Query disbursement order information

POST

URLhttps://open-api.tingee.vn/v1/direct-link/transaction-inquiry

Query the list and details of transactions in the Maker/Checker flow (BIDV).

Header Request

Header	Required	Description
`Content-Type`	✓	`application/json`
`x-client-id`	✓	Partner identifier issued by TINGEE.
`x-signature`	✓	HMAC SHA512 authentication signature.
`x-request-timestamp`	✓	Time the request is sent (format: `yyyyMMddHHmmssSSS`, UTC+7)

Body Parameter

Field	Type	Required	Description
`bankBin`	string	✓	Bank BIN (always `970418` - BIDV).
`actionType`	string	✓	Operation type: - `INTERNAL_TRANSFER` - `SALARY` - `BILL_PAYMENT`
`inquiryType`	string	✓	Inquiry type. Possible values: `PENDING_APPROVAL_LIST`: Get the list of transactions pending approval. (Always uses the authorization session of the `Checker` role). `MAKER_PENDING_LIST`: Get the list of transactions created by the Maker (draft / pending approval). (Always uses the authorization session of the `Maker` role). `FO_REPORT_LIST`: Summary report of the posting status of transactions. (Available to both `Maker` and `Checker`, according to `role`). `BATCH_UPLOAD_INQUIRY`: Query the child transaction records by `batchId` after uploading a batch disbursement order. (Always uses the authorization session of the `Maker` role). `TRANSFER_DETAIL`: View the posting details of a specific transaction by `id`. (Available to both `Maker` and `Checker`, according to `role`). `EDIT_TRANSFER_DETAIL`: Get a draft transaction by `id` for editing. For `INTERNAL_TRANSFER`, the transaction must have been created through TINGEE and still be in draft status. (Always uses the authorization session of the `Maker` role). The `BATCH_DETAIL` value does not apply to BIDV (it is only used for BaoKim — see Transaction inquiry for the automatic disbursement flow).
`role`	string	✓	Role (`Maker` / `Checker`). Determines which BIDV authorization session is used with `FO_REPORT_LIST` and `TRANSFER_DETAIL`.
`id`	string	~	Transaction ID in the BIDV system (the `records[].transactionId` value when creating an `INTERNAL_TRANSFER` order, or `data.transactionId` for `SALARY` / `BILL_PAYMENT`; or the `id` field in the lists). Required when `inquiryType` is `TRANSFER_DETAIL` or `EDIT_TRANSFER_DETAIL`.
`batchId`	string	~	Transaction batch ID (the `data.batchId` value returned when creating a batch payment order). Required when `inquiryType = BATCH_UPLOAD_INQUIRY`.
`status`	string	✕	Status to filter by. - For `BATCH_UPLOAD_INQUIRY`: `VALID` (valid record) or `INVALID` (invalid record) - For `FO_REPORT_LIST`, `MAKER_PENDING_LIST`: BIDV transaction status (the `status` value returned in `items`, e.g. `INIT`, `PENDING_APPROVAL`, `SUCCESS`)
`filter`	string	✕	General search keyword. Applies to the list inquiry types and `BATCH_UPLOAD_INQUIRY`.
`startDate`	string	✕	Filter by creation date greater than or equal to the given value (format `YYYY-MM-DD`). Applies to: `FO_REPORT_LIST`, `MAKER_PENDING_LIST`; for `INTERNAL_TRANSFER` it also applies to `PENDING_APPROVAL_LIST`.
`endDate`	string	✕	Filter by creation date less than or equal to the given value (format `YYYY-MM-DD`). Applies the same way as `startDate`.
`startEffectiveDate`	string	✕	Filter by effective date greater than or equal to the given value (format `YYYY-MM-DD`). Applies to: `FO_REPORT_LIST`, `PENDING_APPROVAL_LIST`, `MAKER_PENDING_LIST`.
`endEffectiveDate`	string	✕	Filter by effective date less than or equal to the given value (format `YYYY-MM-DD`). Applies the same way as `startEffectiveDate`.
`debitAccountNumber`	string	✕	Filter by payment (debit) account number. Applies to: `FO_REPORT_LIST`, `PENDING_APPROVAL_LIST`, `MAKER_PENDING_LIST`.
`receiverValue`	string	✕	Filter by recipient information (account number / ID document number). Applies to: `PENDING_APPROVAL_LIST`, `MAKER_PENDING_LIST`; for `INTERNAL_TRANSFER` it also applies to `FO_REPORT_LIST`.
`amountMin`	number	✕	Filter by minimum amount. Applies to: `FO_REPORT_LIST`, `PENDING_APPROVAL_LIST`, `MAKER_PENDING_LIST`.
`amountMax`	number	✕	Filter by maximum amount. Applies the same way as `amountMin`.
`currency`	string	✕	Filter by currency (e.g. `VND`). Applies to: `FO_REPORT_LIST`, `PENDING_APPROVAL_LIST`, `MAKER_PENDING_LIST`.
`channel`	array	✕	Filter by the channel that created the transaction (e.g. `["ERP"]`). Applies to: `FO_REPORT_LIST`, `PENDING_APPROVAL_LIST`, `MAKER_PENDING_LIST`.
`batchNo`	string	✕	Filter by BIDV batch number (`batchNo`). Applies to: `PENDING_APPROVAL_LIST`, `MAKER_PENDING_LIST`; for `INTERNAL_TRANSFER` it also applies to `FO_REPORT_LIST`.
`receiverBankCode`	array	✕	Filter by a list of receiving bank codes in CITAD format (e.g. `["01202001"]`). Applies to: `PENDING_APPROVAL_LIST`, `MAKER_PENDING_LIST`; for `INTERNAL_TRANSFER` it also applies to `FO_REPORT_LIST`.
`transactionType`	array	✕	Filter by a list of transaction types, using BIDV codes: `I` (within BIDV), `O` (outside BIDV), `F` (247 fast transfer). Only applies to `INTERNAL_TRANSFER`: `FO_REPORT_LIST`, `PENDING_APPROVAL_LIST`, `MAKER_PENDING_LIST`.
`coreRef`	string	✕	Filter by the bank's core posting reference (core reference). Only applies to `INTERNAL_TRANSFER` + `FO_REPORT_LIST`.
`createdBy`	string	✕	Filter by the order creator (Maker username on BIDV). Applies to: `PENDING_APPROVAL_LIST`.
`myTransfer`	string	✕	Filter transactions created by the currently authorized user. Only applies to `INTERNAL_TRANSFER` + `MAKER_PENDING_LIST`.
`validCreateDateRange`	boolean	✕	Enable filtering by creation date range (`startDate` – `endDate`). Only applies to `INTERNAL_TRANSFER`: `PENDING_APPROVAL_LIST`, `MAKER_PENDING_LIST`.
`validEffDateRange`	boolean	✕	Enable filtering by effective date range (`startEffectiveDate` – `endEffectiveDate`). Applies the same way as `validCreateDateRange`.
`amountRange`	boolean	✕	Enable filtering by amount range (`amountMin` – `amountMax`). Applies the same way as `validCreateDateRange`.
`skipCount`	number	✕	Number of records to skip (pagination). For example, page 2 with 50 records per page: `skipCount = 50`. Pass a multiple of `maxResultCount` (the system converts it to a BIDV page number).
`maxResultCount`	number	✕	Maximum number of records per page (default `10`, maximum `2000`).

Sample request payload

Each inquiry type requires different input parameters and returns a different data structure. Click a tab below and all the Code samples and Sample Responses below will automatically switch to the inquiry type you selected!

