{"templateId":"markdown","versions":[{"version":"v1.43","label":"v1.43 LTS","link":"/pt-br/products/custody/governance/genesis/payload-reference","default":true,"active":true,"folderId":"714bb270"},{"version":"v1.42","label":"v1.42 STS","link":"/pt-br/products/custody/v1.42/governance/genesis/payload-reference","default":false,"active":false,"folderId":"714bb270"},{"version":"v1.41","label":"v1.41 STS","link":"/pt-br/products/custody/v1.41/governance/genesis/payload-reference","default":false,"active":false,"folderId":"714bb270"},{"version":"v1.34","label":"v1.34 LTS","link":"/pt-br/products/custody/v1.34/governance/genesis/payload-reference","default":false,"active":false,"folderId":"714bb270"},{"version":"v1.26","label":"v1.26 LTS","link":"/pt-br/products/custody/v1.26/governance/genesis/payload-reference","default":false,"active":false,"folderId":"714bb270"},{"version":"v1.19","label":"v1.19 LTS","link":"/pt-br/products/custody/v1.19/governance/genesis/payload-reference","default":false,"active":false,"folderId":"714bb270"},{"version":"v1.15","label":"v1.15 LTS","link":"/pt-br/products/custody/v1.15/governance/genesis/payload-reference","default":false,"active":false,"folderId":"714bb270"}],"sharedDataIds":{"sidebar":"sidebar-@l10n/pt-BR/products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition","tabs","tab"]},"type":"markdown"},"seo":{"title":"Genesis payload reference","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"genesis-payload-reference","__idx":0},"children":["Genesis payload reference"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this reference when you assemble the request body for the one-time Genesis API operation. For the design sequence that should come before the payload is finalized, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/governance/genesis"},"children":["Design your genesis"]},"."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can only run the Genesis operation once. The system has an anti-rewind mechanism that blocks any attempt to rerun it. Plan your initial domain structure, users, and policies carefully."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"genesis-payload-structure","__idx":1},"children":["Genesis payload structure"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this map to confirm the purpose of each section before you assemble the complete request body."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Payload section"},"children":["Payload section"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Requirement"},"children":["Requirement"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rootDomainSetup"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Mandatory top-level section"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rootDomainSetup"]}," object creates the root domain and the initial governance state that must exist before normal authenticated workflows are available."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["antiRewindMode"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Mandatory top-level field"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["antiRewindMode"]}," to set how strictly the notary applies anti-rewind protection: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["STRICT"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["BALANCED"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["DISABLED"]},". Version 1.43 and later require this field."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["id"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["alias"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["lock"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["governingStrategy"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["description"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["customProperties"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Fields in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rootDomainSetup"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Set the root domain identifier, alias, lock state, governing strategy, description, and custom properties."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["permissions.readAccess"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Part of ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rootDomainSetup"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["permissions.readAccess"]}," to define which roles can view each entity type in the domain."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["users"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Part of ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rootDomainSetup"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Add the first users and roles that can satisfy the policies required at launch. Embedded genesis users do not include a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["type"]}," field."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["policies"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Part of ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rootDomainSetup"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Add the policies that govern day-one administration, operations, fallback behavior, and recovery. Embedded genesis policies do not include a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["type"]}," field."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["descendants"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rootDomainSetup"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Add launch-critical subdomains in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["descendants"]},". Leave the array empty if all day-one governance state belongs in the root domain."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cryptoSetup"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional top-level section"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cryptoSetup"]}," to select the elliptic curves that the notary uses for API response signing, collection signing, and internal notary-to-vault messages."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tickers"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional top-level section"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tickers"]}," to define assets that must be available immediately after Genesis."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ledgers"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional top-level section"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ledgers"]}," to define ledger records that must be available immediately after Genesis. Each ledger entry includes ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["id"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["alias"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["parameters"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["customProperties"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["systemProperties"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional top-level section"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["systemProperties"]}," to include supported Genesis system properties. This example registers the state review authority public key used during anti-rewind file recovery."