Wallet Transfer Audit

Authenticate with the apikey header. Query supports username, direction (in, out, all), start_time, end_time, paired cursor_transaction_time_ns + cursor_id, and limit.

Default limit

100

Maximum limit

1,000

Time units

Unix seconds / nanoseconds

Maximum range

24 hours

Rate

1,000/min per Agent + route

Burst

100

In-flight

100

Direction mapping: IN = transfer/up · OUT = transfer/down · ALL = transfer only.

Response envelope

{
  "rows": [{
    "id": "transfer-row-1",
    "transaction_time_ns": 1787097600000000000,
    "ref_code": "audit-ref-1",
    "username": "audit-user",
    "type_name": "transfer",
    "type_sub_name": "up",
    "amount": 25.5,
    "amount_before": 100,
    "amount_after": 125.5,
    "asset_name": "USD",
    "asset_unit": "USD",
    "note": "audit example"
  }],
  "next_cursor": {
    "transaction_time_ns": 1787097600000000000,
    "id": "transfer-row-1"
  },
  "has_more": false
}

Rows use the tested field names and types. Results are ordered by (transaction_time_ns, id); the route remains draft until Gateway implementation.

Safe request examples

Examples use a placeholder host and a redacted key.

cURL

curl --get 'https://api.example.invalid/v2/external/wallet/transfers' \
  --data-urlencode 'username=audit-user' \
  --data-urlencode 'direction=in' \
  --data-urlencode 'start_time=1787011200' \
  --data-urlencode 'end_time=1787097600' \
  --data-urlencode 'limit=100' \
  -H 'apikey: [REDACTED]'

PHP

<?php
$ch = curl_init('https://api.example.invalid/v2/external/wallet/transfers?' . http_build_query([
    'username' => 'audit-user',
    'direction' => 'in',
    'start_time' => 1787011200,
    'end_time' => 1787097600,
    'limit' => 100,
]));
curl_setopt_array($ch, [
    CURLOPT_HTTPHEADER => ['apikey: [REDACTED]'],
    CURLOPT_RETURNTRANSFER => true,
]);
$response = curl_exec($ch);
curl_close($ch);

Go

req, err := http.NewRequest("GET", "https://api.example.invalid/v2/external/wallet/transfers?username=audit-user&direction=in&start_time=1787011200&end_time=1787097600&limit=100", nil)
if err != nil {
    log.Fatal(err)
}
req.Header.Set("apikey", "[REDACTED]")
resp, err := http.DefaultClient.Do(req)
if err != nil {
    log.Fatal(err)
}
defer resp.Body.Close()

JavaScript

const params = new URLSearchParams({
  username: 'audit-user',
  direction: 'in',
  start_time: '1787011200',
  end_time: '1787097600',
  limit: '100',
});
const response = await fetch(
  `https://api.example.invalid/v2/external/wallet/transfers?${params}`,
  { headers: { apikey: '[REDACTED]' } },
);

Errors and access controls

Possible responses: 400 invalid request, 401 missing or invalid key, 403 forbidden Agent/IP allowlist, 429 rate or concurrency limit, 500 unexpected failure, and 503 temporary unavailability.

Do not persist the API key in this static reference. Production Try It is intentionally disabled.