BATCH_UPLOAD_INQUIRY
PENDING_APPROVAL_LIST
MAKER_PENDING_LIST
TRANSFER_DETAIL
FO_REPORT_LIST

Note: Use this to check the status of the child records after the Maker successfully uploads a batch file. batchId is required. You can also use the status field (VALID/INVALID) to filter valid/invalid records.

{
  "bankBin": "970418",
  "actionType": "INTERNAL_TRANSFER",
  "inquiryType": "BATCH_UPLOAD_INQUIRY",
  "role": "Maker",
  "batchId": "2667c208-a5ab-4c9c-af4d-cbd4de24b817",
  "status": "VALID",
  "skipCount": 0,
  "maxResultCount": 50
}

Note: For the Checker to get the list of transactions pending approval. Only the basic filters and pagination parameters (skipCount, maxResultCount) are needed; you do not need to pass id or batchId.

{
  "bankBin": "970418",
  "actionType": "INTERNAL_TRANSFER",
  "inquiryType": "PENDING_APPROVAL_LIST",
  "role": "Checker",
  "skipCount": 0,
  "maxResultCount": 3
}

Note: For the Maker to get the list of draft transactions (just created) waiting to be submitted for approval. These records have the status INIT.

{
  "bankBin": "970418",
  "actionType": "INTERNAL_TRANSFER",
  "inquiryType": "MAKER_PENDING_LIST",
  "role": "Maker",
  "skipCount": 0,
  "maxResultCount": 3
}

Note: View the details of a specific transaction. You must pass the transaction id. Do not pass pagination parameters (skipCount, maxResultCount) or date filters. The returned data is directly in data (not in an items array).

{
  "bankBin": "970418",
  "actionType": "INTERNAL_TRANSFER",
  "inquiryType": "TRANSFER_DETAIL",
  "role": "Maker",
  "id": "PM0226060400073501"
}

Note: Summary report of transactions (available to both Maker and Checker). Usually combined with startDate, endDate or startEffectiveDate, endEffectiveDate to filter by time.

{
  "bankBin": "970418",
  "actionType": "INTERNAL_TRANSFER",
  "inquiryType": "FO_REPORT_LIST",
  "role": "Maker",
  "startEffectiveDate": "2026-06-10",
  "endEffectiveDate": "2026-06-10",
  "skipCount": 0,
  "maxResultCount": 3
}

Code samples

BATCH_UPLOAD_INQUIRY
PENDING_APPROVAL_LIST
MAKER_PENDING_LIST
TRANSFER_DETAIL
FO_REPORT_LIST

cURL
NestJS
C#
Java
PHP

curl --location --request POST 'https://open-api.tingee.vn/v1/direct-link/transaction-inquiry' \
--header 'accept: application/json' \
--header 'x-client-id: YOUR_CLIENT_ID' \
--header 'x-request-timestamp: 20240509154004003' \
--header 'x-signature: YOUR_SIGNATURE' \
--header 'Content-Type: application/json' \
--data '{
  "bankBin": "970418",
  "actionType": "INTERNAL_TRANSFER",
  "inquiryType": "BATCH_UPLOAD_INQUIRY",
  "role": "Maker",
  "batchId": "2667c208-a5ab-4c9c-af4d-cbd4de24b817",
  "status": "VALID",
  "skipCount": 0,
  "maxResultCount": 50
}'

import axios from "axios";
import { createHmac } from "crypto";

const CLIENT_ID = "YOUR_CLIENT_ID";
const SECRET_KEY = "YOUR_SECRET_KEY";

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
function getTimestamp() {
    return new Date(Date.now() + 7 * 60 * 60 * 1000)
        .toISOString()
        .replace(/[-:TZ.]/g, "")
        .slice(0, 17);
}

async function directLinkTransactionInquiry() {
    const body = {
        bankBin: "970418",
        actionType: "INTERNAL_TRANSFER",
        inquiryType: "BATCH_UPLOAD_INQUIRY",
        role: "Maker",
        batchId: "2667c208-a5ab-4c9c-af4d-cbd4de24b817",
        status: "VALID",
        skipCount: 0,
        maxResultCount: 50,
    };

    const bodyJson = JSON.stringify(body);
    const timestamp = getTimestamp();
    const signature = createHmac("sha512", SECRET_KEY)
        .update(`${timestamp}:${bodyJson}`)
        .digest("hex");

    const res = await axios.request({
        method: "POST",
        url: "https://open-api.tingee.vn/v1/direct-link/transaction-inquiry",
        data: bodyJson,
        headers: {
            accept: "application/json",
            "Content-Type": "application/json",
            "x-client-id": CLIENT_ID,
            "x-request-timestamp": timestamp,
            "x-signature": signature,
        },
    });

    console.log(res.data);
}

directLinkTransactionInquiry();

using System;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Encodings.Web;
using System.Text.Json;
using System.Threading.Tasks;

public class Program
{
    private const string ClientId = "YOUR_CLIENT_ID";
    private const string SecretKey = "YOUR_SECRET_KEY";
    private static readonly HttpClient Client = new HttpClient();

    public static async Task Main()
    {
        var body = new
        {
            bankBin = "970418",
            actionType = "INTERNAL_TRANSFER",
            inquiryType = "BATCH_UPLOAD_INQUIRY",
            role = "Maker",
            batchId = "2667c208-a5ab-4c9c-af4d-cbd4de24b817",
            status = "VALID",
            skipCount = 0,
            maxResultCount = 50
        };

        // Do not escape non-ASCII / special characters so the JSON matches TINGEE's JSON.stringify
        var jsonOptions = new JsonSerializerOptions { Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping };
        var bodyJson = JsonSerializer.Serialize(body, jsonOptions);

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        var timestamp = DateTime.UtcNow.AddHours(7).ToString("yyyyMMddHHmmssfff");
        var signature = HmacSha512(SecretKey, $"{timestamp}:{bodyJson}");

        var request = new HttpRequestMessage(HttpMethod.Post, "https://open-api.tingee.vn/v1/direct-link/transaction-inquiry");
        request.Headers.Add("accept", "application/json");
        request.Headers.Add("x-client-id", ClientId);
        request.Headers.Add("x-request-timestamp", timestamp);
        request.Headers.Add("x-signature", signature);
        request.Content = new StringContent(bodyJson, Encoding.UTF8, "application/json");

        var response = await Client.SendAsync(request);
        Console.WriteLine(await response.Content.ReadAsStringAsync());
    }

    private static string HmacSha512(string key, string message)
    {
        using var hmac = new HMACSHA512(Encoding.UTF8.GetBytes(key));
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(message));
        return Convert.ToHexString(hash).ToLower();
    }
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.time.ZoneId;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class Main {
    private static final String CLIENT_ID = "YOUR_CLIENT_ID";
    private static final String SECRET_KEY = "YOUR_SECRET_KEY";

    public static void main(String[] args) throws Exception {
        // Minified JSON, same as JSON.stringify()
        String bodyJson = "{\"bankBin\":\"970418\",\"actionType\":\"INTERNAL_TRANSFER\",\"inquiryType\":\"BATCH_UPLOAD_INQUIRY\",\"role\":\"Maker\",\"batchId\":\"2667c208-a5ab-4c9c-af4d-cbd4de24b817\",\"status\":\"VALID\",\"skipCount\":0,\"maxResultCount\":50}";

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        String timestamp = ZonedDateTime.now(ZoneId.of("Asia/Ho_Chi_Minh"))
                .format(DateTimeFormatter.ofPattern("yyyyMMddHHmmssSSS"));
        String signature = hmacSha512(SECRET_KEY, timestamp + ":" + bodyJson);

