# Operations & Fees

One public state machine for everything that moves funds, beside the transactions you already read — and the fee levels, spendable amounts and address checks to prepare a send.

## Overview

- **An operation** is what a money route started — a send, an approval, a swap, an Earn deposit or withdrawal, a payout order to a bank account, a dApp broadcast — followed from the request to its end, with every state it passed and when.
- **It changes nothing you already read.** The money routes answer exactly as before, and a transaction keeps its four statuses ([Enums & State Machines](https://docs.aureahub.com/docs/enums-states.md)): an operation's `legacyStatus` is that status, projected from its state. The one exception is a tenant on the institutional security profile, whose policy can hold an operation for approval — or whose [institution callback](https://docs.aureahub.com/docs/guide-institution-callback.md) can answer `RETRY`: the route then answers `202` with the operation to follow (Institutional Tenants, below).
- Read them with [List Operations](https://docs.aureahub.com/docs/operations-list.md) and [Get an Operation](https://docs.aureahub.com/docs/operation-get.md). A user reads their own; the tenant roles that read the tenant's transactions — `owner`, `tenantadmin`, `non_signing_admin`, `signer`, `approver`, `editor`, `viewer`, `auditor` — read every operation of the tenant; `security_admin` and `security_auditor` read only their own.
- Webhook endpoints that name them receive the `operation.created`, `operation.state_changed`, `operation.completed` and `operation.failed` events ([Webhooks & Events](https://docs.aureahub.com/docs/guide-events.md)) — an endpoint that names no type does not: `data` is the operation as Get an Operation answers it, without `events`; `operation.state_changed` adds `previousState` and `previousSubState`.
- `tokenizedOperationId` is the tokenized assets operation an operation carries out, when it carries one out; `null` for every other operation.
- `sourceAccountId` is the [account](https://docs.aureahub.com/docs/guide-accounts.md) of its wallet — the account that holds the wallet, else its user's default account (the user's id) —, or `null` when it has no wallet. The reads carry it; the `operation.*` events do not.

## Where Your Tenant Has Them

Operation records are available on request [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md); a tenant on the institutional security profile has them by its profile. Without them nothing is recorded and no `operation.*` event is sent: List Operations answers an empty page, [Count Operations](https://docs.aureahub.com/docs/operations-count.md) zero, and a read by id answers `404` `OPERATION_NOT_FOUND`.

```json
{
  "operations": [],
  "nextCursor": null
}
```

Cancelling acts on recorded operations only. The fee, spendable-amount and address routes below work for every tenant.

## States

```text
SUBMITTED → PENDING_SCREENING → PENDING_ENRICHMENT → PENDING_POLICY → PENDING_AUTHORIZATION → QUEUED
  → PENDING_SIGNATURE → SIGNED → BROADCASTING → CONFIRMING → COMPLETED

ways out: CANCELLING (then CANCELLED, COMPLETED or FAILED), CANCELLED, BLOCKED, REJECTED, FAILED
```

- **Final**: `COMPLETED`, `CANCELLED`, `BLOCKED`, `REJECTED`, `FAILED`. A state only moves forward, and never leaves a final one.
- `FAILED` and `CANCELLING` can follow any state that is not final; `CANCELLED` only while nothing was sent (up to `SIGNED`); `BLOCKED` up to `QUEUED`; `REJECTED` up to `PENDING_SIGNATURE`.
- **A gate stops an operation only where it is enforced for your tenant**; otherwise the operation passes it with the sub-state `not_gated`. Screening: a match against the sanctions lists holds or refuses it, and a confirmed match ends it `REJECTED` ([Screening & AML Cases](https://docs.aureahub.com/docs/guide-screening.md)). Enrichment: a transaction that cannot be simulated, or whose outcome diverges, ends it `FAILED` ([Signing Rules](https://docs.aureahub.com/docs/guide-signing-rules.md)). Policy and authorization: a tenant on the institutional security profile, whose policy is enforced (Institutional Tenants, below). Authorization also waits for your institution callback [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md): its `REJECT` ends an operation `REJECTED` ([Institution Callback & Co-Signer](https://docs.aureahub.com/docs/guide-institution-callback.md)). The queue stops nothing.
- An operation is `CANCELLED` when its initiator cancels it before anything of it was sent (Cancel an Operation, below).
- An operation's `events` list every state it passed, in order, with its sub-state, failure reason, hash and time: a state an operation only passed on the way is listed too.
- Treat a state or sub-state you don't know as not final.

