Fireblocks to PrimeVault Migration

​

Setup Admin key in Fireblocks

​

1) Create a CSR

• PrimeVault generates the keypair and sends you the CSR file.
• Customer uploads that CSR when creating the API user.
• The customer shares only the API Key (ID) back with PrimeVault.

​

2) Create the API user in Fireblocks Console

In Fireblocks Console:

1. Go to Developer Center → API Users.
2. Click Add API user.
3. Name it.
4. Select role: Non-Signing Admin.
5. Upload the CSR file.
6. Submit and complete any required approval/quorum flow (your workspace may require approvals before the key becomes active).

​

3) Restrict the API key (strongly recommended)

Set an IP allowlist for the API key to PrimeVault’s fixed IPs.

​

4) Share these details with PrimeVault

• API Key (ID) of the created API user (from the API Users list).
• Your Fireblocks API URL.

​

What PrimeVault will pull from Fireblocks (read operations)

​

A) External wallets (whitelisted destinations)

PrimeVault will call List external wallets and read assets[].address (and tag where relevant). This endpoint explicitly allows Non-Signing Admin.

​

B) Policies

PrimeVault will retrieve your active policy (and validation) using Fireblocks policy endpoints (Fireblocks documents retrieving the active policy via API).

​

C) Users

PrimeVault will read console users via Fireblocks’ “Get console users” endpoint, which is available for Non-Signing Admin keys.

​

What PrimeVault will set up during workspace creation

Using the imported configuration, PrimeVault will:

• Invite matching users (based on Fireblocks console users) into PrimeVault.
• Recreate your address book / whitelisted destinations using Fireblocks external wallets (addresses + tags/memos).
• Recreate equivalent policy controls in PrimeVault based on your Fireblocks active policy rules.