Payouts quickstart

This guide walks you from “I just got credentials” to “I just received a successful transaction response.”

This is the payout walkthrough — money going out from you to a recipient. Taking money in has its own guide: Payins. Steps 1 and 2 below (credentials and the request helper) are shared by both, so nothing here is wasted; step 3, logging in for a JWT, is payout-only.

1. Get your credentials

After signing up at pontisglobe.com and completing KYC, open Developer Tools to find:

Not started yet? Steps to get API access and go live walks through what happens before this page applies to you.

Field	What it’s for
API Key	Identifies your account. Sent as the `x-api-key` header.
Encryption Secret	AES-256-GCM key used to encrypt the request body.
HMAC Secret	HMAC-SHA256 key used to sign each request and to verify our callbacks.

Treat all three secrets like passwords. They give full access to your account. If a value leaks, use Regenerate All Credentials immediately.

2. Set up the request helper

Each call does three things: encrypt the body with AES-256-GCM, sign timestamp + "." + encrypted_body with HMAC-SHA256, then POST. Pick your language — the snippet below is a self-contained helper you can drop in and call from anywhere in your code.

import { createCipheriv, createHmac, randomBytes } from 'node:crypto'

const BASE_URL = 'https://api.pontisglobe.com'
const API_KEY = 'YOUR_API_KEY'
const ENC_SECRET = 'YOUR_ENCRYPTION_SECRET' // base64url
const HMAC_SECRET = 'YOUR_HMAC_SECRET' // base64url

function encrypt(plain) {
  const key = Buffer.from(ENC_SECRET, 'base64url')
  const iv = randomBytes(12)
  const c = createCipheriv('aes-256-gcm', key, iv)
  const ct = Buffer.concat([c.update(JSON.stringify(plain), 'utf8'), c.final()])
  return [iv, c.getAuthTag(), ct].map((b) => b.toString('base64url')).join(':')
}

export async function call(path, body, jwt = null) {
  const ts = String(Math.floor(Date.now() / 1000))
  const enc = encrypt(body)
  const sig = createHmac('sha256', Buffer.from(HMAC_SECRET, 'base64url'))
    .update(`${ts}.${enc}`)
    .digest('hex')
  const headers = {
    'content-type': 'application/json',
    'x-api-key': API_KEY,
    'x-timestamp': ts,
    'x-signature': sig,
  }
  if (jwt) headers['authorization'] = `Bearer ${jwt}`
  const res = await fetch(`${BASE_URL}${path}`, {
    method: 'POST',
    headers,
    body: JSON.stringify({ data: enc }),
  })
  return { status: res.status, body: await res.json() }
}

# pip install pycryptodome requests
import json, time, base64, secrets, hmac, hashlib, requests
from Crypto.Cipher import AES

BASE_URL = 'https://api.pontisglobe.com'
API_KEY = 'YOUR_API_KEY'
ENC_SECRET = 'YOUR_ENCRYPTION_SECRET'   # base64url
HMAC_SECRET = 'YOUR_HMAC_SECRET'         # base64url

def b64url(b): return base64.urlsafe_b64encode(b).rstrip(b'=').decode()
def b64url_decode(s):
    pad = '=' * (-len(s) % 4)
    return base64.urlsafe_b64decode(s + pad)

def encrypt(plain):
    key = b64url_decode(ENC_SECRET)
    iv = secrets.token_bytes(12)
    cipher = AES.new(key, AES.MODE_GCM, nonce=iv)
    ct, tag = cipher.encrypt_and_digest(json.dumps(plain).encode())
    return f"{b64url(iv)}:{b64url(tag)}:{b64url(ct)}"

def call(path, body, jwt=None):
    ts = str(int(time.time()))
    enc = encrypt(body)
    sig = hmac.new(b64url_decode(HMAC_SECRET),
                   f"{ts}.{enc}".encode(),
                   hashlib.sha256).hexdigest()
    headers = {
        'content-type': 'application/json',
        'x-api-key': API_KEY,
        'x-timestamp': ts,
        'x-signature': sig,
    }
    if jwt: headers['authorization'] = f'Bearer {jwt}'
    r = requests.post(f'{BASE_URL}{path}', json={'data': enc}, headers=headers)
    return r.status_code, r.json()

