Skip to main content
GET
Get On-ramp Status
Auth method: Signed (HMAC) — this endpoint requires the full set of signed headers: x-access-id, x-request-id, x-timestamp, and an HMAC-SHA256 authorization signature. See Authentication.
Returns the on-ramp for a reference returned by Initiate On-ramp. You can only read on-ramps created by your own merchant account; any other reference returns 404. There are no on-ramp webhooks, so poll this endpoint to track progress. Polling counts against the on-ramp limit of 10 requests per minute, shared with the other on-ramp endpoints. Poll every 30 seconds or so, and stop once the status is crypto_sent or failed. See Rate limits.

Status values

Stages

stages shows the progress of each step, in order: Each stage has a status of pending, in_progress, completed, failed or skipped.

Headers

string
required
Base64-encoded HMAC-SHA256 signature of {"timeStamp":"<x-timestamp>","requestId":"<x-request-id>","accessId":"<x-access-id>"}, signed with your access secret. The request body is not part of the signature.Example: "pV3n0o8kq0lK2mJ8bZ1yq3Yt6hR0cXK9u4mVJ2l9sE0="
string
required
ISO 8601 timestamp; must be within 5 minutes of server timeExample: "2026-10-15T09:45:53.000Z"
string
required
A unique UUID v4 per requestExample: "550e8400-e29b-41d4-a716-446655440000"
string
required
Your API access IDExample: "your-access-id-here"

Path Parameters

string
required
The reference returned by Initiate On-ramp.Example: "a3f1c2d4-8e7b-4f0a-9c1d-2e3f4a5b6c7d"

Response

string
required
Example: "success"
string
required
Example: "success"
object
required
Additional fields may be present; ignore fields you don’t recognise.

Error responses

Authorizations

authorization
string
header
required

Signed (HMAC) authentication. Required headers: x-access-id, x-request-id (UUID v4), x-timestamp (ISO 8601, must be within 5 minutes of server time), and authorization: the Base64 HMAC-SHA256 of the JSON string {"timeStamp":"","requestId":"","accessId":""} (keys in that order, no whitespace) using your access secret. The request body, method and path are not signed. The API key must be linked to an outlet.

Headers

authorization
string
required

Base64-encoded HMAC-SHA256 signature of {"timeStamp":"","requestId":"","accessId":""}, signed with your access secret. The request body is not part of the signature.

x-timestamp
string<date-time>
required

ISO 8601 timestamp; must be within 5 minutes of server time

x-request-id
string<uuid>
required

A unique UUID v4 per request

x-access-id
string
required

Path Parameters

reference
string
required

The reference returned by Initiate On-ramp

Response

On-ramp

status
string
Example:

"success"

message
string
Example:

"success"

data
object

Additional fields may be present; ignore fields you don't recognise.