Credit Funds
curl --request POST \
--url https://api.example.com/client-interfaces/vna/credit-funds \
--header 'Content-Type: application/json' \
--header 'User-Agent: <user-agent>' \
--header 'X-Signature: <x-signature>' \
--header 'X-Timestamp: <x-timestamp>' \
--data '
{
"TransactionId": "<string>",
"AuthTrackingIdentifier": "<string>",
"AccountIdentifier": "<string>",
"Amount": 123,
"Currency": "<string>",
"ExchangeRate": 123
}
'import requests
url = "https://api.example.com/client-interfaces/vna/credit-funds"
payload = {
"TransactionId": "<string>",
"AuthTrackingIdentifier": "<string>",
"AccountIdentifier": "<string>",
"Amount": 123,
"Currency": "<string>",
"ExchangeRate": 123
}
headers = {
"X-Timestamp": "<x-timestamp>",
"X-Signature": "<x-signature>",
"User-Agent": "<user-agent>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'X-Timestamp': '<x-timestamp>',
'X-Signature': '<x-signature>',
'User-Agent': '<user-agent>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
TransactionId: '<string>',
AuthTrackingIdentifier: '<string>',
AccountIdentifier: '<string>',
Amount: 123,
Currency: '<string>',
ExchangeRate: 123
})
};
fetch('https://api.example.com/client-interfaces/vna/credit-funds', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.example.com/client-interfaces/vna/credit-funds",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'TransactionId' => '<string>',
'AuthTrackingIdentifier' => '<string>',
'AccountIdentifier' => '<string>',
'Amount' => 123,
'Currency' => '<string>',
'ExchangeRate' => 123
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"User-Agent: <user-agent>",
"X-Signature: <x-signature>",
"X-Timestamp: <x-timestamp>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.example.com/client-interfaces/vna/credit-funds"
payload := strings.NewReader("{\n \"TransactionId\": \"<string>\",\n \"AuthTrackingIdentifier\": \"<string>\",\n \"AccountIdentifier\": \"<string>\",\n \"Amount\": 123,\n \"Currency\": \"<string>\",\n \"ExchangeRate\": 123\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-Timestamp", "<x-timestamp>")
req.Header.Add("X-Signature", "<x-signature>")
req.Header.Add("User-Agent", "<user-agent>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.example.com/client-interfaces/vna/credit-funds")
.header("X-Timestamp", "<x-timestamp>")
.header("X-Signature", "<x-signature>")
.header("User-Agent", "<user-agent>")
.header("Content-Type", "application/json")
.body("{\n \"TransactionId\": \"<string>\",\n \"AuthTrackingIdentifier\": \"<string>\",\n \"AccountIdentifier\": \"<string>\",\n \"Amount\": 123,\n \"Currency\": \"<string>\",\n \"ExchangeRate\": 123\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.example.com/client-interfaces/vna/credit-funds")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Timestamp"] = '<x-timestamp>'
request["X-Signature"] = '<x-signature>'
request["User-Agent"] = '<user-agent>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"TransactionId\": \"<string>\",\n \"AuthTrackingIdentifier\": \"<string>\",\n \"AccountIdentifier\": \"<string>\",\n \"Amount\": 123,\n \"Currency\": \"<string>\",\n \"ExchangeRate\": 123\n}"
response = http.request(request)
puts response.read_body{
"Success": true,
"TrackingIdentifier": "<string>",
"NonCreditReason": "None"
}POST request to:
[Base-URL]/CreditFunds.
[Base-URL]; the resource segment /CreditFunds, the POST method and the JSON body are fixed by this contract and are case-sensitive.Every request travels signed. It carries the X-Timestamp and X-Signature headers with the HMAC-SHA256 signature of the raw body. The Partner must validate the signature before processing the request.CreditResponseType configuration. If Sync, the response will be immediate. If Async, status will be checked by Get Credit Status endpoint.
Sync is used, this response carries the final outcome, and Get Credit Status does not need to be implemented.AccountIdentifier for the stipulated amount. The destination system must respond whether the action was successful (Success), returning a trace and/or the reason why it failed (NonCreditReason).