# cURL can't reasonably do the encrypt+sign loop natively. Generate the
# encrypted body and signature in any language above, then send the request:

curl -X POST "https://api.pontisglobe.com/api/v1/user/login" \
  -H "content-type: application/json" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "x-timestamp: 1748023400" \
  -H "x-signature: 2f8a9b…" \
  -d '{"data":"<iv>:<tag>:<ciphertext>"}'

package pontis

import (
  "bytes"
  "crypto/aes"
  "crypto/cipher"
  "crypto/hmac"
  "crypto/rand"
  "crypto/sha256"
  "encoding/base64"
  "encoding/hex"
  "encoding/json"
  "fmt"
  "net/http"
  "time"
)

const (
  BaseURL    = "https://api.pontisglobe.com"
  APIKey     = "YOUR_API_KEY"
  EncSecret  = "YOUR_ENCRYPTION_SECRET"  // base64url
  HMACSecret = "YOUR_HMAC_SECRET"         // base64url
)

func encrypt(plain interface{}) (string, error) {
  body, _ := json.Marshal(plain)
  key, _ := base64.RawURLEncoding.DecodeString(EncSecret)
  block, _ := aes.NewCipher(key)
  gcm, _ := cipher.NewGCM(block)
  iv := make([]byte, 12)
  if _, err := rand.Read(iv); err != nil { return "", err }
  sealed := gcm.Seal(nil, iv, body, nil)
  ct, tag := sealed[:len(sealed)-16], sealed[len(sealed)-16:]
  return fmt.Sprintf("%s:%s:%s",
    base64.RawURLEncoding.EncodeToString(iv),
    base64.RawURLEncoding.EncodeToString(tag),
    base64.RawURLEncoding.EncodeToString(ct)), nil
}

func Call(path string, body interface{}, jwt string) (*http.Response, error) {
  ts := fmt.Sprintf("%d", time.Now().Unix())
  enc, err := encrypt(body)
  if err != nil { return nil, err }
  key, _ := base64.RawURLEncoding.DecodeString(HMACSecret)
  mac := hmac.New(sha256.New, key)
  mac.Write([]byte(ts + "." + enc))
  sig := hex.EncodeToString(mac.Sum(nil))

  payload, _ := json.Marshal(map[string]string{"data": enc})
  req, _ := http.NewRequest("POST", BaseURL+path, bytes.NewReader(payload))
  req.Header.Set("content-type", "application/json")
  req.Header.Set("x-api-key", APIKey)
  req.Header.Set("x-timestamp", ts)
  req.Header.Set("x-signature", sig)
  if jwt != "" { req.Header.Set("authorization", "Bearer "+jwt) }
  return http.DefaultClient.Do(req)
}

import javax.crypto.Cipher;
import javax.crypto.Mac;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.net.URI;
import java.net.http.*;
import java.security.SecureRandom;
import java.util.Base64;

public class PontisClient {
  static final String BASE_URL = "https://api.pontisglobe.com";
  static final String API_KEY = "YOUR_API_KEY";
  static final String ENC_SECRET = "YOUR_ENCRYPTION_SECRET";   // base64url
  static final String HMAC_SECRET = "YOUR_HMAC_SECRET";         // base64url

  static byte[] b64urlDecode(String s) { return Base64.getUrlDecoder().decode(s); }
  static String b64url(byte[] b) { return Base64.getUrlEncoder().withoutPadding().encodeToString(b); }

  static String encrypt(String json) throws Exception {
    byte[] key = b64urlDecode(ENC_SECRET);
    byte[] iv = new byte[12];
    new SecureRandom().nextBytes(iv);
    Cipher c = Cipher.getInstance("AES/GCM/NoPadding");
    c.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(key, "AES"), new GCMParameterSpec(128, iv));
    byte[] out = c.doFinal(json.getBytes());
    byte[] ct = new byte[out.length - 16];
    byte[] tag = new byte[16];
    System.arraycopy(out, 0, ct, 0, ct.length);
    System.arraycopy(out, ct.length, tag, 0, 16);
    return b64url(iv) + ":" + b64url(tag) + ":" + b64url(ct);
  }

  public static HttpResponse<String> call(String path, String jsonBody, String jwt) throws Exception {
    String ts = String.valueOf(System.currentTimeMillis() / 1000);
    String enc = encrypt(jsonBody);
    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(b64urlDecode(HMAC_SECRET), "HmacSHA256"));
    byte[] raw = mac.doFinal((ts + "." + enc).getBytes());
    StringBuilder sb = new StringBuilder();
    for (byte b : raw) sb.append(String.format("%02x", b));
    String sig = sb.toString();