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://open-api.tingee.vn/v1/direct-link/transaction-inquiry"))
                .header("accept", "application/json")
                .header("Content-Type", "application/json")
                .header("x-client-id", CLIENT_ID)
                .header("x-request-timestamp", timestamp)
                .header("x-signature", signature)
                .method("POST", HttpRequest.BodyPublishers.ofString(bodyJson, StandardCharsets.UTF_8))
                .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
                .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }

    private static String hmacSha512(String key, String data) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA512");
        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA512"));
        byte[] hash = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        StringBuilder hex = new StringBuilder();
        for (byte b : hash) hex.append(String.format("%02x", b));
        return hex.toString();
    }
}

<?php
$clientId = "YOUR_CLIENT_ID";
$secretKey = "YOUR_SECRET_KEY";

$body = [
    "bankBin" => "970418",
    "actionType" => "INTERNAL_TRANSFER",
    "inquiryType" => "BATCH_UPLOAD_INQUIRY",
    "role" => "Maker",
    "batchId" => "2667c208-a5ab-4c9c-af4d-cbd4de24b817",
    "status" => "VALID",
    "skipCount" => 0,
    "maxResultCount" => 50,
];

// Do not escape "/" or non-ASCII characters so the JSON matches TINGEE's JSON.stringify
$bodyJson = json_encode($body, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
$now = new DateTime("now", new DateTimeZone("Asia/Ho_Chi_Minh"));
$timestamp = $now->format("YmdHisv");
$signature = hash_hmac("sha512", $timestamp . ":" . $bodyJson, $secretKey);

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => "https://open-api.tingee.vn/v1/direct-link/transaction-inquiry",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_POSTFIELDS => $bodyJson,
    CURLOPT_HTTPHEADER => [
        "Accept: application/json",
        "Content-Type: application/json",
        "x-client-id: " . $clientId,
        "x-request-timestamp: " . $timestamp,
        "x-signature: " . $signature,
    ],
]);

$response = curl_exec($ch);
if ($response === false) {
    echo "cURL Error: " . curl_error($ch);
} else {
    echo $response;
}
curl_close($ch);

cURL
NestJS
C#
Java
PHP

curl --location --request POST 'https://open-api.tingee.vn/v1/direct-link/transaction-inquiry' \
--header 'accept: application/json' \
--header 'x-client-id: YOUR_CLIENT_ID' \
--header 'x-request-timestamp: 20240509154004003' \
--header 'x-signature: YOUR_SIGNATURE' \
--header 'Content-Type: application/json' \
--data '{
  "bankBin": "970418",
  "actionType": "INTERNAL_TRANSFER",
  "inquiryType": "PENDING_APPROVAL_LIST",
  "role": "Checker",
  "skipCount": 0,
  "maxResultCount": 3
}'

import axios from "axios";
import { createHmac } from "crypto";

const CLIENT_ID = "YOUR_CLIENT_ID";
const SECRET_KEY = "YOUR_SECRET_KEY";

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
function getTimestamp() {
    return new Date(Date.now() + 7 * 60 * 60 * 1000)
        .toISOString()
        .replace(/[-:TZ.]/g, "")
        .slice(0, 17);
}

async function directLinkTransactionInquiry() {
    const body = {
        bankBin: "970418",
        actionType: "INTERNAL_TRANSFER",
        inquiryType: "PENDING_APPROVAL_LIST",
        role: "Checker",
        skipCount: 0,
        maxResultCount: 3,
    };

    const bodyJson = JSON.stringify(body);
    const timestamp = getTimestamp();
    const signature = createHmac("sha512", SECRET_KEY)
        .update(`${timestamp}:${bodyJson}`)
        .digest("hex");

    const res = await axios.request({
        method: "POST",
        url: "https://open-api.tingee.vn/v1/direct-link/transaction-inquiry",
        data: bodyJson,
        headers: {
            accept: "application/json",
            "Content-Type": "application/json",
            "x-client-id": CLIENT_ID,
            "x-request-timestamp": timestamp,
            "x-signature": signature,
        },
    });

    console.log(res.data);
}

directLinkTransactionInquiry();

using System;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Encodings.Web;
using System.Text.Json;
using System.Threading.Tasks;

public class Program
{
    private const string ClientId = "YOUR_CLIENT_ID";
    private const string SecretKey = "YOUR_SECRET_KEY";
    private static readonly HttpClient Client = new HttpClient();

    public static async Task Main()
    {
        var body = new
        {
            bankBin = "970418",
            actionType = "INTERNAL_TRANSFER",
            inquiryType = "PENDING_APPROVAL_LIST",
            role = "Checker",
            skipCount = 0,
            maxResultCount = 3
        };

        // Do not escape non-ASCII / special characters so the JSON matches TINGEE's JSON.stringify
        var jsonOptions = new JsonSerializerOptions { Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping };
        var bodyJson = JsonSerializer.Serialize(body, jsonOptions);

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        var timestamp = DateTime.UtcNow.AddHours(7).ToString("yyyyMMddHHmmssfff");
        var signature = HmacSha512(SecretKey, $"{timestamp}:{bodyJson}");

        var request = new HttpRequestMessage(HttpMethod.Post, "https://open-api.tingee.vn/v1/direct-link/transaction-inquiry");
        request.Headers.Add("accept", "application/json");
        request.Headers.Add("x-client-id", ClientId);
        request.Headers.Add("x-request-timestamp", timestamp);
        request.Headers.Add("x-signature", signature);
        request.Content = new StringContent(bodyJson, Encoding.UTF8, "application/json");

        var response = await Client.SendAsync(request);
        Console.WriteLine(await response.Content.ReadAsStringAsync());
    }

    private static string HmacSha512(string key, string message)
    {
        using var hmac = new HMACSHA512(Encoding.UTF8.GetBytes(key));
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(message));
        return Convert.ToHexString(hash).ToLower();
    }
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.time.ZoneId;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class Main {
    private static final String CLIENT_ID = "YOUR_CLIENT_ID";
    private static final String SECRET_KEY = "YOUR_SECRET_KEY";

    public static void main(String[] args) throws Exception {
        // Minified JSON, same as JSON.stringify()
        String bodyJson = "{\"bankBin\":\"970418\",\"actionType\":\"INTERNAL_TRANSFER\",\"inquiryType\":\"PENDING_APPROVAL_LIST\",\"role\":\"Checker\",\"skipCount\":0,\"maxResultCount\":3}";

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        String timestamp = ZonedDateTime.now(ZoneId.of("Asia/Ho_Chi_Minh"))
                .format(DateTimeFormatter.ofPattern("yyyyMMddHHmmssSSS"));
        String signature = hmacSha512(SECRET_KEY, timestamp + ":" + bodyJson);

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://open-api.tingee.vn/v1/direct-link/transaction-inquiry"))
                .header("accept", "application/json")
                .header("Content-Type", "application/json")
                .header("x-client-id", CLIENT_ID)
                .header("x-request-timestamp", timestamp)
                .header("x-signature", signature)
                .method("POST", HttpRequest.BodyPublishers.ofString(bodyJson, StandardCharsets.UTF_8))
                .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
                .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }

    private static String hmacSha512(String key, String data) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA512");
        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA512"));
        byte[] hash = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        StringBuilder hex = new StringBuilder();
        for (byte b : hash) hex.append(String.format("%02x", b));
        return hex.toString();
    }
}

<?php
$clientId = "YOUR_CLIENT_ID";
$secretKey = "YOUR_SECRET_KEY";

$body = [
    "bankBin" => "970418",
    "actionType" => "INTERNAL_TRANSFER",
    "inquiryType" => "PENDING_APPROVAL_LIST",
    "role" => "Checker",
    "skipCount" => 0,
    "maxResultCount" => 3,
];

