string because withdrawals may use the literal MAX. See the Swaps and Earn policy examples for allowlists, sponsorship controls, slippage caps, and administrative Earn rules.

Examples

To deny signing raw payloads with the NO_OP hash function (except for EIP-712):

{
  "policyName": "Deny NO_OP hash signing",
  "notes": "",
  "effect": "EFFECT_DENY",
  "condition": "activity.type == 'ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2' && activity.params.hash_function == 'HASH_FUNCTION_NO_OP' && activity.params.encoding != 'PAYLOAD_ENCODING_EIP712'"
}

To allow a user to delete only themselves:

{
  "policyName": "Allow self-deletion",
  "notes": "",
  "effect": "EFFECT_ALLOW",
  "consensus": "approvers.any(user, user.id == '<USER_ID>')",
  "condition": "activity.type == 'ACTIVITY_TYPE_DELETE_USERS' && activity.params.user_ids.count() == 1 && '<USER_ID>' in activity.params.user_ids"
}

Root quorum activities

There are a select few activities that are not governed by policies, but rather by an organization’s root quorum. These activities are: ACTIVITY_TYPE_UPDATE_ROOT_QUORUM, ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE, ACTIVITY_TYPE_REMOVE_ORGANIZATION_FEATURE, ACTIVITY_TYPE_UPDATE_ORGANIZATION_NAME. For example, if a policy is added that allows a specific non-root user to perform ACTIVITY_TYPE_SET_ORGANIZATION_FEATURE activities, these requests will still fail as they are subject specifically to root quorum.Policies can’t allow these activities, but MFA policy conditions and session profile scopes still apply to them. Both can reference:

activity.type and activity.kind
activity.resource, which is ORGANIZATION
activity.action, which is UPDATE

These activities have no activity.params. A condition that references activity.params.* can’t be evaluated for them: an MFA policy that uses one is skipped, and a session profile scope that uses one denies the request.A session profile scope only narrows what a session can do. A request whose scope matches still needs root quorum approval.

Activities that target a root user

Users outside the root quorum can’t modify users in the root quorum. If a non-root user submits any of the activities below against a root quorum user, the request is denied before any policy is evaluated, so no policy can allow it:

ACTIVITY_TYPE_CREATE_AUTHENTICATORS_V2, ACTIVITY_TYPE_DELETE_AUTHENTICATORS
ACTIVITY_TYPE_CREATE_API_KEYS, ACTIVITY_TYPE_CREATE_API_KEYS_V2, ACTIVITY_TYPE_DELETE_API_KEYS
ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS, ACTIVITY_TYPE_CREATE_OAUTH_PROVIDERS_V2, ACTIVITY_TYPE_DELETE_OAUTH_PROVIDERS
ACTIVITY_TYPE_UPDATE_USER, ACTIVITY_TYPE_UPDATE_USER_NAME, ACTIVITY_TYPE_UPDATE_USER_EMAIL, ACTIVITY_TYPE_UPDATE_USER_PHONE_NUMBER
ACTIVITY_TYPE_DELETE_USERS, when any of the users being deleted is a root user

The request fails with a permission error and no policy evaluations are recorded. For example, a non-root recovery user cannot add a passkey to a root user, even with a policy that allows CREATE_AUTHENTICATORS.

Activities a user can perform on themselves

A user can manage their own authenticators, API keys and MFA policies without a policy granting it. When no policy reaches a decision, the engine allows the activities below as long as the user submitting the request is targeting themselves.