    HttpRequest.Builder req = HttpRequest.newBuilder()
      .uri(URI.create(BASE_URL + path))
      .header("content-type", "application/json")
      .header("x-api-key", API_KEY)
      .header("x-timestamp", ts)
      .header("x-signature", sig)
      .POST(HttpRequest.BodyPublishers.ofString("{\"data\":\"" + enc + "\"}"));
    if (jwt != null) req.header("authorization", "Bearer " + jwt);
    return HttpClient.newHttpClient().send(req.build(), HttpResponse.BodyHandlers.ofString());
  }
}

// Uses Java stdlib for crypto + OkHttp for HTTP. Add: implementation("com.squareup.okhttp3:okhttp:4.12.0")
import okhttp3.*
import okhttp3.MediaType.Companion.toMediaType
import okhttp3.RequestBody.Companion.toRequestBody
import javax.crypto.Cipher
import javax.crypto.Mac
import javax.crypto.spec.GCMParameterSpec
import javax.crypto.spec.SecretKeySpec
import java.security.SecureRandom
import java.util.Base64

object PontisClient {
  const val BASE_URL = "https://api.pontisglobe.com"
  const val API_KEY = "YOUR_API_KEY"
  const val ENC_SECRET = "YOUR_ENCRYPTION_SECRET"   // base64url
  const val HMAC_SECRET = "YOUR_HMAC_SECRET"         // base64url

  private fun b64urlDecode(s: String): ByteArray = Base64.getUrlDecoder().decode(s)
  private fun b64url(b: ByteArray): String =
    Base64.getUrlEncoder().withoutPadding().encodeToString(b)

  private fun encrypt(json: String): String {
    val key = b64urlDecode(ENC_SECRET)
    val iv = ByteArray(12).also { SecureRandom().nextBytes(it) }
    val c = Cipher.getInstance("AES/GCM/NoPadding")
    c.init(Cipher.ENCRYPT_MODE, SecretKeySpec(key, "AES"), GCMParameterSpec(128, iv))
    val out = c.doFinal(json.toByteArray())
    val ct = out.copyOfRange(0, out.size - 16)
    val tag = out.copyOfRange(out.size - 16, out.size)
    return "${b64url(iv)}:${b64url(tag)}:${b64url(ct)}"
  }

  fun call(path: String, jsonBody: String, jwt: String? = null): Response {
    val ts = (System.currentTimeMillis() / 1000).toString()
    val enc = encrypt(jsonBody)
    val mac = Mac.getInstance("HmacSHA256").apply {
      init(SecretKeySpec(b64urlDecode(HMAC_SECRET), "HmacSHA256"))
    }
    val sig = mac.doFinal("$ts.$enc".toByteArray()).joinToString("") { "%02x".format(it) }

    val req = Request.Builder()
      .url(BASE_URL + path)
      .post("""{"data":"$enc"}""".toRequestBody("application/json".toMediaType()))
      .addHeader("x-api-key", API_KEY)
      .addHeader("x-timestamp", ts)
      .addHeader("x-signature", sig)
      .apply { jwt?.let { addHeader("authorization", "Bearer $it") } }
      .build()
    return OkHttpClient().newCall(req).execute()
  }
}

