TRPscout Technical Documentation

┌─────────────────────────────────────────────────────────────┐
│                    TRPscout Platform                        │
├─────────────────────────────────────────────────────────────┤
│  API Gateway & Authentication Layer                         │
├─────────────────────────────────────────────────────────────┤
│  TRP Protocol Engine    │  Policy Engine  │  Identity Mgmt  │
├─────────────────────────────────────────────────────────────┤
│  Message Router    │  Encryption Service │  Audit Logger    │
├─────────────────────────────────────────────────────────────┤
│  KYC/AML Engine   │  Risk Scoring       │  Workflow Engine │
├─────────────────────────────────────────────────────────────┤
│  Database Layer (Encrypted Storage)                         │
└─────────────────────────────────────────────────────────────┘

Client Request → API Gateway → Authentication → Policy Engine
                                                      ↓
Audit Logger ← Message Router ← TRP Engine ← Risk Assessment
                    ↓
            Counterparty VASP

travel://[VASP_IDENTIFIER]@[HOSTNAME]:[PORT]/[API_ENDPOINT]?[PARAMETERS]

travel://vaspdomain.com@api.trpscout.com:443/v1/transfer?protocol=trp

{
  "version": "1.0",
  "messageId": "uuid-v4",
  "timestamp": "2025-06-03T10:30:00Z",
  "originator": {
    "vaspId": "originator-vasp-id",
    "address": "travel://originator@domain.com",
    "publicKey": "base64-encoded-key"
  },
  "beneficiary": {
    "vaspId": "beneficiary-vasp-id", 
    "address": "travel://beneficiary@domain.com",
    "publicKey": "base64-encoded-key"
  },
  "transfer": {
    "amount": "1000.00",
    "currency": "USD",
    "virtualAsset": "BTC",
    "blockchain": "bitcoin"
  },
  "compliance": {
    "threshold": 1000,
    "jurisdiction": "US",
    "regulations": ["FATF-16", "BSA"]
  },
  "signature": "cryptographic-signature"
}

GET /api/v1/vasp/discovery
Authorization: Bearer {jwt_token}
Content-Type: application/json

{
  "address": "travel://target-vasp@domain.com",
  "protocols": ["trp-1.0"],
  "verification_level": "enhanced"
}

Client → mTLS → API Gateway → JWT Validation → Service Mesh → Target Service

type KeyManager interface {
    GenerateKeyPair(algorithm string) (*KeyPair, error)
    SignMessage(message []byte, privateKey *PrivateKey) (*Signature, error)
    VerifySignature(message []byte, signature *Signature, publicKey *PublicKey) bool
    EncryptData(data []byte, publicKey *PublicKey) (*EncryptedData, error)
    DecryptData(encryptedData *EncryptedData, privateKey *PrivateKey) ([]byte, error)
}

POST /api/v1/transfers/initiate
Authorization: Bearer {jwt_token}
Content-Type: application/json

{
  "originatorInfo": {
    "name": "John Doe",
    "address": "123 Main St, New York, NY",
    "accountNumber": "ACC-123456",
    "nationalId": "SSN-987654321"
  },
  "beneficiaryInfo": {
    "name": "Jane Smith", 
    "address": "456 Oak Ave, Los Angeles, CA",
    "accountNumber": "ACC-789012",
    "vaspId": "beneficiary-vasp-id"
  },
  "transferDetails": {
    "amount": "1500.00",
    "currency": "USD",
    "virtualAsset": "BTC",
    "threshold": 1000
  }
}

{
  "transferId": "uuid-v4",
  "status": "initiated",
  "complianceCheck": "passed",
  "messageId": "trp-message-uuid",
  "timestamp": "2025-06-03T10:30:00Z"
}

GET /api/v1/vasp/discover/{travel_address}
Authorization: Bearer {jwt_token}

Response:
{
  "vaspId": "discovered-vasp-id",
  "capabilities": ["trp-1.0", "kyc-verification", "aml-screening"],
  "endpoints": {
    "transfer": "https://api.vasp.com/v1/transfers",
    "verification": "https://api.vasp.com/v1/verify"
  },
  "certificates": ["x509-cert-chain"],
  "trustLevel": "verified"
}

