A property data API for verified records.
Issue verified events.
Check any seal.
The Vault API is the property data API behind every home's Vault today, and the same API for every class to follow. It gives agents, insurers, lenders, dealers and platforms scoped read access to Vaults, lets registered professionals create Vaults and draft, issue, correct and withdraw verified events, and pushes signed change webhooks - with an open record schema and document seals anchored in rehearsal on the XRPL testnet (mainnet on the roadmap, subject to approvals).
Four surfaces. One verified records API.
A read, a permitted write, or a notice that a Vault changed - the same surfaces whether the record is a home, a watch or a cask.
Lookup GET /vaults/{id}
Resolve a Vault by its Vault ID, under a scope. No public lookup by address, registration, serial or any natural key; an issuing professional can find by UPRN only a Vault its own organisation already relates to.
Read scope token
The Verified History, the Vault Score and permitted documents, with hashes and receipts.
Write POST /vaults · /events · /documents · /issue
Built: create a Vault, draft an event, upload sealed documents, issue, correct and withdraw - on your Organisation's own Vaults, each call with an Idempotency-Key, recorded in the audit trail against your Organisation's API credentials.
Subscribe webhooks
Built: signed (PV-Signature, HMAC-SHA256 with a timestamp; 300-second replay window), retried with backoff, with a delivery log. Event types: event.issued, event.corrected, event.withdrawn, document.version_added, score.changed, grant.created, grant.revoked, ownership.transferred, request.created, request.responded, report.issued, report.revoked, anchor.confirmed.
The Vault Score in a read is a verification score - whether the documents exist, who issued them and that they are unaltered since issue; never a valuation, a credit input or a judgement of the work.
The owner grants. The role limits. Opens are logged.
No key reads everything. A read happens under a scope an owner granted to a role, for a period and a stated purpose - or, for the professional who issued a record, that record under a fixed scope.
- Scope tokens are 160-bit, stored hashed and expire.
- Every API read states its purpose, which must match the grant; sandbox keys read and write demonstration Vaults only.
- Scopes hide documents, not history. The timeline is always whole.
- Issuing requires registration against a scheme the professional already holds.
| Scope | Granted to | Status |
|---|---|---|
owner | The owner - today through the owner link their professional issued; owner accounts launching | Live in pilot |
agent-buyer | An estate agent and their buyer | Live in pilot |
insurer-surveyor | An insurer's surveyor; structural assets only | Live in pilot |
solicitor | A conveyancer acting on a matter | Live in pilot |
lender-valuer | A regulated lender's valuer | Launching |
loss-adjuster | An insurer's claims team or adjuster | Launching |
probate | An executor or estate solicitor | Launching |
broker | A yacht, art or specialist broker | Launching |
An open record schema you can take with you.
One open schema - documents, hashes, integrity receipts, events and issuer references. The export format for owners; the read format for everyone else.
- Published on GitHub when released, with a changelog. Readers build against a version, not against us.
- Hashes travel with the record, so a conveyancer's copy can be checked years later.
- No URI is the only path to a record. Open export, data escrow once an Organisation pays, and a plain statement of what a holder can read if we cease trading - Everledger's lesson (Rapaport, 2023).
- Designed to travel over the UK property data standards. We plan to join the Open Property Data Association and to map the home record to its data standard as an export; not a member today, and said so until it is true.
Check a seal against an anchor - rehearsal on XRPL testnet.
Every document is hashed on upload and receipted. Integrity anchoring runs as a rehearsal on the XRPL testnet: Merkle roots of keyed commitments are written to the test network, which can be reset, and listed on the public anchor page; mainnet anchoring is on the roadmap, subject to approvals. The anchor page lists each root with its transaction and ledger index, and a record whose manifest has been anchored carries its inclusion proof in its export. Launching
Hash on upload
Originals kept; a correction is a new version, never an overwrite.
Receipt issued
Hash plus timestamp, kept in the record.
Anchored to the ledger
Launching - rehearsal on XRPL testnet: at most one root a day, on days a record has changed, in one AccountSet memo from our anchoring account; mainnet on the roadmap, subject to approvals. No personal data, no asset identifiers.
Verify publicly
verify.html checks an inclusion proof locally - from a commitment up the Merkle path to the root - with or without us.
A receipt proves a document unaltered since sealing, not true when written - that is what issuer weighting in the Vault Score is for.
Native primitives. No smart contract.
Three kinds of object may represent a Vault on the XRP Ledger - each a pointer or attestation, never title; nothing reachable from the ledger identifies a property or a person. Testnet after the data-protection impact assessment (DPIA), then mainnet.
Pointer token XLS-20 · XLS-46
One mutable NFT per Vault ID, taxon = asset class, URI to a scope-gated manifest. It says a record exists and where a permitted reader finds it. Never title - see Tokenise.
XRPL feature live on mainnet · Property Vault: not builtEnabled 31 Oct 2022 / 11 Jun 2025 · testnet after DPIADID XLS-40
A decentralised identifier for Property Vault's account and each issuing professional's, so a pointer or credential traces to its issuer.
XRPL feature live on mainnet · Property Vault: not builtEnabled 30 Oct 2024 · testnet after DPIACredentials XLS-70
Property Vault issues a credential to a registered professional's account. It binds issuer to subject account, not to an NFT - registration, not per-event history.