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["systemSignaturesPublicKey"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional top-level field"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["systemSignaturesPublicKey"]}," when system-signed API proposals must be available from launch with a pre-pinned key."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"complete-genesis-payload-example","__idx":2},"children":["Complete Genesis payload example"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The following example shows a complete, valid genesis request body. It does not include every optional top-level section."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","data-title":"Complete genesis request body","header":{"title":"Complete genesis request body","controls":{"copy":{}}},"source":"{\n    \"rootDomainSetup\": {\n        \"id\": \"e7eb7b63-d63b-4c30-9cca-d3b1ea7e46ad\",\n        \"alias\": \"Root domain\",\n        \"lock\": \"Unlocked\",\n        \"governingStrategy\": \"CoerceDescendants\",\n        \"permissions\": {\n            \"readAccess\": {\n                \"domains\": [\"platform-admin\", \"auditor\"],\n                \"users\": [\"platform-admin\", \"auditor\"],\n                \"endpoints\": [\"platform-admin\"],\n                \"policies\": [\"platform-admin\", \"policy-operator\", \"auditor\"],\n                \"accounts\": [\"platform-admin\", \"auditor\"],\n                \"transactions\": [\"platform-admin\", \"auditor\"],\n                \"requests\": [\"platform-admin\", \"policy-operator\", \"auditor\"],\n                \"events\": [\"platform-admin\", \"auditor\"]\n            }\n        },\n        \"description\": \"A genesis payload for the creation of the root domain\",\n        \"customProperties\": {},\n        \"users\": [\n            {\n                \"id\": \"e1fe3431-f899-427b-9e67-a75fb9fe5e57\",\n                \"alias\": \"platform-admin-1@example.com\",\n                \"publicKey\": \"MFkw...NfPfw/q9YW74Q==\",\n                \"roles\": [\"platform-admin\", \"policy-operator\"],\n                \"loginIds\": [\n                    {\"id\": \"platform-admin-1@example.com\", \"providerId\": \"harmonize\"},\n                    {\"id\": \"platform-admin-1@example.com\", \"providerId\": \"azure-ad\"}\n                ],\n                \"lock\": \"Unlocked\",\n                \"description\": \"Genesis platform administrator\",\n                \"customProperties\": {}\n            }\n        ],\n        \"policies\": [\n            {\n                \"id\": \"00000000-0000-0000-0000-000000000000\",\n                \"alias\": \"root-catch-all\",\n                \"rank\": 20,\n                \"scope\": \"Self\",\n                \"scriptingEngine\": \"Javascript_v0\",\n                \"condition\": {\n                    \"expression\": \"context.request.author.id == 'e1fe3431-f899-427b-9e67-a75fb9fe5e57'\",\n                    \"type\": \"Expression\"\n                },\n                \"workflow\": [\n                    {\"role\": \"platform-admin\", \"quorum\": 1, \"type\": \"RoleQuorum\"}\n                ],\n                \"lock\": \"Unlocked\",\n                \"description\": \"Fallback policy for root-domain launch operations\",\n                \"customProperties\": {}\n            }\n        ],\n        \"descendants\": []\n    },\n    \"cryptoSetup\": {\n        \"apiSigning\": \"Secp256r1\",\n        \"collectionSigning\": \"Secp256r1\",\n        \"messageSigning\": \"Ed25519\"\n    },\n    \"tickers\": [\n        {\n            \"id\": \"688b48e3-8ce1-4e01-b242-96f03ecb554a\",\n            \"ledgerId\": \"bitcoin-testnet\",\n            \"kind\": \"Native\",\n            \"name\": \"Bitcoin testnet\",\n            \"decimals\": 8,\n            \"symbol\": \"tBTC\",\n            \"ledgerDetails\": {\"properties\": {\"type\": \"Native\"}, \"type\": \"Bitcoin\"},\n            \"lock\": \"Unlocked\",\n            \"description\": \"Bitcoin testnet ticker\",\n            \"customProperties\": {}\n        }\n    ],\n    \"systemProperties\": [\n        {\n            \"value\": {\n                \"publicKey\": {\n                    \"value\": \"MFkw...HdVNyxTyl1plgAfh/Yg==\",\n                    \"type\": \"PublicKey\"\n                }\n            },\n            \"type\": \"StateReviewAuthorityProperty\"\n        }\n    ],\n    \"systemSignaturesPublicKey\": \"MFkw...systemSigningPublicKey==\",\n    \"antiRewindMode\": \"STRICT\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"validate-and-submit-the-payload-with-the-sdk","__idx":3},"children":["Validate and submit the payload with the SDK"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The server has no dry run for Genesis, so a mistake in the payload can leave an instance you can't bootstrap again. The SDKs validate a genesis payload on the client, without a network call, before you submit it. Validation reports errors in domains, users, and policies. It also reports advisory warnings, such as a missing catch-all policy. Server-side validation still applies."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The SDKs accept the payload that you assembled on this page, or a request that you build with the SDK's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GenesisBuilder"]},". For client setup, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/get-started/integrate-via-sdk"},"children":["Integrate via SDK"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Genesis call doesn't require authentication. The notary API public key that the SDK uses for ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/developer-experience/sdks/response-verification"},"children":["response verification"]}," doesn't exist until Genesis completes. Run the following examples with response verification turned off (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["RC_VERIFY_RESPONSES=false"]},"). After Genesis, pin the notary API public key in your configuration."