Addresses

Issuing, listing, rotating and revoking opaque addresses, and setting the standing terms on which they receive.

Requires a member credential.

`POST /addresses`

{
  "subject_id": "sub_9f2c41a8",
  "profile": "directory",
  "discoverability": "network",
  "is_primary": true
}

{
  "id": "addr_71bc",
  "address": "path:4a91c2f7e8d3",
  "profile": "directory",
  "discoverability": "network"
}

profile is directory (reachable through a network's index) or relationship (reachable only by a party that already knows where to ask, and requiring no membership).

The address is attached to the subject, never to an account. An address bound to a wallet dies with the wallet, and portability becomes a slogan.

`POST /addresses/{id}/rotate`

{ "address": "path:b82f1c04d7a9", "rotated_from": "addr_71bc" }

Issues a new address for the same subject, revokes the old one, and keeps the link between them.

Revoked, not deleted. A payer holding a saved destination deserves "this moved" rather than "this never existed" — the second reads as an error on their side, and they will call support about it.

Use it when an address has been shared too widely, or when a customer asks for a fresh one. The underlying identity is untouched.

`POST /addresses/{id}/revoke`

{ "id": "addr_71bc", "revoked": true }

Resolution then answers path.address.revoked — distinct from not_found, because the payer needs the difference between ask for a current address and you have the wrong destination.

`PUT /addresses/{id}/standing-intent`

The permanent terms on which the address receives.

{
  "accepts": [
    { "asset": "USDC", "chain": "base" },
    { "rail": "mobile_money", "currency": "XOF" }
  ],
  "limits": { "max_single": "500000", "currency": "XOF" },
  "policy": { "unknown_sender": "quarantine" }
}

{ "version": 4, "active": true }

Versioned, never overwritten

Each write creates a new version and deactivates the previous one.

A payer may have read version 3 an hour ago and be sending against it now. Overwriting in place makes it impossible to establish afterwards which terms were in force — which is precisely the question a dispute turns on.

It beats capability

The standing intent is the receiver's own statement and wins over what the underlying targets imply. A member may hold a USDC wallet and still decline USDC this month; the resolver answers the policy.

`policy.unknown_sender`

quarantine routes an inbound flow from an unrecognised counterparty into the screening states rather than delivering it. This is the setting that makes QUARANTINED reachable, and it exists because on an open rail you cannot decline to receive — funds land before anyone can screen them.