Compliance APIs that match operational reality.
Every operation in Covalent is reachable through stable APIs and signed events, while the console uses the same models for analyst and compliance workflows.
REST API
Cursor-paginated endpoints for transfers, wallets, VASP search, cases, reports, and rules.
Signed webhooks
Lifecycle events signed with HMAC-SHA256, retried automatically, and replayable from logs.
Scope based keys
Per-environment keys with scopes, limits, usage tracking, rotation, and revocation.
Test / Live environments
Separate providers, integrations, rules, webhooks, customers, and transfers.
RBAC + audit
Admin, compliance, analyst, and viewer roles over auditable state changes.
Operational visibility
Queues, orphan detection, conflict resolution, webhook history, and PII-scrubbed activity.
Product teams get a stable interface.
Covalent owns protocol exchange, rules evaluation, and audit state behind the API boundary.
POST /v2/transfers
{
"direction": "outgoing",
"asset": "BTC",
"amount": "0.5",
"network": "bitcoin",
"originator": { "customerId": "cus_123" },
"beneficiary": { "vaspId": "did:vasp:0x..." }
}Subscribe to the lifecycle you actually operate.
transfer.created
transfer.accepted
transfer.rejected
transfer.completed
transfer.held
transfer.failed
case.created
case.updated
case.resolved
screening.complete
report.generated
report.filed
Automate compliance without duplicating the console.
Use the API for product workflows and the console for operations, backed by one shared model.