# Send the Signatures

> Coming soon, upon request — this feature is turned on for your tenant by the Aurea team. [Contact us](https://www.aureahub.com/contact)

Send a prepared supply or withdrawal, signed by the user's wallet. Aurea checks each signature and sends the steps in order.

## Overview

- `steps`: as [Prepare a Supply](https://docs.aureahub.com/docs/lending-prepare-supply.md) or [Prepare a Withdrawal](https://docs.aureahub.com/docs/lending-prepare-withdraw.md) answered them, unchanged. `signatures`: one per step, in the same order — `v` the y-parity `0x0` or `0x1`, `r` and `s` in `0x` hex. `isTestnet` as when prepared.
- Each signed step must come from the user's wallet that Aurea picks for lending (the `walletAddress` of the preparation). Each step is sent and its receipt waited for before the next; the answer is the last step's `txHash`.
- An optional `Idempotency-Key` makes a retry safe ([Idempotency](https://docs.aureahub.com/docs/idempotency.md)).

## Refusals

- `400`: no steps; not as many signatures as steps; the chain refused a step — `Insufficient gas balance…` (the wallet needs the native coin), `Transaction nonce conflict. Please try again.` (prepare again), `Transaction reverted on-chain…` (check the balance), or `Broadcast failed: …`. Steps sent before a refused one stay sent.
- `422`: a signature that cannot be read, or that is not the user's wallet's (`Signature does not correspond to the expected wallet address`).
- `423`: a freeze stops the user, the wallet or your tenant from signing.

## Endpoint

### `POST /v1/lending/broadcast`

Authentication: bearer token required.

Sends the signed steps of a prepared supply or withdrawal. Needs the user's access token and the tenant signature (or a server token).

**Headers**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `Idempotency-Key` | string | no | Optional — required for a tenant on the institutional security profile (`400` `IDEMPOTENCY_KEY_REQUIRED` without it). Up to 255 letters, digits, - or _. The same key with the same request answers with the first answer (`idempotency-replayed: true`) instead of running it again; see [Idempotency](https://docs.aureahub.com/docs/idempotency.md) |
| `X-External-Tx-Id` | string | no | Optional — your own id for the operation this call starts: 1 to 255 letters, digits, `_`, `.`, `:` or `-`, unique in your tenant for ever. Read where your tenant has operation records [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md); otherwise it is not read. An id another operation of your tenant holds answers `409` `EXTERNAL_TX_ID_REUSED` before anything is signed or sent; see [Idempotency](https://docs.aureahub.com/docs/idempotency.md) › Your Own Operation Id |

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `steps` | array | yes | The prepared steps, unchanged |
| `signatures` | array | yes | `[{ "v", "r", "s" }]`, one per step, in order |
| `isTestnet` | boolean | yes | As when prepared |

**Responses**

`200` Sent

```json
{
  "txHash": "0x9a2d…77f0"
}
```

`422` Not the Wallet

```json
{
  "error": "ValidationError",
  "message": "Signature does not correspond to the expected wallet address"
}
```

**Example request**

```bash
curl -X POST https://api.aureahub.com/v1/lending/broadcast \
  -H "Authorization: Bearer USER_ACCESS_TOKEN" \
  -H "x-tenant-api-key: YOUR_API_KEY" \
  -H "x-timestamp: UNIX_SECONDS" \
  -H "x-signature: HMAC_SHA256_HEX" \
  -H "Idempotency-Key: lend-9a2d" \
  -H "Content-Type: application/json" \
  -d '{"steps": [ … ], "signatures": [{"v": "0x1", "r": "0x…", "s": "0x…"}], "isTestnet": false}'
```

---

Web version: https://docs.aureahub.com/#lending-broadcast