Platform overview
RWAT coordinates asset registration, legal rights, evidence, participant eligibility, approvals, settlement and lifecycle events. IBDCP binds each material event to an authorised actor, current policy and verifiable evidence.
Wallet access flow
- RWAT creates a short-lived request with a verified callback, state and PKCE challenge.
- The user authenticates in IBDCP Wallet and completes any required OTP.
- The wallet displays the domain, account, role and scopes for approval.
- RWAT exchanges the one-time code, verifies it and creates a role-bound session.
Canonical lifecycle
Integrations submit versioned events containing a resource identifier, event type, actor, authority, evidence references, policy result, timestamp and idempotency key. State changes are accepted only when required evidence and approvals are present.
The common lifecycle is register, structure, approve, invest, manage and exit.
API quick start
Begin with the OpenAPI specification and API Terms. Public endpoints include service health and public assurance. Business endpoints require approved credentials and scopes.
GET /api/v1/health
Accept: application/json
GET /api/v1/public/assurance
Accept: application/jsonSecurity model
Controls include wallet-bound authentication, PKCE, short-lived single-use authorisations, role and organisation policy, separation of duties, signed requests, replay protection, idempotency, restricted evidence access and auditable decisions. Clients fail closed when identity, policy or evidence cannot be verified.
Integration readiness
- Separate credentials and callback URLs by environment.
- Keep secrets server-side and rotate them regularly.
- Implement idempotent retries and retain correlation identifiers.
- Test expiry, replay, role denial, policy denial and dependency failures.
- Complete security, privacy and operational acceptance before production.