XRPL feature live on mainnet · Property Vault: not builtEnabled 4 Sep 2025 · testnet after DPIA- Enabled on mainnet 8-9 Oct 2026 · Property Vault: not builtBatch (XLS-56), enabled 9 Oct 2026 - mint, set URI and issue the first credential atomically · Permission Delegation, enabled 8 Oct 2026 - a narrow permission for an operator key, no account handover.
- In validator voting · when activatedSingle Asset Vault XLS-65 and Lending Protocol XLS-66, both well short of the 80% threshold - on-ledger Lending & Collateral through regulated lenders; until then lenders read Vaults here · ConfidentialTransfer and DynamicMPT - no date.
Status: xrpl.org Known Amendments and xrpldashboard.com, 7 Oct 2026. Never used: the XRPL EVM sidechain, Xahau/Hooks, a per-asset oracle. The statutory register wins on any conflict.
Ingestion is issuance.
A certificate read from its issuing body enters a Vault at that body's weight. Categories only; none named until signed.
Statutory and scheme registers
Building Control completions; gas, electrical, glazing, solid-fuel certificates.
Open property data
Price paid, title extent, energy rating, planning, flood zone, UPRN.
Vehicle test and registration data
MOT history and keeper-record fields.
Stolen-goods registers
Negative data by serial, read as an event - never a public lookup.
Grading services
Certificate numbers and grades from the grader.
Brand passports
Manufacturer passports for luxury goods, mapped to issuer-weighted events.
Valuation feeds
Valuations as issued, by whom and when. Never computed by us.
Registered professionals
What no register covers - a rewire, a service, an authentication.
Property Vault reads HM Land Registry open data. HM Land Registry is the register of title; we never touch it. Seeding and scheme ingestion are launching.
A property data API built for the systems your Organisation already runs.
Inside existing workflows, not another screen. Categories only until something ships.
Claims platforms
Open the loss-adjuster scope from the claim; pull insurance claim evidence with receipts.
ReadSubscribeConveyancing platforms
Read the Sale-Ready Passport - estate agent material information, verified - under the solicitor scope; hear when a certificate lands mid-matter.
LookupReadSubscribeDealer management systems
Issue the Provenance Passport at sale from the system you already use, and the buyer takes a Vault with the auction house provenance or dealer record in it.
IssueReadBroker CRMs
A broker scope per sale, so provenance travels with the listing.
ReadSubscribeWealth platforms
The Business Vault as a feed from Pro: every asset an Organisation holds, valuations as issued.
ReadSubscribeRegulated lenders
The lender-valuer scope for collateral verification: ownership, condition, insurance, provenance. The lender decides.
ReadSubscribeLaunching. Early access by request.
The live scopes run in the Homes pilot at propertyvault.world/homes; API surfaces open by request.
What early access includes
- Sandbox keys for Organisations in the pilot - demonstration Vaults only, to read and to write.
- The OpenAPI 3.1 document, the webhook signature scheme and a verifier, ahead of publication on GitHub.
- Issuer registration for your Organisation's professionals.
- A named engineering contact and a changelog before the schema moves.
Write to hello@propertyvault.world with your Organisation, sector and surfaces needed. Owners never need the API - the app is free. Questions: contact us.
Property data API questions, answered.
Is the Vault API a free property API for the UK?
Owners never need the API: the app is free for them. The Vault API is for Organisations and is launching with early access by request. There is no free public lookup; every read happens under a scope the Owner granted. Pricing for Organisations is agreed in writing - see Property Vault pricing.
What property data does the API return?
A Vault read returns the Verified History, the Vault Score with its method version, the documents the scope allows with their SHA-256 hashes and integrity receipts, verified events with issuer class and weight, and transfers. Natural keys such as UPRN or title number are held off-chain and released only under scope. The Vault Score is a verification score, never a valuation, a credit input or a judgement of the work.
Can I look up a property by address, or a watch by serial?
No. There is no public lookup by address, registration, serial or any natural key. A Vault is resolved by its Vault ID under a scope; an issuing professional can find by UPRN only a Vault its own Organisation already relates to. Valuables are private by default.
Does the property data API cover assets other than homes?
The record schema is one design for all twelve real-world asset classes. Property is live in pilot; watches and jewellery are the next class, then Vehicles, each launching with the partners who register it. The same asset data API reads a car, a yacht or a cask when its class opens.
What do the webhooks send?
A signed notice (PV-Signature: HMAC-SHA256 with a timestamp; reject anything more than 300 seconds old) when something your Organisation may know about changes: event.issued, event.corrected, event.withdrawn, document.version_added, score.changed, grant.created, grant.revoked, ownership.transferred, request.created, request.responded, report.issued, report.revoked, anchor.confirmed. Retried with backoff for up to eight attempts, with a delivery log. The notice carries identifiers only - never names, addresses, emails, document titles or notes - the receiving system then reads under its scope.
Will the record schema follow the Open Property Data Association standard?
We plan to join the Open Property Data Association and to map the home record to its data standard as an export. Property Vault is not a member or a trust-framework participant today; that is shown here the day it is true. Pointer tokens on the XRP Ledger are described on Tokenise, the asset tokenisation layer.
Read the record. Issue the event. Check the receipt.
Early access to the property data API for Organisations building on verified records.