Deployment & operations
From roles and rollout to individual operations, daily reconciliation and recovery: follow an equipment-rights allocation to see how API and SDK integration becomes an operating workflow.
The operating example
This example represents contractual rights associated with delivery robot ROBOT-A-001 using FlexibleToken, with a cap of 1,000 and zero decimals. The first allocation mints 10 units to a partner wallet. Initial total supply and the partner’s balance are both zero.
The approved recipient receives 10 units, total supply becomes 10, and the asset register links the agreement, recipient, amount and transaction hash. If subsequent transfers occur, reconcile balances at the relevant block rather than comparing against a later balance.
An operation ID identifies the business request, a transaction hash identifies an on-chain transaction, and a receipt records its execution result. Linking these lets an operator trace a request through execution.
This is an example of integrating APIs and SDKs into your own system. The same operating approach applies to inventory or access rights by changing the asset identifier and right definition. When using RWA Ops or Fund Ops, map roles and records to the selected solution’s workflow.
Data model and SDK code for this architecture1. Assign responsibilities and decision owners
Even in a small team, distinguishing operators, approvers and recovery decision owners makes handover easier. These are example responsibilities. If one person holds multiple roles, record which responsibility they exercised.
| Role | Responsibility | Record to retain |
|---|---|---|
| Business owner | Defines the right, recipient and allocation quantity, and approves changes to business terms. | Right definition, agreement, allocation conditions and business completion criteria. |
| Implementation engineer | Implements connections, authorization, submission, result tracking and register updates; verifies recovery paths. | Environment register, versions, test evidence and reconciliation procedures. |
| Operator | Handles intake, status monitoring, daily reconciliation and first-line support. | Operation records, reconciliation results and unresolved operations. |
| Approver / access administrator | Approves issuance and configuration changes, and manages executor permissions and pause/resume authority. | Approvals, permission register, change history and escalation contacts. |
hazBase APIs, SDKs and contracts provide execution and query capabilities. The approval workflow, operation IDs, monitoring and business register below are operating controls implemented in the integrating application.
2. Create an environment and configuration register
Maintain separate registers for validation and production. Changing only a URL can leave addresses or permissions pointing to the wrong network, so check these settings together. Example values illustrate the register; they do not specify production endpoints or access terms.
| Record | Example / how to verify | Owner |
|---|---|---|
| Environment / enabled features | validation / production. Confirm supported chains, write capabilities, rate limits and support for each environment. | Engineering / operations |
apiEndpoint / chainId / RPC | Record API and RPC separately. Sepolia uses chainId 11155111; compare this with the chain ID returned by the connected RPC. | Engineering |
| Contract / ABI / version | Save the FlexibleToken address, initialization parameters, source revision and deployment result together. | Engineering |
| SDK / application version | For example, @hazbase/kit 0.9.0. Retain the dependency lockfile and application release identifier. | Engineering |
| Asset / agreement / quantity | ROBOT-A-001, agreement AGR-2027-001, cap=1000, decimals=0. Define transferability and whether a whitelist is required. | Business owner |
| Signer / permissions | Verify the issuer address and MINTER_ROLE, administrator and pause/resume permissions. Record the key custody reference, not the private key. | Access administrator |
| Authentication / devices | For the Wallet API, verify allowed origins, device registration, session expiry, operation approval and revocation procedures. | Engineering / access administrator |
| Confirmation / recovery policy | Record the chain-finality policy, indexing checkpoint, backup location and recovery decision owner. | Engineering / operations |
3. Progress from validation to production
The sequence below is an example rollout. Recording evidence and open issues at each stage helps the business owner decide when to proceed, without assuming a fixed implementation timeline.
Select one initial workflow
Start with the 10-unit allocation for ROBOT-A-001. Identify the requester, approver and screen where completion will be checked.
Evidence to proceedInputs, approval conditions and the completed register entry form one clearly described procedure.
Verify connectivity and reads
Use the environment register to check chain, token address, decimals, cap, supply and recipient balance. Distinguish API-configured tokens from the contract’s actual state.
Evidence to proceedEvidence identifies the correct target and initial balance 0, supply 0 and cap 1000.
Complete a limited write end to end
Mint 10 units in an isolated validation environment. Trace approval, execution, events and register display under one operation ID. Integrate the example code at this stage.
Evidence to proceedIssuance to the intended recipient, total supply 10, transaction evidence and the completed UI state agree.
Rehearse failure and recovery
Exercise double-clicks, lost responses after submission, missing roles, paused contracts and interruption before register updates. Unresolved operations should remain traceable after a reload.
Evidence to proceedNo duplicate mint occurs; unknown outcomes are not resubmitted, and reconciliation resumes from the interruption point.