## Sub-States

| state | subState | Meaning |
| --- | --- | --- |
| SUBMITTED | — | Recorded. |
| PENDING_SCREENING | not_gated | Passed without a screening that can stop it: none is enforced for your tenant. |
| PENDING_SCREENING | screened | Screened before anything was signed, where screening is enforced for your tenant: nothing matched, or a match was released by your compliance review. |
| PENDING_SCREENING | under_review | Held for your compliance review: a custodial wallet's operation whose counterparty matched a sanctions list. Nothing is signed or sent until your AML case decides — released, it goes on; confirmed, it ends `REJECTED` ([Screening & AML Cases](https://docs.aureahub.com/docs/guide-screening.md)). |
| PENDING_SCREENING | bypassed | Released by your compliance review: it goes on as the call that started it would have. |
| PENDING_ENRICHMENT | not_gated | Passed without a decoding or a simulation that can stop it: none is enforced for your tenant (where the simulation only records, its outcome is in `simulations`). |
| PENDING_ENRICHMENT | simulated | Decoded and simulated before anything was signed, where the simulation is enforced for your tenant: the outcome kept to what was asked ([Signing Rules](https://docs.aureahub.com/docs/guide-signing-rules.md)). |
| PENDING_POLICY | not_gated | Passed without a policy that can stop it: your tenant's policy is not enforced ([Policy Sets](https://docs.aureahub.com/docs/guide-policy-sets.md)). |
| PENDING_POLICY | evaluated | Institutional tenants: evaluated by your tenant's policy, which is enforced; its verdict decides what follows. |
| PENDING_AUTHORIZATION | not_gated | Passed without an approval: none is asked for. |
| PENDING_AUTHORIZATION | not_required | Institutional tenants: passed without an approval — your tenant's policy allowed it as it is. |
| PENDING_AUTHORIZATION | awaiting_approval | Institutional tenants: held for approval by your tenant's policy. Nothing is signed or sent until the rule's approvers approve it ([An Operation's Approval](https://docs.aureahub.com/docs/operation-approval.md)). |
| PENDING_AUTHORIZATION | approved | Institutional tenants: approved by the rule's threshold of approvers; it goes on as the call that started it would have. |
| PENDING_AUTHORIZATION | awaiting_callback | Institutional tenants with institution callbacks: held by your callback, which answered `RETRY`. Nothing is signed or sent; Aurea asks your endpoint again until its deadline (48 hours at most), and the operation goes on as the call that started it would have once it approves ([Institution Callback & Co-Signer](https://docs.aureahub.com/docs/guide-institution-callback.md)); what it went on with — for a client-side or MPC wallet, the preparation to sign — is read with [Get Its Callback](https://docs.aureahub.com/docs/operation-callback.md). |
| QUEUED | not_gated | Passed without a queue of its own: the wallet's nonce is taken as before. |
| PENDING_SIGNATURE | awaiting_client_signature | Handed to the user's device (or MPC) to sign: what it signs comes back with the broadcast. |
| PENDING_SIGNATURE | signing | Signed by Aurea for the wallet it holds the key of. |
| SIGNED | signed_by_client | Signed on the user's side. |
| SIGNED | signed_by_hub | Signed by Aurea. |
| BROADCASTING | sending | Being handed to the chain's node, or to the provider. |
| BROADCASTING | outcome_unknown | Handed over without an answer: it may still go through, and is never sent again by itself. |
| CONFIRMING | awaiting_confirmation | On its way on chain, waiting for its receipt. |
| CONFIRMING | awaiting_provider | Accepted by the provider, which has not settled it yet. |
| CONFIRMING | awaiting_delivery | A swap mined on its source chain that the swap router has not delivered yet (a cross-chain or intent swap). Only where swap deliveries are tracked, on request; the transaction's `status` is not affected. |
| CONFIRMING | awaiting_finalization | A Solana transaction the cluster confirmed, waiting to be finalized. Only where the operations' reconciliation runs, on request; its answer and its transaction already say `confirmed`. |
| CONFIRMING | confirming | Mined, and waiting until its chain has built the platform's confirmations for that chain on it. Only where confirmations are awaited, on request (Waiting for Confirmations, below). |
| CONFIRMING | reorged | Its block left the chain in a reorganisation: the same signed transaction was handed to the node again, and it waits to be mined again (confirmations only). |
| CONFIRMING | sped_up | Its transaction was replaced by the same one at the same nonce with a higher fee (replacement by fee, coming: [Feature Availability](https://docs.aureahub.com/docs/feature-availability.md)): whichever of them is mined ends it. |
| COMPLETED | confirmed | Mined and successful. |
| COMPLETED | processed | Settled by the provider. |
| COMPLETED | signed | A signature, not a transaction: the message or digest is signed, and nothing is sent on chain. |
| COMPLETED | delivered | A swap the swap router delivered as quoted (delivery tracking only). |
| COMPLETED | delivered_other_token | A swap the swap router delivered in another token than the one quoted, on a partial route (delivery tracking only). |
| CANCELLING | drop_sent | A 0-value transaction to the wallet itself was sent at its transaction's nonce with a higher fee (replacement by fee, coming): `CANCELLED` if it is mined, `COMPLETED` or `FAILED` if the original is. |
| FAILED | not_sent | Refused or failed before anything was signed or sent. |
| FAILED | submission_failed | Sending it failed: the node or the provider refused it, or did not take it. |
| FAILED | reverted | Mined, and reverted. |
| FAILED | never_broadcast | Never signed and sent back within an hour: it can no longer be broadcast. |
| FAILED | provider_rejected | Refused by the provider after it took the order. |
| FAILED | delivery_failed | A swap mined on its source chain that the swap router reports failed on the way (delivery tracking only). |
| FAILED | refunded | A swap the swap router could not deliver and refunded on the source chain (delivery tracking only). |
| FAILED | approval_expired | Institutional tenants: held for approval and not approved within the approval window, where one applies. Nothing was signed or sent. |
| FAILED | callback_expired | Institutional tenants: held for your institution callback, which did not approve it before its deadline. Nothing was signed or sent. |
| FAILED | dropped | Its block left the chain in a reorganisation, and another transaction of the wallet took its nonce: it can never be mined (confirmations only). |

