Wallet API Reference

This page shows all Wallet endpoints in the sequence of integration. Use https://api.sandbox.blox.my for tests. Use https://api.blox.my in production.

A read request must have the blox-api-key header. A write request must have the API key and an HTTP message signature. If an endpoint shows an Idempotency-Key header, the write request must also have that header. Store the Idempotency-Key UUID v4 before you send the first request.

In request bodies, amounts are integers in sen. In responses, amounts are strings. Every error uses { "code": "…", "message": "…", "requestId": "…" }. Use code to identify the error. Do not use message to identify the error. For the error behavior that all endpoints share, see Errors.

Get wallet address

Returns the deposit addresses of the wallet. If an address does not exist, BLOX creates it automatically.

Response — 200

{
  "evmAddress": "0x742d35Cc6634C0532925a3b333Bc9e1234f8bD21",
  "solAddress": "DRpbCBMxVnDK7maPM5tGv6MvB3v1sRMC99PZ8okm99hy"
}

{
  "code": "UNAUTHORIZED",
  "message": "API key is required",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

Get wallet balance

Returns the wallet balance that you can use and the pending balance.

Response — 200

{
  "walletBalance": "250000",
  "pendingWithdrawal": "0"
}

{
  "code": "UNAUTHORIZED",
  "message": "API key is required",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

Get supported networks

Returns the active networks and the active tokens on each network. Get the tokenId from this endpoint at runtime. The IDs in sandbox and production are different.

Each network has the fields id, name, type, and tokens. Use the id of a token as the tokenId in token transfers and Onramp checkouts. Use EVM tokens with 0x addresses. Use Solana tokens with Base58 addresses.

The Environments & Chains page also shows contract addresses and chain IDs. At runtime, use this endpoint.

{
  "code": "VALIDATION_FAILED",
  "message": "tokenId: Invalid UUID",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

Create token transfer

Sends a token from the BLOX wallet to an external address. The limit for this endpoint is 30 requests per minute for each account.

Header

Body

An EVM address has 0x and 40 hexadecimal characters. A Solana address uses Base58. BLOX rejects a token transfer to your own deposit address, to a contract address, or to a different restricted destination.

The amount in the request is the total debit from the wallet. If there is a network fee, BLOX deducts it before delivery. The response shows the net amount and the fee in a separate field.

Response — 200

{
  "id": "9b3bd9db-75d8-44dc-a74b-16fe968a01c7",
  "status": "CREATED",
  "toAddress": "0x742d35Cc6634C0532925a3b844Bc9e7595f8bD21",
  "amount": "10000",
  "fee": "0",
  "reference": "ORDER-4471",
  "source": "API",
  "tokenId": "550e8400-e29b-41d4-a716-446655440000",
  "token": {
    "symbol": "MYRC",
    "name": "MYR Coin",
    "network": { "id": "ethereum", "name": "Ethereum", "type": "EVM" }
  },
  "txHash": null,
  "confirmations": null,
  "confirmedAt": null,
  "createdAt": "2026-01-16T10:30:00.000Z",
  "updatedAt": "2026-01-16T10:30:00.000Z"
}

The first status of an EVM token transfer is CREATED. The first status of a Solana token transfer is PENDING. For all fields and statuses, see the Token transfer object.

Store one UUID v4 before you send the request. If you get no response, a timeout, 202, or 5xx, send the request again with the same key. For 24 hours, the same key with the same body returns the initial token transfer. The same key with a different body returns 422 CONFLICT. If you get a 4xx, correct the request and use a new key.

