Confirm virtual account (VA) deletion

Use this API to confirm the deletion of a virtual account (VA) after you have sent a deletion request. It is typically used when the bank requires OTP verification to complete the cancellation.

POST

URLhttps://open-api.tingee.vn/v1/confirm-delete-va

Confirm a VA deletion request with the confirmId received from the delete-va API. Depending on the bank, you may also need to pass otpNumber.

Header Request

Header	Required	Description
Content-Type	✓	application/json
x-client-id	✓	Partner identifier issued by TINGEE.
x-signature	✓	HMAC SHA512 authentication signature. See How to generate the signature.
x-request-timestamp	✓	Time the request is sent (format: yyyyMMddHHmmssSSS, UTC+7)

Body Parameter

Field	Type	Required	Description
merchantId	number	✕	Merchant ID (required if you connect with a Master Merchant account).
bankBin	string	✓	Bank BIN. See Supported banks.
confirmId	string	✓	Confirmation ID received from the Delete virtual account number API.
otpNumber	string	✓	OTP the bank sends to the account holder (SMS / bank app).

Code samples

cURL

curl --location --request POST 'https://open-api.tingee.vn/v1/confirm-delete-va' \
--header 'accept: application/json' \
--header 'x-client-id: YOUR_CLIENT_ID' \
--header 'x-request-timestamp: 20240509154004003' \
--header 'x-signature: YOUR_SIGNATURE' \
--header 'Content-Type: application/json' \
--data '{
  "bankBin": "970418",
  "confirmId": "72496bf2-ba25-4397-bd38-b9c04baedfd7",
  "otpNumber": "123456"
}'

NestJS

import axios from "axios";
import { createHmac } from "crypto";

const CLIENT_ID = "YOUR_CLIENT_ID";
const SECRET_KEY = "YOUR_SECRET_KEY";

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
function getTimestamp() {
    return new Date(Date.now() + 7 * 60 * 60 * 1000)
        .toISOString()
        .replace(/[-:TZ.]/g, "")
        .slice(0, 17);
}

async function confirmDeleteVa() {
    const body = {
        bankBin: "970418",
        confirmId: "72496bf2-ba25-4397-bd38-b9c04baedfd7",
        otpNumber: "123456",
    };

    const bodyJson = JSON.stringify(body);
    const timestamp = getTimestamp();
    const signature = createHmac("sha512", SECRET_KEY)
        .update(`${timestamp}:${bodyJson}`)
        .digest("hex");

    const res = await axios.request({
        method: "POST",
        url: "https://open-api.tingee.vn/v1/confirm-delete-va",
        data: bodyJson,
        headers: {
            accept: "application/json",
            "Content-Type": "application/json",
            "x-client-id": CLIENT_ID,
            "x-request-timestamp": timestamp,
            "x-signature": signature,
        },
    });

    console.log(res.data);
}

confirmDeleteVa();

C#

using System;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Encodings.Web;
using System.Text.Json;
using System.Threading.Tasks;

public class Program
{
    private const string ClientId = "YOUR_CLIENT_ID";
    private const string SecretKey = "YOUR_SECRET_KEY";
    private static readonly HttpClient Client = new HttpClient();

    public static async Task Main()
    {
        var body = new
        {
            bankBin = "970418",
            confirmId = "72496bf2-ba25-4397-bd38-b9c04baedfd7",
            otpNumber = "123456"
        };

        // Do not escape non-ASCII / special characters so the JSON matches TINGEE's JSON.stringify
        var jsonOptions = new JsonSerializerOptions { Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping };
        var bodyJson = JsonSerializer.Serialize(body, jsonOptions);

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        var timestamp = DateTime.UtcNow.AddHours(7).ToString("yyyyMMddHHmmssfff");
        var signature = HmacSha512(SecretKey, $"{timestamp}:{bodyJson}");

        var request = new HttpRequestMessage(HttpMethod.Post, "https://open-api.tingee.vn/v1/confirm-delete-va");
        request.Headers.Add("accept", "application/json");
        request.Headers.Add("x-client-id", ClientId);
        request.Headers.Add("x-request-timestamp", timestamp);
        request.Headers.Add("x-signature", signature);
        request.Content = new StringContent(bodyJson, Encoding.UTF8, "application/json");

        var response = await Client.SendAsync(request);
        Console.WriteLine(await response.Content.ReadAsStringAsync());
    }

    private static string HmacSha512(string key, string message)
    {
        using var hmac = new HMACSHA512(Encoding.UTF8.GetBytes(key));
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(message));
        return Convert.ToHexString(hash).ToLower();
    }
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.time.ZoneId;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class Main {
    private static final String CLIENT_ID = "YOUR_CLIENT_ID";
    private static final String SECRET_KEY = "YOUR_SECRET_KEY";

    public static void main(String[] args) throws Exception {
        // Minified JSON, same as JSON.stringify()
        String bodyJson = "{\"bankBin\":\"970418\",\"confirmId\":\"72496bf2-ba25-4397-bd38-b9c04baedfd7\",\"otpNumber\":\"123456\"}";