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The following examples read the payload from ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["genesis-payload.json"]},", submit it, and then wait until the instance is ready:"]},{"$$mdtype":"Tag","name":"Tabs","attributes":{"size":"medium"},"children":[{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"API","disable":false},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Call ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST /v1/genesis"]}," with the request body. For the full procedure, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/deployment/install/first-time-installation#step-4-deploy-and-initialize-the-notary-genesis-call"},"children":["Installation and initialization"]},"."]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"TypeScript","disable":false},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["genesis.run"]}," validates the payload first and throws a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CustodyError"]}," if validation finds errors. To validate without submitting, call ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client.genesis.validate(payload)"]},"."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"typescript","header":{"controls":{"copy":{}}},"source":"import { readFileSync } from 'node:fs';\n\nconst payload = JSON.parse(readFileSync('genesis-payload.json', 'utf8'));\n\nawait client.genesis.run(payload);\n\n// Polls system information until the notary messaging public key is set.\nconst messagingPublicKey = await client.genesis.waitUntilReady({\n  timeoutMs: 300_000,\n});\n","lang":"typescript"},"children":[]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Java","disable":false},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the Java SDK, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["genesis().run"]}," doesn't validate the payload. Call ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["validate"]}," first."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"java","header":{"controls":{"copy":{}}},"source":"import com.google.gson.JsonObject;\nimport com.ripple.custody.models.CoreGenesisRequest;\nimport com.ripple.custody.namespaces.Genesis;\nimport java.nio.file.Files;\nimport java.nio.file.Path;\n\nCoreGenesisRequest request =\n    CoreGenesisRequest.fromJson(Files.readString(Path.of(\"genesis-payload.json\")));\n\nGenesis.ValidationResult result = client.genesis().validate(request);\nresult.getWarnings().forEach(System.err::println);\nif (!result.isValid()) {\n    throw new IllegalStateException(String.join(\"\\n\", result.getErrors()));\n}\n\nclient.genesis().run(request);\n\n// Polls system information until the notary messaging public key is set.\nJsonObject info = client.genesis().waitUntilReady(300);\n","lang":"java"},"children":[]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Python","disable":false},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["genesis.run"]}," validates the payload first and raises a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CustodyError"]}," if validation finds errors. To validate without submitting, call ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client.genesis.validate(payload)"]},"."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"python","header":{"controls":{"copy":{}}},"source":"import json\n\nwith open(\"genesis-payload.json\") as f:\n    payload = json.load(f)\n\nclient.genesis.run(payload)\n\n# Polls system information until the notary messaging public key is set.\nmessaging_public_key = client.genesis.wait_until_ready(timeout=300)\n","lang":"python"},"children":[]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The SDK ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["run"]}," methods don't return the Genesis response body. If you need values from that response, such as the notary public key for the vault configuration in ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/deployment/install/first-time-installation#step-4-deploy-and-initialize-the-notary-genesis-call"},"children":["Installation and initialization"]},", call the API directly. An HTTP 409 response means that the instance is already bootstrapped."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For a complete program that builds the request with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GenesisBuilder"]},", see example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["40"]}," (genesis bootstrap). To get the examples, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/developer-experience/sdks#examples"},"children":["Examples"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"root-domain-setup","__idx":4},"children":["Root domain setup"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This section is mandatory. The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rootDomainSetup"]}," section resembles a standard new domain creation payload. You specify the read permissions, users, and policies to create in the new ","Ripple Custody (Vault)"," instance."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For design guidance, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/governance/genesis/design-your-domains"},"children":["Design your domains"]},". For post-genesis domain operations, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/governance/domains/manage-domains"},"children":["Manage domains"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"governing-strategy","__idx":5},"children":["Governing strategy"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["During domain creation, you choose between these governing strategies:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CoerceDescendants"]},": The domain ignores the policies of its subdomains."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ConsiderDescendants"]},": The domain considers the policies of its subdomains."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This field is optional. If you do not specify a governing strategy during domain creation, the domain defaults to a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ConsiderDescendants"]}," strategy. Once created, you cannot change the governing strategy for the domain."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To execute a coercive intent within a locked domain, you must unlock the domain first."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"permissions","__idx":6},"children":["Permissions"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This access management section specifies the user roles that can view different entity types in the domain."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"users","__idx":7},"children":["Users"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This section is similar to a standard new user creation payload. Create enough users, with appropriate roles, to fulfill the defined policies."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Embedded genesis users do not include a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["type"]}," field. Role names in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["roles"]},", read-access lists, and workflow steps must use lowercase letters, digits, and hyphens."