ACTIVITY_TYPE_CREATE_AUTHENTICATORS_V2, ACTIVITY_TYPE_DELETE_AUTHENTICATORS
ACTIVITY_TYPE_CREATE_API_KEYS_V2, ACTIVITY_TYPE_DELETE_API_KEYS
ACTIVITY_TYPE_RECOVER_USER
ACTIVITY_TYPE_CREATE_MFA_POLICY, ACTIVITY_TYPE_UPDATE_MFA_POLICY, ACTIVITY_TYPE_DELETE_MFA_POLICY
ACTIVITY_TYPE_CREATE_READ_ONLY_SESSION, for any requesting user, since it only creates a session for that user

Note that this self-targeting behavior applies only under the following conditions:

No policy produced a decision. For non-root users an explicit allow or deny stands, so a policy that denies ACTIVITY_TYPE_CREATE_API_KEYS_V2 denies it for the user’s own keys too.
The request targets the organization it is submitted to. A parent organization user acting on a sub-organization user is not allowed by default and needs a policy.
The requesting user’s MFA policy, if any, is satisfied. Otherwise the activity requires additional authenticators before it runs.
The request did not already meet the root quorum. A request that does is allowed before policies are evaluated, so root users rarely need the allowance. A root user below the threshold can still act on their own credentials through it. For anything else, a root user below the threshold acts alone only when a policy allows it. Any other outcome for a root user, including an explicit deny, becomes a request for quorum approval rather than a denial.

This default is what lets a scoped recovery session enroll a passkey for only the authenticated user. A policy condition or session profile scope can pin the target of CREATE_AUTHENTICATORS_V2 and the API key activities to a fixed user with activity.params.user_id, but neither can refer to the user submitting the request. The approvers and credentials keywords identify the requester and are not available in a condition or scope, and a consensus expression cannot read activity.params. A session scoped only to the activity kind therefore adds authenticators to the session holder alone, as long as no policy allows the activity for other users and the request does not meet the root quorum.

Wallet and private key import activities and ACTIVITY_TYPE_CREATE_READ_WRITE_SESSION must always target the requesting user. A request for another user is denied before policies are evaluated, and no policy can allow it.

Ethereum

Our Ethereum policy language (accessible via eth.tx) allows for the granular governance of signing Ethereum (EVM-compatible) transactions. Our policy engine exposes a fairly standard set of properties belonging to a transaction.See the Ethereum policy examples for sample scenarios.

The policy engine’s int type is limited to 128 bits (i128). Ethereum smart contracts support signed integers up to 256 bits (int256), but values exceeding the 128-bit signed range cannot be used in policy conditions.

EIP-712

Our policy engine supports EIP-712 typed data signing (accessible via eth.eip_712). When defining policies for EIP-712 messages, please ensure that all hex-encoded strings (e.g. addresses, function selectors, bytes) are lowercase. The policy engine expects lowercase hex strings to conform to Ethereum’s standard convention. Using uppercase hex strings may result in errors or policy rejection. Note that EIP-712 messages passed in as transactions will be normalized to lowercase.

EIP-7702

eth.eip_7702_authorization is an EIP-7702 authorization that the signing key signs as a message. It does not describe the authorization list of a Type 4 transaction. Policies on transactions use eth.tx (see Type 4 transactions). The policy engine populates eth.eip_7702_authorization only for these activities:

ACTIVITY_TYPE_SIGN_RAW_PAYLOAD and ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2. The policy engine reads the payload as an authorization for all encodings, so an ALLOW policy must also contain activity.params.encoding == 'PAYLOAD_ENCODING_EIP7702_AUTHORIZATION'. Without this check, the policy also allows EIP-712 typed data, such as a token permit, that contains address, chainId, and nonce fields.
ACTIVITY_TYPE_ETH_SEND_TRANSACTION and ACTIVITY_TYPE_ETH_SEND_TRANSACTION_V2, when Turnkey builds an authorization to its gas delegate contract. This occurs for sponsored transactions and for non-sponsored ACTIVITY_TYPE_ETH_SEND_TRANSACTION_V2 requests with more than one call, when the account is not yet delegated. A request without an authorization causes an evaluation error, so do not require eth.eip_7702_authorization in ALLOW policies for these activities.
ACTIVITY_TYPE_ETH_UNDELEGATE_7702.

For all other activities, the keyword causes an evaluation error. See Evaluation errors and short-circuiting for more details. There is no plural eth.eip_7702_authorizations keyword — if you attempt to create a policy with it, it’ll get rejected.

