Core resources › Transfers
Create a transfer
POST/v1/transfers
Moves money from an account you control to a counterparty you've already verified. A transfer is created immediately and settles asynchronously, so a successful response only means Strata accepted it.
Jump to request example ↓Parameters
amountintegerrequired
Amount in the smallest currency unit. 1250 is $12.50 for USD, ¥1250 for JPY.
currencystringrequired
Three-letter ISO 4217 code, lowercase. Must match the source account.
sourcestringrequired
ID of the account to debit, in the form acct_….
destinationstringrequired
ID of a counterparty, in the form cp_….
idempotency_keystringoptional
Safely retry without creating a second transfer. Keys are held for 24 hours.
metadataobjectoptional
Up to 40 key-value pairs. Returned on every subsequent read of this transfer.
Note
Always send an idempotency_key from a retrying client. Without one, a timeout that your code retries will create a second transfer, and we cannot tell the two apart.
Returns
The transfer object, with status set to pending. A 200 doesn't mean the transfer has settled, so poll the object or subscribe to the transfer.settled webhook.
Errors
StatusCodeWhen it happens
400invalid_request
A parameter was missing or malformed. The param field names the offender.
402insufficient_funds
The source account balance is below amount. Nothing was moved.
409idempotency_conflict
The same key was reused with a different body.
429rate_limited
Back off using the Retry-After header. Rate limits apply to each API key, whatever IP address the requests come from.
Core resources › Transfers
Retrieve a transfer
GET/v1/transfers/:id
Reads a single transfer by ID. This is the endpoint you poll while a transfer settles, and the one you call after a transfer.settled webhook to confirm the payload you were sent.
Parameters
idstringrequired
The transfer ID, in the form tr_…. Send it in the URL path.
expandarrayoptional
Inline related objects instead of returning bare IDs. Accepts source, destination and events.
Note
A transfer is immutable once created, so responses are safe to cache until status leaves pending. Every read returns the same id, even for transfers created under an earlier API version.
Returns
The transfer object. Once money has moved, status is settled and settled_at is populated; a rejected transfer carries status failed and a failure_code.
Errors
StatusCodeWhen it happens
401unauthorized
The key is missing, revoked, or belongs to another environment.
404not_found
No transfer with that ID exists for this key. Live keys cannot read test objects.
429rate_limited
Polling too fast. Prefer the transfer.settled webhook over a tight loop.
Core resources › Accounts
List accounts
GET/v1/accounts
Returns every account the key can see, newest first. The list is cursor paginated, so read next_cursor and pass it back as starting_after instead of counting offsets.
Parameters
limitintegeroptional
How many accounts to return, between 1 and 100. Defaults to 20.
starting_afterstringoptional
A cursor from the previous page. Pass next_cursor back exactly as you received it.
statusstringoptional
Filter by open, frozen or closed. Omit to return all three.
currencystringoptional
Restrict to one ISO 4217 code, lowercase.
Note
Balances on a listed account are a snapshot taken when the page was built. Before you move money against a balance, read the account directly. Use list balances for display only.
Returns
A list object. data holds the accounts, has_more tells you if another page exists, and next_cursor is null on the final page.
Errors
StatusCodeWhen it happens
400invalid_request
limit was outside 1–100, or status was not a known value.
401unauthorized
The key is missing, revoked, or belongs to another environment.
429rate_limited
Listing is cheaper than polling, but still limited. Back off on Retry-After.
Core resources › Counterparties
Create a counterparty
POST/v1/counterparties
Registers somebody you intend to pay. Verification runs synchronously, so the response already tells you if the bank details are usable. A counterparty you can't verify can't receive a transfer.
Parameters
namestringrequired
Legal name as held by the receiving bank. Nicknames fail verification more often than they fail validation.
typestringrequired
Either individual or business. This decides which verification network we use.
account_numberstringrequired
Digits only, no spaces or dashes. Stored encrypted and never returned in full.
routing_numberstringrequired
Nine-digit ABA number for USD, or the local equivalent for other currencies.
emailstringoptional
Used only for payment notifications. Never shown to the receiving bank.
metadataobjectoptional
Up to 40 key-value pairs, returned on every subsequent read.
Note
Send an Idempotency-Key here too. Duplicate counterparties are the most common cause of a payment landing in the wrong account, because two records for one person drift apart over time.
Returns
The counterparty object with verification set to verified or pending_review. Only verified counterparties can be used as a transfer destination.
Errors
StatusCodeWhen it happens
400invalid_request
routing_number failed its checksum, or type was not recognised.
409duplicate_counterparty
These bank details already exist. The existing field carries the ID you should reuse.
422verification_failed
The name does not match the account holder on record. Nothing was created.
429rate_limited
Verification is rate limited separately from reads. Back off on Retry-After.
Reference › Changelog
Changelog
Every dated release below is a pinned API version. Your key stays on the version it was created with and only moves to a newer one when you upgrade it.
Releases
v32026-04-11current
Transfers gained expand, and list endpoints moved to cursor pagination.
v22025-11-02supported
Counterparty verification became synchronous; status is returned on create.
v12024-08-19deprecated
Retires 2027-01-01. Amounts were decimal strings rather than minor units.
Pin it
Pin explicitly in CI. A request without Strata-Version uses the account default, which means a colleague changing that default can change your test results.
Reference › Support
Support
Reach a human who can read your logs. Include the request ID from the failing response. It's in every error body and every response header, and it lets us look up the exact request.
Channels
ChannelFirst replyWhat to send
Developer chatunder 1 hour
Integration questions, unexpected 4xx responses, anything you can reproduce.
Emailsame working day
Account changes, key rotation, and anything with an attachment.
Incident lineimmediate
Money moved that should not have, or an endpoint failing for every key.
Keys
Never send us a live secret key, even in a screenshot. If a key has been shared anywhere, rotate it before you contact us. Once it's rotated, the copy in the conversation can't be used.
Getting started › Introduction
Introduction
Getting started › Authentication
Authentication
Getting started › Errors
Errors
Getting started › Versioning
Versioning
Core resources › Balances
Balances
Core resources › Statements
Statements
Webhooks › Event types
Event types
Webhooks › Signature checks
Signature checks
Webhooks › Replay & retries
Replay & retries
SDKs › Node
Node
SDKs › Python
Python
SDKs › Go
Go
Workspace › Dashboard
Developer dashboard
Check live-mode health, key rotation, webhook delivery and the requests that need attention.
Request log
RequestStatusTrace
POST /v1/transfers201 · 221 msreq_5Tn1Vc · 4 seconds ago
GET /v1/accounts200 · 96 msreq_8Jm4Qp · 18 seconds ago
POST /v1/webhook-replays202 · 143 msreq_3Pk9Ba · 2 minutes ago
Trace it
Open a request ID to inspect headers, version pinning, response payload, and webhook fan-out without exposing secret-key material.