With a failing end, `failureReason` is the code of the answer that ended it, for example `RPC_ERROR`; a cancelled operation's is `OPERATION_CANCELLED`, a dropped one's `OPERATION_DROPPED`, one your AML case confirmed `AML_CASE_CONFIRMED`; one your institution callback ended `INSTITUTION_CALLBACK_REJECTED`, `INSTITUTION_CALLBACK_ANSWER_INVALID`, `INSTITUTION_CALLBACK_UNAVAILABLE`, `INSTITUTION_CALLBACK_PENDING` or `INSTITUTION_CALLBACK_EXPIRED`. `BLOCKED`, `REJECTED` and `CANCELLED` carry no sub-state.

## Cancel an Operation

The initiator of an operation — holding the permission that starts it, so `user`, `owner`, `tenantadmin` or `signer` — can stop it before anything of it was sent:

| Route | When | What happens |
| --- | --- | --- |
| [Cancel](https://docs.aureahub.com/docs/operation-cancel.md) | Nothing of it was sent: waiting for the client's signature, or held for approval or for your institution callback (institutional tenants). | `CANCELLED`. What it prepared can no longer be broadcast (`409` `OPERATION_CANCELLED`), a prepared transaction's nonce is free again, its transaction is `cancelled`; a held one's approval request is `withdrawn`, its callback request `cancelled`. |

- Cancelling acts on recorded operations only (above).
- Speeding up or dropping a transaction already sent — replacement by fee — is coming ([Feature Availability](https://docs.aureahub.com/docs/feature-availability.md)).

## Waiting for Confirmations

[Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md) Where confirmations are awaited, a mined operation is not `COMPLETED` at once: it waits in `CONFIRMING` `confirming` until its chain has built the platform's confirmations on it — the number set for that chain, or one agreed for your tenant or for the asset on that chain.

- `CONFIRMING` `reorged`: its block left the chain in a reorganisation; the same signed transaction was handed to the node again, and it waits to be mined again.
- `FAILED` `dropped`: its block left the chain, and another transaction of the wallet took its nonce — it can never be mined. Mined and reverted: `FAILED` `reverted`.
- Solana, where the operations' reconciliation runs: `CONFIRMING` `awaiting_finalization`, a transaction the cluster confirmed waiting to be finalized; its answer and its transaction already say `confirmed`.
- Each move is an `operation.state_changed` event to the endpoints that name it, as any other. Otherwise a mined transaction completes its operation at its receipt.