// Do not escape "/" or non-ASCII characters so the JSON matches TINGEE's JSON.stringify
$bodyJson = json_encode($body, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
$now = new DateTime("now", new DateTimeZone("Asia/Ho_Chi_Minh"));
$timestamp = $now->format("YmdHisv");
$signature = hash_hmac("sha512", $timestamp . ":" . $bodyJson, $secretKey);

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => "https://open-api.tingee.vn/v1/direct-link/transaction-inquiry",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_POSTFIELDS => $bodyJson,
    CURLOPT_HTTPHEADER => [
        "Accept: application/json",
        "Content-Type: application/json",
        "x-client-id: " . $clientId,
        "x-request-timestamp: " . $timestamp,
        "x-signature: " . $signature,
    ],
]);

$response = curl_exec($ch);
if ($response === false) {
    echo "cURL Error: " . curl_error($ch);
} else {
    echo $response;
}
curl_close($ch);

cURL
NestJS
C#
Java
PHP

curl --location --request POST 'https://open-api.tingee.vn/v1/direct-link/transaction-inquiry' \
--header 'accept: application/json' \
--header 'x-client-id: YOUR_CLIENT_ID' \
--header 'x-request-timestamp: 20240509154004003' \
--header 'x-signature: YOUR_SIGNATURE' \
--header 'Content-Type: application/json' \
--data '{
  "bankBin": "970418",
  "actionType": "INTERNAL_TRANSFER",
  "inquiryType": "MAKER_PENDING_LIST",
  "role": "Maker",
  "skipCount": 0,
  "maxResultCount": 3
}'

import axios from "axios";
import { createHmac } from "crypto";

const CLIENT_ID = "YOUR_CLIENT_ID";
const SECRET_KEY = "YOUR_SECRET_KEY";

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
function getTimestamp() {
    return new Date(Date.now() + 7 * 60 * 60 * 1000)
        .toISOString()
        .replace(/[-:TZ.]/g, "")
        .slice(0, 17);
}

async function directLinkTransactionInquiry() {
    const body = {
        bankBin: "970418",
        actionType: "INTERNAL_TRANSFER",
        inquiryType: "MAKER_PENDING_LIST",
        role: "Maker",
        skipCount: 0,
        maxResultCount: 3,
    };

    const bodyJson = JSON.stringify(body);
    const timestamp = getTimestamp();
    const signature = createHmac("sha512", SECRET_KEY)
        .update(`${timestamp}:${bodyJson}`)
        .digest("hex");

    const res = await axios.request({
        method: "POST",
        url: "https://open-api.tingee.vn/v1/direct-link/transaction-inquiry",
        data: bodyJson,
        headers: {
            accept: "application/json",
            "Content-Type": "application/json",
            "x-client-id": CLIENT_ID,
            "x-request-timestamp": timestamp,
            "x-signature": signature,
        },
    });

    console.log(res.data);
}

directLinkTransactionInquiry();

using System;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Encodings.Web;
using System.Text.Json;
using System.Threading.Tasks;

public class Program
{
    private const string ClientId = "YOUR_CLIENT_ID";
    private const string SecretKey = "YOUR_SECRET_KEY";
    private static readonly HttpClient Client = new HttpClient();

    public static async Task Main()
    {
        var body = new
        {
            bankBin = "970418",
            actionType = "INTERNAL_TRANSFER",
            inquiryType = "MAKER_PENDING_LIST",
            role = "Maker",
            skipCount = 0,
            maxResultCount = 3
        };

        // Do not escape non-ASCII / special characters so the JSON matches TINGEE's JSON.stringify
        var jsonOptions = new JsonSerializerOptions { Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping };
        var bodyJson = JsonSerializer.Serialize(body, jsonOptions);

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        var timestamp = DateTime.UtcNow.AddHours(7).ToString("yyyyMMddHHmmssfff");
        var signature = HmacSha512(SecretKey, $"{timestamp}:{bodyJson}");

        var request = new HttpRequestMessage(HttpMethod.Post, "https://open-api.tingee.vn/v1/direct-link/transaction-inquiry");
        request.Headers.Add("accept", "application/json");
        request.Headers.Add("x-client-id", ClientId);
        request.Headers.Add("x-request-timestamp", timestamp);
        request.Headers.Add("x-signature", signature);
        request.Content = new StringContent(bodyJson, Encoding.UTF8, "application/json");

        var response = await Client.SendAsync(request);
        Console.WriteLine(await response.Content.ReadAsStringAsync());
    }

    private static string HmacSha512(string key, string message)
    {
        using var hmac = new HMACSHA512(Encoding.UTF8.GetBytes(key));
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(message));
        return Convert.ToHexString(hash).ToLower();
    }
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.time.ZoneId;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class Main {
    private static final String CLIENT_ID = "YOUR_CLIENT_ID";
    private static final String SECRET_KEY = "YOUR_SECRET_KEY";

    public static void main(String[] args) throws Exception {
        // Minified JSON, same as JSON.stringify()
        String bodyJson = "{\"bankBin\":\"970418\",\"actionType\":\"INTERNAL_TRANSFER\",\"inquiryType\":\"MAKER_PENDING_LIST\",\"role\":\"Maker\",\"skipCount\":0,\"maxResultCount\":3}";

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        String timestamp = ZonedDateTime.now(ZoneId.of("Asia/Ho_Chi_Minh"))
                .format(DateTimeFormatter.ofPattern("yyyyMMddHHmmssSSS"));
        String signature = hmacSha512(SECRET_KEY, timestamp + ":" + bodyJson);

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://open-api.tingee.vn/v1/direct-link/transaction-inquiry"))
                .header("accept", "application/json")
                .header("Content-Type", "application/json")
                .header("x-client-id", CLIENT_ID)
                .header("x-request-timestamp", timestamp)
                .header("x-signature", signature)
                .method("POST", HttpRequest.BodyPublishers.ofString(bodyJson, StandardCharsets.UTF_8))
                .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
                .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }

    private static String hmacSha512(String key, String data) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA512");
        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA512"));
        byte[] hash = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        StringBuilder hex = new StringBuilder();
        for (byte b : hash) hex.append(String.format("%02x", b));
        return hex.toString();
    }
}

<?php
$clientId = "YOUR_CLIENT_ID";
$secretKey = "YOUR_SECRET_KEY";

$body = [
    "bankBin" => "970418",
    "actionType" => "INTERNAL_TRANSFER",
    "inquiryType" => "MAKER_PENDING_LIST",
    "role" => "Maker",
    "skipCount" => 0,
    "maxResultCount" => 3,
];

// Do not escape "/" or non-ASCII characters so the JSON matches TINGEE's JSON.stringify
$bodyJson = json_encode($body, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
$now = new DateTime("now", new DateTimeZone("Asia/Ho_Chi_Minh"));
$timestamp = $now->format("YmdHisv");
$signature = hash_hmac("sha512", $timestamp . ":" . $bodyJson, $secretKey);

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => "https://open-api.tingee.vn/v1/direct-link/transaction-inquiry",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_POSTFIELDS => $bodyJson,
    CURLOPT_HTTPHEADER => [
        "Accept: application/json",
        "Content-Type: application/json",
        "x-client-id: " . $clientId,
        "x-request-timestamp: " . $timestamp,
        "x-signature: " . $signature,
    ],
]);

