Create Bank Disbursement

Transfer funds from your wallet to a bank account.

Endpoint

POST /api/disbursement/create

Authentication

RSA-SHA256 X-SIGNATURE header. See Authentication.

Request

Headers

Header	Required	Description
X-SIGNATURE	Yes	Base64-encoded RSA-SHA256 signature
Content-Type	Yes	application/json

Body

Field	Type	Required	Description
clientId	string	Yes	Your legacy_client_id
orderId	string	Yes	Your unique disbursement ID (idempotency key)
bankCode	string	Yes	Bank short code (e.g., BCA, MANDIRI)
accountNumber	string	Yes	Destination account number
accountName	string	Yes	Account holder name
requestAmount	integer	Yes	Transfer amount in full IDR (NOT minor units)
notifyUrl	string	No	Callback URL for disbursement status updates

Amount Units

requestAmount is in full IDR. IDR 500,000 = 500000. This is the opposite of the V1 API.

Example

PHP

$body = json_encode([
    'clientId'      => 'TEST_CLIENT_001',
    'orderId'       => 'DISB-2026-001',
    'bankCode'      => 'BCA',
    'accountNumber' => '1234567890',
    'accountName'   => 'Budi Santoso',
    'requestAmount' => 500000,
    'notifyUrl'     => 'https://your-site.com/callbacks/disbursement',
]);

$bodyHash    = hash('sha256', $body);
$stringToSign = "TEST_CLIENT_001|TEST_SECRET_001|$bodyHash";
openssl_sign($stringToSign, $rawSig, $privateKey, OPENSSL_ALGO_SHA256);
$xSignature  = base64_encode($rawSig);

$ch = curl_init('https://api.flypay.asia/api/disbursement/create');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'X-SIGNATURE: ' . $xSignature,
    ],
    CURLOPT_POSTFIELDS => $body,
]);
$response = json_decode(curl_exec($ch), true);

Response

HTTP 200 OK

{
  "code": 200,
  "message": "Success",
  "data": {
    "refCode": "DSB-260601110000-C3D4",
    "orderId": "DISB-2026-001",
    "accountNumber": "1234567890",
    "accountName": "Budi Santoso",
    "bank": {
      "name": "Bank Central Asia",
      "code": "BCA"
    },
    "requestAmount": "500000.00",
    "disbursementFee": "5000.00",
    "disbursementAmount": "500000.00",
    "status": "PENDING",
    "requestAt": "2026-06-01 11:00:00"
  }
}

Fields

Field	Description
requestAmount	Decimal string of the amount you requested (IDR)
disbursementFee	Flat fee deducted from your wallet (IDR)
disbursementAmount	Amount delivered to the beneficiary; the fee is never added to this value
status	Initial status: PENDING
requestAt	WIB timestamp

Idempotency

Submitting the same orderId again is rejected with code: 400 and message: "Disbursement with orderId … Already Exists.". Query the existing disbursement instead.

Error Responses

Message	Description
Invalid Client ID	clientId not found
Invalid X-SIGNATURE	Signature verification failed
Public Key is not set	No RSA public key uploaded
Bank Cannot be used for Disbursement	bankCode not found or disabled
Invalid request parameters	Missing required field
Insufficient Balance	Wallet balance < (requestAmount + fee)
Maximum Request Amount Exceeded	Exceeds per-transaction limit
Disbursement with orderId … Already Exists.	orderId already exists for this merchant