External withdrawal preparation.
Durable requests, read-only RPC quote adapters, balance reservations and cancellation journals are implemented. Providers require verification; actual signing, dispatch and reconciliation remain unavailable. Browser examples use labelled isolated simulations.
01Request a frozen destination
POST /withdrawal-quote-requests with a wallet, exact asset, decimal recipient amount and either destination or recipientId. Keep its Idempotency-Key and saved request ID. Preparation has a five-minute deadline and does not reserve funds.
02Review a 60-second quote
The worker freezes processing tariff, native network components, conversion and maximum debit. Quotes last exactly 60 seconds. Check executionReady and quote.fundingState before authorization: metadata or a reviewable quote alone cannot enable sending. Manual policy scenarios cannot create executable quotes.
03Check source observation freshness
Active request status includes sourceObservation: current, changed or unverified; other states return null. Known preparation, signing, submission, transaction observation and settlement invalidate earlier unconsumed liquidity snapshots. A current revision alone does not enable execution. Confirmation rechecks under locks. On SOURCE_LIQUIDITY_CHANGED or SOURCE_LIQUIDITY_UNVERIFIED, close the quote and request a fresh one. Private revisions are never accepted from callers or returned in the public quote.
04Wait for consistent source account state
EVM quote estimation compares independent latest and pending source nonces after simulation and rechecks account code. Pending activity or a changed nonce returns QUOTE_SOURCE_NONCE_UNSETTLED; peer disagreement returns QUOTE_SOURCE_STATE_DISAGREEMENT. The dashboard explains the condition and keeps the saved request available without reserving funds. Inspect the same request after the source settles. Private source observations are not returned in the public quote and do not enable spending or replace platform gas ownership.
05Check platform gas funding separately
The server derives EVM quote funding from classified platform capital, current reservations and fresh reconciled source evidence. Latest and finalized balances and nonces must agree. Caller gas flags cannot establish ownership. Insufficient verified gas remains reviewable as gas_funding_required. A changed funded source receives its own estimate before publication, with at most three attempts. QUOTE_GAS_SOURCE_CHANGED or QUOTE_GAS_EVIDENCE_STALE means the saved request needs a fresh custody check; QUOTE_SOURCE_REESTIMATE means source selection remained unstable. TRON cost review retains zero verified gas until equivalent current-state evidence is integrated. A funded quote alone never establishes executionReady.
06Understand the balance and blockchain source
Internal transfers move balances within your workspace. Blockchain assets may remain in the original custody wallet. A server-selected same-workspace route requires complete journal-backed liabilities, matched custody observations, sufficient unreserved assets and classified platform gas. When present, custodyRoute discloses the fixed blockchain source in the quote and receipt. The selected balance wallet is debited. Callers cannot select arbitrary custody sources or route across workspaces. This does not enable live execution; actual service attestations and funded verification remain required.
07Authorize and reserve once
Current workspace owner/admin permission and recent app passkey verification are rechecked in the transaction. POST /withdrawals with quoteId and a separate Idempotency-Key saves the instruction and moves the maximum debit from available to in transit. No fee revenue is earned yet. RPC admission permits one unresolved withdrawal per physical source across all assets. SOURCE_SPEND_PENDING retains the current quote, reports executionReady=false and does not reserve this request. Wait for proven settlement or legitimate unprepared cancellation, then review a fresh quote. An expired worker lease never frees the source. Quote expiry is rechecked after account locks and final audit/outbox writes; an expired authorization rolls back all reservation effects.
08Recover and cancel safely
GET the original quote request after a response loss. It returns an existing receipt if confirmation committed. Close an unresolved request atomically. A reserved instruction can return its complete balance only before preparation; an expired worker lease cannot undo that barrier.
09Inspect preparation and signing
User and admin receipts expose status and transaction IDs while keeping source bindings and raw bytes private. Canonical payloads, EVM nonce/TRON identities and restricted signing components are implemented. Prepared and signed transfers retain reserved funds while awaiting network submission. Actual RPC/custody verification, supervised dispatch and funded execution remain pending. Local final receipt settlement is documented below.
10Recover the original custody request
MFA-authenticated operators can inspect GET /v1/admin/withdrawals/{id}/signing-status. Owner, operations or security can POST /v1/admin/withdrawals/{id}/recheck-signing with an audit reason. The worker queries the original activity by ID or exact saved request fingerprint and validates its intent and signature. This does not sign another request or release funds. Live cloud recovery remains unverified.
11Inspect the original network submission
Operators can inspect GET /v1/admin/withdrawals/{id}/submission-status. Authorized owner, operations or security sessions can POST /v1/admin/withdrawals/{id}/check-submission with an audit reason. This queries the retained hash and never sends another payment. Broadcast means acknowledgement only; funds remain reserved until final confirmation, fee and unused-reserve reconciliation. Actual funded execution remains unverified.
12Verify the final receipt and return unused reserves
GET /v1/admin/withdrawals/{id}/finality-status shows sanitized receipt-check status. Owner, operations or security may POST /v1/admin/withdrawals/{id}/check-finality with an audit reason. Independent finalized execution must prove the original signed transaction and exact recipient amount. The settlement records actual fees and returns unused reserves at the frozen quote conversion. Definitive on-chain failure returns the unsent amount and processing fee; incurred network costs may still apply up to the quoted reserve. Unknown outcomes retain reservations. Local synthetic verification does not establish live execution readiness.
POST /v1/workspaces/{workspaceId}/withdrawal-quote-requests
Idempotency-Key: <quote-request-id>
{ "walletId": "<uuid>", "assetId": "ethereum:sepolia:usdc", "amount": "25", "recipientId": "<saved-recipient-uuid>", "reference": "Supplier settlement" }
GET /v1/workspaces/{workspaceId}/withdrawal-quote-requests/{id}
POST /v1/workspaces/{workspaceId}/withdrawals
Idempotency-Key: <confirmation-id>
{ "quoteId": "<published-quote-uuid>" }
GET /v1/workspaces/{workspaceId}/withdrawals/{id}
POST /v1/workspaces/{workspaceId}/withdrawals/{id}/cancel
{}Open your workspace