> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aropay.aro.media/llms.txt
> Use this file to discover all available pages before exploring further.

# .nota files

> Notareum resource files: shareable address cards, passphrase-encrypted key exports, and notarized transaction receipts.

Several AroPay endpoints return a `.nota` file: a serialized **Notareum
resource**. Think of it as a portable, typed envelope for payment artifacts:
instead of copy-pasting hex strings or screenshotting receipts, you exchange a
file that any Aro surface understands.

All `.nota` endpoints return the same shape:

```json theme={null}
{
  "ok": true,
  "data": {
    "filename": "payouts-address.nota",
    "nota": "…serialized resource…"
  }
}
```

Write the `nota` payload to disk under the suggested `filename`:

```bash theme={null}
curl -s "$BASE/wallets/$WALLET/nota" -H "Authorization: Bearer $KEY" \
  | jq -r .data.nota > payouts-address.nota
```

## The three kinds

<CardGroup cols={3}>
  <Card title="Address card" icon="address-card" iconType="duotone">
    `GET /wallets/{id}/nota`. The file twin of a receive QR: public address
    plus chain context, no key material. Safe to share freely.
  </Card>

  <Card title="Key export" icon="file-shield" iconType="duotone">
    `POST /wallets/{id}/export`. A custodial wallet's private key,
    re-encrypted under **your** passphrase before it leaves the server.
    Handle like a secret.
  </Card>

  <Card title="Transaction receipt" icon="file-invoice-dollar" iconType="duotone">
    `GET /transactions/{id}/nota`. A notarized receipt for a transaction
    that reached the chain. Attach it to invoices or audit trails.
  </Card>
</CardGroup>

## Address cards

Any wallet (custodial or external) can produce an address card. Recipients
import it into any Aro recipient field (including
[external wallet registration](/concepts/wallets)) instead of pasting an
address, eliminating transcription errors.

```bash theme={null}
# Alice exports her card…
curl -s "$BASE/wallets/$WALLET/nota" -H "Authorization: Bearer $ALICE_KEY" \
  | jq -r .data.nota > alice.nota

# …Bob registers it as a watch-only wallet
curl -s "$BASE/wallets" -H "Authorization: Bearer $BOB_KEY" \
  -H "content-type: application/json" \
  -d "{\"type\":\"external\",\"nota\":\"$(cat alice.nota)\",\"label\":\"Alice\"}"
```

A malformed or wrong-type file is rejected with `400 invalid_nota`.

## Key exports

Exporting a custodial key is deliberately guarded:

* **Session-only**: API keys get `403 session_required`; you must be signed
  in to a browser session.
* You supply a **passphrase (8–200 characters)**; the key is encrypted
  server-side with PBKDF2-SHA256 (310,000 iterations) + AES-256-GCM. The
  plaintext key never crosses the wire.
* Only custodial wallets can be exported; there is nothing to export for a
  watch-only address.

See [Export & backup](/guides/export-and-backup) for the full flow and
handling guidance.

## Transaction receipts

Receipts are generated from on-chain state, so they exist only for
transactions that actually reached the chain. A transaction that is still
being submitted (or failed before submission) returns `400` until (unless)
it can be represented. For redeems, the receipt reflects both legs once
settled.

<Note>
  `.nota` content is opaque to the API consumer; treat it as a blob. Its
  internal structure is a Notareum implementation detail and may evolve;
  round-trip it through Aro surfaces rather than parsing it yourself.
</Note>