{
  "code": "INVALID_REQUEST",
  "message": "Missing idempotency key",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "VALIDATION_FAILED",
  "message": "amount: Amount can't be less than 10 MYR",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "INSUFFICIENT_BALANCE",
  "message": "Insufficient MYRC balance in wallet.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "LIMIT_EXCEEDED",
  "message": "Daily transaction limit exceeded.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "UNAUTHORIZED",
  "message": "API key is required",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "FEATURE_DISABLED",
  "message": "Feature wallet_api is not enabled for this account.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "ACCOUNT_FROZEN",
  "message": "Your account has been frozen. Please contact support.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "ACCOUNT_TERMINATED",
  "message": "Your account has been terminated. Please contact support.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "ACCOUNT_PENDING_VERIFICATION",
  "message": "Your account is pending verification. This action is not allowed for this account at this time.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "CONFLICT",
  "message": "Idempotency key used with different request payload",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "RATE_LIMITED",
  "message": "Too many token withdrawals. Please try again later.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "INTERNAL_ERROR",
  "message": "An unexpected error occurred.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

Get token transfer

Returns one token transfer. This endpoint returns the token transfer immediately after you create it. Use this endpoint to monitor the status.

Response — 200: Token transfer object. An unknown ID, or an ID that belongs to a different account, returns 404 NOT_FOUND.

While an EVM token transfer is CREATED, GET /v1/wallet/transactions does not show it. Thus, use this endpoint to get the correct status from the time of creation.

{
  "code": "NOT_FOUND",
  "message": "Token withdrawal not found",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

List bank accounts

Returns the active bank accounts that are linked to the BLOX account. To create a fiat withdrawal, use the id of a verified bank account as the bankAccountId.

Response — 200

{
  "data": [
    {
      "id": "6639e2e8-9d71-4a77-9fd7-34fcd0ce5355",
      "name": "Business account",
      "accountNumber": "123456789012",
      "verified": true,
      "bank": { "code": "MBBM", "name": "Maybank" },
      "createdAt": "2026-01-10T04:00:00.000Z",
      "updatedAt": "2026-01-10T04:00:00.000Z"
    }
  ],
  "hasMore": false,
  "nextCursor": null
}

Send the request again with the next cursor until hasMore is false. The response has no total field.

{
  "code": "VALIDATION_FAILED",
  "message": "limit: Number must be less than or equal to 100",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

Create fiat withdrawal

Sends MYR from the BLOX wallet to a linked bank account. The limit for this endpoint is 30 requests per minute for each account.

Header

Body

For an individual account, the maximum is RM300,000 for each request. A business account can use the full range for each request. Other limits for each account can also apply.

Response — 200

{
  "id": "1de31ea3-c2b5-454b-a1f0-547c21738aef",
  "status": "PENDING",
  "amount": "50000",
  "fee": "0",
  "reference": "WD-4471",
  "refId": "FW-20260116-A1B2C3",
  "source": "API",
  "destination": {
    "name": "ADA LOVELACE",
    "accountNumber": "1234567890",
    "bank": { "code": "MBBM", "name": "Maybank" }
  },
  "confirmedAt": null,
  "createdAt": "2026-01-16T10:30:00.000Z",
  "updatedAt": "2026-01-16T10:30:00.000Z"
}

For all fields and statuses, see the Fiat withdrawal object. The idempotency and retry rules are the same as for token transfers. Store the key before you send the request. Use the same key for each retry of the same fiat withdrawal.

{
  "code": "INVALID_REQUEST",
  "message": "Missing idempotency key",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "VALIDATION_FAILED",
  "message": "amount: Amount can't be less than 10 MYR",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "INSUFFICIENT_BALANCE",
  "message": "Insufficient MYRC balance in wallet.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "LIMIT_EXCEEDED",
  "message": "Daily transaction limit exceeded.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "UNAUTHORIZED",
  "message": "API key is required",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "FEATURE_DISABLED",
  "message": "Feature wallet_api is not enabled for this account.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "ACCOUNT_FROZEN",
  "message": "Your account has been frozen. Please contact support.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "ACCOUNT_TERMINATED",
  "message": "Your account has been terminated. Please contact support.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "ACCOUNT_PENDING_VERIFICATION",
  "message": "Your account is pending verification. This action is not allowed for this account at this time.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "NOT_FOUND",
  "message": "Bank account not found",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "CONFLICT",
  "message": "Idempotency key used with different request payload",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "RATE_LIMITED",
  "message": "Too many fiat withdrawals. Please try again later.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

{
  "code": "INTERNAL_ERROR",
  "message": "An unexpected error occurred.",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

Get fiat withdrawal

Returns one fiat withdrawal. Send GET /v1/wallet/fiat/withdrawals/{id} again until the status is COMPLETED, FAILED, or REJECTED.

