Skip to main content
GET
Auth method: Signed (HMAC) — this endpoint requires the full set of signed headers: x-access-id, x-request-id, x-timestamp, and an HMAC-SHA256 authorization signature. See Authentication.
All conversion endpoints share a bucket of 10 requests per minute per merchant, on top of the general limit. Polling counts against it. See Rate limits.

Headers

string
required
Base64-encoded HMAC-SHA256 signature of {"timeStamp":"<x-timestamp>","requestId":"<x-request-id>","accessId":"<x-access-id>"}, signed with your access secret. The request body is not part of the signature.Example: "pV3n0o8kq0lK2mJ8bZ1yq3Yt6hR0cXK9u4mVJ2l9sE0="
string
required
ISO 8601 timestamp; must be within 5 minutes of server timeExample: "2026-10-15T09:45:53.000Z"
string
required
A unique UUID v4 per requestExample: "550e8400-e29b-41d4-a716-446655440000"
string
required
Your API access ID provided by TenderExample: "your-access-id-here"

Query parameters

number
required
Page number, starting at 1. There is no default; always send it.Example: 1
number
required
Number of records per page. There is no default; always send it.Example: 10
string
Filter by conversion status. Passing pending returns both pending and processing records.Allowed values: pending, processing, completed, failedExample: "completed"
string
Filter by conversion type.Allowed values: crypto, fiatExample: "fiat"
string
Start of a createdAt date range (ISO 8601). Only applied when to is also sent.Example: "2026-10-01T00:00:00.000Z"
string
End of a createdAt date range (ISO 8601). Only applied when from is also sent.Example: "2026-10-15T23:59:59.999Z"
Case-insensitive search across the transaction ID, status, and the bank account name, bank name and account number of fiat conversions.Example: "kuda"
Send only the query parameters listed above.

Response

string
required
success on successExample: "success"
string
required
Human-readable result messageExample: "success"
object
required
Paginated conversions and aggregate totals
Additional fields may be present; ignore fields you don’t recognise.

Authorizations

authorization
string
header
required

Signed (HMAC) authentication. Required headers: x-access-id, x-request-id (UUID v4), x-timestamp (ISO 8601, must be within 5 minutes of server time), and authorization: the Base64 HMAC-SHA256 of the JSON string {"timeStamp":"","requestId":"","accessId":""} (keys in that order, no whitespace) using your access secret. The request body, method and path are not signed. The API key must be linked to an outlet.

Headers

authorization
string
required

Base64-encoded HMAC-SHA256 signature of {"timeStamp":"<x-timestamp>","requestId":"<x-request-id>","accessId":"<x-access-id>"}, signed with your access secret. The request body is not part of the signature.

x-timestamp
string<date-time>
required

ISO 8601 timestamp; must be within 5 minutes of server time

x-request-id
string<uuid>
required

A unique UUID v4 per request

x-access-id
string
required

Query Parameters

page
integer
required

Page number, starting at 1

Required range: x >= 1
limit
integer
required

Records per page

Required range: x >= 1
status
enum<string>

pending also matches processing

Available options:
pending,
processing,
completed,
failed
type
enum<string>

Conversion type

Available options:
crypto,
fiat
from
string<date-time>

Start of createdAt range; needs to

to
string<date-time>

End of createdAt range; needs from

Searches transaction ID, status and bank details

Response

Conversions

status
string
required
Example:

"success"

message
string
required
Example:

"success"

data
object
required