Allwallex API · v1

Private records, ready to share.

Create ledger statements and transaction records, keep a private document library and attach reviewed files to Support messages. These endpoints require an authenticated dashboard session; merchant server API keys do not grant access.

Testnet environment. Transactions use test assets and do not settle real payments.

01Create an export

Use Files & exports in the workspace dashboard, or POST a statement, receipt or merchant payment request with an original Idempotency-Key. The returned file starts queued. Poll its metadata until available, failed, rejected, cancelled or review. Only available files can be downloaded.

02Choose the right financial record

Statements cover one wallet and asset, up to 366 days and 10,000 movements, with exact atomic-unit amounts and reconciled account totals. CSV preserves Unicode and protects spreadsheet formulas. PDF embeds its font and represents unsupported glyphs as visible Unicode scalar values. Transaction records show processing state at generation; a reserved or broadcast withdrawal is not proof of delivery. A merchant payment request is not a tax invoice.

03Upload original bytes privately

Allocate a Support file with a portable filename, application/pdf, image/png or image/jpeg, exact byte size and lowercase SHA-256. Send the same bytes to its content endpoint as application/octet-stream using a retained content Idempotency-Key. The binary limit is 8 MiB; other JSON routes retain their own smaller limit. Reselect the original file after an interrupted upload. Archives and other file types are not supported. Unfinished upload allocations expire after twenty-four hours unless a receive lease is still active.

04Wait for evidence before attaching

Uploaded bytes stay quarantined until scanning and original-version storage verification succeed. Up to five unique available files can be included as optional attachmentIds in a Support reply. Each file must belong to the sending author, audience and ticket and may bind to one message. Internal-note attachments remain visible only to authorized operators. Omit attachmentIds for a text-only message.

05Download with current access

GET the authorized download route to receive a 303 redirect to an attachment download. The temporary link binds the exact stored version and expires after five minutes. Keep it private and out of logs. Workspace membership and Support permissions are checked again for each link. Unsigned object paths and file IDs alone grant no access.

06Recover or cancel clearly

Retain the original key and exact request body before each write. Recover those values after a lost response and refresh current metadata. Cancel a pending or failed file using expectedVersion. A requester or current workspace administrator can cancel an export; cancellation does not erase the retained storage evidence. Each account may keep ten active requests, create thirty per UTC day and submit fifty MiB of declared upload bytes per UTC day.

// Authenticated workspace session. POSTs require an Idempotency-Key.
POST /v1/workspaces/{workspaceId}/files/statements
{
  "format": "pdf",
  "statement": {
    "walletId": "original-wallet-uuid",
    "assetId": "ethereum:sepolia:usdc",
    "from": "2026-10-01T00:00:00Z",
    "to": "2026-11-01T00:00:00Z",
    "timezone": "UTC"
  }
}
GET /v1/workspaces/{workspaceId}/files?purpose=statement&status=all&limit=20
GET /v1/workspaces/{workspaceId}/files/{fileId}
GET /v1/workspaces/{workspaceId}/files/{fileId}/download
POST /v1/workspaces/{workspaceId}/files/{fileId}/cancel
{ "expectedVersion": 1 }
POST /v1/workspaces/{workspaceId}/files/receipts
{ "kind": "withdrawal", "referenceId": "original-transaction-uuid" }
POST /v1/workspaces/{workspaceId}/files/invoices
{ "orderId": "original-order-uuid" }

// Allocate, send binary bytes, poll, then bind only available files.
POST /v1/account/support/{ticketId}/files
{ "filename": "reference.pdf", "contentType": "application/pdf",
  "sizeBytes": 12345, "sha256": "original-lowercase-64-character-sha256" }
POST /v1/account/support/{ticketId}/files/{fileId}/content
Content-Type: application/octet-stream
// Exact original bytes, not JSON or base64.
GET /v1/account/support/{ticketId}/files
POST /v1/account/support/{ticketId}/messages
{ "message": "Please review this reference.", "attachmentIds": ["available-file-uuid"] }

// Operator Support file routes use /v1/admin/support/{ticketId}/files
// and require current category permission plus recent operator passkey verification.
// Aggregate-only storage monitor: GET /v1/admin/files (Owner, Operations, Security).

Open your workspace