ACTIVITY_TYPE_SIGN_RAW_PAYLOADS does not populate eth.eip_7702_authorization for any encoding. If an ALLOW policy for this activity does not limit activity.params.encoding, the key can sign authorizations for any contract. Deny batch signing of EIP-7702 authorizations blocks only PAYLOAD_ENCODING_EIP7702_AUTHORIZATION. The key can still sign authorizations as hexadecimal or UTF-8 payloads (see below). If a key must not sign authorizations, allow this activity only with activity.params.encoding == 'PAYLOAD_ENCODING_EIP712'.

What a signed authorization allows

Anyone who has a signed authorization can send it in a Type 4 transaction from any account, with no other signature from the key. The network gets the delegated account from the authorization signature, not from the sender. After that, calls to the account run the code at address until another authorization replaces it. If that code does not verify the caller, anyone can move the funds of the account. Write the ALLOW policy as an allowlist:

address: Only delegate contracts that you trust, with == or in. A list of bad contracts in a DENY policy does not work, because an attacker can deploy a new contract.
chain_id: The chains that you use. An authorization with chain_id 0 is valid on all EVM chains.
nonce: An authorization is usable only when the account nonce is equal to its nonce, so an authorization with a future nonce stays usable until the account nonce is more than its nonce.

The policy engine gives address in the EIP-55 checksummed (mixed-case) form, and the comparison is case-sensitive. Write each address in your policy in the checksummed form. An address in another case never matches, so an ALLOW policy does not allow the authorization and a DENY policy does not deny it.Raw payload signing with other encodings can also sign an authorization. A PAYLOAD_ENCODING_HEXADECIMAL payload can be the authorization hash (HASH_FUNCTION_NO_OP) or the authorization message (HASH_FUNCTION_KECCAK256). A PAYLOAD_ENCODING_TEXT_UTF8 payload can be the authorization hash if the delegate address makes that hash valid UTF-8. These payloads do not parse as authorizations, so eth.eip_7702_authorization causes an evaluation error, and a limit on activity.params.hash_function does not stop this. An ALLOW policy that permits these encodings can sign authorizations.If a key must not sign authorizations, allow raw payload signing only with activity.params.encoding == 'PAYLOAD_ENCODING_EIP712'. Do not deny encodings one at a time. This also blocks signMessage in @turnkey/viem and @turnkey/ethers, which signs PAYLOAD_ENCODING_HEXADECIMAL payloads with HASH_FUNCTION_NO_OP. No policy can stop a key that signs these payloads from signing an authorization. If you need both, use separate keys. To let a key sign only the authorizations that your policy allows, also allow PAYLOAD_ENCODING_EIP7702_AUTHORIZATION, but only for ACTIVITY_TYPE_SIGN_RAW_PAYLOAD and ACTIVITY_TYPE_SIGN_RAW_PAYLOAD_V2. Also, ACTIVITY_TYPE_ETH_SEND_TRANSACTION(_V2) requests that include an authorization sign one to the Turnkey gas delegate contract, and ACTIVITY_TYPE_ETH_UNDELEGATE_7702 signs one to the zero address.For examples, see Allow signing of EIP-7702 authorizations.

Type 4 transactions

ACTIVITY_TYPE_SIGN_TRANSACTION_V2 does not populate eth.eip_7702_authorization, and the policy engine does not expose the authorization list of a Type 4 transaction. Signing a Type 4 transaction does not delegate the signer, because each entry in the list has its own signature from its authority, over a different message format. To control Type 4 transactions, use eth.tx.type. For more information, see EIP-7702 (type 4) support.