GET /api/v1/compliance/status/{transfer_id}
Authorization: Bearer {jwt_token}

Response:
{
  "transferId": "uuid-v4",
  "complianceStatus": "compliant",
  "regulationsChecked": ["FATF-16", "MiCA", "GDPR"],
  "riskScore": 15,
  "amlStatus": "cleared",
  "kycStatus": "verified",
  "lastUpdated": "2025-06-03T10:35:00Z"
}

POST /api/v1/identity/did/create
Authorization: Bearer {jwt_token}
Content-Type: application/json

{
  "method": "did:key",
  "keyType": "Ed25519",
  "purpose": ["authentication", "assertionMethod"]
}

Response:
{
  "did": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
  "publicKey": "base64-encoded-public-key",
  "keyId": "key-1"
}

POST /api/v1/credentials/issue
Authorization: Bearer {jwt_token}
Content-Type: application/json

{
  "type": ["VerifiableCredential", "KYCCredential"],
  "issuer": "did:key:issuer-did",
  "subject": "did:key:subject-did",
  "claims": {
    "kycLevel": "enhanced",
    "verifiedDate": "2025-06-03",
    "jurisdiction": "US"
  }
}

apiVersion: v1
kind: ConfigMap
metadata:
  name: trpscout-config
data:
  database_url: "postgresql://encrypted-connection"
  redis_url: "redis://cluster-endpoint"
  kafka_brokers: "broker1:9092,broker2:9092"
  encryption_key: "base64-encoded-key"
  log_level: "info"

Minimum Requirements:
- CPU: 8 cores (16 recommended)
- RAM: 32GB (64GB recommended) 
- Storage: 1TB SSD (enterprise grade)
- Network: 1Gbps connection with redundancy

Recommended Architecture:  
- 3-node Kubernetes cluster
- PostgreSQL cluster with replication
- Redis cluster for high availability
- Load balancer with SSL termination

# 1. Install TRPscout via Helm
helm repo add trpscout https://charts.trpscout.com
helm install trpscout trpscout/trpscout-platform \
  --set database.host=localhost \
  --set encryption.hsm.enabled=true \
  --set compliance.jurisdiction=US

# 2. Initialize database schema
kubectl exec -it trpscout-migrate -- /app/migrate up

# 3. Generate system certificates
kubectl exec -it trpscout-ca -- /app/generate-certs

# 4. Verify installation
curl -k https://localhost:8443/health

# Node.js
npm install @trpscout/sdk

# Python  
pip install trpscout-sdk

# Go
go get github.com/trpscout/go-sdk

const TRPScout = require('@trpscout/sdk');

const client = new TRPScout({
  apiKey: 'your-api-key',
  endpoint: 'https://api.trpscout.com',
  version: 'v1'
});

// Initiate transfer
const transfer = await client.transfers.initiate({
  originator: originatorData,
  beneficiary: beneficiaryData,
  amount: 1500.00,
  currency: 'USD'
});

console.log('Transfer ID:', transfer.id);

# Generate VASP certificate signing request
openssl req -new -newkey rsa:4096 -nodes \
  -keyout vasp-private.key \
  -out vasp-csr.csr \
  -subj "/CN=vasp.domain.com/O=Your VASP Name"

# Submit CSR to TRPscout CA for signing
curl -X POST https://ca.trpscout.com/v1/sign \
  -H "Authorization: Bearer {api_key}" \
  -F "csr=@vasp-csr.csr"

// Webhook endpoint for real-time notifications
app.post('/webhooks/trpscout', (req, res) => {
  const event = req.body;
  
  switch(event.type) {
    case 'transfer.compliance_check':
      handleComplianceCheck(event.data);
      break;
    case 'transfer.completed':
      handleTransferComplete(event.data);
      break;
    case 'vasp.discovered':
      handleVaspDiscovery(event.data);
      break;
  }
  
  res.status(200).send('OK');
});

import trpscout

client = trpscout.Client(api_key='your-key')

