Create outbound payment

post

https://api.sandbox.ibanq.com/v1/outbound-payments

Creates and submits an outbound payment for processing; it skips manual approval and is never held in Draft. clientId is required and must be a client this credential may act for. Retries with the same idempotencyKey and the same details return 200 with the original payment's id instead of creating a duplicate. 409 is returned for a key reused with different details, or a byte-identical resubmission under a new key without incrementing copyNumber.

Body Params

clientId

string

required

length ≥ 1

Required; must be a client this credential may act for

payeeId

string

required

length ≥ 1

accountId

string

required

length ≥ 1

amount

int64

required

> 0

currency

string

required

length ≥ 1

paymentMethod

string | null

enum

The payment rail: one of Fps, Chaps, Swift or Sepa. Blank auto-resolves from the payee/account capabilities; an explicit value is rejected if it is disabled, unsupported for the payee/account, or an internal (IbanqToIbanq) transfer

Allowed:

chargeType

string | null

enum

Who bears the Swift charges: OUR or SHA. Swift payments only — supplying it for any other rail is rejected. Blank defaults a Swift payment to OUR. BEN is not supported

Allowed:

reference

string

required

length between 0 and 140

^[a-zA-Z0-9()':?,.\-+\/ ]*$

internalReference

string | null

purpose

string | null

valueDate

date | null

Blank resolves to the earliest available date for the resolved rail: today, if it is a working day for the rail and IFX's release cut-off for that rail has not passed; otherwise the rail's next working day. A supplied date outside the earliest-available/max-future window, or not a working day for the rail, is rejected

ultimateDebtorName

string | null

The party the payment is ultimately from. Available to PSP clients only: any populated ultimateDebtor* field on a non-PSP client is rejected. Supplying one makes six of them mandatory — name, identificationNumber, country, streetAddress, city and postCode; buildingName, buildingNumber and county stay optional. On a sub-account they are overwritten with the sub-account's own identity whatever you send

ultimateDebtorIdentificationNumber

string | null

ultimateDebtorCountry

string | null

ultimateDebtorBuildingName

string | null

ultimateDebtorBuildingNumber

string | null

ultimateDebtorStreetAddress

string | null

ultimateDebtorCity

string | null

ultimateDebtorCounty

string | null

ultimateDebtorPostCode

string | null

copyNumber

int32

≥ 1

Deliberate-copy escape hatch: an otherwise byte-identical resubmission under a new idempotencyKey is rejected as a 409 duplicate unless copyNumber is incremented to signal a deliberate copy. Defaults to 1; must be 1 or greater

idempotencyKey

string

required

length between 0 and 100

Caller-generated key that makes the request retry-safe; at most 100 characters. Retrying with the same key and the same details returns 200 with the original payment's id, so a caller whose create response was lost can recover it by retrying. Reusing a key with different details is rejected with 409 whose body carries existingPaymentId

Headers

DPoP

string

required

Fresh RFC 9449 proof JWT (ES256) signed with the client's DPoP key, binding this request's method and URL to the access token; generate a new proof per request

Content-Digest

string

required

RFC 9530 digest of the request body, e.g. sha-256=:...:

Signature-Input

string

required

RFC 9421 signature parameters: covered components plus created and keyid

Signature

string

required

RFC 9421 signature over the signature base, signed with the client's registered signing key

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

200Identical retry replayed; the id of the payment originally created under this idempotencyKey is returned

201Payment created; the payment's id is returned. There is no Location header — read the payment at GET /outbound-payments/{id}

400Invalid request parameters, or request signature verification failed

401Missing or invalid access token / DPoP proof

403Payments are not enabled for this client, or clientId does not match a client this credential may act for

404Payee, client account or client not found

409The idempotency key was reused with different payment details, or this payment is a duplicate of an existing payment; existingPaymentId identifies the payment already created under the supplied idempotencyKey, when there is one

422Business rule validation failed

500Internal server error

504The request timed out before a response could be produced.