Solana

Similarly, our Solana policy language (accessible via solana.tx) allows for control over signing Solana transactions. Note that there are some fundamental differences between the architecture of the two types of transactions, hence the resulting differences in policy structure.Notably, within our policy engine, a Solana transaction contains a list of Transfers, currently corresponding to native SOL transfers. Each transfer within a transaction is considered a separate entity. Each entity represents only top-level transfers that directly invoke supported System Program transfer instructions and do not include transfers performed indirectly inside other programs, or via unsupported System Program instructions.Similarly, the policy engine exposes solana.tx.spl_transfers, which contains only top-level SPL transfers using the supported Token and Token-2022 instructions Transfer, TransferChecked, and TransferCheckedWithFee. SPL transfers performed indirectly inside other programs or via unsupported Token and Token-2022 instructions are not detected and do not appear in this list.Here are some approaches you might take to govern transfers:

All transfers need to match the policy condition. Useful for allowlists (example)
Just one transfer needs to match the policy condition. Useful for blocklists (example)
Only match if there is a single transfer in the transaction, and that transfer meets the criteria (example). This is the most secure approach, and thus most restrictive.

Solana V1 config

See Solana transactions for wire-format requirements. solana.tx.version returns the wire version of unsignedTransaction as a case-sensitive string: LEGACY, V0, or V1. Sponsorship preserves this version. It is independent of the Turnkey activity version.The following fields expose the V1 transaction config in unsignedTransaction, before sponsorship fills missing values:

Policy field	Type	Unit	When omitted from the transaction
`solana.tx.priority_fee_lamports`	`int`	Total lamports	Returns zero
`solana.tx.compute_unit_limit`	`int`	Compute units (CU)	Evaluation error (`FieldNotUsed`)
`solana.tx.loaded_accounts_data_size_limit`	`int`	Bytes	Evaluation error (`FieldNotUsed`)
`solana.tx.heap_size`	`int`	Bytes	Evaluation error (`FieldNotUsed`)

priority_fee_lamports is a total priority fee, not a per-CU price. It excludes base fees and rent. An explicit zero remains zero in the policy value. An absent resource limit is unavailable, rather than zero or a runtime default. For legacy/V0 transactions, access to any of these four fields produces a FieldNotUsed evaluation error.

The policy engine does not short-circuit && or ||. A condition such as solana.tx.version == 'V1' && solana.tx.priority_fee_lamports <= 1000 still evaluates the fee field for legacy/V0 and produces an error. Use separate, fully scoped allow policies for the transaction versions you accept. See Evaluation errors and short-circuiting for more details.

Account address lookups

V0 transactions can reference onchain address lookup tables for account addresses. Legacy and V1 transactions have no ALTs; their address_table_lookups lists are empty. Turnkey surfaces any account address pulled from a lookup table as the literal string ADDRESS_TABLE_LOOKUP in Solana address fields (account_keys, instruction accounts, transfers, and spl_transfers). The solana.tx.address_table_lookups array indicates when lookups are present, but the specific addresses are not resolved. If you rely on allowlists or denylists of addresses, add a guard for this placeholder (for example, require solana.tx.address_table_lookups.count == 0 before comparing addresses, or explicitly deny when ADDRESS_TABLE_LOOKUP appears with something like solana.tx.transfers.any(t, t.to == 'ADDRESS_TABLE_LOOKUP')) so that dynamic lookups cannot bypass or unexpectedly fail your policy. See the address table lookup examples for examples on how to enforce this.

Program address lookups

Turnkey rejects Solana transactions where program addresses are resolved via address lookup tables. Program IDs must be statically defined in the transaction to enable static analysis of instructions without requiring onchain data lookups. If your transaction references a program via an address table lookup, the signing request will fail. Account addresses (non-program) can still be dynamically resolved via lookup tables as described above.See the Solana policy examples for sample scenarios.