<?php
const BASE_URL = 'https://api.pontisglobe.com';
const API_KEY = 'YOUR_API_KEY';
const ENC_SECRET = 'YOUR_ENCRYPTION_SECRET';   // base64url
const HMAC_SECRET = 'YOUR_HMAC_SECRET';         // base64url

function b64url(string $s): string {
  return rtrim(strtr(base64_encode($s), '+/', '-_'), '=');
}
function b64url_decode(string $s): string {
  return base64_decode(strtr($s, '-_', '+/'));
}

function encrypt(array $plain): string {
  $key = b64url_decode(ENC_SECRET);
  $iv = random_bytes(12);
  $tag = '';
  $ct = openssl_encrypt(json_encode($plain), 'aes-256-gcm', $key, OPENSSL_RAW_DATA, $iv, $tag);
  return b64url($iv) . ':' . b64url($tag) . ':' . b64url($ct);
}

function call(string $path, array $body, ?string $jwt = null): array {
  $ts = (string) time();
  $enc = encrypt($body);
  $sig = hash_hmac('sha256', "$ts.$enc", b64url_decode(HMAC_SECRET));
  $headers = [
    'content-type: application/json',
    'x-api-key: ' . API_KEY,
    "x-timestamp: $ts",
    "x-signature: $sig",
  ];
  if ($jwt) $headers[] = "authorization: Bearer $jwt";

  $ch = curl_init(BASE_URL . $path);
  curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => $headers,
    CURLOPT_POSTFIELDS => json_encode(['data' => $enc]),
    CURLOPT_RETURNTRANSFER => true,
  ]);
  $body = curl_exec($ch);
  return ['status' => curl_getinfo($ch, CURLINFO_HTTP_CODE), 'body' => json_decode($body, true)];
}

require 'json'
require 'base64'
require 'openssl'
require 'securerandom'
require 'net/http'

BASE_URL    = 'https://api.pontisglobe.com'
API_KEY     = 'YOUR_API_KEY'
ENC_SECRET  = 'YOUR_ENCRYPTION_SECRET'   # base64url
HMAC_SECRET = 'YOUR_HMAC_SECRET'          # base64url

def b64url(b)        = Base64.urlsafe_encode64(b, padding: false)
def b64url_decode(s) = Base64.urlsafe_decode64(s)

def encrypt(plain)
  cipher = OpenSSL::Cipher.new('aes-256-gcm')
  cipher.encrypt
  cipher.key = b64url_decode(ENC_SECRET)
  iv = SecureRandom.bytes(12)
  cipher.iv = iv
  ct = cipher.update(plain.to_json) + cipher.final
  "#{b64url(iv)}:#{b64url(cipher.auth_tag)}:#{b64url(ct)}"
end

def call(path, body, jwt = nil)
  ts  = Time.now.to_i.to_s
  enc = encrypt(body)
  sig = OpenSSL::HMAC.hexdigest('SHA256', b64url_decode(HMAC_SECRET), "#{ts}.#{enc}")
  uri = URI(BASE_URL + path)
  req = Net::HTTP::Post.new(uri, {
    'content-type' => 'application/json',
    'x-api-key'    => API_KEY,
    'x-timestamp'  => ts,
    'x-signature'  => sig,
  })
  req['authorization'] = "Bearer #{jwt}" if jwt
  req.body = { data: enc }.to_json
  res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }
  { status: res.code.to_i, body: JSON.parse(res.body) }
end

// .NET 5+ required for AesGcm
using System;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Threading.Tasks;

public static class PontisClient {
  const string BaseUrl    = "https://api.pontisglobe.com";
  const string ApiKey     = "YOUR_API_KEY";
  const string EncSecret  = "YOUR_ENCRYPTION_SECRET";   // base64url
  const string HmacSecret = "YOUR_HMAC_SECRET";          // base64url

  static byte[] B64UrlDecode(string s) {
    s = s.Replace('-', '+').Replace('_', '/');
    return Convert.FromBase64String(s.PadRight(s.Length + (4 - s.Length % 4) % 4, '='));
  }
  static string B64Url(byte[] b) =>
    Convert.ToBase64String(b).Replace('+', '-').Replace('/', '_').TrimEnd('=');

  static string Encrypt(object plain) {
    var key  = B64UrlDecode(EncSecret);
    var iv   = RandomNumberGenerator.GetBytes(12);
    var json = JsonSerializer.SerializeToUtf8Bytes(plain);
    var ct   = new byte[json.Length];
    var tag  = new byte[16];
    using var gcm = new AesGcm(key);
    gcm.Encrypt(iv, json, ct, tag);
    return $"{B64Url(iv)}:{B64Url(tag)}:{B64Url(ct)}";
  }

