Reject a disbursement order

DELETE

URLhttps://open-api.tingee.vn/v1/direct-link/reject-transaction

Reject approval of a disbursement order (Checker)

Header Request

Header	Required	Description
Content-Type	✓	application/json
x-client-id	✓	Partner identifier issued by TINGEE.
x-signature	✓	HMAC SHA512 authentication signature.
x-request-timestamp	✓	Time the request is sent (format: yyyyMMddHHmmssSSS, UTC+7)

Body Parameter

Field	Type	Required	Description
bankBin	string	✓	Bank BIN. Currently only 970418 (BIDV) is supported. The API uses the BIDV authorization session of the Checker role.
actionType	string	✓	Disbursement order type - INTERNAL_TRANSFER: Domestic transfer - SALARY: Salary payment - BILL_PAYMENT: Bill payment (payment list)
transactionIds	array	✓	List of pending-approval transaction IDs to reject (the id field in the result of Transaction inquiry with inquiryType = PENDING_APPROVAL_LIST).
rejectReason	string	✕	Reason for rejection (if any).

Code samples

cURL

curl --location --request DELETE 'https://open-api.tingee.vn/v1/direct-link/reject-transaction' \
--header 'accept: application/json' \
--header 'x-client-id: YOUR_CLIENT_ID' \
--header 'x-request-timestamp: 20240509154004003' \
--header 'x-signature: YOUR_SIGNATURE' \
--header 'Content-Type: application/json' \
--data '{
  "bankBin": "970418",
  "actionType": "INTERNAL_TRANSFER",
  "transactionIds": [
    "PM0226061000074420"
  ],
  "rejectReason": "Thông tin không chính xác"
}'

NestJS

import axios from "axios";
import { createHmac } from "crypto";

const CLIENT_ID = "YOUR_CLIENT_ID";
const SECRET_KEY = "YOUR_SECRET_KEY";

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
function getTimestamp() {
    return new Date(Date.now() + 7 * 60 * 60 * 1000)
        .toISOString()
        .replace(/[-:TZ.]/g, "")
        .slice(0, 17);
}

async function directLinkRejectTransaction() {
    const body = {
        bankBin: "970418",
        actionType: "INTERNAL_TRANSFER",
        transactionIds: [
            "PM0226061000074420",
        ],
        rejectReason: "Thông tin không chính xác",
    };

    const bodyJson = JSON.stringify(body);
    const timestamp = getTimestamp();
    const signature = createHmac("sha512", SECRET_KEY)
        .update(`${timestamp}:${bodyJson}`)
        .digest("hex");

    const res = await axios.request({
        method: "DELETE",
        url: "https://open-api.tingee.vn/v1/direct-link/reject-transaction",
        data: bodyJson,
        headers: {
            accept: "application/json",
            "Content-Type": "application/json",
            "x-client-id": CLIENT_ID,
            "x-request-timestamp": timestamp,
            "x-signature": signature,
        },
    });

    console.log(res.data);
}

directLinkRejectTransaction();

C#

using System;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Encodings.Web;
using System.Text.Json;
using System.Threading.Tasks;

public class Program
{
    private const string ClientId = "YOUR_CLIENT_ID";
    private const string SecretKey = "YOUR_SECRET_KEY";
    private static readonly HttpClient Client = new HttpClient();

    public static async Task Main()
    {
        var body = new
        {
            bankBin = "970418",
            actionType = "INTERNAL_TRANSFER",
            transactionIds = new object[]
            {
                "PM0226061000074420"
            },
            rejectReason = "Thông tin không chính xác"
        };

        // Do not escape non-ASCII / special characters so the JSON matches TINGEE's JSON.stringify
        var jsonOptions = new JsonSerializerOptions { Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping };
        var bodyJson = JsonSerializer.Serialize(body, jsonOptions);

