Tell us you have sent the funds

post

https://api.avvio.xyz/business/api/v1/payments/organizations/{orgId}/payouts/{payoutId}/funding/confirm

Send either transactionHash (you broadcast it yourself) or
signedOperations (you signed what /funding returned). Which one you
use depends on how you hold the money, not on anything we prefer.

We read the chain before recording anything. The transaction must
exist, have succeeded, and have moved the expected token to the deposit
address we issued, in at least the expected amount, from the wallet
registered for this payout. If it did not, nothing is recorded and the
payout stays fundable — so a rejection here is always safe to correct
and retry.

Three outcomes are worth handling separately:

FUNDING_TRANSACTION_INVALID (400) — we read the chain and it does
not fund this payout. Do not retry unchanged; send the right one.
FUNDING_NOT_YET_VERIFIABLE (409) — we could not read it yet (not
mined, or we could not reach the chain). Retry the SAME request once
it is mined. If you already paid, your funds are unaffected.
FUNDING_TRANSACTION_ALREADY_USED (409) — one transfer funds exactly
one payout. The deposit address is shared between payouts, so this is
reachable by honest mistake; the message names the payout it funded.

In the sandbox there is no chain to read, so the LAST FOUR DIGITS of the
hash choose the outcome — 0001 invalid, 0002 not-yet-verifiable,
anything else accepted — and reuse is refused exactly as in production.

Solana funding is not chain-verified today and is recorded on shape
alone.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

orgId

string

required

length ≥ 1

The opaque organization id issued to you, normally CUID-shaped (for
example cmsx…). It is not an org_-prefixed alias. Pass it unchanged
in every organization-scoped path.

payoutId

string

required

length ≥ 1

Opaque payoutId returned by create or accept. Pass it unchanged.

Body Params

Headers

Idempotency-Key

string

required

length between 1 and 255

^[A-Za-z0-9_.:-]+$

A unique value per logical operation, 1-255 chars of A-Z a-z 0-9 _ . : -.

Reuse it to retry. Same key with the same body replays the stored
response; same key with a different body is a 409, because
answering with the first call's result would hand you a receipt for a
payout you did not request. A 4xx releases the key, so you can fix the
body and reuse it.

Reuse it — do not generate one per attempt. A key minted per attempt
defeats replay entirely: every retry looks like a new request, so every
retry pays. We also watch for an identical body arriving under a
different key within 15 minutes and refuse it with
DUPLICATE_REQUEST_DETECTED.

Records are kept for 7 days. That is a retention window, not a
correctness one — there is no path where an expired key is re-executed.

X-Allow-Duplicate

string

enum

Set to true to send a request that is byte-identical to one you sent
seconds ago under a different key. Only set it deliberately: it switches
off the guard that catches a retry arriving under a fresh key.

Allowed:

Responses

200The payout, now funded.

400Neither proof of funding was supplied.

401Missing, invalid, or revoked key — or a key on a route that does not accept one.

403Valid key, wrong organization.