account_auth_descriptor

An entity that allows fine-tuned access control over accounts. It's used to specify what keypairs can access an account, and it can limit the conditions for access in some ways.

entity account_auth_descriptor {
 key id: byte_array;
 key account: account;
 auth_type: auth_type;
 args: byte_array;
 rules: byte_array;
 mutable ctr: integer;
 created: integer;
}

key id: byte_array;

a unique identifier for the auth descriptor

key account: account;

the account it allows access to

auth_type: auth_type;

whether it's single-sig or multi-sig. It will influence the args property.

args: byte_array;

It specifies signers and level of access for the auth descriptor. It should be either of the following structs, encoded into a byte array:

• single_sig_args, if auth_type is S
• multi_sig_args, if auth_type is M

rules: byte_array;

Must be one of these values, converted to gtv and then encoded into a byte array:

• no rules: null (when encoded, it will be converted to GTV_NULL_BYTES)
• a simple rule: a rule_expression
• a complex rule: a list starting with the value "and" and followed by rule_expressions

The amount of rule expressions should always be less than or equal to auth_descriptor_config.max_rules.

After the expiration conditions are reached, this auth descriptor will automatically be deleted as soon as the account that owns it sends an operation.

Must be GTV_NULL_BYTES if this is the main_auth_descriptor for the account.

See Also

• [rule_expression] — explains what it means to expire

mutable ctr: integer;

Used for the op_count expiration rule, counts how many operations this auth descriptor has authenticated.

created: integer;

When was this auth descriptor registered