Reference
Status Values & Glossary
Consolidated deposit and withdrawal status enums, Portal role labels, and the key constants (replay window, idempotency TTL, empty-body SHA-256) in one place
A single reference for the status enums, Portal roles, and the constants that the rest of the docs depend on.
Deposit status
| Status | Terminal | Meaning |
|---|---|---|
PENDING | — | Created, waiting for the customer to transfer expected_amount. pay_to is present only in this state. |
CREDITED | ✅ | Exact expected_amount matched and credited (matched_amount populated). Fires deposit.success. |
EXPIRED | ✅ | No matching amount before match_window_until. Fires deposit.expired. |
CANCELLED | ✅ | Cancelled by you via POST /v1/deposits/:id/cancel while still PENDING. |
Withdrawal status
| Status | Terminal | Meaning |
|---|---|---|
PENDING | — | Created; gross (amount + fee) debited immediately, awaiting manual approval. |
APPROVED | — | Approved by the team, queued for processing. |
PROCESSING | — | Being processed. |
IN_PROGRESS | — | In progress at the bank/settlement layer. |
SUCCESS | ✅ | Payout completed. Fires withdrawal.success. |
FAILED | ✅ | Failed mid-processing. Fires withdrawal.failed; gross is refunded (withdrawal.refunded). |
REJECTED | ✅ | Manually rejected while PENDING/APPROVED. Fires withdrawal.rejected; gross is refunded (withdrawal.refunded). |
Never treat the initial
201 PENDING as success — wait for a terminal webhook (withdrawal.success, withdrawal.failed, or withdrawal.rejected).Portal roles
| Role | Can do |
|---|---|
| owner / admin | Issue/rotate API secrets, configure webhooks — full configuration. |
| operator | Operational actions, but cannot issue/rotate secrets or configure webhooks. |
| viewer | Read-only. |
Pending confirmation — confirm the exact Portal role labels and which buttons each role sees
Key constants
| Constant | Value | Used for |
|---|---|---|
| Replay window | ±300 seconds | X-Timestamp must be within this window of server time. |
| Idempotency-Key TTL | 24 hours | How long a key (scoped per mode + merchant) is remembered for replay. |
| Empty-body SHA-256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | The body hash on line 4 of the canonical string for any bodyless/GET request. |
| Money format | baht string, 2 decimals (e.g. "100.50") | Every money field on the wire — never a number, never satang. THB only. |