$response = curl_exec($ch);
if ($response === false) {
    echo "cURL Error: " . curl_error($ch);
} else {
    echo $response;
}
curl_close($ch);

cURL
NestJS
C#
Java
PHP

curl --location --request POST 'https://open-api.tingee.vn/v1/direct-link/transaction-inquiry' \
--header 'accept: application/json' \
--header 'x-client-id: YOUR_CLIENT_ID' \
--header 'x-request-timestamp: 20240509154004003' \
--header 'x-signature: YOUR_SIGNATURE' \
--header 'Content-Type: application/json' \
--data '{
  "bankBin": "970418",
  "actionType": "INTERNAL_TRANSFER",
  "inquiryType": "TRANSFER_DETAIL",
  "role": "Maker",
  "id": "PM0226060400073501"
}'

import axios from "axios";
import { createHmac } from "crypto";

const CLIENT_ID = "YOUR_CLIENT_ID";
const SECRET_KEY = "YOUR_SECRET_KEY";

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
function getTimestamp() {
    return new Date(Date.now() + 7 * 60 * 60 * 1000)
        .toISOString()
        .replace(/[-:TZ.]/g, "")
        .slice(0, 17);
}

async function directLinkTransactionInquiry() {
    const body = {
        bankBin: "970418",
        actionType: "INTERNAL_TRANSFER",
        inquiryType: "TRANSFER_DETAIL",
        role: "Maker",
        id: "PM0226060400073501",
    };

    const bodyJson = JSON.stringify(body);
    const timestamp = getTimestamp();
    const signature = createHmac("sha512", SECRET_KEY)
        .update(`${timestamp}:${bodyJson}`)
        .digest("hex");

    const res = await axios.request({
        method: "POST",
        url: "https://open-api.tingee.vn/v1/direct-link/transaction-inquiry",
        data: bodyJson,
        headers: {
            accept: "application/json",
            "Content-Type": "application/json",
            "x-client-id": CLIENT_ID,
            "x-request-timestamp": timestamp,
            "x-signature": signature,
        },
    });

    console.log(res.data);
}

directLinkTransactionInquiry();

using System;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Encodings.Web;
using System.Text.Json;
using System.Threading.Tasks;

public class Program
{
    private const string ClientId = "YOUR_CLIENT_ID";
    private const string SecretKey = "YOUR_SECRET_KEY";
    private static readonly HttpClient Client = new HttpClient();

    public static async Task Main()
    {
        var body = new
        {
            bankBin = "970418",
            actionType = "INTERNAL_TRANSFER",
            inquiryType = "TRANSFER_DETAIL",
            role = "Maker",
            id = "PM0226060400073501"
        };

        // Do not escape non-ASCII / special characters so the JSON matches TINGEE's JSON.stringify
        var jsonOptions = new JsonSerializerOptions { Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping };
        var bodyJson = JsonSerializer.Serialize(body, jsonOptions);

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        var timestamp = DateTime.UtcNow.AddHours(7).ToString("yyyyMMddHHmmssfff");
        var signature = HmacSha512(SecretKey, $"{timestamp}:{bodyJson}");

        var request = new HttpRequestMessage(HttpMethod.Post, "https://open-api.tingee.vn/v1/direct-link/transaction-inquiry");
        request.Headers.Add("accept", "application/json");
        request.Headers.Add("x-client-id", ClientId);
        request.Headers.Add("x-request-timestamp", timestamp);
        request.Headers.Add("x-signature", signature);
        request.Content = new StringContent(bodyJson, Encoding.UTF8, "application/json");

        var response = await Client.SendAsync(request);
        Console.WriteLine(await response.Content.ReadAsStringAsync());
    }

    private static string HmacSha512(string key, string message)
    {
        using var hmac = new HMACSHA512(Encoding.UTF8.GetBytes(key));
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(message));
        return Convert.ToHexString(hash).ToLower();
    }
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.time.ZoneId;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class Main {
    private static final String CLIENT_ID = "YOUR_CLIENT_ID";
    private static final String SECRET_KEY = "YOUR_SECRET_KEY";

    public static void main(String[] args) throws Exception {
        // Minified JSON, same as JSON.stringify()
        String bodyJson = "{\"bankBin\":\"970418\",\"actionType\":\"INTERNAL_TRANSFER\",\"inquiryType\":\"TRANSFER_DETAIL\",\"role\":\"Maker\",\"id\":\"PM0226060400073501\"}";

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        String timestamp = ZonedDateTime.now(ZoneId.of("Asia/Ho_Chi_Minh"))
                .format(DateTimeFormatter.ofPattern("yyyyMMddHHmmssSSS"));
        String signature = hmacSha512(SECRET_KEY, timestamp + ":" + bodyJson);

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://open-api.tingee.vn/v1/direct-link/transaction-inquiry"))
                .header("accept", "application/json")
                .header("Content-Type", "application/json")
                .header("x-client-id", CLIENT_ID)
                .header("x-request-timestamp", timestamp)
                .header("x-signature", signature)
                .method("POST", HttpRequest.BodyPublishers.ofString(bodyJson, StandardCharsets.UTF_8))
                .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
                .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }

    private static String hmacSha512(String key, String data) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA512");
        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA512"));
        byte[] hash = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        StringBuilder hex = new StringBuilder();
        for (byte b : hash) hex.append(String.format("%02x", b));
        return hex.toString();
    }
}

<?php
$clientId = "YOUR_CLIENT_ID";
$secretKey = "YOUR_SECRET_KEY";

$body = [
    "bankBin" => "970418",
    "actionType" => "INTERNAL_TRANSFER",
    "inquiryType" => "TRANSFER_DETAIL",
    "role" => "Maker",
    "id" => "PM0226060400073501",
];

// Do not escape "/" or non-ASCII characters so the JSON matches TINGEE's JSON.stringify
$bodyJson = json_encode($body, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
$now = new DateTime("now", new DateTimeZone("Asia/Ho_Chi_Minh"));
$timestamp = $now->format("YmdHisv");
$signature = hash_hmac("sha512", $timestamp . ":" . $bodyJson, $secretKey);

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => "https://open-api.tingee.vn/v1/direct-link/transaction-inquiry",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_POSTFIELDS => $bodyJson,
    CURLOPT_HTTPHEADER => [
        "Accept: application/json",
        "Content-Type: application/json",
        "x-client-id: " . $clientId,
        "x-request-timestamp: " . $timestamp,
        "x-signature: " . $signature,
    ],
]);

$response = curl_exec($ch);
if ($response === false) {
    echo "cURL Error: " . curl_error($ch);
} else {
    echo $response;
}
curl_close($ch);

cURL
NestJS
C#
Java
PHP

curl --location --request POST 'https://open-api.tingee.vn/v1/direct-link/transaction-inquiry' \
--header 'accept: application/json' \
--header 'x-client-id: YOUR_CLIENT_ID' \
--header 'x-request-timestamp: 20240509154004003' \
--header 'x-signature: YOUR_SIGNATURE' \
--header 'Content-Type: application/json' \
--data '{
  "bankBin": "970418",
  "actionType": "INTERNAL_TRANSFER",
  "inquiryType": "FO_REPORT_LIST",
  "role": "Maker",
  "startEffectiveDate": "2026-06-10",
  "endEffectiveDate": "2026-06-10",
  "skipCount": 0,
  "maxResultCount": 3
}'

import axios from "axios";
import { createHmac } from "crypto";

const CLIENT_ID = "YOUR_CLIENT_ID";
const SECRET_KEY = "YOUR_SECRET_KEY";

