Add missing chains
A user’s wallet set is fixed at /create time, so a user created before a chain was configured has no address on it. /extend derives and inserts wallets for the missing chains only.
The server proves ownership before adding anything: the mnemonic must derive one of the user’s stored addresses (otherwise 403), and the password must decrypt an existing keystore entry (otherwise 401).
Idempotent — when nothing is missing you get added: []. The mnemonic is never returned or stored.
Authentication
A 15-minute token from /auth. Required on every endpoint except /auth.
Headers
Correlation id. Generated if omitted, echoed on every response, and written to the audit log. /send is the exception — there it is required, and it doubles as the idempotency key.
Optional. When present it overrides any userId in the body.
Request
24-character hex id, returned by /create.
bip39 seed phrase, validated with bip39.validateMnemonic.
Keystore password (AES-256-GCM, scrypt KDF). Unrecoverable — required by /send and /extend.
Response
Echo of the inbound X-Request-Id, or a generated one.