Confirm payment order

PUT

URLhttps://open-api.tingee.vn/v1/direct-link/confirm-transfer

Authenticate and complete the approval request for a disbursement payment order you created

Header Request

Header	Required	Description
`Content-Type`	✓	`application/json`
`x-client-id`	✓	Partner identifier issued by TINGEE.
`x-signature`	✓	HMAC SHA512 authentication signature.
`x-request-timestamp`	✓	Time the request is sent (format: `yyyyMMddHHmmssSSS`, UTC+7)

Body Parameter

Field	Type	Required	Description
`bankBin`	string	✓	Bank BIN. Currently only 970418 (BIDV) is supported. The API uses the BIDV authorization session of the `Maker` role.
`actionType`	string	✓	Purpose of the disbursement order (must match the `actionType` used when creating the order) - `INTERNAL_TRANSFER`: Domestic transfer - `SALARY`: Salary payment - `BILL_PAYMENT`: Bill / statement payment
`confirmId`	string	✓	Confirmation key, taken from `data.confirmId` of the Create payment order API (`action = REQUEST_APPROVAL`) or the Submit payment order for approval API (when `requireAuth = true`).
`otp`	string	~	Confirmation value (OTP / SmartOTP). Required for BIDV.

Code samples

cURL
NestJS
C#
Java
PHP

curl --location --request PUT 'https://open-api.tingee.vn/v1/direct-link/confirm-transfer' \
--header 'accept: application/json' \
--header 'x-client-id: YOUR_CLIENT_ID' \
--header 'x-request-timestamp: 20240509154004003' \
--header 'x-signature: YOUR_SIGNATURE' \
--header 'Content-Type: application/json' \
--data '{
  "bankBin": "970418",
  "actionType": "INTERNAL_TRANSFER",
  "confirmId": "TXNKEY_INIT_PM13_25607354makerotv_2827594e-037d-434b-b534-b1ff52adad4a",
  "otp": "123456"
}'

import axios from "axios";
import { createHmac } from "crypto";

const CLIENT_ID = "YOUR_CLIENT_ID";
const SECRET_KEY = "YOUR_SECRET_KEY";

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
function getTimestamp() {
    return new Date(Date.now() + 7 * 60 * 60 * 1000)
        .toISOString()
        .replace(/[-:TZ.]/g, "")
        .slice(0, 17);
}

async function directLinkConfirmTransfer() {
    const body = {
        bankBin: "970418",
        actionType: "INTERNAL_TRANSFER",
        confirmId: "TXNKEY_INIT_PM13_25607354makerotv_2827594e-037d-434b-b534-b1ff52adad4a",
        otp: "123456",
    };

    const bodyJson = JSON.stringify(body);
    const timestamp = getTimestamp();
    const signature = createHmac("sha512", SECRET_KEY)
        .update(`${timestamp}:${bodyJson}`)
        .digest("hex");

    const res = await axios.request({
        method: "PUT",
        url: "https://open-api.tingee.vn/v1/direct-link/confirm-transfer",
        data: bodyJson,
        headers: {
            accept: "application/json",
            "Content-Type": "application/json",
            "x-client-id": CLIENT_ID,
            "x-request-timestamp": timestamp,
            "x-signature": signature,
        },
    });

    console.log(res.data);
}

directLinkConfirmTransfer();

using System;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Encodings.Web;
using System.Text.Json;
using System.Threading.Tasks;

public class Program
{
    private const string ClientId = "YOUR_CLIENT_ID";
    private const string SecretKey = "YOUR_SECRET_KEY";
    private static readonly HttpClient Client = new HttpClient();

    public static async Task Main()
    {
        var body = new
        {
            bankBin = "970418",
            actionType = "INTERNAL_TRANSFER",
            confirmId = "TXNKEY_INIT_PM13_25607354makerotv_2827594e-037d-434b-b534-b1ff52adad4a",
            otp = "123456"
        };

        // Do not escape non-ASCII / special characters so the JSON matches TINGEE's JSON.stringify
        var jsonOptions = new JsonSerializerOptions { Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping };
        var bodyJson = JsonSerializer.Serialize(body, jsonOptions);

