Skip to main content
POST
Create a confirmation intent

Authorizations

DPoP
string
header
required

Per-request RFC 9449 DPoP proof signed with ES256. Protected requests use Authorization: DPoP your_access_token_here. Create a new proof for the exact method and normalized target URI, and include the server nonce when challenged.

Authorization
string
header
required

OAuth 2.0 with RFC 9700 security practices. Discover exact environment endpoints from /.well-known/openid-configuration and /.well-known/oauth-authorization-server, and discover the resource from /.well-known/oauth-protected-resource. Authorization-code clients use PKCE S256, the exact environment resource, nonce with openid, and DPoP binding. Confidential clients also require PAR and private_key_jwt. Access and refresh tokens are sender-constrained with DPoP. purchases:execute is unavailable and omitted from this scope registry.

Headers

X-Request-Id
string

Optional caller request identifier. Unsafe values are replaced with a generated UUID.

Pattern: ^[A-Za-z0-9._~-]{8,128}$

Body

application/json

One irreversible action and its complete target request.

action
string
required

Create a beneficiary with sensitive payout-schema answers.

Allowed value: "beneficiaries.create"
request
object
required

The complete target beneficiary-creation request.

Response

The one-use confirmation intent.

A five-minute, one-use API-owned confirmation intent.

action
enum<string>
required

The irreversible action bound to this intent.

Available options:
beneficiaries.create,
cards.create,
cards.freeze,
spending.withdraw
expires_at
string<date-time>
required

Exact expiry of this five-minute intent.

Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
id
string<uuid>
required

Opaque one-use confirmation-intent identifier.

Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$