{"templateId":"markdown","versions":[{"version":"v1.40","label":"v1.40 STS","link":"/products/custody/deployment/install/cold-bridge-deployment","default":true,"active":false,"folderId":"c15a2701"},{"version":"v1.39","label":"v1.39 STS","link":"/products/custody/v1.39/deployment/install/cold-bridge-deployment","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.38","label":"v1.38 STS","link":"/products/custody/v1.38/deployment/install/cold-bridge-deployment","default":false,"active":true,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/deployment/install/cold-bridge-deployment","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/deployment/install/cold-bridge-deployment","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/deployment/install/cold-bridge-deployment","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/deployment/install/cold-bridge-deployment","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Deploy a cold bridge","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"deploy-a-cold-bridge","__idx":0},"children":["Deploy a cold bridge"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this page when deploying cold vault operations. The cold bridge is required only for cold storage deployments."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-the-cold-bridge-does","__idx":1},"children":["What the cold bridge does"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The cold bridge runs on the air-gapped workstation and provides:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A local UI for cold vault operations."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A local API for uploading, decoding, and downloading operation payloads."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Optional payload encryption and decryption for ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," files."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A local endpoint that the vault component polls for signing work."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The cold bridge is stateless and uses in-memory storage for workloads. It does not require a database or persistent volume."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For workstation requirements, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/deployment/planning/cold-vault-workstation"},"children":["Cold vault workstation planning"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"deployment-flow","__idx":2},"children":["Deployment flow"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart TD\n Plan[\"Plan air-gapped workstation\"]\n Install[\"Install cold bridge and vault stack\"]\n Configure[\"Configure cold bridge and vault\"]\n Register[\"Register cold vault\"]\n Handshake[\"Complete first-time handshake\"]\n Test[\"Test export, sign, import\"]\n\n Plan --> Install --> Configure --> Register --> Handshake --> Test\n","diagramHtml":"

Plan air-gapped workstation

Install cold bridge and vault stack

Configure cold bridge and vault

Register cold vault

Complete first-time handshake

Test export, sign, import

","diagramHtmlDark":"