Tron

Our Tron policy language (accessible via tron.tx) allows for policy control over signing Tron transactions. Our policy language supports the standard fields in a Tron transaction: https://developers.tron.network/docs/tron-protocol-transaction. To reference a Contract within a Transaction you should use tron.tx.contract[0].field_name in your policy where field_name is some field of the contract used in your transaction. While Tron only currently supports 1 contract per transaction this could change in the future, and we’re ready for it if it does! The policy engine currently supports the following Tron contract types:

TransferContract (TRX transfers)
TriggerSmartContract (Smart contract, including, but not limited to TRC-20, invocations)
DelegateResourceContract
UnDelegateResourceContract
FreezeBalanceV2Contract
UnfreezeBalanceV2Contract
AccountPermissionUpdateContract

See the Tron policy examples for sample scenarios.

Bitcoin

Our Bitcoin policy language (accessible via bitcoin.tx) allows for policy control over signing Bitcoin transactions.NOTE: While our SIGN TRANSACTION endpoint takes in a Partially Signed Bitcoin Transaction (PSBT) as required for signing context — our policy language supports only the standard fields inside a Bitcoin transaction: https://learnmeabitcoin.com/technical/transaction/#structureFor further reference on how Turnkey handles Bitcoin transactions in our policy-enabled transaction signing flow, check out this section in our Bitcoin Network Support page.See the Bitcoin policy examples for sample Bitcoin policies.

Spark

Spark-specific activities expose their request data through activity.params. The activity parameter table lists the top-level fields for all four Spark activities, and the structs below describe the nested values available to policies.Spark optional string fields evaluate to an empty string when omitted. SparkKeyDerivation supports five variants: identity, signing_leaf, deposit, static_deposit, and htlc_preimage. Only signing_leaf and static_deposit have variant-specific data, so those are the only variants with nested fields (see table below).At policy runtime, inactive variant fields evaluate to their type defaults rather than producing an evaluation error. For example, by default signing_leaf.leaf_id would an empty string, and static_deposit.index would return 0. These defaults do not indicate that the variant is active. We’d recommend checking SparkKeyDerivation.type before targeting a variant-specific field. Note: the type field is an empty string when unset, and 0 is a valid static deposit index.

Struct	Field	Type	Description
SparkSignatureRequest	`derivation`	SparkKeyDerivation	The key derivation for the signature request
	`message`	string	The message to sign
	`verifying_key`	string	The verifying key
	`operator_commitments`	list<SparkFrostCommitment>	Per-operator FROST commitments
	`adaptor_public_key`	string	The adaptor public key, or an empty string when omitted
SparkKeyDerivation	`type`	string	The active variant: `identity`, `signing_leaf`, `deposit`, `static_deposit`, or `htlc_preimage`; empty when unset
	`signing_leaf`	SparkSigningLeafDerivation	The signing-leaf variant fields
	`static_deposit`	SparkStaticDepositDerivation	The static-deposit variant fields
SparkSigningLeafDerivation	`leaf_id`	string	The leaf ID, or an empty string when `signing_leaf` is not active
SparkStaticDepositDerivation	`index`	int	The deposit index, or `0` when `static_deposit` is not active
SparkFrostCommitment	`id`	string	The commitment ID
	`hiding`	string	The hiding nonce commitment
	`binding`	string	The binding nonce commitment
SparkTransferPackage	`transfer_id`	string	The transfer ID
	`leaves`	list<SparkTransferLeaf>	The leaves included in the transfer
	`threshold`	int	The signing threshold
	`operator_recipients`	list<SparkOperatorRecipient>	The operator recipients
	`receiver_public_key`	string	The receiver public key
SparkTransferLeaf	`leaf_id`	string	The leaf ID
	`old_leaf_derivation`	SparkKeyDerivation	The old leaf derivation
	`new_leaf_derivation`	SparkKeyDerivation	The new leaf derivation
	`refund_signature`	string	The refund signature, or an empty string when omitted
	`direct_refund_signature`	string	The direct refund signature, or an empty string when omitted
	`direct_from_cpfp_refund_signature`	string	The direct-from-CPFP refund signature, or an empty string when omitted
SparkOperatorRecipient	`operator_id`	string	The operator ID
	`encryption_public_key`	string	The operator’s encryption public key
SparkClaimPackage	`leaves`	list<SparkClaimLeaf>	The leaves included in the claim
	`threshold`	int	The signing threshold
	`operator_recipients`	list<SparkOperatorRecipient>	The operator recipients
	`transfer_id`	string	The transfer ID
	`sender_identity_public_key`	string	The sender’s identity public key
SparkClaimLeaf	`leaf_id`	string	The leaf ID
	`ciphertext`	string	The encrypted leaf data
	`sender_signature`	string	The sender signature
SparkLightningReceivePackage	`threshold`	int	The signing threshold
	`operator_recipients`	list<SparkOperatorRecipient>	The operator recipients

