A permission group acts as a set of rules for how an organization and its resources can be accessed. Permission groups are created independently of API keys, and new permission groups must be created prior to making an API key.
Each permission group has a name, a description and a set of permissions which can be applied to your organization's vaults. Updating, creating and deleting permissions groups require a quorum of approvals. After creation, a permission group can be freely assigned to an unlimited number of API keys.
Each API key inherits its permissions from the associated permission group. When the permission group is updated, all API keys associated with it will inherit the updated permission set. If a permission group is deleted, all associated API keys will no longer work.
Each organization is created with a default permission group that allows read-only access. This permission group may be modified or deleted at any time, and no API keys are created by default with this permission group.
| Permission | Description |
|---|---|
| Read vault activity (READ) | See an overview of your vault(s) and wallets. Read vault details, balances, asset types, transaction history and deposit addresses. |
| Create address (CREATE_DEPOSIT_ADDRESS) | Receive deposits in the vault from external sources. Create and read deposit addresses. |
| Transfer funds (INTERNAL_TRANSFER) | This permission is configurable to enable an API key endowed with this permission to either 1) Transfer funds to any Anchorage Digital institutional account, including those outside of your organization or 2) Transfer funds to any blockchain address not custodied by Anchorage Digital that has gone through quorum approval. |
There are also special vault permissions for enabled by Anchorage Digital on a per-organization basis:
Additionally, there are global permissions which apply to the entire organization:
| Permissions | Description |
|---|---|
| Initiate withdrawals (INITIATE_WITHDRAWAL) | Initiate withdrawals to external destinations. All withdrawals require quorum approval through the Anchorage Digital mobile app. |
| Read sub-accounts | View read-only information for program customer subaccounts Note: Only visible for ledger clients. |
| Write sub-accounts | Create and manage program customer sub-accounts. Note: Only visible for ledger clients. |
| Execute trades (TRADE) | Request for quotes (RFQ) from the Anchorage Digital trading desk. Create and accept quotes. Read data of trades and settlements created by this key. |
| Read trade activity (READ_TRADE) | Read trade activity and trade settlements data of your organization. |
| Read lending activity (LENDER_READ) | Read lending activity of your organization. |
| Read facility data (FACILITY_ONLY) | Read lending facility data. |
| Read deposit attribution activity (READ_DEPOSIT_ATTRIBUTION) | Read deposit attribution activity of your organization. |
| Manage deposit attributions (DEPOSIT_ATTRIBUTION) | Read deposit attribution activity of your organization. Perform deposit attributions. |
| Configure Webhook | Create and configure Webhook notifications |
| Initiate Staking and Unstaking | Initiate Staking and Unstaking. All activities require quorum approval through the Anchorage Digital mobile app |
| Manage Trusted Destinations | Create, edit and delete Trusted Destinations through the API |
Example workflow: Allow transfers from specific vaults
To create an API key with the ability to transfer funds from an Anchorage Digital vaults or wallet, a permission group must first be created with the Transfer funds permission for the desired source vaults. Creating this permission group requires a quorum of approvals on the Anchorage Digital iOS app. Once the creation is confirmed, any number of API keys may be created with this permission group in the Anchorage Digital web dashboard under the API 2.0 section.
To add additional permissions to the API key, update the associated permission group through the Anchorage Digital Web Dashboard. To revoke any permissions, the individual API key may be revoked, or the permission group may be updated or deleted to remove Transfer access.