Plan air-gapped workstation

Install cold bridge and vault stack

Configure cold bridge and vault

Register cold vault

Complete first-time handshake

Test export, sign, import

"},"children":["flowchart TD\n Plan[\"Plan air-gapped workstation\"]\n Install[\"Install cold bridge and vault stack\"]\n Configure[\"Configure cold bridge and vault\"]\n Register[\"Register cold vault\"]\n Handshake[\"Complete first-time handshake\"]\n Test[\"Test export, sign, import\"]\n\n Plan --> Install --> Configure --> Register --> Handshake --> Test\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-prepare-the-air-gapped-workstation","__idx":3},"children":["Step 1: Prepare the air-gapped workstation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before installing the cold bridge:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Build the workstation according to ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/deployment/planning/cold-vault-workstation"},"children":["Cold vault workstation planning"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify that network connectivity is disabled."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Install the hardened operating system from verified media."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Install KMS or HSM drivers, if applicable."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Prepare approved transfer media for moving ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," files."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-install-cold-bridge-and-vault-components","__idx":4},"children":["Step 2: Install cold bridge and vault components"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Transfer the cold bridge software, vault stack components, and configuration files to the air-gapped workstation using approved physical media."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Install the components using the deployment method agreed for your environment. The cold bridge and vault are deployed together so the vault can poll the local cold bridge endpoint for signing work."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-configure-payload-encryption-if-used","__idx":5},"children":["Step 3: Configure payload encryption, if used"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If your deployment enables cold bridge payload encryption, configure the same passphrase on:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The cold bridge."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The online system configuration used to process cold bridge payloads."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the passphrase differs between the air-gapped workstation and the online system, operation payloads cannot be decrypted."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-4-verify-the-cold-bridge","__idx":6},"children":["Step 4: Verify the cold bridge"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After startup, call the status endpoint from the air-gapped workstation:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"curl -X GET \"{ColdBridgeURL}/v1/feed/status\"\n","lang":"sh"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Expected response shape:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"accountToSign\": 0,\n \"accountSigned\": 0,\n \"transactionToSign\": 0,\n \"transactionSigned\": 0,\n \"manifestToSign\": 0,\n \"manifestSigned\": 0\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-5-register-the-cold-vault","__idx":7},"children":["Step 5: Register the cold vault"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Register the cold vault with the standard vault registration process:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/identity-and-access/vault-management/manage-vaults#register-a-vault-in-the-ui"},"children":["Register a vault in the UI"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/identity-and-access/vault-management/manage-vaults#register-a-vault-with-the-api"},"children":["Register a vault with the API"]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After registration, the vault can appear as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Pending"]}," because the cold vault cannot automatically connect to the online deployment."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-6-complete-the-vault-handshake","__idx":8},"children":["Step 6: Complete the vault handshake"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Complete the manual handshake by transferring the initial vault payload from the cold bridge to the online system:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["On the air-gapped workstation, download the payload from the cold bridge."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Transfer the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," file to the online environment."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Import the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," file into ","Ripple Custody","."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify that the vault status is ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Completed"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For exact UI and API steps, see:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/identity-and-access/vault-management/cold-vault-setup-ui#complete-the-first-time-vault-handshake"},"children":["Complete the first-time vault handshake in the UI"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/identity-and-access/vault-management/cold-vault-setup-api#complete-the-first-time-vault-handshake"},"children":["Complete the first-time vault handshake with the API"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-7-test-cold-vault-operations","__idx":9},"children":["Step 7: Test cold vault operations"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before using the cold vault for production operations:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Create a test account using the cold vault."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Export pending operations from the online environment."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Transfer the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," file to the air-gapped workstation."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Upload the file to the cold bridge."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm that the operation appears in the signing queue."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Download the signed ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," file."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Transfer the signed file back to the online environment."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Import the signed operations and verify the result."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"cold-bridge-api-reference","__idx":10},"children":["Cold bridge API reference"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Endpoint"},"children":["Endpoint"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Method"},"children":["Method"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v1/feed/status"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Get signing status counters."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v1/feed/upload"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Upload operations to be signed."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v1/feed/download"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Download signed operations or handshake payloads."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v1/feed/decode"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Decode a payload for inspection before signing."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For day-to-day operation steps, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/identity-and-access/vault-management/cold-vault-setup-api"},"children":["Process cold vault operations with the API"]},"."]}]},"headings":[{"value":"Deploy a cold bridge","id":"deploy-a-cold-bridge","depth":1},{"value":"What the cold bridge does","id":"what-the-cold-bridge-does","depth":2},{"value":"Deployment flow","id":"deployment-flow","depth":2},{"value":"Step 1: Prepare the air-gapped workstation","id":"step-1-prepare-the-air-gapped-workstation","depth":2},{"value":"Step 2: Install cold bridge and vault components","id":"step-2-install-cold-bridge-and-vault-components","depth":2},{"value":"Step 3: Configure payload encryption, if used","id":"step-3-configure-payload-encryption-if-used","depth":2},{"value":"Step 4: Verify the cold bridge","id":"step-4-verify-the-cold-bridge","depth":2},{"value":"Step 5: Register the cold vault","id":"step-5-register-the-cold-vault","depth":2},{"value":"Step 6: Complete the vault handshake","id":"step-6-complete-the-vault-handshake","depth":2},{"value":"Step 7: Test cold vault operations","id":"step-7-test-cold-vault-operations","depth":2},{"value":"Cold bridge API reference","id":"cold-bridge-api-reference","depth":2}],"frontmatter":{"seo":{"title":"Deploy a cold bridge"}},"lastModified":"2026-07-27T10:10:43.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/v1.38/deployment/install/cold-bridge-deployment","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}