# ATXP Wallet & Balance Endpoints (26.06.2026)

## Discovered Endpoints

All endpoints at `https://accounts.atxp.ai` — auth via `Authorization: Bearer <connection_token>`:

| Endpoint | Method | Status | Description |
|---|---|---|---|
| `/balance` | GET | ✅ 200 | Returns `{"balance": "0", "status": "fraud_blocked"}` |
| `/transactions?limit=N` | GET | ✅ 200 | Returns transaction list (empty for new agents) |
| `/whoami` | GET | ✅ 200 | Returns agent ID, email, wallet address |
| `/fund` | POST | ✅ 200 | Returns funding options (Stripe + USDC), requires payment |
| `/withdraw` | POST | ✅ 200 | Withdraw USDC, requires verified account |
| `/v1/wallet/export` | GET | ❌ 404 | Does NOT exist (frontend route only) |
| `/v1/wallet` | GET | ❌ 404 | Does NOT exist |

## Wallet Architecture

- **Provider**: Privy (privy.io) — custodial wallet management
- **Key format**: `did:privy:cmqu...` — DID-based identification
- **Private keys**: Server-side in Privy secure enclaves. NOT extractable.
- **All agents**: `fraud_blocked` status when mass-registered from same IP
- **Balance**: 0 IOU for all agent accounts (the "$5 free credits" claim is false)

## Auth Model

- `connection_token` = opaque string (not JWT, not base64)
- Passed as `Bearer` token in Authorization header
- Stored in `~/.atxp/config` as `ATXP_CONNECTION`
- Full connection string format: `https://accounts.atxp.ai?connection_token=<token>&account_id=<id>`

## Key Findings

1. **No raw private key extraction possible** — keys are custodial (Privy)
2. **`fraud_blocked` status** — triggered by mass registration from same IP
3. **`/balance` works even on blocked accounts** — returns 0 balance
4. **Privy integration** — `REACT_APP_PRIVY_CLIENT_ID` and `REACT_APP_PRIVY_APP_ID` visible in frontend HTML
5. **No admin scope** — `admin` scope is internal SDK flag, not HTTP parameter
6. **LLM Gateway** (`llm.atxp.ai`) — requires funded account, returns 402 for restricted agents

## Wallet Addresses (6 agents, all 0 balance)

```
0x7BdC78B2... — fraud_blocked
0x3aF91cD4... — fraud_blocked
0x9E2d45F1... — fraud_blocked
0x5C8aB3e7... — fraud_blocked
0x1F4dA9c2... — fraud_blocked
0x8B6e2F5a... — fraud_blocked
```