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Users follow these identifier guidelines:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Users within the same domain cannot have the same alias."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Users that have the same public key in different domains must have the same alias."]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","data-title":"Example user with four roles and Azure AD SSO","header":{"title":"Example user with four roles and Azure AD SSO","controls":{"copy":{}}},"source":"\"users\": [\n    {\n        \"id\": \"e1fe3431-f899-427b-9e67-a75fb9fe5e57\",\n        \"alias\": \"operator@ripple.com\",\n        \"publicKey\": \"MFkw...NfPfw/q9YW74Q==\",\n        \"roles\": [\"platform-admin\", \"policy-operator\", \"compliance\", \"auditor\"],\n        \"loginIds\": [\n            {\"id\": \"op1@company.com\", \"providerId\": \"harmonize\"},\n            {\"id\": \"op1@company.com\", \"providerId\": \"azure-ad\"}\n        ],\n        \"lock\": \"Unlocked\",\n        \"description\": \"A user\",\n        \"customProperties\": {}\n    }\n]\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For user planning guidance, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/governance/genesis/plan-your-first-users"},"children":["Plan your first users"]},". For the post-genesis user creation procedure, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/governance/users/manage-users-and-roles"},"children":["Manage users and roles"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"policies","__idx":8},"children":["Policies"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This section is similar to a standard new policy creation payload. Genesis policies are embedded in a domain's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["policies"]}," array and do not include a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["type"]}," field. If a policy should match all user-signed proposal types, omit ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intentTypes"]},"; do not set it to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["null"]},". Include a breakglass policy. For more information, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/governance/genesis/design-your-policies"},"children":["Design your policies"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"descendants","__idx":9},"children":["Descendants"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This section is optional. Specify subdomains as an array of domain objects inside the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["descendants"]}," property. For each subdomain, specify the same information as for the root domain."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"crypto-setup","__idx":10},"children":["Crypto setup"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This optional section specifies the cryptographic methods (elliptic curves) that the notary uses to create and verify signatures."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can specify different elliptic curves for different operations:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["apiSigning"]},": The curve used to sign payloads returned to users following a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET"]}," request."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["collectionSigning"]},": The curve for signing the roots of all collections' Merkle trees. This guarantees tamper-proof storage of the information. For more information, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/overview/security-model"},"children":["Security model"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["messageSigning"]},": The curve used to sign internal messages from the notary to the vault."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For all types of operations you can choose between ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Secp256r1"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Secp256k1"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Ed25519"]}," elliptic curves."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"tickers","__idx":11},"children":["Tickers"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This optional section includes a list of tickers and other assets available for blockchain ledgers. Use this section to provide a list of pre-validated tickers."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"ledgers","__idx":12},"children":["Ledgers"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This optional section includes ledger records that must be available immediately after Genesis. Each ledger entry includes an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["id"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["alias"]},", ledger-specific ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["parameters"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["customProperties"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"system-properties","__idx":13},"children":["System properties"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This optional section includes supported Genesis system properties. Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["StateReviewAuthorityProperty"]}," to register the public key of the state review authority. Use a public key in a standard ","Ripple Custody (Vault)"," accepted format: secp256k1, secp256r1, or Ed25519. Represent it as a Base64-encoded string."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The state review authority acts as a trusted party to confirm the authenticity of the system state if you need to recover the anti-rewind file (ARF)."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you do not specify this information during Genesis, register it as soon as possible afterwards. This allows you to recover your system in a disaster recovery scenario. For more information, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/operations-and-maintenance/backup-and-restore/register-a-key"},"children":["Register the state review authority public key"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"system-signed-intent-enablement-property","__idx":14},"children":["System-signed intent enablement property"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The system properties model also includes ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["NOTARY_SYSTEM_SIGNED_INTENTS_ENABLED"]},", whose value contains an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["enabled"]}," boolean. This property controls runtime processing of system-signed intents."