> ## Documentation Index > Fetch the complete documentation index at: https://docs.singapay.id/llms.txt > Use this file to discover all available pages before exploring further. # Transfer between accounts (PG or cross-channel) > Transfers funds from the given PG account (remitter) to a beneficiary under the same merchant. Compatible-extend contract: omit `beneficiary_channel` (or set `PG`) and pass `beneficiary_account_number` for intra-PG movement; set `beneficiary_channel=KYC` to credit the merchant KYC credit-pool (Shanghai §6.7 + IVS local TRANSFER_CREDIT, no MONEY_IN). `BILLER` is reserved. Requires request signature headers (`verify.signature-internal`). Idempotency: send an optional `merchant_ref_no` unique per merchant. If a value already used by the same merchant is submitted again, the original transfer is returned (HTTP 200) and no new movement is created — regardless of which of the merchant's accounts is the remitter. If `merchant_ref_no` is omitted or empty, the platform auto-generates a unique reference (format `AM--`) and returns it in the response. ## OpenAPI ````yaml https://payment-b2b.singapay.id/api/docs/merchant-api.json post /api/v1.0/account-transfer/{account_id}/transfer openapi: 3.1.0 info: title: Singa Merchant API description: >- OpenAPI specification for the merchant/partner HTTP API. All routes below are additionally protected by `ip.whitelisted.merchant` — the caller IP must be registered for the credential or merchant. Obtain a JWT using `POST /api/v1.0/access-token/b2b` (Basic auth) or `POST /api/v1.1/access-token/b2b` (X-Signature) before calling secured endpoints. version: 1.0.0 servers: - url: https://sandbox-payment-b2b.singapay.id description: >- API host. Paths include `/api` prefix (see `RouteServiceProvider`). Replace scheme/host with your environment. security: [] tags: - name: Security description: >- Merchant authentication (`OauthMerchantTokenController`). **v1.1** B2B token uses `X-CLIENT-ID`, `X-PARTNER-ID`, and `X-Signature` (no Basic auth). Secured routes also require the issued Bearer JWT plus `X-PARTNER-ID`. - name: Accounts description: >- Account management (`routes/merchantApiRoute.php`, `v1.0`). Path parameter `{id}` is always the account ULID. - name: Balance Inquiry description: >- Merchant and per-account balance inquiry (`BalanceController`, `v1.0`). Path `account_id` is the account ULID. - name: Statements description: >- Per-account statement list and detail (`AccountController::accountStatements`, `accountStatementDetail`, prefix `v1.0/statements`). Flugger responses; detail path param `{statement_id}` maps to `statements.transaction_id`. - name: Payment Link description: >- Payment link CRUD and payment-method catalog (`PaymentLinkApiController`, prefix `v1.0/payment-link-manage`). `account_id` is ULID; `payment_link_id` is numeric `payment_links.id`. - name: Payment Link History description: >- Payment link transaction/history listing and detail (`PaymentLinkApiController`, prefix `v1.0/payment-link-histories`). `history_id` is numeric `payment_link_histories.id`. - name: Virtual Account description: >- Native VA CRUD (`VirtualAccountController`, prefix `v1.0/virtual-accounts`). `account_id` and `virtual_account_id` are ULIDs. - name: VA Transaction description: >- VA money-in transaction listing and detail (`VirtualAccountController`, prefix `v1.0/va-transactions`). - name: QRIS (Money In) description: >- MPM dynamic QRIS list, show, and generate (`QrisMpmDynamicApiController`, prefix `v1.0/qris-dynamic`). - name: QRIS (Money Out) description: >- Issuer MPM decode/inquiry, payment credit (money out), and transaction status (`QrisIssuerMpmController`, `QrisApiV2Controller::checkStatus`, prefix `v2.0/qris`). Related list/detail: `GET /api/v2.0/qris/transaction/...