# Process batch of transfers
transfers = [
    {'originator': orig1, 'beneficiary': ben1, 'amount': 1000},
    {'originator': orig2, 'beneficiary': ben2, 'amount': 2000}
]

batch_result = client.transfers.batch_process(transfers)
for result in batch_result:
    print(f"Transfer {result.id}: {result.status}")

{
  "@context": ["https://www.w3.org/ns/did/v1"],
  "id": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
  "verificationMethod": [{
    "id": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK#z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
    "type": "Ed25519VerificationKey2020",
    "controller": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
    "publicKeyMultibase": "z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
  }],
  "authentication": ["#z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"],
  "assertionMethod": ["#z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"]
}

func VerifyCredential(credential *VerifiableCredential) (*VerificationResult, error) {
    // 1. Validate credential structure
    if err := validateCredentialStructure(credential); err != nil {
        return nil, err
    }
    
    // 2. Resolve issuer DID
    issuerDoc, err := resolveDID(credential.Issuer)
    if err != nil {
        return nil, err
    }
    
    // 3. Verify cryptographic proof
    valid, err := verifySignature(credential.Proof, issuerDoc.PublicKey)
    if err != nil {
        return nil, err
    }
    
    // 4. Check expiration and revocation
    if isExpired(credential) || isRevoked(credential) {
        return &VerificationResult{Valid: false, Reason: "expired_or_revoked"}, nil
    }
    
    return &VerificationResult{Valid: valid, TrustLevel: "high"}, nil
}

Document Upload → OCR/AI Processing → Data Extraction → 
Verification → Risk Assessment → Credential Issuance

// Biometric enrollment
const biometricData = await client.biometric.enroll({
  userId: 'user-123',
  biometricType: 'facial',
  livenesCheck: true,
  qualityThreshold: 0.85
});

// Biometric verification during transaction
const verification = await client.biometric.verify({
  userId: 'user-123',
  biometricSample: capturedBiometric,
  transactionId: 'txn-456'
});

policies:
  - name: "US_FATF_Compliance"
    jurisdiction: "US"
    rules:
      - condition: "transfer.amount >= 1000"
        action: "require_travel_rule"
        priority: 1
      - condition: "counterparty.risk_score > 80"
        action: "manual_review"
        priority: 2
      - condition: "originator.kyc_level == 'enhanced'"
        action: "auto_approve"
        priority: 3

  - name: "EU_MiCA_Compliance"  
    jurisdiction: "EU"
    rules:
      - condition: "transfer.amount >= 1000"
        action: "require_travel_rule"
      - condition: "counterparty.jurisdiction not_in ['EU', 'EEA']"
        action: "enhanced_screening"

class PolicyEngine:
    def evaluate_transfer(self, transfer_data, jurisdiction):
        policies = self.load_policies(jurisdiction)
        results = []
        
        for policy in policies:
            for rule in policy.rules:
                if self.evaluate_condition(rule.condition, transfer_data):
                    results.append({
                        'action': rule.action,
                        'priority': rule.priority,
                        'rule': rule.name
                    })
        
        return self.resolve_actions(results)

[Initiated] → [Screening] → [Compliance Check] → [Approved/Rejected]
     ↓             ↓              ↓
[Failed] ← [Manual Review] ← [Flagged]

type WorkflowEngine struct {
    policyEngine   *PolicyEngine
    riskScorer     *RiskScorer
    auditLogger    *AuditLogger
}

func (w *WorkflowEngine) ProcessTransfer(transfer *Transfer) (*Decision, error) {
    // 1. Risk scoring
    riskScore, err := w.riskScorer.ScoreTransfer(transfer)
    if err != nil {
        return nil, err
    }
    
