Creating and editing Accounts
How to create an Account on Ledger Enterprise, set the Rules that govern it, and edit it later, in the interface and through the API.
Role: Master Administrators. An API Administrator can also create an Account through the API.
Creating an Account is a Request. The Master Administrator quorum approves it, each Master Administrator on their own Ledger device. Nothing exists until that approval completes.
Note: An API Administrator can create an Account through the API when the Policy-based account creation rule includes them. The Approvers in that Rule then approve the Request, not the Master Administrator quorum. An API Administrator cannot edit an Account. See Workspace and the API documentation. Through the API, you can also attach an optional note to the Request.
Start
From the Accounts list, select Create account. To change an existing Account, use Edit on its row or on the Account page.
Throughout the flow everything you have chosen stays visible and editable until you review.
Choose the asset
Search the available coins by name or ticker. Only coins your Workspace supports appear, each with its name, ticker, and logo. Ledger sets which networks your Workspace has. See Networks and tokens in your Workspace.
A coin on one network is added directly.
A coin on several networks prompts you to choose the network.
Important: If you change the asset after you configure Rules or select a Policy, the form asks you to confirm in a Change asset? dialog. Change asset clears the Rules, the selected Policy and the parent Account.
The 1. Account details section can show more fields, depending on the asset:
Parent account: required for a token. The parent is an existing Account on the token's network. If there is none, create that Account first.
Portfolios: where Portfolios are enabled for your Workspace. See Portfolios.
Address options: Bitcoin only. Select Dynamic or Static. You cannot change it after creation. See Bitcoin.
On Canton, an information banner describes how Canton Accounts work. See Canton.
For a native Account on an EVM network, the interface gives the new Account an index that no other EVM Account uses. The Account therefore has a new address and no Linked Accounts. See Ethereum.
Name the Account
A name can have up to 45 characters. It must not match the name of another Account in the Workspace, or a name that a pending create or edit Request holds. The interface accepts ASCII characters only, and the API does not check it. If a name is rejected, the form says why.
The Account name appears in the Operators' navigation and on approval screens. A name carrying only the asset does not distinguish two Accounts that hold it.
Set the Rules
An Account is governed either by its own Rules, used nowhere else, or by a shared Policy that other Accounts also use. Under Rule setup, select Manual for its own Rules, or From policy for a shared Policy.
Its own Rules
The governance is genuinely specific to this Account
A shared Policy
The governance is a pattern you apply across many Accounts
A shared Policy must already exist and be approved before you can reference it. You cannot create one from this form, so provision it first: see Policies.
Select policy lists only the Policies that can govern this Account. A Policy qualifies when it is for the asset's network or for any asset, and when it contains a Send Rule. On Canton, it must also contain a Receive Rule. If no Policy qualifies, Select policy is unavailable and its tooltip reads "No existing policy".
Note: Linking a shared Policy makes this Account's Rules read-only. The Account names the Policy governing it, and changes are made on the Policy, where they apply to every adopting Account at once.
Which Rules an Account can have
Rules are set per operation type. In the interface, a Send Rule is always required. The others appear only where the asset supports them.
Send
All assets
Yes
4
Yes
Yes
Receive
Canton only
Yes, on Canton
1
No
No
Stake
Assets that support staking
No
1
No
No
Sign message
Assets that support it
No
1
No
No
Contract interaction
EVM networks
No
1
Yes
Yes
Contract deployment
EVM networks
No
1
Yes
No
Token activation
No supported asset today
No
1
No
No
A token Account takes Send Rules only, plus a Receive Rule on Canton. Stake, Sign message and contract Rules apply to native Accounts only.
The interface enforces the required Rules, the maximum number of Rules and the operation types of the asset. The API does not check them. It accepts any number of Rules for each operation type, and it does not require a Send Rule.
Note: A Receive Rule appears on Canton Accounts only. Canton is the only network where receiving is an action somebody has to approve. See Canton.