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
function getTimestamp() {
    return new Date(Date.now() + 7 * 60 * 60 * 1000)
        .toISOString()
        .replace(/[-:TZ.]/g, "")
        .slice(0, 17);
}

async function directLinkTransactionInquiry() {
    const body = {
        bankBin: "970418",
        actionType: "INTERNAL_TRANSFER",
        inquiryType: "FO_REPORT_LIST",
        role: "Maker",
        startEffectiveDate: "2026-06-10",
        endEffectiveDate: "2026-06-10",
        skipCount: 0,
        maxResultCount: 3,
    };

    const bodyJson = JSON.stringify(body);
    const timestamp = getTimestamp();
    const signature = createHmac("sha512", SECRET_KEY)
        .update(`${timestamp}:${bodyJson}`)
        .digest("hex");

    const res = await axios.request({
        method: "POST",
        url: "https://open-api.tingee.vn/v1/direct-link/transaction-inquiry",
        data: bodyJson,
        headers: {
            accept: "application/json",
            "Content-Type": "application/json",
            "x-client-id": CLIENT_ID,
            "x-request-timestamp": timestamp,
            "x-signature": signature,
        },
    });

    console.log(res.data);
}

directLinkTransactionInquiry();

using System;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Text.Encodings.Web;
using System.Text.Json;
using System.Threading.Tasks;

public class Program
{
    private const string ClientId = "YOUR_CLIENT_ID";
    private const string SecretKey = "YOUR_SECRET_KEY";
    private static readonly HttpClient Client = new HttpClient();

    public static async Task Main()
    {
        var body = new
        {
            bankBin = "970418",
            actionType = "INTERNAL_TRANSFER",
            inquiryType = "FO_REPORT_LIST",
            role = "Maker",
            startEffectiveDate = "2026-06-10",
            endEffectiveDate = "2026-06-10",
            skipCount = 0,
            maxResultCount = 3
        };

        // Do not escape non-ASCII / special characters so the JSON matches TINGEE's JSON.stringify
        var jsonOptions = new JsonSerializerOptions { Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping };
        var bodyJson = JsonSerializer.Serialize(body, jsonOptions);

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        var timestamp = DateTime.UtcNow.AddHours(7).ToString("yyyyMMddHHmmssfff");
        var signature = HmacSha512(SecretKey, $"{timestamp}:{bodyJson}");

        var request = new HttpRequestMessage(HttpMethod.Post, "https://open-api.tingee.vn/v1/direct-link/transaction-inquiry");
        request.Headers.Add("accept", "application/json");
        request.Headers.Add("x-client-id", ClientId);
        request.Headers.Add("x-request-timestamp", timestamp);
        request.Headers.Add("x-signature", signature);
        request.Content = new StringContent(bodyJson, Encoding.UTF8, "application/json");

        var response = await Client.SendAsync(request);
        Console.WriteLine(await response.Content.ReadAsStringAsync());
    }

    private static string HmacSha512(string key, string message)
    {
        using var hmac = new HMACSHA512(Encoding.UTF8.GetBytes(key));
        var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(message));
        return Convert.ToHexString(hash).ToLower();
    }
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.time.ZoneId;
import java.time.ZonedDateTime;
import java.time.format.DateTimeFormatter;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class Main {
    private static final String CLIENT_ID = "YOUR_CLIENT_ID";
    private static final String SECRET_KEY = "YOUR_SECRET_KEY";

    public static void main(String[] args) throws Exception {
        // Minified JSON, same as JSON.stringify()
        String bodyJson = "{\"bankBin\":\"970418\",\"actionType\":\"INTERNAL_TRANSFER\",\"inquiryType\":\"FO_REPORT_LIST\",\"role\":\"Maker\",\"startEffectiveDate\":\"2026-06-10\",\"endEffectiveDate\":\"2026-06-10\",\"skipCount\":0,\"maxResultCount\":3}";

        // Timestamp in UTC+7, format yyyyMMddHHmmssSSS
        String timestamp = ZonedDateTime.now(ZoneId.of("Asia/Ho_Chi_Minh"))
                .format(DateTimeFormatter.ofPattern("yyyyMMddHHmmssSSS"));
        String signature = hmacSha512(SECRET_KEY, timestamp + ":" + bodyJson);

        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://open-api.tingee.vn/v1/direct-link/transaction-inquiry"))
                .header("accept", "application/json")
                .header("Content-Type", "application/json")
                .header("x-client-id", CLIENT_ID)
                .header("x-request-timestamp", timestamp)
                .header("x-signature", signature)
                .method("POST", HttpRequest.BodyPublishers.ofString(bodyJson, StandardCharsets.UTF_8))
                .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
                .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }

    private static String hmacSha512(String key, String data) throws Exception {
        Mac mac = Mac.getInstance("HmacSHA512");
        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA512"));
        byte[] hash = mac.doFinal(data.getBytes(StandardCharsets.UTF_8));
        StringBuilder hex = new StringBuilder();
        for (byte b : hash) hex.append(String.format("%02x", b));
        return hex.toString();
    }
}

<?php
$clientId = "YOUR_CLIENT_ID";
$secretKey = "YOUR_SECRET_KEY";

$body = [
    "bankBin" => "970418",
    "actionType" => "INTERNAL_TRANSFER",
    "inquiryType" => "FO_REPORT_LIST",
    "role" => "Maker",
    "startEffectiveDate" => "2026-06-10",
    "endEffectiveDate" => "2026-06-10",
    "skipCount" => 0,
    "maxResultCount" => 3,
];

// Do not escape "/" or non-ASCII characters so the JSON matches TINGEE's JSON.stringify
$bodyJson = json_encode($body, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);

// Timestamp in UTC+7, format yyyyMMddHHmmssSSS
$now = new DateTime("now", new DateTimeZone("Asia/Ho_Chi_Minh"));
$timestamp = $now->format("YmdHisv");
$signature = hash_hmac("sha512", $timestamp . ":" . $bodyJson, $secretKey);

$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => "https://open-api.tingee.vn/v1/direct-link/transaction-inquiry",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => "POST",
    CURLOPT_POSTFIELDS => $bodyJson,
    CURLOPT_HTTPHEADER => [
        "Accept: application/json",
        "Content-Type: application/json",
        "x-client-id: " . $clientId,
        "x-request-timestamp: " . $timestamp,
        "x-signature: " . $signature,
    ],
]);

$response = curl_exec($ch);
if ($response === false) {
    echo "cURL Error: " . curl_error($ch);
} else {
    echo $response;
}
curl_close($ch);

Sample Response

BATCH_UPLOAD_INQUIRY
PENDING_APPROVAL_LIST
MAKER_PENDING_LIST
TRANSFER_DETAIL
FO_REPORT_LIST

{
  "code": "00",
  "message": "Success",
  "data": {
    "enableUpdateName": false,
    "items": [
      {
        "id": "6dbf35f0-99b2-4d63-8ab3-3027e8cc263d",
        "transactionType": "in-bank",
        "errorDescription": null,
        "debitAccountNumber": "8600007007",
        "amount": "32987",
        "currency": "VND",
        "remark": "Check1",
        "feeMethod": "O",
        "feeAccountNumber": "8600007007",
        "originId": "TRANS_1106_A04",
        "notAuthorized": false,
        "batchId": "2667c208-a5ab-4c9c-af4d-cbd4de24b817",
        "effectiveDate": "11/06/2026",
        "status": "VALID",
        "creditAccountType": "ACCOUNT",
        "creditAccountNumber": "2220366666",
        "creditAccountName": "TITLE 1 2220366666",
        "creditBankName": "Ngan hang TMCP Dau tu va Phat trien Viet Nam",
        "creditBranchCode": "222000"
      }
    ],
    "validRows": 1,
    "invalidRows": 0,
    "total": 1
  }
}