`. - name: E-Wallet (Money In) description: >- E-Wallet Native checkout and transactions (`EwalletNativeApiController`, `EwalletNativeTransactionApiController`, `EwalletNativeV2ApiController`). Paths include `v1.0/ewallet-native`, `v1.0/ewallet-native-transactions`, and `v2.0/ewallet-native`. - name: E-Wallet (Money Out) description: >- E-wallet disbursement / top-up to beneficiary wallets (`EWalletTopUpController`, prefix `v2.0/ewallet`). Responses use the custom **`MerchantV2ApiEnvelope`** with **`MerchantV2ResponseCode`** (SP000–SP020). - name: Card (Money In) description: >- One-time card payment, cancel, and inquiry (`CardPaymentMerchantApiController`, prefix `v2.0/card`). - name: Subscription (Recurring) description: >- Credit-card recurring subscription plans (`SubscriptionPlanApiController`, prefix `v2.0/recurring`). Plan `{id}` is UUID (`sub_plans.id`). - name: Direct Debit description: >- Direct Debit — bind a customer bank account once via hosted webview, then charge it host-to-host (`DirectDebitMerchantController`, prefix `v2.0/direct-debit`). Binding `{binding_id}` and transaction `{transaction_id}` are UUIDs. Responses use the **`MerchantV2ApiEnvelope`** with standard Singapay SP000–SP020 dictionary codes and messages. Field-level validation detail is returned in `data.errors` for **SP018**. The `/charge` endpoint is additionally protected by **`X-Signature`** + **`X-Timestamp`** (`verify.signature-internal`); see operation parameters for the signing scheme. Asynchronous outcomes (bind / unbind / charge) are HTTP POST callbacks to `callback_urls.direct_debit_notif_url` — see the Direct Debit **webhooks** (`directDebitBindingNotification`, `directDebitUnbindingNotification`, `directDebitTransactionNotification`). All three share that single URL; discriminate on `event`. - name: Account Transfer description: >- Move funds between sub-accounts within the same merchant (`AnotherAccountApiController`, prefix `v1.0/account-transfer`). The transfer endpoint requires request signature headers (`verify.signature-internal`). Both accounts must belong to the authenticated merchant and be accessible to the credential. - name: Disbursement (Money Out) description: >- Bank disbursement (`DisbursementController` **v1.0**, `DisbursementV2Controller` **v2.0**). **v1.0** list/show/fee/beneficiary/transfer use Flugg envelopes; v1 inquiry-status uses the **custom v2 envelope** (`MerchantV2ApiEnvelope`, codes **SP000–SP020**). **v2.0** check-beneficiary, transfer, and inquiry-status use the same custom envelope — see component schema **`MerchantV2ResponseCode`** for the full response code table. - name: Cardless Withdrawal description: >- Cardless withdrawal API for initiating ATM cash withdrawals without a physical card. Supports creating withdrawals with OTP generation, listing transaction history, viewing transaction details, canceling pending withdrawals, and deleting canceled records. All endpoints use the `v1.0/cardless-withdrawals` route prefix and the standard success/error response envelope. Path parameter `{id}` refers to the `transaction_id` (platform-assigned business identifier). - name: Retail Store description: >- Native Retail Store money-in — generate an Alfamart / Indomaret payment code the customer pays at the cashier, then read its status (`RetailTransactionController`, prefix `v1.0/retail-transactions`). Only two endpoints: create and show. `account_id` is the account ULID; `transaction_id` is the platform-assigned `retail_transactions.transaction_id` string returned by create. Payment confirmation arrives as a POST callback to `callback_urls.transaction_notif_url` with `event = retail-transaction`. - name: Settlement Transaction description: >- Read-only listing of the transactions inside a settlement (`SettlementMerchantApiController`, `GET v1.0/settlement-transactions/{identifier}`). A sub-menu of the merchant Transaction Record APIs. Merchant-scoped — only settlements with status `completed` are exposed. `{identifier}` is the numeric `settlements.id` or the `settlements.reference_no`. Each item mirrors the money-in transaction shape (`account`, `fees`, `amount`, `post_timestamp`, `processed_timestamp`, `has_settle`, `settle_at`). Merchants cannot create, approve, or refund settlements; those actions are BOSS-only. paths: /api/v1.0/account-transfer/{account_id}/transfer: post: tags: - Account Transfer summary: Transfer between accounts (PG or cross-channel) description: >- Transfers funds from the given PG account (remitter) to a beneficiary under the same merchant. Compatible-extend contract: omit `beneficiary_channel` (or set `PG`) and pass `beneficiary_account_number` for intra-PG movement; set `beneficiary_channel=KYC` to credit the merchant KYC credit-pool (Shanghai §6.7 + IVS local TRANSFER_CREDIT, no MONEY_IN). `BILLER` is reserved. Requires request signature headers (`verify.signature-internal`). Idempotency: send an optional `merchant_ref_no` unique per merchant. If a value already used by the same merchant is submitted again, the original transfer is returned (HTTP 200) and no new movement is created — regardless of which of the merchant's accounts is the remitter. If `merchant_ref_no` is omitted or empty, the platform auto-generates a unique reference (format `AM--`) and returns it in the response. operationId: accountTransferTransfer parameters: - name: account_id in: path required: true schema: description: ULID of the source (remitter) PG account. type: string requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AccountTransferRequestBody' responses: '200': description: >- Transfer completed successfully. The `data` object contains the created transfer record. content: application/json: schema: $ref: '#/components/schemas/AccountTransferSuccessEnvelope' '401': description: Unauthenticated. content: application/json: schema: $ref: '#/components/schemas/ResponderErrorEnvelope401' '403': description: Access denied to remitter account. content: application/json: schema: $ref: '#/components/schemas/ResponderErrorEnvelope403' '404': description: Remitter or beneficiary account not found or inactive. content: application/json: schema: $ref: '#/components/schemas/ResponderErrorEnvelope404' '409': description: Remitter or KYC pool not provisioned on Shanghai. content: application/json: schema: $ref: '#/components/schemas/ResponderErrorEnvelope422' '422': description: >- Validation failed: missing fields, insufficient balance, same-account transfer, or unsupported channel. content: application/json: schema: $ref: '#/components/schemas/ResponderErrorEnvelope422' '500': description: Internal server error during transfer processing. content: application/json: schema: $ref: '#/components/schemas/ResponderErrorEnvelope500' security: - BearerAuth: [] PartnerId: [] components: schemas: AccountTransferRequestBody: description: >- Compatible-extend contract: PG→PG still uses `beneficiary_account_number`. Cross-channel (KYC / future BILLER) sets `beneficiary_channel` and omits the PG account number. Optional `beneficiary_account_id` is reserved for multi-pool peer products. required: - amount properties: amount: description: >- Transfer amount in IDR. Must be at least 1 and not exceed the remitter account available balance. type: number format: float example: 500000 beneficiary_channel: description: >- Destination product channel. Omit or `PG` for intra-PG movement. `KYC` credits the merchant KYC credit-pool. `BILLER` reserved until biller Shanghai provisioning. type: - string - 'null' enum: - PG - KYC - BILLER example: KYC beneficiary_account_number: description: >- Required when beneficiary_channel is PG (or omitted). 12-digit PG account number of the destination account; must belong to the same merchant and be active. type: - string - 'null' example: '123456789012' beneficiary_account_id: description: >- Optional peer-product account selector. Unused for KYC today (one pool per merchant). Reserved for future multi-pool / BILLER. type: - string - 'null' example: null merchant_ref_no: description: >- Optional merchant-supplied idempotency reference. Unique per merchant across all account movements: reusing a value already used by the same merchant returns the original transfer (HTTP 200) without creating a duplicate. If omitted or empty, the platform auto-generates a unique reference (format `AM--`) and returns it in the response — a generated reference is unique per request and therefore provides no replay protection. A different merchant may reuse the same value. type: - string - 'null' maxLength: 191 example: MOVE-20260702-001 type: object AccountTransferSuccessEnvelope: description: Standard success response envelope for account transfer endpoints. properties: status: type: integer example: 200 success: type: boolean example: true data: $ref: '#/components/schemas/AccountTransferResource' pagination: description: >- Pagination metadata for list endpoints; omitted for single-object responses. type: - object - 'null' additionalProperties: true type: object ResponderErrorEnvelope401: required: - status - success - error properties: status: type: integer example: 401 success: type: boolean example: false error: $ref: '#/components/schemas/ResponderErrorBody401' type: object ResponderErrorEnvelope403: required: - status - success - error properties: status: type: integer example: 403 success: type: boolean example: false error: $ref: '#/components/schemas/ResponderErrorBody403' type: object ResponderErrorEnvelope404: required: - status - success - error properties: status: type: integer example: 404 success: type: boolean example: false error: $ref: '#/components/schemas/ResponderErrorBody404' type: object ResponderErrorEnvelope422: required: - status - success - error properties: status: type: integer example: 422 success: type: boolean example: false error: $ref: '#/components/schemas/ResponderErrorBody422' data: type: object example: errors: field: - error message additionalProperties: true type: object ResponderErrorEnvelope500: required: - status - success - error properties: status: type: integer example: 500 success: type: boolean example: false error: $ref: '#/components/schemas/ResponderErrorBody500' type: object AccountTransferResource: description: Account transfer transaction resource. properties: transaction_id: description: Unique transaction identifier generated by the platform. type: string example: 12301AM20240609120000123 merchant_ref_no: description: >- Merchant-supplied idempotency reference echoed back, or null if none was provided. type: - string - 'null' example: MOVE-20260702-001 status: description: Transaction status. Always `success` for completed transfers. type: string example: success remitter_channel: description: Source product channel. type: string example: PG beneficiary_channel: description: Destination product channel. type: string example: KYC amount: description: Transfer amount. properties: currency: type: string example: IDR value: description: Amount as string to preserve decimal precision. type: string example: '500000' type: object remitter: description: Source account details. properties: account_id: description: Remitter account ULID. type: - string - 'null' account_name: description: Remitter account name. type: - string - 'null' account_number: description: Remitter account number. type: - string - 'null' balance_after: description: Remitter available balance after transfer. type: string type: object beneficiary: description: >- Destination account details. For KYC/BILLER, account_id/account_number are Shanghai bankcore handles. properties: account_id: description: Beneficiary PG ULID, or peer Shanghai account_id. type: - string - 'null' account_name: description: Beneficiary account name, or peer pool label. type: - string - 'null' account_number: description: Beneficiary PG account number, or peer Shanghai account_number. type: - string - 'null' balance_after: description: Beneficiary available balance after transfer. type: string type: object processed_timestamp: description: Unix timestamp in milliseconds when the transfer was processed. type: - string - 'null' example: '1717920000123' created_at: description: Unix timestamp in milliseconds when the record was created. type: string example: '1717920000456' type: object ResponderErrorBody401: properties: code: type: integer example: 401 message: type: string example: Unauthorized merchant, please sign in type: object ResponderErrorBody403: properties: code: type: integer example: 403 message: type: string example: Access denied. type: object ResponderErrorBody404: properties: code: type: integer example: 404 message: type: string example: Account not found. type: object ResponderErrorBody422: properties: code: type: integer example: 422 message: type: string example: Validation error. errors: type: object example: field: - error message type: object ResponderErrorBody500: properties: code: type: integer example: 500 message: type: string example: Internal server error. type: object securitySchemes: BearerAuth: type: http description: >- JWT issued by `POST /api/v1.1/access-token/b2b`. Send `Authorization: Bearer `. bearerFormat: JWT scheme: bearer PartnerId: type: apiKey description: Merchant API key (`Credential.api_key`). Required on every request. name: X-PARTNER-ID in: header ````