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        var timestamp = DateTime.UtcNow.AddHours(7).ToString("yyyyMMddHHmmssfff");
        var signature = HmacSha512(SecretKey, $"{timestamp}:{bodyJson}");

        var request = new HttpRequestMessage(HttpMethod.Delete, "https://open-api.tingee.vn/v1/direct-link/reject-transaction");
        request.Headers.Add("accept", "application/json");
        request.Headers.Add("x-client-id", ClientId);
        request.Headers.Add("x-request-timestamp", timestamp);
        request.Headers.Add("x-signature", signature);
        request.Content = new StringContent(bodyJson, Encoding.UTF8, "application/json");

        var response = await Client.SendAsync(request);
        Console.WriteLine(await response.Content.ReadAsStringAsync());
    }

    private static string HmacSha512(string key, string message)
    {
        using var hmac = new HMACSHA512(Encoding.UTF8.GetBytes(key));
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(message));
        return Convert.ToHexString(hash).ToLower();
    }
}

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.time.ZoneId;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class Main {
    private static final String CLIENT_ID = "YOUR_CLIENT_ID";
    private static final String SECRET_KEY = "YOUR_SECRET_KEY";

    public static void main(String[] args) throws Exception {
        // Minified JSON, same as JSON.stringify()
        String bodyJson = "{\"bankBin\":\"970418\",\"actionType\":\"INTERNAL_TRANSFER\",\"transactionIds\":[\"PM0226061000074420\"],\"rejectReason\":\"Thông tin không chính xác\"}";

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        String timestamp = ZonedDateTime.now(ZoneId.of("Asia/Ho_Chi_Minh"))
                .format(DateTimeFormatter.ofPattern("yyyyMMddHHmmssSSS"));
        String signature = hmacSha512(SECRET_KEY, timestamp + ":" + bodyJson);

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://open-api.tingee.vn/v1/direct-link/reject-transaction"))
                .header("accept", "application/json")
                .header("Content-Type", "application/json")
                .header("x-client-id", CLIENT_ID)
                .header("x-request-timestamp", timestamp)
                .header("x-signature", signature)
                .method("DELETE", HttpRequest.BodyPublishers.ofString(bodyJson, StandardCharsets.UTF_8))
                .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
                .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }

    private static String hmacSha512(String key, String data) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA512");
        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA512"));
        byte[] hash = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        StringBuilder hex = new StringBuilder();
        for (byte b : hash) hex.append(String.format("%02x", b));
        return hex.toString();
    }
}

PHP

<?php
$clientId = "YOUR_CLIENT_ID";
$secretKey = "YOUR_SECRET_KEY";

$body = [
    "bankBin" => "970418",
    "actionType" => "INTERNAL_TRANSFER",
    "transactionIds" => [
        "PM0226061000074420",
    ],
    "rejectReason" => "Thông tin không chính xác",
];

// Do not escape "/" or non-ASCII characters so the JSON matches TINGEE's JSON.stringify
$bodyJson = json_encode($body, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
$now = new DateTime("now", new DateTimeZone("Asia/Ho_Chi_Minh"));
$timestamp = $now->format("YmdHisv");
$signature = hash_hmac("sha512", $timestamp . ":" . $bodyJson, $secretKey);

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => "https://open-api.tingee.vn/v1/direct-link/reject-transaction",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "DELETE",
    CURLOPT_POSTFIELDS => $bodyJson,
    CURLOPT_HTTPHEADER => [
        "Accept: application/json",
        "Content-Type: application/json",
        "x-client-id: " . $clientId,
        "x-request-timestamp: " . $timestamp,
        "x-signature: " . $signature,
    ],
]);

$response = curl_exec($ch);
if ($response === false) {
    echo "cURL Error: " . curl_error($ch);
} else {
    echo $response;
}
curl_close($ch);