Success: true response MUST carry a TrackingIdentifier. It is the only handle the Platform has on the credit movement, and it cannot be recovered afterwards. Without it the credit can no longer be polled through Get Credit Status nor undone through Reverse Credit Funds — under an Async configuration the Platform is left unable to confirm a credit the Partner already applied, and under Sync the credit becomes irreversible. Either way it has to be reconciled by hand with the Partner.If the credit fails, return Success: false with the corresponding NonCreditReason; that path does not require a TrackingIdentifier.Headers
UTC timestamp in ISO-8601 format with milliseconds (yyyy-MM-ddTHH:mm:ss.fffZ), generated at send time. Its exact string value is part of the signed message, so it cannot be altered, and it lets the Partner reject stale requests (replay protection). See Data Integrity.
HMAC-SHA256 signature of the request, Base64-encoded (standard alphabet). It is computed over bytes(X-Timestamp) + bytes(".") + rawBodyBytes using the shared secret agreed for the integration. The Partner MUST validate it — with a constant-time comparison and over the raw body, before any deserialization — and reject the request if it does not match. See Data Integrity.
Fixed value VNA. Sent on every request. Some Partners' WAFs reject requests without a User-Agent, so the Platform always sets it explicitly; if the Partner filters by this header, this is the value to allow.
Body
Unique identifier of the request, used as an idempotency key. It is derived deterministically from the operation, the Partner and the action, so a retry of the same action arrives with the same value: the Partner MUST process it only once and return the original outcome on repeats.
The TrackingIdentifier the Partner returned in the Tx Authorization response for this same transaction. It lets the Partner match the credit against the authorization it already approved.
An Id representing the External Account Object for the Partner.
Amount of the transaction, with TWO decimals.
Currency of the transaction, per ISO 4217. String of 3 chars.
Exchange rate applied to the transaction.
Response
Ok
True if the CreditFunds is Successful / False if the CreditFunds Failed.
Identifier assigned by the Partner to the credit movement. Mandatory whenever Success is true — the Platform uses it to query the status (Get Credit Status) and to request a reversal (Reverse Credit Funds), so a successful credit returned without it leaves the operation unreconcilable and the Platform reports the transaction as failed even though the funds were applied.
If the credit is not successful, the reason should be sent, otherwise not sent. The text must be one of the fixed possible values.
None— no reason; the credit was not denied for any of the reasons belowAccountBlocked— the credit has been denied because the external account object is blockedAccountBlockedByLaw— the credit has been denied because the external account object is blocked by legal reasons (e.g. litigation)AccountBlockedByGovernment— the credit has been denied because the external account object is blocked due to government mandated reasons (e.g. fiscal)ByVelocity— the credit has been denied because the external account object has reached the velocity limit defined in the Partner, this is, the amount of transactions in a specific lapse of time allowed by the partnerByAmountLimit— the credit has been denied because the external account object has reached the transaction amount limit defined in the Partner systemByAccumulateAmountLimit— the credit has been denied because the external account object has reached the accumulated amount limit defined in the Partner systemInvalidAccount— the credit has been denied because the account referenced is invalidInvalidParameter— the credit has been denied because a parameter of the request is invalidInvalidCurrency— the credit has been denied because the currency of the request is invalidInvalidSenderData— the credit has been denied because the sender's personal data is invalidInvalidDestinationData— the credit has been denied because the receiver's personal data is invalidInvalidExchangeRate— the credit has been denied because the exchange rate provided is invalidInvalidAmount— the credit has been denied because the amount is invalidNotPreviouslyValidated— the credit has been denied because the account was not previously validated through a TxAuthorization requestInvalidReferenceId— the credit has been denied because the reference/tracking id provided is invalid
None, AccountBlocked, AccountBlockedByLaw, AccountBlockedByGovernment, ByVelocity, ByAmountLimit, ByAccumulateAmountLimit, InvalidAccount, InvalidParameter, InvalidCurrency, InvalidSenderData, InvalidDestinationData, InvalidExchangeRate, NotPreviouslyValidated, InvalidReferenceId, InvalidAmount