Skip to main content
An operator vault is a bank issuer’s own earning product. Verified investors deposit the vault’s settlement asset (a stablecoin such as USDC) and receive vault shares. The operator is the lender of record on its external-securities lending markets and allocates the pooled funds into those markets as the liquidity provider. Share price covers idle funds plus the vault’s value across every market it funds, so it rises as the markets pay interest. Trusset holds no role on any vault. Each vault belongs to the issuer operating it, and every response names that operator in operatedBy. Show the operator wherever you show the vault. This API covers the investor side: discovering vaults, reading positions, depositing, and redeeming. Creating a vault, allocating into markets, pausing deposits, lowering the fee, and publishing are operator actions done in the Issuer Portal.

​
Base Path

Every request authenticates with an instance API key in the X-API-Key header. See Authentication. The instance bound to your key determines which vaults you see: your own instance’s vault, plus every vault a bank has published on your network.

​
Redemptions

An operator can pause deposits. Nothing can pause a redemption. When market utilization blocks part of the vault’s value, a redemption pays out what liquidity allows and the remaining shares stay in the wallet. See Redeem. Size a redemption against redeemableNow on Get Vault, not against idleAssets. Idle funds are only the part the vault holds loose. redeemableNow adds, for each market the vault funds, whichever is smaller: what the vault holds there, and what that market has uncommitted. Redeem answers the same question for one specific redemption, with willFillFully and expectedPayout.

​
When a deposit is refused and a redemption is not

The asymmetry is deliberate. A deposit issues shares at a price, so it must not happen against a number the vault cannot stand behind. A redemption returns a holder’s own money, so nothing on that path may close the door. A market the vault funds can go dark. When that happens the vault cannot total its book, and deposits are refused with VAULT_BOOK_INCOMPLETE until it answers again or the operator writes it off. Redemptions carry on, quoted from totals read without the completeness flag. The price they get understates the vault by an unknown amount, priceWarning says so, and the difference stays with the holders who wait. A vault can also end up with shares in issue against nothing. Deposits into it are refused with VAULT_WIPED_OUT, because they would be absorbed by the existing holders rather than buying a position. Such a vault cannot be recapitalized and the operator has to run a new one.

​
Failed reads

The chain state on Get Vault carries a readFailed flag. When it is true the figures are absent, not zero. Keep your last verified values on screen and retry. A vault whose read failed still holds every deposit it held a minute ago.

​
Response envelope

On failure, success is false, data is null, and error carries code and message. Schema failures use VALIDATION_ERROR with error.details listing each offending field. metadata.requestId always equals the X-Request-Id response header, so you can quote it when reporting a problem. Always branch on success rather than on the HTTP status alone.

​
Writes

Every write endpoint returns unsigned transaction data for a wallet you control to sign and broadcast. Nothing is submitted on your behalf. After broadcasting, report the hash to Confirm Transaction. The backend verifies the receipt on-chain before recording anything.