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        var timestamp = DateTime.UtcNow.AddHours(7).ToString("yyyyMMddHHmmssfff");
        var signature = HmacSha512(SecretKey, $"{timestamp}:{bodyJson}");

        var request = new HttpRequestMessage(HttpMethod.Put, "https://open-api.tingee.vn/v1/direct-link/confirm-transfer");
        request.Headers.Add("accept", "application/json");
        request.Headers.Add("x-client-id", ClientId);
        request.Headers.Add("x-request-timestamp", timestamp);
        request.Headers.Add("x-signature", signature);
        request.Content = new StringContent(bodyJson, Encoding.UTF8, "application/json");

        var response = await Client.SendAsync(request);
        Console.WriteLine(await response.Content.ReadAsStringAsync());
    }

    private static string HmacSha512(string key, string message)
    {
        using var hmac = new HMACSHA512(Encoding.UTF8.GetBytes(key));
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(message));
        return Convert.ToHexString(hash).ToLower();
    }
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.time.ZoneId;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class Main {
    private static final String CLIENT_ID = "YOUR_CLIENT_ID";
    private static final String SECRET_KEY = "YOUR_SECRET_KEY";

    public static void main(String[] args) throws Exception {
        // Minified JSON, same as JSON.stringify()
        String bodyJson = "{\"bankBin\":\"970418\",\"actionType\":\"INTERNAL_TRANSFER\",\"confirmId\":\"TXNKEY_INIT_PM13_25607354makerotv_2827594e-037d-434b-b534-b1ff52adad4a\",\"otp\":\"123456\"}";

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        String timestamp = ZonedDateTime.now(ZoneId.of("Asia/Ho_Chi_Minh"))
                .format(DateTimeFormatter.ofPattern("yyyyMMddHHmmssSSS"));
        String signature = hmacSha512(SECRET_KEY, timestamp + ":" + bodyJson);

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://open-api.tingee.vn/v1/direct-link/confirm-transfer"))
                .header("accept", "application/json")
                .header("Content-Type", "application/json")
                .header("x-client-id", CLIENT_ID)
                .header("x-request-timestamp", timestamp)
                .header("x-signature", signature)
                .method("PUT", HttpRequest.BodyPublishers.ofString(bodyJson, StandardCharsets.UTF_8))
                .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
                .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }

    private static String hmacSha512(String key, String data) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA512");
        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA512"));
        byte[] hash = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        StringBuilder hex = new StringBuilder();
        for (byte b : hash) hex.append(String.format("%02x", b));
        return hex.toString();
    }
}

<?php
$clientId = "YOUR_CLIENT_ID";
$secretKey = "YOUR_SECRET_KEY";

$body = [
    "bankBin" => "970418",
    "actionType" => "INTERNAL_TRANSFER",
    "confirmId" => "TXNKEY_INIT_PM13_25607354makerotv_2827594e-037d-434b-b534-b1ff52adad4a",
    "otp" => "123456",
];

// Do not escape "/" or non-ASCII characters so the JSON matches TINGEE's JSON.stringify
$bodyJson = json_encode($body, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
$now = new DateTime("now", new DateTimeZone("Asia/Ho_Chi_Minh"));
$timestamp = $now->format("YmdHisv");
$signature = hash_hmac("sha512", $timestamp . ":" . $bodyJson, $secretKey);

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => "https://open-api.tingee.vn/v1/direct-link/confirm-transfer",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "PUT",
    CURLOPT_POSTFIELDS => $bodyJson,
    CURLOPT_HTTPHEADER => [
        "Accept: application/json",
        "Content-Type: application/json",
        "x-client-id: " . $clientId,
        "x-request-timestamp: " . $timestamp,
        "x-signature: " . $signature,
    ],
]);

$response = curl_exec($ch);
if ($response === false) {
    echo "cURL Error: " . curl_error($ch);
} else {
    echo $response;
}
curl_close($ch);