Sample Response

{
  "code": "00",
  "message": "Success",
  "data": {
    "successfulTransactions": [
      {
        "transactionId": "PM0226061000074420",
        "transactionType": "in-bank",
        "amount": 32987,
        "currency": "VND",
        "feeAccountNumber": "8600007007",
        "transactionCode": "PM02",
        "effectiveDate": "2026-06-10",
        "amountText": "Ba mươi hai nghìn chín trăm tám mươi bảy đồng",
        "feeTotal": 11000,
        "feeMethod": "O",
        "remark": "Chuyen tien",
        "originId": "TRANS_1006_A04",
        "priority": true,
        "status": "REJECTED",
        "creditAccountType": "ACCOUNT",
        "creditAccountNumber": "2220366666",
        "creditAccountName": "NGUYEN VAN A",
        "creditBankCode": "01202001",
        "creditBankShortName": "BIDV",
        "debitAccountNumber": "8600007007",
        "debitAccountName": "Title 1 8600007007"
      }
    ],
    "failedTransactions": []
  }
}

Field	Type	Description
code	string	Result code (00 = Success).
message	string	Response message.
data	object	Object containing the rejection result.
data.successfulTransactions	array	List of transactions rejected successfully. For INTERNAL_TRANSFER, the array contains the details of one representative transaction (the first transaction rejected) — use Transaction inquiry to check the status of each transaction when you reject several at once.
data.failedTransactions	array	List of transactions that failed to be rejected.

Elements of successfulTransactions / failedTransactions

Field	Type	Description
transactionId	string	BIDV transaction ID.
transactionType	string	Transaction type: in-bank (within BIDV), regular-out (regular interbank transfer), fast-out (NAPAS 247 fast transfer).
transactionCode	string	BIDV transaction type code (e.g. PM02, PM13).
status	string	Transaction status returned by BIDV (e.g. INIT, PENDING_APPROVAL, PROCESSING, BANK_PROCESSING, APPROVED, SUCCESS, REJECTED, FAILED).
amount	number	Transaction amount.
amountText	string	Amount in words.
currency	string	Currency (VND).
remark	string	Transaction description.
approvalNote	string	Approval submission note from the maker (Maker).
originId	string	The requestId reference the partner sent when creating the order.
priority	boolean	Priority processing flag.
effectiveDate	string	Effective date of the transaction.
acceptedDate	string	Time the bank accepted the transaction.
approvedDate	string	Time the transaction was approved.
processDate	string	Time the bank processed the transaction.
feeMethod	string	Fee bearer: O (the payment account pays the fee), B (the recipient pays the fee).
feeAccountNumber	string	Fee account.
feeAmount	number	Transaction fee (excluding VAT).
feeVAT	number	VAT on the fee.
feeTotal	number	Total transaction fee.
debitAccountNumber	string	Debit account number.
debitAccountName	string	Debit account name.
creditAccountType	string	Receiving method: ACCOUNT (account number) or ID (ID document).
creditAccountNumber	string	Recipient account number.
creditAccountName	string	Recipient name.
creditBankCode	string	Receiving bank code in CITAD format (e.g. 01202001 is BIDV).
creditBankName	string	Receiving bank name.
creditBankShortName	string	Receiving bank short name.
creditBankAbbr	string	Receiving bank abbreviation.
creditBranchCode	string	Receiving bank branch code.
creditBranchName	string	Receiving bank branch name.
creditId	string	Recipient ID document number (when creditAccountType = ID).
creditIssueDate	string	ID document issue date.
creditIssueAddress	string	ID document place of issue.
creditCurrency	string	Recipient currency.
originalCreditAccountNumber	string	Original recipient account number (from the original data when the order was created, if returned by BIDV).
originalCreditName	string	Original recipient name (from the original data when the order was created, if returned by BIDV).

Fields that BIDV does not return are omitted from the element (or set to null).

---

Common error codes

Code	Description	How to handle
1077	The BIDV authorization session of the approver (Checker) has expired or has not been granted	Call Get the authorization URL with role = Checker to re-authorize, then reject again.
1021	The bank is not supported for this API	Check bankBin; this API only supports BIDV (970418).
90, 91, 92, 97	Request authentication error (timestamp, client-id, signature)	See System error codes.
Others	Other errors	See Error codes.