{
  "code": "00",
  "message": "Success",
  "data": {
    "items": [
      {
        "id": "PM0226060200073011",
        "status": "PENDING_APPROVAL",
        "statusDesc": "Chờ duyệt",
        "amount": 44220,
        "currency": "VND",
        "createdDate": "2026-06-02T17:42:02.024833",
        "createdBy": "25607354makerotv",
        "remark": "Check1",
        "effectiveDate": "2026-06-02",
        "transactionType": "in-bank",
        "channel": "ERP",
        "originId": "TRANS_0206_B07",
        "feeTotal": 11000,
        "transactionDesc": "Chuyển tiền trong BIDV khác CTK",
        "feeMethod": "O",
        "feeAccountNumber": "8600007007",
        "priority": true,
        "creditAccountType": "ACCOUNT",
        "creditAccountNumber": "2220366666",
        "creditAccountName": "Title 1 2220366666",
        "creditBankCode": "01202001",
        "creditBankShortName": "BIDV",
        "creditBranchCode": "222000",
        "debitAccountNumber": "8600007007",
        "debitAccountName": "Title 1 8600007007"
      }
    ],
    "total": 43
  }
}

{
  "code": "00",
  "message": "Success",
  "data": {
    "items": [
      {
        "id": "PM0226061000074420",
        "status": "INIT",
        "statusDesc": "Tạo mới",
        "amount": 32987,
        "currency": "VND",
        "createdDate": "2026-06-10T15:52:49.708424",
        "createdBy": "25607354makerotv",
        "remark": "Check1",
        "effectiveDate": "2026-06-10",
        "transactionType": "in-bank",
        "channel": "ERP",
        "originId": "TRANS_1006_A04",
        "feeTotal": 11000,
        "transactionDesc": "Chuyển tiền trong BIDV khác CTK",
        "feeMethod": "O",
        "feeAccountNumber": "8600007007",
        "priority": true,
        "creditAccountType": "ACCOUNT",
        "creditAccountNumber": "2220366666",
        "creditAccountName": "Title 1 2220366666",
        "creditBankCode": "01202001",
        "creditBankShortName": "BIDV",
        "creditBranchCode": "222000",
        "debitAccountNumber": "8600007007",
        "debitAccountName": "Title 1 8600007007"
      }
    ],
    "total": 119
  }
}

{
  "code": "00",
  "message": "Success",
  "data": {
    "id": "PM0226060400073501",
    "transactionType": "in-bank",
    "transactionId": "PM0226061300074843",
    "transactionCode": "PM02",
    "channel": "ERP",
    "effectiveDate": "2026-06-04",
    "status": "SUCCESS",
    "statusDesc": "Thành công",
    "transactionDesc": "Chuyển tiền trong BIDV khác CTK",
    "createdBy": "25607354makerotv",
    "priority": false,
    "amount": 32987,
    "batchNo": "17EF138E3BFB50D7FE909DE84200D778",
    "currency": "VND",
    "feeCurrency": "VND",
    "remark": "Check1",
    "coreRef": "11324gyA-89bif3i2P",
    "amountText": "Ba mươi hai nghìn chín trăm tám mươi bảy đồng",
    "bankTransferType": 0,
    "stateDescription": "Thành công",
    "feeAccountNumber": "8600007007",
    "feeMethod": "O",
    "feeOpt": "INST",
    "feeTotal": 11000,
    "originId": "TRANS_0406_A04",
    "creditAccountType": "ACCOUNT",
    "creditAccountNumber": "2220366666",
    "creditAccountName": "TITLE 1 2220366666",
    "creditBankCode": "01202001",
    "creditBankName": "Ngan hang TMCP Dau tu va Phat trien Viet Nam",
    "creditBankShortName": "BIDV",
    "creditBranchCode": "222000",
    "creditCurrency": "VND",
    "debitAccountNumber": "8600007007",
    "debitAccountName": "Title 1 8600007007"
  }
}

{
  "code": "00",
  "message": "Success",
  "data": {
    "items": [
      {
        "id": "PM1326061100074601",
        "status": "INIT",
        "state": "INIT",
        "statusDesc": "Tạo mới",
        "amount": 13456,
        "currency": "VND",
        "createdDate": "2026-06-11T15:20:27.669607",
        "createdBy": "25607354makerotv",
        "remark": "Check3",
        "effectiveDate": "2026-06-11",
        "transactionType": "regular-out",
        "channel": "ERP",
        "originId": "TRANS_1106_A30",
        "batchNo": "C7DF645985F84077BDAFEDA83944D1FB",
        "feeOpt": "INST",
        "feeTotal": 11000,
        "transactionDesc": "Chuyển tiền ngoài BIDV thông qua STK",
        "transactionId": "PM1326061300074844",
        "transactionCode": "PM13",
        "feeMethod": "O",
        "feeAccountNumber": "8600007007",
        "creditAccountType": "ACCOUNT",
        "creditAccountNumber": "6666688811",
        "creditAccountName": "NGUYEN LOC PHAT",
        "creditBankCode": "79304001",
        "creditBankShortName": "DongA Bank",
        "debitAccountNumber": "8600007007",
        "debitAccountName": "Title 1 8600007007"
      }
    ],
    "total": 2
  }
}

Response `data` structure

Note: The structure of data depends on inquiryType and actionType. The Sample Responses above illustrate actionType = INTERNAL_TRANSFER.

For list inquiry types (BATCH_UPLOAD_INQUIRY, PENDING_APPROVAL_LIST, MAKER_PENDING_LIST, FO_REPORT_LIST), data contains an items array and pagination information.

For detail inquiry types (TRANSFER_DETAIL, EDIT_TRANSFER_DETAIL) of INTERNAL_TRANSFER, data directly contains the transaction's information.

For SALARY / BILL_PAYMENT, see Differences for SALARY / BILL_PAYMENT below.

Fields that BIDV does not return are omitted from the response (or set to null).

Field	Type	Description
`total`	number	Total number of records matching the filters.
`items`	array	List of transaction details.
`validRows`	number	Number of valid records (only returned with `BATCH_UPLOAD_INQUIRY`).
`invalidRows`	number	Number of invalid records (only returned with `BATCH_UPLOAD_INQUIRY`).
`enableUpdateName`	boolean	BIDV flag indicating whether the batch allows updating beneficiary names (only returned with `BATCH_UPLOAD_INQUIRY`).

Transaction details (in the `data.items` array, or directly in `data` for `TRANSFER_DETAIL`)

The Applies to column shows which inquiry types return the field: B = BATCH_UPLOAD_INQUIRY, L = PENDING_APPROVAL_LIST / MAKER_PENDING_LIST / FO_REPORT_LIST, D = TRANSFER_DETAIL.