Send Rules
A Send Rule has four parts.
Request initiator. Who may create a transfer. Their creation counts as the first approval. Required. Select one group, or one or more Operators. Selecting a group removes the Operators already selected, and selecting an Operator removes the group.
Whitelists. Which destinations are permitted. Optional, and you can select several, in which case the Rule allows the combined set of their addresses. The picker lists only active Transaction Whitelists with at least one address on this Account's network. It shows the number of matching addresses in each Whitelist, and searches by Whitelist name.
Amount threshold. The amount range the Rule covers. Optional: set a minimum, a maximum, or one of the two. Amounts are entered in the asset, with the current countervalue shown. In the interface, the minimum must be lower than the maximum. The API also accepts a minimum equal to the maximum.
Request approval. Who must approve, in ordered steps, each with its own quorum. Optional. Select Add approval step to add a step. Each step names one group or a list of Operators, never both. A user or group cannot appear in two approval steps. In the interface, a step's quorum is at most one less than its number of members, with a minimum of 1. The API accepts a quorum from 1 to the number of members.
Up to four Send Rules per Account in the interface, evaluated in order. The first Rule that matches the transfer is the one that applies. A Rule matches when all of these are true:
The amount is inside its threshold. The minimum and the maximum are included.
The destination is in one of its Whitelists, when the Rule has any.
The user who creates the transfer is in its Request initiator step.
To copy one Rule within the same operation type, select its Duplicate Rule icon in the Rule list. It is unavailable when the operation type has its maximum number of Rules, or while the Rule has an error.
To copy every Rule from an existing Account, use Select account under Manual. Apply rules replaces all the Rules in the form. If the source Account holds a different asset, the amount thresholds are not copied.
Important: Order and thresholds together decide who approves a given transfer. A Rule set can be valid and still route a common amount to the wrong Approvers.
Contract interaction Rules
On a native Account on an EVM network, contract interaction takes its own Rule, with its own thresholds and its own Smart Contract Whitelists. See Whitelists.
Staking Rules
Where the asset supports staking, staking Rules are separate and off until you enable them. They take a Request initiator step and approval steps, with no Whitelists or thresholds.
An Account with no staking Rules cannot be staked from, and Operators are told to ask you. See Staking.
Optional Rule types
Every Rule type other than Send, and Receive on Canton, starts off. Select Enable on a Rule type to add its first Rule.
To start from your Send Rules, select Copy send rules on the Rule type instead. It is available when the Send Rules are valid. It copies the first Send Rule only, because an optional Rule type takes one Rule. It keeps the threshold where the Rule type supports one. It keeps the Whitelists only where the Rule type uses the same kind of Whitelist.
Review
Review becomes available once every required field is filled. When you edit an Account, it also stays unavailable until you change something. While it is unavailable, hovering over it shows the first field error, where there is one.
Select Review to check the Account on your Ledger device. Once you confirm there, the Request goes to the Master Administrator quorum.
Editing an Account
Edit changes the Account name and its Rules, or the Policy it uses. The asset, the network, the parent Account and the Bitcoin address option are fixed for the Account's life. A different asset means a new Account.
Portfolios are not changed here. Link them from the Accounts list or the Account info tab. See Portfolios.
The edit form is the creation form, filled in with the current values, with the fixed fields locked. Reviewing creates an Account edit Request for the Master Administrator quorum.
When editing is blocked
In these cases Edit is unavailable, and its tooltip gives the reason:
An edit Request for the Account is pending approval: "A request is already pending".
An operation on the Account is pending: "You cannot edit this account while there are pending operations."
The Account is an inactive Hedera Account: "An inactive Hedera account cannot be edited". See Hedera.
The API refuses the same edits. Wait for the pending Request to complete, expire, or be rejected.
The block works both ways. While an edit Request is pending, Operators cannot create a transaction on the Account. So no transfer is approved under Rules that changed while it was in flight.
Related
Last updated