  public static async Task<(int Status, string Body)> Call(string path, object body, string jwt = null) {
    var ts  = DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString();
    var enc = Encrypt(body);
    using var hmac = new HMACSHA256(B64UrlDecode(HmacSecret));
    var sig = Convert.ToHexString(hmac.ComputeHash(Encoding.UTF8.GetBytes($"{ts}.{enc}"))).ToLower();

    var req = new HttpRequestMessage(HttpMethod.Post, BaseUrl + path);
    req.Headers.Add("x-api-key", ApiKey);
    req.Headers.Add("x-timestamp", ts);
    req.Headers.Add("x-signature", sig);
    if (jwt != null) req.Headers.Add("authorization", $"Bearer {jwt}");
    req.Content = new StringContent($"{{\"data\":\"{enc}\"}}", Encoding.UTF8, "application/json");

    var res = await new HttpClient().SendAsync(req);
    return ((int) res.StatusCode, await res.Content.ReadAsStringAsync());
  }
}

// iOS 13+ / macOS 10.15+ for CryptoKit
import Foundation
import CryptoKit

let baseURL    = "https://api.pontisglobe.com"
let apiKey     = "YOUR_API_KEY"
let encSecret  = "YOUR_ENCRYPTION_SECRET"   // base64url
let hmacSecret = "YOUR_HMAC_SECRET"          // base64url

func b64urlDecode(_ s: String) -> Data {
  var str = s.replacingOccurrences(of: "-", with: "+")
             .replacingOccurrences(of: "_", with: "/")
  while str.count % 4 != 0 { str += "=" }
  return Data(base64Encoded: str)!
}
func b64url(_ d: Data) -> String {
  d.base64EncodedString()
    .replacingOccurrences(of: "+", with: "-")
    .replacingOccurrences(of: "/", with: "_")
    .replacingOccurrences(of: "=", with: "")
}

func encrypt<T: Encodable>(_ plain: T) throws -> String {
  let data = try JSONEncoder().encode(plain)
  let key  = SymmetricKey(data: b64urlDecode(encSecret))
  let iv   = AES.GCM.Nonce()
  let sealed = try AES.GCM.seal(data, using: key, nonce: iv)
  return "\(b64url(Data(iv))):\(b64url(sealed.tag)):\(b64url(sealed.ciphertext))"
}

func call<T: Encodable>(path: String, body: T, jwt: String? = nil) async throws -> (Int, Data) {
  let ts  = String(Int(Date().timeIntervalSince1970))
  let enc = try encrypt(body)
  let key = SymmetricKey(data: b64urlDecode(hmacSecret))
  let sig = HMAC<SHA256>.authenticationCode(for: "\(ts).\(enc)".data(using: .utf8)!, using: key)
    .map { String(format: "%02x", $0) }.joined()

  var req = URLRequest(url: URL(string: baseURL + path)!)
  req.httpMethod = "POST"
  req.setValue("application/json", forHTTPHeaderField: "content-type")
  req.setValue(apiKey,             forHTTPHeaderField: "x-api-key")
  req.setValue(ts,                 forHTTPHeaderField: "x-timestamp")
  req.setValue(sig,                forHTTPHeaderField: "x-signature")
  if let jwt = jwt { req.setValue("Bearer \(jwt)", forHTTPHeaderField: "authorization") }
  req.httpBody = #"{"data":"\#(enc)"}"#.data(using: .utf8)

  let (data, res) = try await URLSession.shared.data(for: req)
  return ((res as! HTTPURLResponse).statusCode, data)
}

3. Log in

const login = await call('/api/v1/user/login', {
  email: 'you@example.com',
  password: 'YOUR_PASSWORD',
})
const jwt = login.body.data.access_token

status, body = call('/api/v1/user/login', {
    'email': 'you@example.com',
    'password': 'YOUR_PASSWORD',
})
jwt = body['data']['access_token']

res, _ := Call("/api/v1/user/login", map[string]string{
  "email":    "you@example.com",
  "password": "YOUR_PASSWORD",
}, "")
var body struct{ Data struct{ AccessToken string `json:"access_token"` } }
json.NewDecoder(res.Body).Decode(&body)
jwt := body.Data.AccessToken