## Institutional Tenants: Policy and Approvals

For a tenant on the institutional security profile — agreed with Aurea — operations are recorded, and the tenant's [policy set](https://docs.aureahub.com/docs/guide-policy-sets.md) is enforced at every signing step:

- **Allowed:** `PENDING_POLICY` `evaluated` → `PENDING_AUTHORIZATION` `not_required` → on its way as usual.
- **Blocked or frozen:** `BLOCKED`, `failureReason` `POLICY_BLOCKED` or `POLICY_FROZEN`. Any other refusal of the policy ends it `FAILED` `not_sent` with the refusal's code.
- **Held for approval** on the money routes that start an operation — [Create Transaction](https://docs.aureahub.com/docs/tx-create.md), [Approve Token](https://docs.aureahub.com/docs/swap-approve.md), [Execute Swap](https://docs.aureahub.com/docs/swap-execute.md), [Execute Solana Swap](https://docs.aureahub.com/docs/swap-execute-solana.md) and [Execute Gasless](https://docs.aureahub.com/docs/swap-gasless.md): the route answers `202` with `operationId`, `state` `PENDING_AUTHORIZATION`, `subState` `awaiting_approval` and the approval request. Then `approved` and on its way — a client-side or MPC wallet's to `PENDING_SIGNATURE` `awaiting_client_signature`, its prepared transaction in [An Operation's Approval](https://docs.aureahub.com/docs/operation-approval.md) — or `REJECTED` (`failureReason` `APPROVAL_REJECTED`), or `FAILED` `approval_expired` (`APPROVAL_EXPIRED`) where an approval window applies. [Approvals](https://docs.aureahub.com/docs/guide-approvals.md).
- **Held for your institution callback** [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md): on the same routes, at the call's first signature, your endpoint's `RETRY` answers `202` with `subState` `awaiting_callback` and `callback` (`requestId`, `nextPollAt`, `deadlineAt`). Then on its way once your endpoint approves — or `REJECTED` (`INSTITUTION_CALLBACK_REJECTED` or `INSTITUTION_CALLBACK_ANSWER_INVALID`), or `FAILED` `callback_expired` (`INSTITUTION_CALLBACK_EXPIRED`) past its deadline. Its request and, once approved, what it went on with: [Get Its Callback](https://docs.aureahub.com/docs/operation-callback.md). [Institution Callback & Co-Signer](https://docs.aureahub.com/docs/guide-institution-callback.md).
- **The money routes need an `Idempotency-Key`**: `400` `IDEMPOTENCY_KEY_REQUIRED` without one. The key of a held call answers its `202` again; follow the operation for the outcome.

```json
"events": [
  { "seq": 1, "state": "SUBMITTED", "subState": null, "failureReason": null, "txHash": null, "at": "2026-10-06T12:01:44.120Z" },
  { "seq": 2, "state": "PENDING_SCREENING", "subState": "not_gated", "failureReason": null, "txHash": null, "at": "2026-10-06T12:01:44.120Z" },
  { "seq": 3, "state": "PENDING_ENRICHMENT", "subState": "not_gated", "failureReason": null, "txHash": null, "at": "2026-10-06T12:01:44.120Z" },
  { "seq": 4, "state": "PENDING_POLICY", "subState": "evaluated", "failureReason": null, "txHash": null, "at": "2026-10-06T12:01:44.120Z" },
  { "seq": 5, "state": "PENDING_AUTHORIZATION", "subState": "awaiting_approval", "failureReason": null, "txHash": null, "at": "2026-10-06T12:01:44.131Z" },
  { "seq": 6, "state": "PENDING_AUTHORIZATION", "subState": "awaiting_approval", "failureReason": null, "txHash": null, "at": "2026-10-06T12:20:03.511Z" },
  { "seq": 7, "state": "PENDING_AUTHORIZATION", "subState": "approved", "failureReason": null, "txHash": null, "at": "2026-10-06T12:24:51.302Z" },
  { "seq": 8, "state": "QUEUED", "subState": "not_gated", "failureReason": null, "txHash": null, "at": "2026-10-06T12:24:51.990Z" },
  { "seq": 9, "state": "PENDING_SIGNATURE", "subState": "awaiting_client_signature", "failureReason": null, "txHash": null, "at": "2026-10-06T12:24:52.004Z" }
]
```

A held client-side send's history: each approval short of the threshold is a step of its own in the same sub-state (`seq` 6), and the threshold moves it on.