    // 2. Policy evaluation
    actions, err := w.policyEngine.Evaluate(transfer, riskScore)
    if err != nil {
        return nil, err
    }
    
    // 3. Decision making
    decision := w.makeDecision(actions, riskScore)
    
    // 4. Audit logging
    w.auditLogger.LogDecision(transfer.ID, decision, actions)
    
    return decision, nil
}

# Transfer processing metrics
trpscout_transfers_total{status="completed|failed|pending"}
trpscout_transfer_duration_seconds{operation="screening|compliance|approval"}
trpscout_compliance_checks_total{jurisdiction="US|EU|UK"}

# System health metrics
trpscout_api_requests_total{endpoint="/transfers|/compliance|/identity"}
trpscout_error_rate{service="policy-engine|trp-engine|identity-service"}
trpscout_database_connections{status="active|idle"}

alerts:
  - name: HighErrorRate
    condition: rate(trpscout_error_rate[5m]) > 0.05
    severity: warning
    description: "Error rate exceeding 5% over 5 minutes"
    
  - name: ComplianceFailure
    condition: trpscout_compliance_checks_total{status="failed"} > 10
    severity: critical
    description: "Multiple compliance check failures detected"

{
  "timestamp": "2025-06-03T10:30:00Z",
  "eventType": "transfer_compliance_check",
  "userId": "user-123",
  "transferId": "txn-456",
  "jurisdiction": "US",
  "regulations": ["FATF-16", "BSA"],
  "decision": "approved",
  "riskScore": 25,
  "automatedDecision": true,
  "reviewRequired": false,
  "hash": "sha256-hash-of-event",
  "signature": "cryptographic-signature"
}

-- Generate monthly compliance report
SELECT 
    jurisdiction,
    COUNT(*) as total_transfers,
    SUM(CASE WHEN status = 'compliant' THEN 1 ELSE 0 END) as compliant_transfers,
    AVG(risk_score) as avg_risk_score,
    COUNT(CASE WHEN manual_review = true THEN 1 END) as manual_reviews
FROM transfers 
WHERE created_at >= DATE_TRUNC('month', CURRENT_DATE - INTERVAL '1 month')
    AND created_at < DATE_TRUNC('month', CURRENT_DATE)
GROUP BY jurisdiction;

Load Balancer → API Gateway Cluster → Microservices Mesh
                        ↓
            Message Queue (Kafka) → Worker Pools
                        ↓
         Database Cluster (PostgreSQL) + Cache (Redis)

type CacheManager struct {
    redis        *redis.ClusterClient
    localCache   *bigcache.BigCache
    ttl          time.Duration
}

func (c *CacheManager) GetVASPInfo(vaspId string) (*VASPInfo, error) {
    // Check local cache first
    if data, err := c.localCache.Get(vaspId); err == nil {
        var vasp VASPInfo
        json.Unmarshal(data, &vasp)
        return &vasp, nil
    }
    
    // Check Redis cache
    if data, err := c.redis.Get(vaspId).Result(); err == nil {
        var vasp VASPInfo
        json.Unmarshal([]byte(data), &vasp)
        
        // Update local cache
        c.localCache.Set(vaspId, []byte(data))
        return &vasp, nil
    }
    
    // Fetch from database and cache
    vasp, err := c.fetchFromDatabase(vaspId)
    if err != nil {
        return nil, err
    }
    
    c.cacheVASPInfo(vaspId, vasp)
    return vasp, nil
}

-- Optimized indexes for common queries
CREATE INDEX CONCURRENTLY idx_transfers_status_created 
    ON transfers (status, created_at) 
    WHERE status IN ('pending', 'processing');

CREATE INDEX CONCURRENTLY idx_transfers_vasp_jurisdiction 
    ON transfers (originator_vasp_id, beneficiary_vasp_id, jurisdiction);

-- Partitioning for large tables
CREATE TABLE transfers_2025_q2 PARTITION OF transfers
    FOR VALUES FROM ('2025-04-01') TO ('2025-07-01');