External withdrawal preparation.
Durable requests, read-only RPC quote adapters, balance reservations and cancellation journals are implemented. Providers require verification; actual signing, dispatch and reconciliation remain unavailable. Browser examples use labelled isolated simulations.
01Request a frozen destination
POST /withdrawal-quote-requests with a wallet, exact asset, decimal recipient amount and either destination or recipientId. Keep its Idempotency-Key and saved request ID. Preparation has a five-minute deadline and does not reserve funds.
02Review a 60-second quote
The worker freezes processing tariff, native network components, conversion and maximum debit. Quotes last exactly 60 seconds. Check executionReady and quote.fundingState before authorization: metadata or a reviewable quote alone cannot enable sending. Manual policy scenarios cannot create executable quotes.
03Check source observation freshness
Active request status includes sourceObservation: current, changed or unverified; other states return null. Known preparation, signing, submission, transaction observation and settlement invalidate earlier unconsumed liquidity snapshots. A current revision alone does not enable execution. Confirmation rechecks under locks. On SOURCE_LIQUIDITY_CHANGED or SOURCE_LIQUIDITY_UNVERIFIED, close the quote and request a fresh one. Private revisions are never accepted from callers or returned in the public quote.
04Wait for consistent source account state
EVM quote estimation compares independent latest and pending source nonces after simulation and rechecks account code. Pending activity or a changed nonce returns QUOTE_SOURCE_NONCE_UNSETTLED; peer disagreement returns QUOTE_SOURCE_STATE_DISAGREEMENT. The dashboard explains the condition and keeps the saved request available without reserving funds. Inspect the same request after the source settles. Private source observations are not returned in the public quote and do not enable spending or replace platform gas ownership.
05Check platform gas funding separately
The server derives EVM quote funding from classified platform capital, current reservations and fresh reconciled source evidence. Latest and finalized balances and nonces must agree. Caller gas flags cannot establish ownership. Insufficient verified gas remains reviewable as gas_funding_required. A changed funded source receives its own estimate before publication, with at most three attempts. QUOTE_GAS_SOURCE_CHANGED or QUOTE_GAS_EVIDENCE_STALE means the saved request needs a fresh custody check; QUOTE_SOURCE_REESTIMATE means source selection remained unstable. TRON cost review retains zero verified gas until equivalent current-state evidence is integrated. A funded quote alone never establishes executionReady.
06Understand the balance and blockchain source
Internal transfers move balances within your workspace. Blockchain assets may remain in the original custody wallet. A server-selected same-workspace route requires complete journal-backed liabilities, matched custody observations, sufficient unreserved assets and classified platform gas. When present, custodyRoute discloses the fixed blockchain source in the quote and receipt. The selected balance wallet is debited. Callers cannot select arbitrary custody sources or route across workspaces. This does not enable live execution; actual service attestations and funded verification remain required.
07Authorize and reserve once
Current workspace owner/admin permission and recent app passkey verification are rechecked in the transaction. POST /withdrawals with quoteId and a separate Idempotency-Key saves the instruction and moves the maximum debit from available to in transit. No fee revenue is earned yet. RPC admission permits one unresolved withdrawal per physical source across all assets. SOURCE_SPEND_PENDING retains the current quote, reports executionReady=false and does not reserve this request. Wait for proven settlement or legitimate unprepared cancellation, then review a fresh quote. An expired worker lease never frees the source. Quote expiry is rechecked after account locks and final audit/outbox writes; an expired authorization rolls back all reservation effects.
08Recover and cancel safely
GET the original quote request after a response loss. It returns an existing receipt if confirmation committed. Close an unresolved request atomically. A reserved instruction can return its complete balance only before preparation; an expired worker lease cannot undo that barrier.
09Retain the approved quote
The dashboard saves the complete public quote and confirmation identity before authorization. It verifies the original workspace, wallet, asset, recipient, exact amount, processing fee, network reserve and maximum debit against the returned receipt. A lost or mismatched response keeps the original authorization pending verification. Retrying uses the same quote and Idempotency-Key. Recovery remains saved until the original receipt and local cleanup are verified. A missing response does not prove that funds remain available.
10Inspect preparation and signing
User and admin receipts expose status and transaction IDs while keeping source bindings and raw bytes private. Canonical payloads, EVM nonce/TRON identities and restricted signing components are implemented. Prepared and signed transfers retain reserved funds while awaiting network submission. Actual RPC/custody verification, supervised dispatch and funded execution remain pending. Local final receipt settlement is documented below.
11Recover the original custody request
Current operators can inspect GET /v1/admin/withdrawals/{id}/signing-status. Owner, Operations or Security can POST /v1/admin/withdrawals/{id}/recheck-signing with a reason of 12–500 characters. An Idempotency-Key preserves the original check across interruptions and worker completion. Active worker leases and search progress remain intact. The worker inspects the original custody request; queuing a check never signs again, sends funds or releases reserves. Unkeyed clients remain supported without replay guarantees. Live cloud recovery remains unverified.
12Cancel an unprepared withdrawal
POST /v1/workspaces/{workspaceId}/withdrawals/{id}/cancel with an empty JSON object. Current workspace Owner or Admin access and a recent passkey are required. Before preparation starts, the original reservation journal is verified and the complete recipient amount plus both fee reserves returns to available balance. Cancellation charges no fee. Repeat the same withdrawal ID after a lost response; its original release is verified and returned without another balance change. Preparation, signing, submission or settlement evidence prevents cancellation, including after worker lease expiry. The returned releaseJournalId identifies the balance return. A paused provider or service does not prevent a legitimate unprepared return; service recovery pauses balance changes.
13Inspect the original network submission
Operators can inspect GET /v1/admin/withdrawals/{id}/submission-status. Authorized owner, operations or security sessions can POST /v1/admin/withdrawals/{id}/check-submission with an audit reason. The Go service verifies the original signed bytes, source, chain, recipient, amount and fee ceiling before scheduling observation. Send an Idempotency-Key to recover the original request after a lost response. An active check retains its worker lease and progress. This queries the retained hash and never sends another payment. Broadcast means acknowledgement only; funds remain reserved until final confirmation, fee and unused-reserve reconciliation. Actual funded execution remains unverified.
14Verify the final receipt and return unused reserves
GET /v1/admin/withdrawals/{id}/finality-status shows sanitized receipt-check status. Owner, operations or security may POST /v1/admin/withdrawals/{id}/check-finality with an audit reason and an Idempotency-Key. The original transaction is verified before queuing. A live worker keeps its lease and progress; replay returns the original acknowledgement even if the worker has completed. Independent finalized execution must prove the original signed transaction and exact recipient amount. The settlement records actual fees and returns unused reserves at the frozen quote conversion. Definitive on-chain failure returns the unsent amount and processing fee; incurred network costs may still apply up to the quoted reserve. Unknown outcomes retain reservations. Local synthetic verification does not establish live execution readiness.
POST /v1/workspaces/{workspaceId}/withdrawal-quote-requests
Idempotency-Key: <quote-request-id>
{ "walletId": "<uuid>", "assetId": "ethereum:sepolia:usdc", "amount": "25", "recipientId": "<saved-recipient-uuid>", "reference": "Supplier settlement" }
GET /v1/workspaces/{workspaceId}/withdrawal-quote-requests/{id}
POST /v1/workspaces/{workspaceId}/withdrawals
Idempotency-Key: <confirmation-id>
{ "quoteId": "<published-quote-uuid>" }
GET /v1/workspaces/{workspaceId}/withdrawals/{id}
POST /v1/workspaces/{workspaceId}/withdrawals/{id}/cancel
{}Open your workspace