## Types

| type | Started by |
| --- | --- |
| TRANSFER | [Create Transaction](https://docs.aureahub.com/docs/tx-create.md), continued by [Broadcast Transaction](https://docs.aureahub.com/docs/tx-broadcast.md) for a client-side wallet; a dApp broadcast of a transfer; a pool withdrawal of an omnibus structure (`origin` `omnibus.withdrawal`, [Account Structures](https://docs.aureahub.com/docs/guide-account-structures.md)). |
| APPROVE | [Approve Token](https://docs.aureahub.com/docs/swap-approve.md) and its broadcast; a dApp broadcast of an approval. |
| SWAP | Execute Swap, Execute Solana Swap, Execute Gasless and their broadcasts. |
| CONTRACT_CALL | A dApp broadcast that calls a contract. |
| DEPLOY | A dApp broadcast with no destination. |
| RAW | A dApp broadcast Aurea cannot read; an MPC signature of a digest that is none of the wallet's prepared transactions. |
| TYPED_MESSAGE | A message a key the platform holds for your tenant signs: the permit of a custodial gasless swap, a dApp's personal message signed with a custodial key. It ends `COMPLETED` / `signed`. |
| EARN | An Earn deposit or withdrawal. |
| PAYOUT | A payout order to a bank account. |
| GAS_TOPUP | A top-up of one of your wallets by the [Gas Station](https://docs.aureahub.com/docs/guide-gas-station.md), from a funding wallet: no `userId` or `walletId`, `destination` the wallet topped up, `origin` `gas_station.topup`. Recorded once signed (`SIGNED` `signed_by_hub`). |
| SWEEP | A sweep of an omnibus structure's collection account into your treasury ([Account Structures](https://docs.aureahub.com/docs/guide-account-structures.md)), once the omnibus processing comes ([Feature Availability](https://docs.aureahub.com/docs/feature-availability.md)): `origin` `omnibus.sweep`. An omnibus's sweeps and pool withdrawals are recorded as operations whether or not your other operations are. |

`origin` names the call that started it, for example `transactions.create`. A request that stops before its first signing step — a validation error, an unknown id, a replayed `Idempotency-Key` — records nothing.

## The Transaction's Status

`legacyStatus` is the operation's state as a transaction's `status` says it, and the transaction the same calls wrote (`transactionId`) carries that very status:

- `confirmed` once `COMPLETED`;
- `failed` after `FAILED`, `BLOCKED` or `REJECTED`;
- `cancelled` after `CANCELLED`;
- `pending` until then.

## Fees and the Most You Can Send

- [Estimate Fees](https://docs.aureahub.com/docs/fees-estimate.md): `LOW`, `MEDIUM` and `HIGH` fee levels for one of your tenant's chains, read from the chain's recent fees through your tenant's own node. On EVM chains, from the last 20 blocks' fee history: each level's tip is the median, over the blocks, of the 10th, 50th or 90th percentile of the tips paid (never below the level under it), and its `maxFeePerGas` is the next block's base fee × 1.125, × 1.5 or × 2, plus the tip. A chain without a fee history or a base fee uses its gas price, × 1, × 1.125 or × 1.25 (`model` `legacy`). On Solana, the 10th, 50th or 90th percentile of the priority fees recent blocks paid, on top of 5000 lamports a signature.
- Each level's `networkFee` is what a plain native transfer costs at most at that level: 21 000 gas at `maxFeePerGas` on EVM; one signature and the priority fee of 200 000 compute units on Solana.
- [Most a Wallet Can Send](https://docs.aureahub.com/docs/wallet-max-spendable.md): for the native coin, its balance minus the fee of sending it at the level, never below zero; for a token, its whole balance, with `feeCovered` saying whether the native balance pays the fee (a token transfer's gas as the node estimates it, plus 30%).
- Amounts are decimal text in the smallest unit (wei, lamports, the token's smallest unit); a fee per gas is in wei, a Solana priority fee in micro-lamports per compute unit. Nothing is signed or sent.

## Address Checks

[Validate an Address](https://docs.aureahub.com/docs/address-validate.md) says whether an address is well formed for a chain and what sits there, before you send to it. The address goes in the body, so it stays out of URLs and logs.

- **EVM**: `0x` and 40 hex digits. All lower or all upper case carries no checksum (`checksum` `absent`: valid, but a typo would not have been caught); mixed case must be the EIP-55 checksum (`valid`), else the address is refused (`reason` `checksum`). `normalized` is the checksummed form. `kind`, from one read of your tenant's node: `eoa`, `contract`, `delegated_eoa` (an EIP-7702 delegation), or `unknown` when the node does not answer.
- **Solana**: base58 of exactly 32 bytes; `kind` `wallet` on the curve, `program_derived` off it — no key can sign for such an address. `checksum` is `not_applicable`.

---

Web version: https://docs.aureahub.com/#guide-operations