Sample Response

{
  "code": "00",
  "message": "Success",
  "data": {
    "successfulTransactions": [
      {
        "transactionId": "PM2226061600075162",
        "amount": 101418,
        "currency": "VND",
        "feeAccountNumber": "8600007007",
        "transactionCode": "PM22",
        "effectiveDate": "2026-06-16",
        "processDate": "2026-06-16T11:20:19.448429323",
        "feeTotal": 27500,
        "feeMethod": "O",
        "remark": "Chuyen luong",
        "approvalNote": "",
        "originId": "8AFF13679AC48563911C4B50BA857E8E",
        "priority": true,
        "status": "PENDING_APPROVAL",
        "creditAccountType": "ACCOUNT",
        "creditAccountNumber": "2220366666",
        "creditAccountName": "TITLE 1 2220366666",
        "debitAccountNumber": "8600007007",
        "debitAccountName": "Title 1 8600007007"
      }
    ],
    "failedTransactions": []
  }
}

Response `data` structure

Field	Type	Description
`successfulTransactions`	array	Transactions authenticated successfully.
`failedTransactions`	array	Transactions whose authentication failed.
`batchNo`	string	BIDV batch number (only returned when confirming an `INTERNAL_TRANSFER` batch order).

Items in `successfulTransactions` / `failedTransactions`

Field	Type	Description
`transactionId`	string	BIDV transaction ID.
`transactionType`	string	Transaction type: `in-bank` (within BIDV), `regular-out` (standard interbank transfer), `fast-out` (NAPAS 247 fast transfer).
`transactionCode`	string	BIDV transaction type code (e.g. `PM02`, `PM13`).
`status`	string	Transaction status returned by BIDV (e.g. `INIT`, `PENDING_APPROVAL`, `PROCESSING`, `BANK_PROCESSING`, `APPROVED`, `SUCCESS`, `REJECTED`, `FAILED`).
`amount`	number	Transaction amount.
`amountText`	string	Amount in words.
`currency`	string	Currency (VND).
`remark`	string	Transaction description.
`approvalNote`	string	Approval request note from the maker (Maker).
`originId`	string	The `requestId` reference the partner sent when creating the order.
`priority`	boolean	Priority processing flag.
`effectiveDate`	string	Transaction effective date.
`acceptedDate`	string	Time the bank accepted the transaction.
`approvedDate`	string	Time the transaction was approved.
`processDate`	string	Time the bank processed the transaction.
`feeMethod`	string	Fee payer: `O` (the payment account pays the fee), `B` (the recipient pays the fee).
`feeAccountNumber`	string	Fee account.
`feeAmount`	number	Transaction fee (excluding VAT).
`feeVAT`	number	VAT on the fee.
`feeTotal`	number	Total transaction fee.
`debitAccountNumber`	string	Debit account number.
`debitAccountName`	string	Debit account name.
`creditAccountType`	string	How the recipient receives the money: `ACCOUNT` (account number) or `ID` (identity document).
`creditAccountNumber`	string	Recipient account number.
`creditAccountName`	string	Recipient name.
`creditBankCode`	string	Recipient bank code in the CITAD standard (e.g. `01202001` is BIDV).
`creditBankName`	string	Recipient bank name.
`creditBankShortName`	string	Recipient bank short name.
`creditBankAbbr`	string	Recipient bank abbreviation.
`creditBranchCode`	string	Recipient bank branch code.
`creditBranchName`	string	Recipient bank branch name.
`creditId`	string	Recipient identity document number (when `creditAccountType = ID`).
`creditIssueDate`	string	Identity document issue date.
`creditIssueAddress`	string	Identity document place of issue.
`creditCurrency`	string	Recipient currency.
`originalCreditAccountNumber`	string	Original recipient account number (from the original data when the order was created, if BIDV returns it).
`originalCreditName`	string	Original recipient name (from the original data when the order was created, if BIDV returns it).

Fields that BIDV does not return are omitted from the item (or have a null value).

Common error codes

Code	Description	How to handle
`1077`	The BIDV authorization session of the maker (Maker) has expired or has not been granted	Call Get authorization URL with `role = Maker` to re-authorize; create the transaction again if `confirmId` has expired.
`1021`	The bank is not supported for this API	Check `bankBin`; this API only supports BIDV (`970418`).
`90`, `91`, `92`, `97`	Request authentication error (timestamp, client-id, signature)	See System error codes.
`Others`	Other errors	See Error codes.

Header Request​

Body Parameter​

Code samples​

Sample Response​

Response data structure​

Items in successfulTransactions / failedTransactions​

Common error codes​

Header Request

Body Parameter

Code samples

Sample Response

Response `data` structure

Items in `successfulTransactions` / `failedTransactions`

Common error codes