Field	Type	Applies to	Description
`id`	string	B, L, D	Transaction ID in the BIDV system (used as `id` for `TRANSFER_DETAIL` and in `transactionIds` / `ids` of the submit, approve, reject and delete APIs). For `BATCH_UPLOAD_INQUIRY`, this is the record ID in the batch file.
`status`	string	B, L, D	Transaction status returned by BIDV (e.g. `INIT`, `PENDING_APPROVAL`, `SUCCESS`, `FAILED`, `REJECTED`). For `BATCH_UPLOAD_INQUIRY`: `VALID` / `INVALID`.
`statusDesc`	string	L, D	Transaction status description in Vietnamese.
`state`	string	L	Secondary posting status of the transaction.
`stateDescription`	string	D	Posting status description.
`amount`	number	B, L, D	Transaction amount. For `BATCH_UPLOAD_INQUIRY`, BIDV may return it as a string (e.g. `"32987"`).
`amountText`	string	D	Amount in words.
`currency`	string	B, L, D	Currency (VND).
`createdDate`	string	L	Transaction creation time (ISO 8601).
`createdBy`	string	L, D	Username of the creator (Maker).
`remark`	string	B, L, D	Transaction description.
`approvalNote`	string	L, D	Approval submission note from the Maker.
`effectiveDate`	string	B, L, D	Effective date of the transaction (`YYYY-MM-DD`; for `BATCH_UPLOAD_INQUIRY` BIDV returns `DD/MM/YYYY`).
`transactionType`	string	B, L, D	Transaction type: `in-bank`, `regular-out`, `fast-out`.
`transactionDesc`	string	L, D	Transaction type description (e.g. `Chuyển tiền trong BIDV khác CTK`).
`transactionId`	string	L, D	BIDV transaction ID (used for the Transaction log inquiry API).
`transactionCode`	string	L, D	BIDV transaction type code (e.g. `PM02`).
`channel`	string	L, D	Channel that created the transaction (e.g. `ERP`).
`originId`	string	B, L, D	The `requestId` reference the partner sent when creating the order.
`batchId`	string	B	Transaction batch ID.
`batchNo`	string	L, D	Batch number issued by the bank's system.
`priority`	boolean	L, D	Priority processing flag.
`feeMethod`	string	B, L, D	Fee bearer (`O`: payment account, `B`: recipient).
`feeAccountNumber`	string	B, L, D	Fee account number.
`feeOpt`	string	L, D	BIDV fee collection method (e.g. `INST`).
`feeID`	string	L	Fee schedule code.
`feeTotal`	number	L, D	Total transaction fee.
`feeCurrency`	string	D	Fee currency.
`approvalUsers`	string	L	List of approvers.
`approvedBy`	string	L	User who approved the transaction.
`approvedDate`	string	L	Time the transaction was approved.
`coreRef`	string	L, D	The bank's core posting reference (core reference).
`pmtRef`	string	L	Payment reference number.
`pmhId`	string	L, D	BIDV payment identifier.
`errorCode`	string	B, L	Error code of the transaction / record (if any).
`errorDescription`	string	B	Error description of an invalid record.
`notAuthorized`	boolean	B	Flag indicating the record's debit account has not been granted permission.
`validBenAccount`	boolean	B	Recipient account validation flag.
`bankLogoUrl`	string	D	Receiving bank logo.
`ibftBankCode`	string	D	Receiving bank BIN (NAPAS).
`bankTransferType`	number	D	Bank-side transfer type.
`debitAccountNumber`	string	B, L, D	Sender (debit) account number.
`debitAccountName`	string	L, D	Sender account name.
`creditAccountType`	string	B, L, D	Receiving method: `ACCOUNT` (account number) or `ID` (ID document).
`creditAccountNumber`	string	B, L, D	Recipient account number.
`creditAccountName`	string	B, L, D	Recipient name.
`creditBankCode`	string	B, L, D	Receiving bank code (CITAD code).
`creditBankName`	string	B, L, D	Receiving bank name.
`creditBankShortName`	string	B, L, D	Receiving bank short name.
`creditBankAbbr`	string	B, L, D	Receiving bank abbreviation.
`creditBranchCode`	string	B, L, D	Receiving bank branch code.
`creditBranchName`	string	B, L, D	Receiving bank branch name.
`creditId`	string	B, L, D	Recipient ID document number (when `creditAccountType = ID`).
`creditIssueDate`	string	B, L, D	ID document issue date.
`creditIssueAddress`	string	B, L, D	ID document place of issue.
`creditCurrency`	string	B, L, D	Recipient currency.
`originalCreditAccountNumber`	string	B, L, D	Original recipient account number (if returned by BIDV).
`originalCreditName`	string	B, L, D	Original recipient name (if returned by BIDV).

`data` structure with `EDIT_TRANSFER_DETAIL` (`INTERNAL_TRANSFER`)

data is an object with the fields: id, txnType (transaction type: in-bank / regular-out / fast-out), creditAccountType, senderAccountNumber, senderAccountName, receiverAccountNumber, receiverAccountName, receiverBankCode, receiverBankName, receiverBankShortName, receiverBankAbbr, receiverBranchCode, receiverBranchName, receiverId, receiverIssueDate, receiverIssueAddress, receiverCurrency, originalReceiverAccountNumber, originalReceiverName, amount, amountText, currency, remark, approvalNote, feeMethod, feeOpt, feeAccountNumber, feeAmount, feeVAT, feeTotal, originId (the partner's requestId), priority, effectiveDate, transactionCode, acceptedDate, approvedDate, processDate, bankLogoUrl, status, accountingStatus. The meanings are the same as the fields in the table above (prefix sender = sending party, receiver = receiving party).

Differences for `SALARY` / `BILL_PAYMENT`

`inquiryType`	`data` structure
`TRANSFER_DETAIL`, `EDIT_TRANSFER_DETAIL`	`data.transaction` is an object with the batch order information: `transactionId` (batch-level transaction ID), `transactionCode`, `status`, `statusDesc`, `amount`, `currency`, `debitAccountNumber`, `debitAccountType`, `debitAccountName`, `feeAccountNumber`, `feeTotal`, `feeCurrency`, `feeMethod`, `effectiveDate`, `approvalNote` (Maker's note), `approvalNoteChecker` (Checker's note), `originId`, `batchNo`, `batchId`, `priority`, `totalAmountText`, `remark`.
`FO_REPORT_LIST`	`data.items[]` contains: `id`, `status`, `statusDesc`, `amount`, `currency`, `createdDate`, `createdBy`, `remark`, `effectiveDate`, `channel`, `originId`, `batchId`, `totalRow` (total records), `successRow` (successful records), `errorRow` (failed records), `fileName`, `feeOpt`, `feeTotal`, `approvalUsers`, `approvedDate`, `feeAccountNumber`, `debitAccountNumber`, `debitAccountName`; plus `data.total`.
`PENDING_APPROVAL_LIST`, `MAKER_PENDING_LIST`	`data.items[]` contains the same fields as `FO_REPORT_LIST`, plus: `senderAccountType`, `feeCurrency`, `feeMethod`, `transactionId`, `transactionCode`, `raNote` (Maker's note), `approvalNote` (Checker's note), `batchNo`, `priority`, `totalAmountText`, `processDate`; plus `data.total`.
`BATCH_UPLOAD_INQUIRY`	Same as `INTERNAL_TRANSFER`; each element also has `processFlow` and a transaction description (`txnDesc` for `SALARY`, `txDesc` for `BILL_PAYMENT`).

Common error codes

Code	Description	How to handle
`1077`	The BIDV authorization session for the role has expired or has not been granted	Call Get the authorization URL with the correct `role` to re-authorize, then query again.
`1110`	The transaction is no longer in draft status, so it cannot be edited	Only use `EDIT_TRANSFER_DETAIL` for draft transactions; for other transactions use `TRANSFER_DETAIL`.
`1109`	Transaction not found	Check the transaction ID (`id`).
`1021`	The bank is not supported for this API	Check `bankBin`; the Maker/Checker flow applies to BIDV (`970418`).
`90`, `91`, `92`, `97`	Request authentication error (timestamp, client-id, signature)	See System error codes.
`Others`	Other errors	See Error codes.

Header Request​

Body Parameter​

Sample request payload​

Code samples​

Sample Response​

Response data structure​

Transaction details (in the data.items array, or directly in data for TRANSFER_DETAIL)​

data structure with EDIT_TRANSFER_DETAIL (INTERNAL_TRANSFER)​

Differences for SALARY / BILL_PAYMENT​

Common error codes​