Skip to main content
POST
Get Transfer Status
Auth method: Signed (HMAC) — this endpoint requires the full set of signed headers: x-access-id, x-request-id, x-timestamp, and an HMAC-SHA256 authorization signature. See Authentication.
Use this endpoint to follow a gasless token transfer after Transfer Funds returned 202 with an operation_id. You can only look up operations created by your own merchant account. The HTTP status tells you whether the operation is final:
  • 200: the operation has settled (succeeded or failed).
  • 202: the operation is still in progress. Poll again later.
You don’t have to poll: Tender also sends sub_user_wallet_transfer_confirmed or sub_user_wallet_transfer_failed when the operation settles. If you poll, keep the interval at 10 seconds or more; this endpoint counts against the subwallet rate limit.

Status values

status is returned as-is from the gasless network and depends on the chain: Treat any value other than succeeded, succeed or failed as in progress.

Example

Headers

string
required
Base64-encoded HMAC-SHA256 signature of {"timeStamp":"<x-timestamp>","requestId":"<x-request-id>","accessId":"<x-access-id>"}, signed with your access secret. The request body is not part of the signature.Example: "pV3n0o8kq0lK2mJ8bZ1yq3Yt6hR0cXK9u4mVJ2l9sE0="
string
required
ISO 8601 timestamp; must be within 5 minutes of server timeExample: "2026-10-15T09:45:53.000Z"
string
required
A unique UUID v4 per requestExample: "550e8400-e29b-41d4-a716-446655440000"
string
required
Your API access IDExample: "your-access-id-here"
string
required
Example: "application/json"

Body

string
required
Network of the transfer: EVM for ethereum transfers or TRON for tron transfers. The aliases ethereum, eth and trx are also accepted, case-insensitively. Bitcoin transfers are never gasless.Example: "TRON"
string
required
The operation_id returned by Transfer Funds.Example: "f3b0c2d1e4a5..."

Response

string
required
Example: "success"
string
required
Example: "transfer status retrieved"
object
required

Error responses

Authorizations

authorization
string
header
required

Signed (HMAC) authentication. Required headers: x-access-id, x-request-id (UUID v4), x-timestamp (ISO 8601, must be within 5 minutes of server time), and authorization: the Base64 HMAC-SHA256 of the JSON string {"timeStamp":"","requestId":"","accessId":""} (keys in that order, no whitespace) using your access secret. The request body, method and path are not signed. The API key must be linked to an outlet.

Headers

authorization
string
required

Base64-encoded HMAC-SHA256 signature of {"timeStamp":"","requestId":"","accessId":""}, signed with your access secret. The request body is not part of the signature.

x-timestamp
string<date-time>
required

ISO 8601 timestamp; must be within 5 minutes of server time

x-request-id
string<uuid>
required

A unique UUID v4 per request

x-access-id
string
required
Content-Type
string
required

Body

application/json
network
string
required

EVM or TRON (aliases ethereum, eth, trx accepted).

Example:

"TRON"

operation_id
string
required
Example:

"f3b0c2d1e4a5..."

Response

Operation settled

status
string
Example:

"success"

message
string
Example:

"transfer status retrieved"

data
object