Begin production with limited scope
Recheck production configuration and permissions, then start with agreed recipients and quantities. Have an operator observe the first run through reconciliation before expanding volume.
Evidence to proceedThe business owner and operator have reviewed reconciliation, monitoring, escalation contacts and recovery procedures.
4. Process a single allocation
Map the operator’s workflow to system actions as below. This allocation mints 10 new units. Transferring existing tokens is a different operation that reduces the sender’s balance, so record the operation type as well.
| Operator action | System action | Evidence |
|---|---|---|
| Accept the request | Save asset, agreement, recipient and quantity under an application operationId. Return the existing record for repeated intake of the same request. | ALLOC-2027-001 / MINT / 10 |
| Approve the details | Show chain ID, token, recipient and 10 units. Require a new approval if those values change. | Approver, timestamp and approved payload. |
| Issue the units | Check permissions, cap and pause state; convert to atomic units. Persist the submitting state before calling FlexibleTokenHelper.mint. | With decimals=0, 10 units is 10 atomic units. Record failures caused by concurrent state changes too. |
| Check execution | Store available transaction hashes and the receipt. Match the successful receipt, contract, recipient and mint-event amount. | Separate submission acceptance from on-chain success. A missing response goes to Needs review. |
| Reconcile the register | Apply results that satisfy the chain-confirmation policy. Deduplicate using transaction hash and event position. | Allocation 10, total supply 10, traceable by operation ID and transaction. |
| Notify completion | Update the UI and notify after reconciliation succeeds. Retry notification alone if it fails; do not repeat issuance. | The partner and operator see the same processing status. |
5. Retain operation records and processing states
The following is an application-side record, not a hazBase API request schema. Addresses and hashes are abbreviated. Keep agreement originals and personal data in access-controlled storage, linked through identifiers.
{
"operationId": "ALLOC-2027-001",
"operationType": "MINT",
"assetId": "ROBOT-A-001",
"agreementId": "AGR-2027-001",
"chainId": 11155111,
"tokenAddress": "<token address>",
"recipient": "<approved recipient>",
"amountAtomic": "10",
"decimals": 0,
"approvalRecordId": "APPROVAL-001",
"status": "RECONCILED",
"sourceEvent": {
"transactionHash": "<transaction hash>",
"blockNumber": 1234567,
"blockHash": "<block hash>",
"logIndex": 0
},
"reconciliation": {
"allocatedAtomic": "10",
"totalSupplyAtomic": "10",
"asOfBlock": 1234567
}
}Store atomic quantities as strings to avoid rounding large values. Link the approved payload, stage timestamps, executor and attempt history. Handle conflicting payloads and concurrent processing with database uniqueness and concurrency controls. Merely storing an operation ID does not prevent duplicate execution.
| Application state | When to use it | Next action |
|---|---|---|
AWAITING_APPROVAL | Request accepted; recipient and amount await approval. | Freeze approved values before execution. Retain the record if cancelled. |
SUBMITTING | Submitting an approved operation; no response received yet. | Prevent concurrent submission. Move to NEEDS_REVIEW on lost connectivity or interruption. |
CONFIRMING | A tracking hash or execution result is available, but confirmation or reconciliation is incomplete. | Check status and events; withhold completion until the policy is satisfied. |
RECONCILED | Execution matches the request, confirmation policy is satisfied and the register is updated. | Notify completion. Retry notification independently of issuance. |
NEEDS_REVIEW | Submission outcome is unknown, synchronization is inconsistent or details do not match. | Stop automatic resubmission and reconcile the original transaction and records. |
FAILED | Non-execution or failure is established from chain or execution-path evidence. | Correct the cause, document the retry decision and approval, and retain the original attempt. |
6. Monitor and reconcile daily operations
Monitor whether accepted business operations complete, as well as API availability. The cadence and criteria below are examples. Set alert timing and retry intervals according to chain finality, workload and service limits.
| When | What to inspect | If something is wrong |
|---|---|---|
| During processing | Counts and oldest age of submitting/confirming operations, API/RPC errors and status responses. Respect retryAfterMs when supplied. | Alert operations when the configured age limit is exceeded; do not automatically repeat writes. |
| When review is required | Operation ID, last successful stage, available hashes, asset and quantity for NEEDS_REVIEW items. | Assign an owner and record reconciliation and decisions against the same operation. |
| Daily close | Reconcile accepted, completed, failed and unresolved counts, then compare allocations with chain balances and events at the same reference point. | List discrepancies by asset and operation ID, including later transfers or burns. |
| Periodic review / staff changes | Review permissions, devices, signing methods, usage costs, alert recipients and unused accounts. | Revoke unused permissions and update the access register and contacts. |
| Recovery exercises | Restore the business register from backup and replay events from an indexing checkpoint. | Review recovery time, missing-record scope and the procedure for resuming service. |
Duplicate events and chain reorganizations
Identify indexed events by chainId, transactionHash and logIndex so replay does not apply them twice. Store both block number and hash at checkpoints. If the block hash changes, roll back derived register views for that range and replay it, keeping affected operations under review until resolved.