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        String timestamp = ZonedDateTime.now(ZoneId.of("Asia/Ho_Chi_Minh"))
                .format(DateTimeFormatter.ofPattern("yyyyMMddHHmmssSSS"));
        String signature = hmacSha512(SECRET_KEY, timestamp + ":" + bodyJson);

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://open-api.tingee.vn/v1/confirm-delete-va"))
                .header("accept", "application/json")
                .header("Content-Type", "application/json")
                .header("x-client-id", CLIENT_ID)
                .header("x-request-timestamp", timestamp)
                .header("x-signature", signature)
                .method("POST", HttpRequest.BodyPublishers.ofString(bodyJson, StandardCharsets.UTF_8))
                .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
                .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }

    private static String hmacSha512(String key, String data) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA512");
        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA512"));
        byte[] hash = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        StringBuilder hex = new StringBuilder();
        for (byte b : hash) hex.append(String.format("%02x", b));
        return hex.toString();
    }
}

PHP

<?php
$clientId = "YOUR_CLIENT_ID";
$secretKey = "YOUR_SECRET_KEY";

$body = [
    "bankBin" => "970418",
    "confirmId" => "72496bf2-ba25-4397-bd38-b9c04baedfd7",
    "otpNumber" => "123456",
];

// Do not escape "/" or non-ASCII characters so the JSON matches TINGEE's JSON.stringify
$bodyJson = json_encode($body, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
$now = new DateTime("now", new DateTimeZone("Asia/Ho_Chi_Minh"));
$timestamp = $now->format("YmdHisv");
$signature = hash_hmac("sha512", $timestamp . ":" . $bodyJson, $secretKey);

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => "https://open-api.tingee.vn/v1/confirm-delete-va",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_POSTFIELDS => $bodyJson,
    CURLOPT_HTTPHEADER => [
        "Accept: application/json",
        "Content-Type: application/json",
        "x-client-id: " . $clientId,
        "x-request-timestamp: " . $timestamp,
        "x-signature: " . $signature,
    ],
]);

$response = curl_exec($ch);
if ($response === false) {
    echo "cURL Error: " . curl_error($ch);
} else {
    echo $response;
}
curl_close($ch);

Sample Response

On successful confirmation, data contains the details of the deleted account:

{
  "code": "00",
  "message": "Success",
  "data": {
    "id": 12345,
    "creationTime": "2025-09-04T08:12:32.160Z",
    "merchantId": 1001,
    "shopId": 1024,
    "cashFlowSource": "bank-transfer",
    "name": "ACB - 88889999",
    "bankName": "ACB",
    "bankBin": "970416",
    "accountType": "personal-account",
    "linkType": "api-exact",
    "accountName": "NGUYEN VAN A",
    "accountNumber": "88889999",
    "vaAccountNumber": "88889999",
    "realVANumber": "88889999",
    "isNotifyAccountNumber": true,
    "status": "active",
    "transactionType": "credit"
  }
}

Field	Type	Description
code	string	Result code (00 = success).
message	string	Response message.
data.id	number	Account ID on the TINGEE system.
data.creationTime	string	Account creation time (ISO 8601, UTC).
data.merchantId	number	ID of the Merchant that owns the account.
data.shopId	number	ID of the shop the account is assigned to.
data.cashFlowSource	string	Source of funds: bank-transfer or card.
data.name	string	Account nickname.
data.bankName	string	Bank code (e.g. ACB, OCB).
data.bankBin	string	Bank BIN.
data.accountType	string	Account type (personal-account, business-account, business-household-account).
data.linkType	string	Link method: api-exact, manual-exact, manual-include.
data.accountName	string	Account holder name.
data.accountNumber	string	Original account number.
data.vaAccountNumber	string	Virtual account number stored on the system.
data.realVANumber	string	Virtual account number used to receive money (the value the partner passed in vaAccountNumber when calling the delete API).
data.isNotifyAccountNumber	boolean	true if this is an original account number link.
data.status	string	Account status at the time of deletion: active, inactive, lock.
data.transactionType	string	Registered notification type: credit or debit.

note

data may contain additional internal technical fields (audit information, bank configuration...). Do not rely on fields that are not described above.

---

Common error codes

Code	Description	How to handle
1065	OTP timed out	The confirmId has expired. Call Delete account number again.
1080	Incorrect ConfirmId	The confirmId does not belong to the Merchant calling the API.
1010	Account number not found	The account number no longer exists or does not belong to the Merchant.
1021	The bank does not require a confirmation step	Only ACB, OCB, PGBank, VietinBank, Sacombank, VIB require deletion confirmation; other banks are deleted immediately at the delete-va step.
90, 91, 92, 97	Request authentication error (timestamp, client-id, signature)	See System error codes.
Others	Other errors	See Error codes.