MegTrustDevelopers

Cancel a pending withdrawal

Withdraws a payout that is still pending_approval. No body and no Idempotency-Key; repeating it is safe and returns the cancelled withdrawal. 409 withdrawal_not_cancellable once an approver has acted or the payout has moved past pending_approval.

POST/api/v1/withdrawals/{id}/cancel

Withdraws a payout that is still pending_approval. No body and no Idempotency-Key; repeating it is safe and returns the cancelled withdrawal. 409 withdrawal_not_cancellable once an approver has acted or the payout has moved past pending_approval.

Authorization

KeyId Timestamp Signature
x-api-key-id<token>

Key ID registered by your organisation administrator.

In: header

x-api-timestamp<token>

Unix seconds within ±300 seconds of the server clock.

In: header

x-api-signature<token>

Padded base64 Ed25519 signature over timestamp, METHOD, exact path+query, lowercase SHA256(raw body), Idempotency-Key or empty string, joined with LF. Legacy HMAC uses lowercase hex HMAC-SHA256. Signing is required; entering a static value is insufficient.

In: header

Path Parameters

id*string
Formatuuid

Query Parameters

_request_id?string

Fresh random UUID per attempt, included in the signed path. Avoids duplicate signatures for identical requests in the same second.

Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/api/v1/withdrawals/497f6eca-6276-4993-bfeb-53cbbbba6f08/cancel"
{  "data": {    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "status": "received",    "wallet_id": "string",    "asset": "string",    "amount": "string",    "destination": "string",    "network": "string",    "tx_hash": "string",    "created_at": "2019-08-24T14:15:22Z",    "updated_at": "2019-08-24T14:15:22Z"  },  "meta": {    "count": 0,    "limit": 0,    "offset": 0,    "next_offset": 0,    "idempotent_replay": true,    "already_exists": true,    "stale": true  }}

Refresh withdrawal status GET

Returns last recorded state with meta.stale=true if a live refresh fails. Final rows use recorded state. Polling never approves or retries a payment.

Delivery to your registered HTTPS receiver Webhook

Verify raw bytes with the endpoint secret: HMAC-SHA256(timestamp + '.' + raw body), ±5 minutes. Durably deduplicate event.id. Deliveries may be delayed, duplicated and out of order; up to eight attempts. Respond within 10 seconds after durably accepting the event.