Payment account transaction history

GET

URLhttps://open-api.tingee.vn/v1/direct-link/account-statement/payment-transaction-history

Payment transaction history

Header Request

Header	Required	Description
Content-Type	✓	application/json
x-client-id	✓	Partner identifier issued by TINGEE.
x-signature	✓	HMAC SHA512 authentication signature.
x-request-timestamp	✓	Time the request is sent (format: yyyyMMddHHmmssSSS, UTC+7)

Query Parameters

Field	Type	Required	Description
bankBin	string	✓	Bank BIN. Currently only 970418 (BIDV) is supported.
role	string	✓	User role: Maker or Checker (uses the BIDV authorization session of that role).
accountNumber	string	✓	Payment account number to get the transaction history for.
startDate	string	✕	Search start time (yyyy-MM-dd)
endDate	string	✕	Search end time (yyyy-MM-dd)
moreRecordIndicator	string	✕	Pagination key: pass back the moreRecordIndicator value of the last record on the previous page to get the next page.
postingDate	string	✕	Pagination key: pass back the postingDate value of the last record on the previous page.
postingOrder	string	✕	Pagination key: pass back the postingOrder value of the last record on the previous page.
balanceAfterTxn	string	✕	Pagination key: pass back the nextRUNBAL value (balance after the transaction) of the last record on the previous page.
totalRecords	number	✕	Number of records to get per query.

Code samples

cURL

curl --location --request GET 'https://open-api.tingee.vn/v1/direct-link/account-statement/payment-transaction-history?bankBin=970418&role=Maker&accountNumber=1234567890&startDate=2025-11-01&endDate=2025-11-10' \
--header 'accept: application/json' \
--header 'x-client-id: YOUR_CLIENT_ID' \
--header 'x-request-timestamp: 20240509154004003' \
--header 'x-signature: YOUR_SIGNATURE'

NestJS

import axios from "axios";
import { createHmac } from "crypto";

const CLIENT_ID = "YOUR_CLIENT_ID";
const SECRET_KEY = "YOUR_SECRET_KEY";

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
function getTimestamp() {
    return new Date(Date.now() + 7 * 60 * 60 * 1000)
        .toISOString()
        .replace(/[-:TZ.]/g, "")
        .slice(0, 17);
}

async function directLinkAccountStatementPaymentTransactionHistory() {
    const body = {}; // Request has no body: sign the string "{}"

    const params = {
        bankBin: "970418",
        role: "Maker",
        accountNumber: "1234567890",
        startDate: "2025-11-01",
        endDate: "2025-11-10",
    };

    const bodyJson = JSON.stringify(body);
    const timestamp = getTimestamp();
    const signature = createHmac("sha512", SECRET_KEY)
        .update(`${timestamp}:${bodyJson}`)
        .digest("hex");

    const res = await axios.request({
        method: "GET",
        url: "https://open-api.tingee.vn/v1/direct-link/account-statement/payment-transaction-history",
        params,
        headers: {
            accept: "application/json",
            "Content-Type": "application/json",
            "x-client-id": CLIENT_ID,
            "x-request-timestamp": timestamp,
            "x-signature": signature,
        },
    });

    console.log(res.data);
}

directLinkAccountStatementPaymentTransactionHistory();

C#

using System;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;

public class Program
{
    private const string ClientId = "YOUR_CLIENT_ID";
    private const string SecretKey = "YOUR_SECRET_KEY";
    private static readonly HttpClient Client = new HttpClient();

    public static async Task Main()
    {
        var bodyJson = "{}"; // Request has no body: sign the string "{}"

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        var timestamp = DateTime.UtcNow.AddHours(7).ToString("yyyyMMddHHmmssfff");
        var signature = HmacSha512(SecretKey, $"{timestamp}:{bodyJson}");

        var request = new HttpRequestMessage(HttpMethod.Get, "https://open-api.tingee.vn/v1/direct-link/account-statement/payment-transaction-history?bankBin=970418&role=Maker&accountNumber=1234567890&startDate=2025-11-01&endDate=2025-11-10");
        request.Headers.Add("accept", "application/json");
        request.Headers.Add("x-client-id", ClientId);
        request.Headers.Add("x-request-timestamp", timestamp);
        request.Headers.Add("x-signature", signature);

        var response = await Client.SendAsync(request);
        Console.WriteLine(await response.Content.ReadAsStringAsync());
    }

    private static string HmacSha512(string key, string message)
    {
        using var hmac = new HMACSHA512(Encoding.UTF8.GetBytes(key));
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(message));
        return Convert.ToHexString(hash).ToLower();
    }
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.time.ZoneId;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class Main {
    private static final String CLIENT_ID = "YOUR_CLIENT_ID";
    private static final String SECRET_KEY = "YOUR_SECRET_KEY";

    public static void main(String[] args) throws Exception {
        // Minified JSON, same as JSON.stringify(). Request has no body: sign the string "{}"
        String bodyJson = "{}";

