Skip to main content
GET
Auth method: Signed (HMAC) — this endpoint requires the full set of signed headers: x-access-id, x-request-id, x-timestamp, and an HMAC-SHA256 authorization signature. See Authentication.
The ledger transactions behind a fiat payout made with method: "internal". That payout runs as a conversion: your crypto is sent on-chain to the payout provider, which then pays the bank account. This endpoint returns that on-chain send. Results are oldest first. Other payouts (crypto, MoneyGram) have no internal transactions and return 200 with an empty data array. All payout endpoints share a bucket of 10 requests per minute per merchant. See Rate limits.

Headers

string
required
Base64-encoded HMAC-SHA256 signature of {"timeStamp":"<x-timestamp>","requestId":"<x-request-id>","accessId":"<x-access-id>"}, signed with your access secret. The request body is not part of the signature.Example: "pV3n0o8kq0lK2mJ8bZ1yq3Yt6hR0cXK9u4mVJ2l9sE0="
string
required
ISO 8601 timestamp; must be within 5 minutes of server timeExample: "2026-10-15T09:45:53.000Z"
string
required
A unique UUID v4 per requestExample: "550e8400-e29b-41d4-a716-446655440000"
string
required
Your API access ID provided by TenderExample: "your-access-id-here"

Path parameters

string
required
The payout ID: _id from Payout Crypto, or id from Payout FiatExample: "66aec7de809b7f45c42a49f9"

Response

string
required
success on successExample: "success"
string
required
Human-readable result messageExample: "success"
array
required
Internal transactions, oldest first
Additional fields may be added later; ignore fields you don’t recognise.

Roles

Errors

Authorizations

authorization
string
header
required

Signed (HMAC) authentication. Required headers: x-access-id, x-request-id (UUID v4), x-timestamp (ISO 8601, must be within 5 minutes of server time), and authorization: the Base64 HMAC-SHA256 of the JSON string {"timeStamp":"","requestId":"","accessId":""} (keys in that order, no whitespace) using your access secret. The request body, method and path are not signed. The API key must be linked to an outlet.

Headers

authorization
string
required

Base64-encoded HMAC-SHA256 signature of {"timeStamp":"<x-timestamp>","requestId":"<x-request-id>","accessId":"<x-access-id>"}, signed with your access secret. The request body is not part of the signature.

x-timestamp
string<date-time>
required

ISO 8601 timestamp; must be within 5 minutes of server time

x-request-id
string<uuid>
required

A unique UUID v4 per request

x-access-id
string
required

Path Parameters

id
string
required

Payout ID

Response

Internal transactions (may be empty)

status
string
Example:

"success"

message
string
Example:

"success"

data
object[]