The sign queue

Your party is hosted on the desk's participant node, but the desk never holds your party key — you generate it at registration and keep it. So every ledger effect that needs your signature has to reach you as a prepared transaction you sign yourself.

Almost always, it reaches you as the answer to the call that caused it:

If a call cannot take effect until you sign, it returns the actions in its own response.

Registration returns your activation. Quoting returns the proposal pair. Accepting a deposit returns the accept. You sign their hashes and submit them — all of them at once — to POST /tx/execute. That is the whole loop, and the Quickstart signer implements it in ~15 lines.

What still arrives unasked

One thing has no call of yours behind it: when a taker accepts your quote, the desk prepares your allocations. Nobody asked for them, so nothing can return them. They arrive on GET /tx/pending, and as sign.requested on your stream.

(accept-dvp also exists, but it is the taker's side of an accept — a maker never sees it.)

The queue is also your recovery path

Everything returned inline is also queued. If a response is lost to a timeout, a crash, or a retry you never saw the answer to, GET /tx/pending still has it — polling it is always safe and returns {actions: []} when there is nothing to do. Repeating a request that enqueues (quoting the same RFQ, re-accepting the same deposit) hands back the action already pending, never a duplicate.

Rules that bite

• hash is base64 of raw bytes. Decode the base64 first, sign those bytes, then base64-encode the signature. The only string signed as plain UTF-8 text anywhere in this API is the key-rotation challenge.
• Batch results are per-action. POST /tx/execute with a signatures array answers 200 with one {actionId, status} per entry, and a failure does not abort the rest. Partial success is ordinary — check each status, not just the HTTP code. After a timed-out execute, check GET /tx/pending before resending: entries that already executed answer error on a blind retry (see Error handling).
• Actions expire after 10 minutes and are then simply dropped. Nothing breaks: whatever needed the signature re-drives on its own (a dropped quote signature just means you re-quote).
• An unsigned quote does not exist for the taker. Until both propose-dvp actions are signed, your quote is unanchored and invisible — see Quotes live on the ledger.