String jsonBody = "{\"email\":\"you@example.com\",\"password\":\"YOUR_PASSWORD\"}";
HttpResponse<String> res = PontisClient.call("/api/v1/user/login", jsonBody, null);
// Parse res.body() with your JSON library, e.g. Jackson, to get data.access_token

val res = PontisClient.call(
  "/api/v1/user/login",
  """{"email":"you@example.com","password":"YOUR_PASSWORD"}"""
)
// Parse res.body!!.string() with your JSON library to get data.access_token

$res = call('/api/v1/user/login', [
  'email'    => 'you@example.com',
  'password' => 'YOUR_PASSWORD',
]);
$jwt = $res['body']['data']['access_token'];

res = call('/api/v1/user/login', {
  email:    'you@example.com',
  password: 'YOUR_PASSWORD',
})
jwt = res[:body]['data']['access_token']

var (status, body) = await PontisClient.Call("/api/v1/user/login", new {
  email    = "you@example.com",
  password = "YOUR_PASSWORD",
});
// Parse body with System.Text.Json to get data.access_token

struct LoginInput: Encodable { let email: String; let password: String }
let (_, data) = try await call(path: "/api/v1/user/login",
                               body: LoginInput(email: "you@example.com",
                                                password: "YOUR_PASSWORD"))
// Decode data to get data.access_token

Response:

{
  "ok": true,
  "data": {
    "access_token": "eyJhbGciOi...",
    "token_type": "Bearer",
    "expires_in": 900
  }
}

4. Send a transaction

import { randomUUID } from 'node:crypto'

const created = await call(
  '/api/v1/payouts/sendPayoutRequest',
  {
    idempotency_key: randomUUID(),
    country_code: 'PH',
    currency_code: 'PHP',
    payment_method: 'bank_local',
    source_amount: '10.00',
    source_currency: 'USDT',
    recipient_details: { name: 'Jane Doe', account_number: '1234567890' },
  },
  jwt,
)

import uuid

status, body = call('/api/v1/payouts/sendPayoutRequest', {
    'idempotency_key': str(uuid.uuid4()),
    'country_code': 'PH',
    'currency_code': 'PHP',
    'payment_method': 'bank_local',
    'source_amount': '10.00',
    'source_currency': 'USDT',
    'recipient_details': {'name': 'Jane Doe', 'account_number': '1234567890'},
}, jwt)

import "github.com/google/uuid"

payload := map[string]interface{}{
  "idempotency_key":   uuid.NewString(),
  "country_code":      "PH",
  "currency_code":     "PHP",
  "payment_method":    "bank_local",
  "source_amount":     "10.00",
  "source_currency":   "USDT",
  "recipient_details": map[string]string{"name": "Jane Doe", "account_number": "1234567890"},
}
res, _ := Call("/api/v1/payouts/sendPayoutRequest", payload, jwt)

String jsonBody = """
  {"idempotency_key":"%s","country_code":"PH","currency_code":"PHP",
   "payment_method":"bank_local","source_amount":"10.00","source_currency":"USDT",
   "recipient_details":{"name":"Jane Doe","account_number":"1234567890"}}
""".formatted(java.util.UUID.randomUUID().toString());
HttpResponse<String> res = PontisClient.call("/api/v1/payouts/sendPayoutRequest", jsonBody, jwt);

val payload = """
  {"idempotency_key":"${java.util.UUID.randomUUID()}","country_code":"PH","currency_code":"PHP",
   "payment_method":"bank_local","source_amount":"10.00","source_currency":"USDT",
   "recipient_details":{"name":"Jane Doe","account_number":"1234567890"}}
""".trimIndent()
val res = PontisClient.call("/api/v1/payouts/sendPayoutRequest", payload, jwt)

