# Dashboard + API

One platform, two doors — everything operable by humans and by code, under one set of rules.

Platforms often ship a dashboard for people and an API for machines, and the two drift: a policy
applies on one surface and not the other, and the safe path becomes whichever one the team happens
to use. Rules that only hold when a human is watching are not rules. Vaultody keeps one policy
engine, one approval path and one audit trail behind both surfaces.

## The dashboard

Vault, team, policy, automation and transaction management in the browser: create vaults and vault
accounts, derive addresses, raise a transfer, edit rules, invite people, read history.

- Sensitive actions do not complete because someone clicked them — 26 action types are
  approval-gated, policy edits among them.
- Transaction history exports as CSV, per vault and per period.

## The API

The same operations programmatically, with per-client keys.

- Every call carries an HMAC-SHA256 signature over its body and a timestamp, so a replayed or
  tampered request is rejected before it reaches business logic.
- Creating or changing a key is itself an approval-gated action.
- Idempotency keys on transaction creation, so a retry cannot double-spend.
- An explicit version header pins your integration while defaults move on.
- Signed webhook events push each state change, so nothing has to poll.

## Where the two surfaces are not identical

Entry runs on the dashboard and the mobile co-signer, with no webhook endpoints and no server
co-signing key — if your integration is code-first, start at Standard. API requests are included
from Standard, with three webhook endpoints on Standard and five on Business.

## FAQ

**Can everything be done from the API?**
Vaults, accounts, addresses, assets, transaction requests and webhooks are managed from either
surface, and both go through the same policy engine. Where a rule requires human approval, that
approval happens on the mobile co-signer regardless of where the request came from.

**Does an API key bypass policy?**
No. It is bounded by its role and by the policy engine; above your threshold the request waits for
people, whichever surface raised it.

## Related

- [API Signer](/features/api-signer)
- [Webhook Notifications](/features/webhooks)
- [Policy Engine](/features/policy-engine)
- [Pricing](/pricing)