See the Spark policy examples for sample policies covering receiver allowlists, FROST key derivations, static deposits, and receive-only delegated access.

Tempo

Our Tempo policy language (accessible via tempo.tx) allows for policy control over signing Tempo transactions. Tempo transactions natively support batched calls — a single transaction can contain one or more calls that execute atomically. The tempo.tx.calls list gives you access to each individual call, including its destination and raw input data.The tempo.tx namespace exposes the following transaction-level fields: chain_id, from, nonce, gas_limit, max_fee_per_gas, max_priority_fee_per_gas, fee_token, valid_before, and valid_after. Each call in tempo.tx.calls exposes: to, input, and function_signature.You can also govern Tempo transactions at the activity level using activity.params.type == 'TRANSACTION_TYPE_TEMPO', combined with other fields such as specific wallets, private keys, or consensus rules.See the Tempo policy examples for sample scenarios.

Secrets

Export secrets requests expose two keywords: secret, the secret being evaluated, and request_context, the string key-value pairs the request binds to that secret. Each secret in a batch is evaluated separately, and batch export is all-or-nothing. Read both by key and compare them with strings:

{
  "effect": "EFFECT_ALLOW",
  "condition": "activity.type == 'ACTIVITY_TYPE_EXPORT_SECRETS' && secret.static_properties['kind'] == 'creditCard' && request_context['domain'] == secret.static_properties['domain']"
}

Reading a key the request does not carry is an evaluation error. An erroring EFFECT_ALLOW policy does not allow, and an erroring EFFECT_DENY policy does not deny, so a deny policy on request_context can be skipped by omitting the key. Prefer allow policies when gating on request context.
An export that repeats a key within one secret’s request context is rejected before policy evaluation.

See Managed Secrets for how request context is set and signed, and the key management solutions for more policies.

​Grammar

​Operator precedence

​Keywords

​Consensus

​Condition

​Time

​Types

​Primitive

​Struct

​Nested structs

​Time expressions

​Timestamp

​CronSpan

​Activity breakdown

​Activity resources and actions

​Activity types by resource and action

​Activity kinds

​Choosing between type, kind, and resource + action

​Evaluation errors and short-circuiting

​Short-circuiting

​Example: one policy for two activities

​Guidelines

​Appendix

​Activity parameters

​Examples

​Root quorum activities

​Activities that target a root user

​Activities a user can perform on themselves

​Ethereum

​EIP-712

​EIP-7702

What a signed authorization allows

Type 4 transactions

​Solana

​Solana V1 config

​Account address lookups

​Program address lookups

​Tron

​Bitcoin

​Spark

​Tempo

​Secrets

Grammar

Operator precedence

Keywords

Consensus

Condition

Time

Types

Primitive

Struct

Nested structs

Time expressions

Timestamp

CronSpan

Activity breakdown

Activity resources and actions

Activity types by resource and action

Activity kinds

Choosing between `type`, `kind`, and `resource` + `action`

Evaluation errors and short-circuiting

Short-circuiting

Example: one policy for two activities

Guidelines

Appendix

Activity parameters

Examples

Root quorum activities

Activities that target a root user

Activities a user can perform on themselves

Ethereum

EIP-712

EIP-7702

Solana

Solana V1 config

Account address lookups

Program address lookups

Tron

Bitcoin

Spark

Tempo

Secrets