Response — 200: Fiat withdrawal object. An unknown ID, or an ID that belongs to a different account, returns 404 NOT_FOUND.

{
  "code": "NOT_FOUND",
  "message": "Fiat withdrawal not found",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

Create a deposit trigger address

Creates a trigger address for a linked bank account. When tokens arrive at this address, BLOX automatically sends a fiat withdrawal to that bank account. You do not send a create request. For more information, see Withdraw automatically on deposit.

The bank account must be active. A bank account has one trigger address for all of its life. If you send this request again, it returns the same address. Thus, an Idempotency-Key is not necessary. The limit for this endpoint is 20 requests per minute.

Success response (201)

{
  "address": "0x7c1a3e889d2b4f618a441f0b6d3c9a5588ab01cd",
  "network": "EVM",
  "destination": {
    "type": "BANK_ACCOUNT",
    "id": "b21f4c77-3e5a-4d90-9c18-6a2f7e0b4d31"
  }
}

Until you allow one or more senders, a deposit to this address does not start a fiat withdrawal.

List allowed senders

Returns the allowed senders of the trigger address of this bank account. The oldest sender is first.

Success response (200)

[
  {
    "id": "3f8c1d02-5b47-4a6e-91cd-77e2b0a4f915",
    "address": "0x9a3f7c21b8e04d6f5a19c2e70b48d3f61a5e9d02",
    "label": "Treasury wallet",
    "active": true,
    "createdAt": "2026-08-07T09:31:05.000Z"
  }
]

The list also shows disabled senders. A disabled sender counts in the limit of 50 senders until you remove it.

If the bank account does not have a trigger address, the response is 404 NOT_FOUND.

Allow a sender

Adds one allowed sender to the trigger address of this bank account. Deposits from this sender start fiat withdrawals to the bank account. A trigger address can have a maximum of 50 allowed senders.

Success response (201)

Returns the new allowed sender, in the same format as List allowed senders.

Disable or re-enable a sender

Disables or enables an allowed sender. A disabled sender stays in the list and keeps its label. After you disable a sender, its deposits do not start fiat withdrawals. This change occurs immediately. You can enable the sender again at a later time.

If you will send from the wallet again, disable the sender. If you will not use the wallet again, remove the sender. Only a removal makes a place available in the limit of 50 senders.

Request body

Success response (200)

Returns the sender, in the same format as List allowed senders.

Remove an allowed sender

Removes the allowed sender. After the removal, deposits from that sender do not start fiat withdrawals. The removal makes a place available in the limit of 50 senders. This change has no effect on deposits that are already in progress. Sign only @method and @path. A Content-Digest is not necessary.

Success response (200)

{ "success": true }

If the sender id is unknown or belongs to a different trigger address, the response is 404 NOT_FOUND.

Get a deposit

Returns a deposit. If the deposit started a fiat withdrawal, the response also shows that fiat withdrawal. The deposit webhook sends the same payload.

Success response (200)

{
  "id": "5e9d0273-8a41-4c62-b0f7-1d3e8c95a460",
  "txHash": "0x5d53558791c9346d644d077354420f9a93600acf54eb806ecb9aad077c103ee3",
  "logIndex": 12,
  "chainId": 1,
  "tokenId": "a71c4e08-2f96-4b3d-85ae-6c0f7d21b943",
  "amount": "100000",
  "from": "0x9a3f7c21b8e04d6f5a19c2e70b48d3f61a5e9d02",
  "status": "COMPLETED",
  "confirmations": 24,
  "triggerAddress": "0x7c1a3e889d2b4f618a441f0b6d3c9a5588ab01cd",
  "destination": {
    "type": "BANK_ACCOUNT",
    "id": "b21f4c77-3e5a-4d90-9c18-6a2f7e0b4d31",
    "name": "ACME SDN BHD"
  },
  "result": {
    "status": "COMPLETED",
    "statusReason": null,
    "withdrawal": {
      "id": "c4a80f13-6d29-4e75-83b1-9f0c2a7e5d68",
      "amount": "100000",
      "status": "COMPLETED",
      "refId": "FW-20260807-0001",
      "reference": "ACME payout",
      "createdAt": "2026-08-07T09:31:05.000Z",
      "updatedAt": "2026-08-07T09:34:22.000Z"
    }
  },
  "createdAt": "2026-08-07T09:30:44.000Z",
  "updatedAt": "2026-08-07T09:34:22.000Z"
}