$res = call('/api/v1/payouts/sendPayoutRequest', [
  'idempotency_key'  => bin2hex(random_bytes(16)),
  'country_code'     => 'PH',
  'currency_code'    => 'PHP',
  'payment_method'   => 'bank_local',
  'source_amount'    => '10.00',
  'source_currency'  => 'USDT',
  'recipient_details' => ['name' => 'Jane Doe', 'account_number' => '1234567890'],
], $jwt);

require 'securerandom'

res = call('/api/v1/payouts/sendPayoutRequest', {
  idempotency_key:   SecureRandom.uuid,
  country_code:      'PH',
  currency_code:     'PHP',
  payment_method:    'bank_local',
  source_amount:     '10.00',
  source_currency:   'USDT',
  recipient_details: { name: 'Jane Doe', account_number: '1234567890' },
}, jwt)

var (status, body) = await PontisClient.Call("/api/v1/payouts/sendPayoutRequest", new {
  idempotency_key   = Guid.NewGuid().ToString(),
  country_code      = "PH",
  currency_code     = "PHP",
  payment_method    = "bank_local",
  source_amount     = "10.00",
  source_currency   = "USDT",
  recipient_details = new { name = "Jane Doe", account_number = "1234567890" },
}, jwt);

struct Recipient: Encodable { let name: String; let account_number: String }
struct PayoutInput: Encodable {
  let idempotency_key: String
  let country_code, currency_code, payment_method, source_amount, source_currency: String
  let recipient_details: Recipient
}
let (_, data) = try await call(path: "/api/v1/payouts/sendPayoutRequest",
  body: PayoutInput(
    idempotency_key:   UUID().uuidString,
    country_code:      "PH",
    currency_code:     "PHP",
    payment_method:    "bank_local",
    source_amount:     "10.00",
    source_currency:   "USDT",
    recipient_details: Recipient(name: "Jane Doe", account_number: "1234567890")
  ), jwt: jwt)

Response:

{
  "ok": true,
  "data": {
    "transaction_id": "029b2038-6166-4bea-80a9-f1a2425a85eb",
    "status": "pending"
  }
}

5. Get the status

const txnId = created.body.data.transaction_id
const status = await call('/api/v1/payouts/getPayoutStatus', { transaction_id: txnId }, jwt)

txn_id = body['data']['transaction_id']
status, body = call('/api/v1/payouts/getPayoutStatus', {'transaction_id': txn_id}, jwt)

res, _ := Call("/api/v1/payouts/getPayoutStatus",
  map[string]string{"transaction_id": txnId}, jwt)

String jsonBody = "{\"transaction_id\":\"" + txnId + "\"}";
HttpResponse<String> res = PontisClient.call("/api/v1/payouts/getPayoutStatus", jsonBody, jwt);

val res = PontisClient.call(
  "/api/v1/payouts/getPayoutStatus",
  """{"transaction_id":"$txnId"}""",
  jwt
)

$res = call('/api/v1/payouts/getPayoutStatus', ['transaction_id' => $txnId], $jwt);

res = call('/api/v1/payouts/getPayoutStatus', { transaction_id: txn_id }, jwt)

var (status, body) = await PontisClient.Call(
  "/api/v1/payouts/getPayoutStatus",
  new { transaction_id = txnId },
  jwt);

struct StatusInput: Encodable { let transaction_id: String }
let (_, data) = try await call(path: "/api/v1/payouts/getPayoutStatus",
                               body: StatusInput(transaction_id: txnId),
                               jwt: jwt)

Response:

{
  "ok": true,
  "data": {
    "transaction_id": "029b2038-6166-4bea-80a9-f1a2425a85eb",
    "status": "completed",
    "status_message": null
  }
}

What to do next

Set a Callback URL so you stop polling
Test failures and edge cases with sandbox trigger codes
Taking payments as well as sending them? Payins reuses the helper you just wrote — no new transport, and no login call
Ready for real money? Follow the Going live checklist
Browse the full API reference

Get started

Payins

Payouts

Sandbox testing

Errors

Go to production

1. Get your credentials

2. Set up the request helper

3. Log in

4. Send a transaction

5. Get the status

What to do next

​1. Get your credentials

​2. Set up the request helper

​3. Log in

​4. Send a transaction

​5. Get the status

​What to do next

1. Get your credentials

2. Set up the request helper

3. Log in

4. Send a transaction

5. Get the status

What to do next