The KeyStone Protocol presents settlement as a single instruction: state every leg, name the books, attach your policy, and commit. Screening, coordination, anchoring and the receipt happen inside the movement. This page is what your engineers need in order to believe that.
Request participant access →There is no SDK zoo and no per-ledger dialect. Your system speaks to one surface, and the protocol speaks to the books. Adding a ledger to the network changes your integration by exactly nothing.
Submit a movement: every leg, every book, your policy references, one idempotency key. Commits all legs in one movement, or none of them.
The settlement's state and its receipt: what was screened, what committed where, and the anchor that makes it final.
The full audit bundle as an evidentiary document: screening results, policy evaluation, commitments and proof, identical for every party.
The same instruction, evaluated without committing: policy outcomes, reachability of every book, and what would have settled.
There is no partial state to clean up and no compensating transaction to write, because nothing commits until everything can. Retries are safe by construction: the same idempotency key returns the same settlement, never a second one.
The instruction is validated and keyed. Duplicate keys return the original.
Entities, wallets and policy, on every side. A failure ends here, before anything exists.
Each leg is held on its own book. Nothing has moved, and every leg can still be released.
Every leg, one movement, the same instant. All of it, or none of it.
The proof is recorded where every party can verify it independently.
One receipt, issued identically to every side. The audit bundle is already built.
No partial settlement exists at any point, on any book, for any duration. There is nothing to unwind because incomplete states are unrepresentable.
Every settlement records a proof that any party can check without asking us, or anyone, for permission.
Every write carries a key. Networks fail, retries happen, and the same key can never produce a second settlement.
Value never passes through KeyStone: no omnibus account, no bridge contract, no pooled anything. The attack surface you audit is your own.
Shapes shown here stand for the model, not the interface. Field names and paths are indicative until the specification is published.
POST /v1/settlements
Idempotency-Key: stl-7c41-a09e
{
"type": "dvp.settle",
"commit": "all, or none",
"legs": [
{ "deliver": "UST 912828Z78",
"book": "Depository ledger",
"from": "Seller", "to": "Buyer" },
{ "deliver": "USD 24,180,000",
"book": "Bank ledger",
"from": "Buyer", "to": "Seller" }
],
"policy": ["eligibility",
"jurisdiction", "screening"]
}
200 OK
{
"settlement": "stl-7c41-a09e",
"state": "final",
"screening": {
"entities": "passed",
"wallets": "clear"
},
"legs": [
{ "book": "Depository ledger",
"state": "committed" },
{ "book": "Bank ledger",
"state": "committed" }
],
"anchor": "proof recorded",
"bundle": "/v1/settlements/
stl-7c41-a09e/bundle"
}
The pre-production environment runs the full lifecycle against real ledger integrations with nothing at risk: your books, your policy, your instruments.
Request participant access →Discover how secure settlement expands your addressable market, drives growth and client retention, and brings agency back to you and your clients. Bring a settlement your desk runs today and we will walk it through.
You submit your own instruction and watch every leg commit together, or none of them. It runs in the KeyStone pre-production environment, on our side only, with nothing at risk.
We review every request and reply within one working day. The first step is a mutual non-disclosure agreement, then a scoping call.