📘
Sandbox API URL: https://api.stage.siti.ws/api/v1/payouts
Sandbox API & Sign key: 23455432-4444-3333-8888-123456654321
Sandbox Merchant ID: 23455432-4444-3333-8888-123456654321
Production credentials: Please contact your provider to obtain your production credentials

This endpoint allows you to initiate an outgoing transfer to a beneficiary’s bank account. Once the transfer request is submitted, it enters Processing status. You will receive the final result (Done or Failed) through the callbackUrl provided in the request or via calling GET https://api.stage.siti.ws/api/v1/payouts/{id} endpoint.

Check outgoing transfer status

Check via transfer status endpoint

You can retrieve the latest status of a transfer by calling the transfer status endpoint: GET https://api.stage.siti.ws/api/v1/payouts/{id}.

/Provide the transfer ID (id from the outgoing transfer creation response), and the endpoint will return its current status along with key details such as currency, amount, payee information and reference. Use this method to poll for updates or confirm the final result on demand.

Check via callback

You can also receive transfer status updates automatically through a callback (webhook). Specify your callbackUrl when initiating the transfer, and our system will send a notification to that URL when the payment status changes.

Callback body example

{
      "id": "trf_9b7e2c1f-4d3a-4c9b-8a3d-123456abcdef",
      "status": "Failed",
      "amount": 1500.75,
      "currency": "EUR",
      "orderId": "12345",
      "payee": {
        "name": "John Doe",
        "account": {
          "iban": "DE89370400440532013000"
        }
      },
      "rejectReason": "Insufficient funds",
      "createdAt": "2025-11-27T12:00:00.000Z",
      "reference": "OUT-20251127-001",
      "eventId": "858facfc-1eca-4ca4-84be-1484a84bc169",
      "eventTimestamp": 1763524800000
    }

Callback signature verification

Each webhook request includes security headers for signature validation:

signature-timestamp — Unix timestamp.
signature — HMAC_SHA256(MerchantSignatureKey, signature-timestamp + "." + RequestBodyContent)

You must verify this signature on your end to ensure authenticity. The signature-timestamp must be unique for each callback delivery attempt.

🚧
Both API key and token-based authentication methods are currently supported. Token-based authentication is strongly recommended for higher security and future compatibility, as API key-only authentication will be decommissioned by the end of March 2026.
To authenticate:

When using an API key, include it in the request as an x-api-key header.

When using a token, include it as an Authorization header in the format:

Authorization: Bearer YOUR_TOKEN