Skip to main content
Use this endpoint to find out whether a facility requires an XLS-70 credential to deposit, and if so, exactly which credential issuers are trusted. This is enforcement, not advice: an LP without an accepted credential from a named issuer cannot deposit at all — the ledger refuses the transaction. The endpoint also answers the rater’s own question — is Orma cited as an accepted issuer — without asking the vault owner, because the rating relationship is unilateral by design.

​
Parameters

​
string
required
64-character hex object ID of the Vault ledger entry. Case insensitive.
This route is cached for 30 seconds per vault. A domain changes only when someone edits it, not every four seconds, and the gate lookup requires two extra ledger reads.

​
Request

​
Response — Gated Vault

​
Response — Open Vault

​
Response Fields

​
string
The vault ID this response covers, echoed for verification.
​
boolean
true only when private is true and at least one accepted credential is listed. A vault with a DomainID but without the tfVaultPrivate flag enforces nothing — gated is false and note explains why.
​
boolean
Whether the tfVaultPrivate flag (0x00010000) is set on the vault.
​
string | null
64-character hex object ID of the PermissionedDomain on the share MPTokenIssuance. null when no domain is attached.
​
array
List of credential types that grant deposit access.
​
string | null
XRPL address of the account that controls the PermissionedDomain. null when no domain exists.
​
string | null
Human-readable explanation when gated is false. For example: "open to any depositor" or "DomainID present but tfVaultPrivate not set — domain does not enforce access".
​
boolean
Whether the configured raterAddress appears in acceptedCredentials. This is the rater’s own question — am I cited in this domain — answered without asking the vault owner.
​
string | null
The rater address configured in the Orma deployment. Used to compute issuerNamed.
DomainID is not stored on the Vault ledger object. It lives on the share MPTokenIssuance. Reading the Vault object to determine whether a vault is gated returns nothing, which looks exactly like “open to everyone”. This route reads the issuance, not the vault, to give you the correct answer.
tfVaultPrivate must be set alongside DomainID at VaultCreate. A DomainID without the flag does not enforce access control — the flag and the domain together are what gate deposits. If you see domainId set but gated: false, read the note field.