Skip to main content
POST

Authorizations

​
Authorization
string
header
required

ES256 JWT bearer token, minted fresh per request.

See Authentication for the claims, including the nonce, the request signature, the two scopes, and which status means what.

​
X-Request-Signature
string
header
required

Body-bound ES256 signature over the request, required alongside the bearer token on every call. Base64url of an IEEE P-1363 fixed 64-byte r‖s signature.

See Authentication for the canonical string it signs, including the JWT nonce that binds it to the bearer token.

Headers

​
X-App-Mode
enum<string>
default:SANDBOX

Which environment this request runs against.

An omitted header means SANDBOX. Send it explicitly on every call rather than relying on that default, so live money movement is never missed because a header was forgotten: a live API key that reaches a live instance without an explicit LIVE value is rejected with AUTH_API_KEY_SANDBOX_REQUIRED. When present, the value must be SANDBOX or LIVE, matched without regard to case. Any other value, including an empty one, returns 400 INVALID_APP_MODE; details.received echoes the value you sent.

Available options:
SANDBOX,
LIVE
Example:

"SANDBOX"

​
X-Request-Id
string

Your own correlation id for this request, returned on the response exactly as you sent it.

Optional. Where you send none the response omits it, and the X-Trace-Id response header is the handle to correlate on instead.

Example:

"9f2c1b7e-4d3a-4f81-9c2e-6b0a5d7e1f34"

​
Idempotency-Key
string
required

Unique client-generated key identifying this request.

A request that timed out or failed can be replayed safely under the same key. See Idempotency keys.

Pattern: ^[a-zA-Z0-9_-]{1,255}$
Example:

"3fa85f64-5717-4562-b3fc-2c963f66afa6"

Body

application/json

CreatePayout variant selected by type: "FROM_QUOTE": applies a prior quote's locked-in pricing and routing, taking only the execution and compliance details a quote does not capture.

​
type
string
required
Allowed value: "FROM_QUOTE"
​
quoteId
string
required

Prior quote whose rate, rail, and routing are applied as-is. An expired quote is rejected with 409 QUOTE_EXPIRED.

Pattern: ^pytqte_[1-9A-HJ-NP-Za-km-z]{21,22}$
Example:

"pytqte_5PKPvtstSbXf9BurnLJfLA"

​
receiverMemo
string

Free-text memo to the receiver, where the rail carries one. Each rail validates it its own way, and a memo it rejects comes back as 400 VALIDATION_ERROR.

Example:

"Invoice INV-2026-0412"

​
purpose
enum<string>

Why the payout is being made. Required where receiveCurrency asks for one, today AED, which also refuses OTHER, and refused on every other currency. A quote carries no purpose, so state it here when applying one.

Available options:
GOODS_AND_SERVICES,
INVESTMENTS,
PAYROLL,
TREASURY_MANAGEMENT,
OTHER
Example:

"GOODS_AND_SERVICES"

​
metadata
object

Your own key/value pairs, kept on the record and returned with it.

See Metadata for what belongs in a metadata object, the limits, and where it comes back. Metadata is visible in the OpenFX platform, API, and MCP server (including connected AI tools), so don't include sensitive or personal data.

Example:

Response

The created payout.

​
data
object
required

Money moving out of one of your financial accounts to the receiving account's payout address: every payout debits financialAccountId and credits receiver.payoutAddressId. It is created in REQUIRES_CONFIRMATION with no funds moved, and confirmations[] says what the client acknowledges before they move.