Skip to main content
POST
Fetch one beneficiary
The field above is what you encrypt, not what goes on the wire. The body is always { "data": "<aes-256-gcm ciphertext>" } — see Authentication.
POST, not GET. The consumer API carries an AES-encrypted request body, which a GET cannot — so the action is in the path and everything else is in the encrypted payload. The same convention getPayoutStatus follows.
recipient_details comes back masked — an account number is reduced to its last digits. A read is not a way to recover what you stored. Keep your own copy if you need the full value.
An id that belongs to another account returns beneficiary_not_found, exactly as a non-existent one does — the endpoint never confirms that someone else’s beneficiary exists.

Example request

The snippets assume you have already encrypted the body and signed the request — see the Quickstart for the full helper in Node and Python.
See Beneficiaries for how saving and reusing recipients fits together, and Errors for the envelope shape shared by every endpoint.

Authorizations

x-api-key
string
header
required

Identifies your account. Issued from Developer Tools in the dashboard.

Authorization
string
header
required

Short-lived token from /api/v1/user/login, bound to your account and mode. Expires in 900 seconds.

Headers

x-timestamp
integer<int64>
required

Unix epoch in seconds — not milliseconds. Must be within ±5 minutes of our clock, which is what makes a captured request unusable later. Keep your client's clock NTP-synced.

Example:

1748023400

x-signature
string
required

HMAC-SHA256 over the signing string, hex encoded. The timestamp is part of what is signed, so a replayed body cannot be re-dated. See https://docs.pontisglobe.com/authentication for how it is built.

Example:

"2f8a9b4c1d7e0a3f6b8c2d5e9f1a4b7c0d3e6f9a2b5c8d1e4f7a0b3c6d9e2f5a"

Body

application/json
beneficiary_id
string<uuid>
required

Response

The beneficiary.

ok
enum<boolean>
Available options:
true
data
object