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create or update this property only when the deployment is configured for system-signed intent processing, the Gateway system signing public key is registered, and the required policies are in place. System-signed intent configuration is enabled by default at deployment level, but processing remains disabled until this runtime property is set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["enabled: true"]},". For the operational sequence, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/deployment/reference/system-signed-intents"},"children":["System-signed intent configuration"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"anti-rewind-mode","__idx":15},"children":["Anti-rewind mode"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The mandatory top-level ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["antiRewindMode"]}," field sets how strictly the notary applies ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/overview/security/data-integrity-and-audit-trail#anti-rewind-modes"},"children":["anti-rewind protection"]},":"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["STRICT"]}," rejects any mismatch between the database and the notary's anti-rewind file. This is the behavior of versions before 1.43."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["BALANCED"]}," accepts a collection that the anti-rewind file has no record of, and rejects a conflicting one. Choose it if you plan to run a standby notary."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["DISABLED"]}," skips the anti-rewind check. It also lets you run a standby notary."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The examples on this page use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["STRICT"]},". For a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["BALANCED"]}," example, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/operations-and-maintenance/security-maintenance/notary-hot-failover#anti-rewind-modes"},"children":["Set up notary hot failover"]},"."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Required starting in version 1.43"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Version 1.43 rejects a Genesis request without ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["antiRewindMode"]},". Update any automation that builds the Genesis payload before you install version 1.43. This change doesn't affect platforms that completed Genesis on an earlier version. They run in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["STRICT"]}," mode by default, or in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["BALANCED"]}," mode if the notary runs with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["HMZ_NOTARY_ALLOW_EMPTY_COLS=true"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can change the mode after Genesis with a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_SetSystemProperty"]}," intent. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/operations-and-maintenance/security-maintenance/notary-hot-failover"},"children":["Set up notary hot failover"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"system-signatures-public-key","__idx":16},"children":["System signatures public key"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The optional top-level ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["systemSignaturesPublicKey"]}," field registers the public key used by the platform to verify system-signed intent proposals."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this field when system-signed API proposals must be available from launch with a pre-pinned key. In the default post-genesis path, Gateway mints the system signing keypair on first boot. Retrieve the active public key with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET /v1/system-signing/info"]},", then register it after launch with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["v0_RegisterTrustedPublicKey"]}," intent and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["purpose: \"SystemSignatures\""]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The system signing key is separate from user API signing keys, Notary collection signing keys, and messaging signing keys. For the request shape used by system-signed proposals, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/governance/intents/intent-request-structure#system-signed-proposal-request-body"},"children":["Intent request structure"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"genesis-events","__idx":17},"children":["Genesis events"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you run the Genesis operation, ","Ripple Custody (Vault)"," includes two properties in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GenesisSucceeded"]}," event:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["genesis"]},": A data structure holding the notary-signed original Genesis payload."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["createdEntitiesReferences"]},": Key information on the data created."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For more information, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/pt-br/products/custody/reference/events-and-webhooks/event-payload-reference#genesis-event"},"children":["Event management > Genesis event"]},"."]}]},"headings":[{"value":"Genesis payload reference","id":"genesis-payload-reference","depth":1},{"value":"Genesis payload structure","id":"genesis-payload-structure","depth":2},{"value":"Complete Genesis payload example","id":"complete-genesis-payload-example","depth":2},{"value":"Validate and submit the payload with the SDK","id":"validate-and-submit-the-payload-with-the-sdk","depth":2},{"value":"Root domain setup","id":"root-domain-setup","depth":2},{"value":"Governing strategy","id":"governing-strategy","depth":3},{"value":"Permissions","id":"permissions","depth":3},{"value":"Users","id":"users","depth":3},{"value":"Policies","id":"policies","depth":3},{"value":"Descendants","id":"descendants","depth":3},{"value":"Crypto setup","id":"crypto-setup","depth":2},{"value":"Tickers","id":"tickers","depth":2},{"value":"Ledgers","id":"ledgers","depth":2},{"value":"System properties","id":"system-properties","depth":2},{"value":"System-signed intent enablement property","id":"system-signed-intent-enablement-property","depth":3},{"value":"Anti-rewind mode","id":"anti-rewind-mode","depth":2},{"value":"System signatures public key","id":"system-signatures-public-key","depth":2},{"value":"Genesis events","id":"genesis-events","depth":2}],"frontmatter":{"seo":{"title":"Genesis payload reference"}},"lastModified":"2026-10-09T10:42:29.000Z","isTranslationFallback":true,"pagePropGetterError":{"message":"","name":""}},"slug":"/pt-br/products/custody/governance/genesis/payload-reference","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}