When comparing API and application balances, account for differences in read time and aggregation range. Use block-specific RPC/ABI reads when a fixed reference block is needed; comparing independently retrieved latest balances is insufficient to establish a discrepancy.
7. Respond to incidents
Identify the affected operation and establish how far it progressed before submitting anything new. A connectivity issue and suspected unauthorized activity may require different containment. Distinguish holding business requests from pausing a contract globally.
A request timed out immediately after submission
- Check first
- Check the operation ID and captured hashes. Use the relevant Wallet API status endpoint, or inspect the receipt, sender, nonce and events through RPC for direct calls. A missing receipt alone does not prove non-execution.
- Action
- If executed, resume at reconciliation. If no hash is available and the operation cannot be identified unambiguously, keep it under review and escalate with time, sender and target.
- Resume when
- Identify the original successful operation or establish submission/failure/replacement status before deciding whether a retry is needed.
The transaction succeeded but the register was not updated
- Check first
- Verify receipt success and the mint event’s recipient and amount, then inspect database updates and the indexing checkpoint.
- Action
- Resume event ingestion and register updates without minting again. Exclude events already applied.
- Resume when
- The original transaction is linked to the same operation ID and register quantities match the reference-point balance.
An operation failed because of permissions, expiry or pausing
- Check first
- Check the executor, required roles, authentication expiry and pause state. Establish whether execution failure is confirmed.
- Action
- Correct permissions or authentication within the required scope and revalidate the request. Resume a paused contract only after the decision owner confirms the cause has been resolved.
- Resume when
- Configuration and execution conditions are verified, and a new attempt can use the approved payload while retaining the failed attempt.
Balance, amount or recipient differs from expectations
- Check first
- Check chain ID, token address, decimals, approved payload and reference block, then inspect subsequent transfers or burns.
- Action
- Hold the affected workflow until the discrepancy is understood. Rolling back the application does not reverse confirmed issuance or transfers. Corrective operations require separate approval and records.
- Resume when
- The discrepancy and any correction are explained, and business and operations owners have reviewed the reconciliation.
Credentials or permissions may have been misused
- Check first
- Identify affected devices, signers, contracts and operation history, then involve the access administrator.
- Action
- Revoke affected devices or permissions and pause relevant targets as appropriate. With EmergencyPauseManager, inspect per-target failure events and actual pause state.
- Resume when
- Reconcile the impact, update credentials or permissions, complete a limited verification and obtain the designated owner’s approval to resume.
8. Manage releases and configuration changes
SDKs, applications, contracts and permissions are separate changes. Record the target, old and new values, affected workflows, validation method, executor and approver for each change.
| Change | Before and after checks |
|---|---|
| SDK / application | Review changelogs and type changes, then verify reads, the 10-unit allocation and recovery from unknown outcomes. Check compatibility with new database records before reverting the application. |
| Contract / initialization | Review architecture, ABI, permissions and state compatibility. Registering a new factory version does not change existing deployments; evaluate each target address. |
| Permissions / personnel | Verify required actions for the new operator, revoke obsolete permissions and devices, and update escalation contacts and approvals. |
After a change, reconcile a limited operation before expanding scope. If intake is held temporarily, distinguish in-flight and new requests and resume from the unresolved-operation list.
9. Complete the operational handover
Validate handover by having the operator investigate an operation ID and choose the next action, rather than relying on a walkthrough alone. The following evidence supports a go-live decision.
- Environment register: production connections, addresses, SDK/ABI versions, permissions and custody references are recorded.
- Successful-operation evidence: approval, transaction, confirmation decision and register display are traceable for the 10-unit allocation.
- Recovery evidence: double-clicks, missing responses and failed register updates were exercised without duplicate issuance.
- Monitoring and daily close: alert recipients, age thresholds, reconciliation checkpoints and owners of unresolved items are assigned.
- Continuity: backup operators, revocation, restore procedures, release revalidation and pause/resume decision owners are confirmed.
Information for technical support
Include timestamp and time zone, environment, chain ID, contract, SDK/application versions, operation ID, available transaction hashes, HTTP status/errorCode and expected versus actual results. Note whether a retry occurred and the last successful stage.
Redact private keys, OTPs, sessions, highTrustToken and customer personal data before sharing logs. Use request IDs for support tracing, separately from the application operationId used in duplicate-execution controls.