Vault view keys & NAV attestations

Saxeo Vault seals everything sensitive by default: declared value, yield, maturity, positions, all readable only by the issuer or the holder. That is the right default, and it is the wrong answer the moment a regulator or an auditor needs to see the book. View keys resolve that without weakening the default: privacy by default, transparency by permission. The issuer grants a specific party read access to specific fields, for a bounded time, and revokes it at will.

Granting a scoped view

POST /v1/vault/assets/{id}/view-grant (session-authed, issuer only) mints a view key over exactly the fields you name.

curl https://www.saxeonetwork.tech/__api/v1/vault/assets/$ASSET_ID/view-grant \
-H "Authorization: Bearer $SAXEO_SESSION_TOKEN" \
-H "Content-Type: application/json" \
-d '{
  "scope": ["holders", "value", "nav"],
  "label": "Q3 auditor: Ernst example LLP",
  "expires_in_days": 30
}'

scope: the fields the grantee may read, any of holders, value, yield, maturity, nav, documents. Nothing outside the scope is ever returned.
label: a note to yourself naming who this grant is for.
expires_in_days: when the view key stops working.

{
  "grant_id": "vg_7c02…",
  "token": "vk_…",
  "url": "https://www.saxeonetwork.tech/__api/v1/vault/view/vk_…",
  "note": "The token is shown once. Share it over a secure channel; it grants read access to the scoped fields until it expires or is revoked."
}

The token is returned exactly once. The grantee needs no Saxeo account: they read the granted fields at the public endpoint, and see only what the scope allows.

# The grantee, with only the token:
curl https://www.saxeonetwork.tech/__api/v1/vault/view/$VIEW_TOKEN

{
  "asset": { "id": "…", "name": "Series A receivables", "type": "receivable" },
  "scope": ["holders", "value", "nav"],
  "holders": [{ "wallet": "0x…", "position_usd": 380000 }],
  "value": { "declared_usd": 500000 },
  "nav": { "nav_usd": 496200, "as_of": "2026-08-30T00:00:00Z" },
  "chain_head": "a91f…",
  "expires_at": "2026-09-30T00:00:00Z"
}

A field outside the granted scope is simply absent from the response. The response also carries the asset's current chain_head, so a grantee can cross-check what they were shown against the public event chain and confirm the record is intact.

Managing grants

GET /v1/vault/assets/{id}/view-grants (issuer only) lists the live grants on an asset with their scope, label, and expiry. DELETE /v1/vault/view-grants/{id} revokes one immediately; the token stops resolving on the next request. Grants are per-asset and independent, so a grant to one auditor never widens what another can see.

NAV attestations

An auditor often needs one number on the record rather than the whole book: the net asset value, and the reserves the issuer says stand behind it. POST /v1/vault/assets/{id}/nav (issuer only) records both — as the issuer's own declaration, sealed, hash-chained, and signed as a declaration. Saxeo counts nothing and confirms nothing here; read what it does and does not say before you hand one to a counterparty.

curl https://www.saxeonetwork.tech/__api/v1/vault/assets/$ASSET_ID/nav \
-H "Authorization: Bearer $SAXEO_SESSION_TOKEN" \
-H "Content-Type: application/json" \
-d '{
  "nav_usd": 496200,
  "reserves_usd": 500000,
  "as_of": "2026-08-30T00:00:00Z",
  "note": "August month-end mark"
}'

The gateway seals nav_usd and reserves_usd at rest, appends a hash-chained nav_attestation event to the asset's ledger (so it anchors to Solana with everything else), and returns a signed proof:

{
  "proof": "eyJ2Ijox…",
  "signature": "0x4f8c…",
  "signer": "0xA1b2…9F",
  "payload": {
    "v": 1,
    "type": "nav-attestation",
    "asset_id": "…",
    "seq": 7,
    "nav_micro_usd": 496200000000,
    "reserves_micro_usd": 500000000000,
    "solvent": true,
    "as_of": "2026-08-30T00:00:00Z",
    "commitment": "a91f…",
    "trust_model": "attested: signed by the Saxeo registry over its hash-chained ledger; publicly anchored when an anchor is present; not zero-knowledge",
    "issued_at": "2026-08-30T09:14:02Z"
  },
  "verify": "POST /v1/receipts/verify with {receipt: proof, signature}"
}

What the NAV proof says

The proof carries the figures the issuer typed, and a solvent flag, without publishing the book. Be exact about that flag: solvent is true when the declared reserves_usd is greater than or equal to the declared nav_usd. It is arithmetic over two numbers an issuer entered in a form. Saxeo does not count the reserves, contact a custodian, price the assets, or check that either figure corresponds to anything that exists — so the flag records an issuer asserting solvency, signed as their assertion. Send no reserves_usd and the proof carries the NAV with no solvent field at all, rather than a claim it cannot support.

What the signature does establish is narrower, and still worth having: that these figures were declared for this asset at this time and sealed under commitment (the sha256 of the sealed figures), that the same commitment was appended to the asset's event chain as a nav_attestation event — a chain from which nothing can be quietly removed or reordered — and, once the anchor pass runs, that the chain's root is published on a public chain. seq is this asset's NAV sequence number, so a skipped mark shows up as a gap and a re-stated one as a later entry, both of them permanent. A counterparty verifies the signature through the same public receipt verify endpoint as everything else, learns the declared NAV, and learns nothing about individual positions, counterparties, or reserve composition unless you separately grant a view over those fields.

A backer who needs the figure checked still has to do what an auditor does, with the view key you grant them. A declared backing figure is never proof of reserves — the same rule Saxeo Attestation states, and it applies here identically.

Honest scope

Everything here is registry infrastructure, not custody or audit. The figures are issuer-declared — the solvent flag included, since it is only a comparison of two declared numbers. The registry seals them, chains them so they are tamper-evident, anchors them publicly, and proves the record's integrity. It does not hold the assets, verify that the reserves exist, or appraise the NAV. A proof means Saxeo's signature is genuine, the ledger it signed over is intact, and its anchors are on a public chain. It does not mean Saxeo has independently confirmed what an issuer stated. That confirmation is what an auditor does with the view key you grant them.