> For the complete documentation index, see [llms.txt](https://docs.hiveauth.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hiveauth.com/has-for-wallets-pksa/transactions/transaction-request.md).

# Transaction request

When an **APP** sends a transaction request involving an account to the **HAS**, if the **PKSA** has registered that account with the **HAS** then it will receive the following message:

### sign\_req

```javascript
{
    cmd: "sign_req" 
    account: string
    data: string
    uuid: string
    expire: number
    token: string // DEPRECATED - protocol < 1 only
}
```

{% tabs %}
{% tab title="Properties" %}

* **`account`**: the Hive account name
* **`data`**: the Base64 representation of an encrypted [`sign_req_data`](#sign_req_data) object
* **`uuid`** {string} the transaction request identifier
* **`expire`** {Number} UNIX time when the request will expire<br>
* **`token`**: the authentication token - ***DEPRECATED since protocol v1***
  {% endtab %}
  {% endtabs %}

The structure of the `sign_req_data` object is:

### sign\_req\_data

```javascript
{
    key_type: string
    ops: Array
    broadcast: boolean
    nonce: number
}
```

{% tabs %}
{% tab title="Properties" %}

* **`key_type`**: the key type required to sign the transactions. It can be one of `posting`|`active`
* **`ops`**: an array of operations
* **`broadcast`**: `true` if the **PKSA** must broadcast the transaction to the blockchain. `false` if the **PKSA** must return a signed transaction but not broadcast it to the blockchain.
* **`nonce`**: UNIX time of the request
  {% endtab %}
  {% endtabs %}

Before sending its `sign_req` request, the **APP** has encrypted the `sign_req_data` using the encryption `key` shared with the **PKSA** during the authentication process.

Only a **PKSA** having previously authenticated an account and having access to the encryption `auth_key` will be able to decrypt the operations to be put in a transaction and to be signed.

As the **HAS** has no access to the \`auth\_key\`, it is completely unaware of what's going on between the **APP** and the **PKSA**.