amount and result.withdrawal.amount use different units. amount is in the smallest unit of the token. result.withdrawal.amount is in sen. Read each value from its own field.

If the deposit id is unknown or belongs to a different account, the response is 404 NOT_FOUND.

Deposit status reason values

If result.status is not FAILED, result.statusReason is null.

In all cases, the tokens stay in your wallet balance. If you can correct the cause, correct it and then retry the deposit. For example, allow the sender, activate the bank account again, or wait for the start of the next daily or monthly limit period.

Check for a missed deposit

Asks BLOX to examine a transaction that BLOX did not detect. Use this endpoint if you sent tokens and no deposit appeared.

This is the only endpoint that accepts a transaction hash. If BLOX already detected the transaction, the response contains the deposit ids. Use these ids with Get a deposit and Retry a deposit. The limit for this endpoint is 30 requests per minute.

Success response (201)

{
  "status": "ALREADY_DETECTED",
  "depositIds": ["5e9d0273-8a41-4c62-b0f7-1d3e8c95a460"]
}

Read status before you read depositIds. For QUEUED, an empty array means that the deposits do not exist yet. It does not mean that BLOX found no deposits. One transaction can contain more than one deposit. If the status is QUEUED, wait for the webhook event. Do not send the request again.

Retry a deposit

Examines again a deposit that BLOX credited but that did not start a fiat withdrawal. Use this endpoint after you correct the cause. For example, allow the sender, activate the bank account again, or wait for the start of the next daily or monthly limit period.

You can send this request more than one time with no risk. If the deposit already started a fiat withdrawal, the response shows that fiat withdrawal. BLOX does not create a second fiat withdrawal. The limit for this endpoint is 60 requests per minute.

This request has no body. Sign only @method and @path.

Success response (201)

Returns the deposit after the retry, in the same format as Get a deposit.

List wallet transactions

Returns the wallet transactions. The newest transaction is first. Use this endpoint for history and reconciliation. To monitor one withdrawal, use the read endpoint for that resource.

Response — 200

{
  "data": [
    {
      "transactionId": "9b3bd9db-75d8-44dc-a74b-16fe968a01c7",
      "type": "OUT",
      "mode": "TOKEN",
      "status": "PENDING",
      "amount": "-10000",
      "fee": "0",
      "effectiveAmount": "-10000",
      "beneficiary": "0x742d35Cc6634C0532925a3b844Bc9e7595f8bD21",
      "reference": "ORDER-4471",
      "refId": "",
      "source": "API",
      "networkId": "ethereum",
      "createdAt": "2026-01-16T10:30:00.000Z",
      "confirmedAt": null
    }
  ],
  "hasMore": true,
  "nextCursor": "MjAyNi0wMS0xNlQxMDozMDowMC4wMDBafDliM2Jk…"
}

Send nextCursor as cursor in the next request. Do this until hasMore is false. The response has no total field. Treat each cursor as an opaque string. The response does not show a transaction that has the status CREATED. It shows the transaction after the status changes.

{
  "code": "VALIDATION_FAILED",
  "message": "limit: Number must be less than or equal to 100",
  "requestId": "9f21ab04-6c3e-4d90-b1a7-8e5f2c0d4416"
}

Shared response schemas

Token transfer object

Fiat withdrawal object