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        String timestamp = ZonedDateTime.now(ZoneId.of("Asia/Ho_Chi_Minh"))
                .format(DateTimeFormatter.ofPattern("yyyyMMddHHmmssSSS"));
        String signature = hmacSha512(SECRET_KEY, timestamp + ":" + bodyJson);

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://open-api.tingee.vn/v1/direct-link/account-statement/payment-transaction-history?bankBin=970418&role=Maker&accountNumber=1234567890&startDate=2025-11-01&endDate=2025-11-10"))
                .header("accept", "application/json")
                .header("Content-Type", "application/json")
                .header("x-client-id", CLIENT_ID)
                .header("x-request-timestamp", timestamp)
                .header("x-signature", signature)
                .method("GET", HttpRequest.BodyPublishers.noBody())
                .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
                .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }

    private static String hmacSha512(String key, String data) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA512");
        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA512"));
        byte[] hash = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        StringBuilder hex = new StringBuilder();
        for (byte b : hash) hex.append(String.format("%02x", b));
        return hex.toString();
    }
}

PHP

<?php
$clientId = "YOUR_CLIENT_ID";
$secretKey = "YOUR_SECRET_KEY";

$bodyJson = "{}"; // Request has no body: sign the string "{}"

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
$now = new DateTime("now", new DateTimeZone("Asia/Ho_Chi_Minh"));
$timestamp = $now->format("YmdHisv");
$signature = hash_hmac("sha512", $timestamp . ":" . $bodyJson, $secretKey);

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => "https://open-api.tingee.vn/v1/direct-link/account-statement/payment-transaction-history?bankBin=970418&role=Maker&accountNumber=1234567890&startDate=2025-11-01&endDate=2025-11-10",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "GET",
    CURLOPT_HTTPHEADER => [
        "Accept: application/json",
        "Content-Type: application/json",
        "x-client-id: " . $clientId,
        "x-request-timestamp: " . $timestamp,
        "x-signature: " . $signature,
    ],
]);

$response = curl_exec($ch);
if ($response === false) {
    echo "cURL Error: " . curl_error($ch);
} else {
    echo $response;
}
curl_close($ch);

Sample Response

{
  "code": "00",
  "message": "Success",
  "data": {
    "items": [
      {
        "coreRefNo": "REF001",
        "transTime": "2025-01-01 10:00:00",
        "debitAmount": 1000000,
        "creditAmount": 0,
        "remark": "Thanh toan hoa don",
        "nextRUNBAL": "9000000",
        "postingDate": "2025-01-01",
        "postingOrder": "001",
        "moreRecordIndicator": "N"
      }
    ],
    "total": 1
  }
}

Field	Type	Description
code	string	Result code (00 = Success).
message	string	Response message.
data.items	array	List of payment transactions.
data.items[].coreRefNo	string	Transaction reference number.
data.items[].transTime	string	Transaction time.
data.items[].debitAmount	number	Debit amount.
data.items[].creditAmount	number	Credit amount.
data.items[].remark	string	Transaction description.
data.items[].nextRUNBAL	string	Balance after the transaction.
data.items[].postingDate	string	Posting date.
data.items[].postingOrder	string	Posting order.
data.items[].moreRecordIndicator	string	Whether more records follow (Y/N).
data.total	number	Total number of transactions.

---

Common error codes

Code	Description	How to handle
1077	The BIDV authorization session for the role has expired or has not been granted	Call Get the authorization URL with the correct role to re-authorize, then query again.
1021	The bank is not supported for this API	Check bankBin; this API only supports BIDV (970418).
90, 91, 92, 97	Request authentication error (timestamp, client-id, signature)	See System error codes.
Others	Other errors	See Error codes.