Create a withdrawal

API_KEY="YOUR_API_KEY"
SECRET_KEY="YOUR_SECRET_KEY"
BASE_URL="https://api-sandbox.inspay.dev/merchant"
 
CANONICAL='{"amount":"100000","callbackUrl":"https://merchant.example.com/callbacks/withdraw","channel":"BANK_TRANSFER","currency":"JPY","destination":"0005","destinationAccount":"0987654","destinationAccountName":"\u30bf\u30ca\u30ab \u30e6\u30ad","destinationAccountType":"1","destinationBranchCode":"001","destinationBranchName":"Head Office","destinationName":"MUFG Bank","nonce":"c1d2e3f4","playerId":"player_abc123","referenceId":"WD-20261011-001","timestamp":"1791729147"}'
SIG=$(printf '%s' "$CANONICAL" | openssl dgst -sha256 -hmac "$SECRET_KEY" -hex | awk '{print $NF}')
# Expected with YOUR_SECRET_KEY: 874f023bf0f749af00294362657462cb6d926118f91774623d049fc17432644e
 
curl -sS -X POST "$BASE_URL/withdraw" \
  -H "Content-Type: application/json" \
  -H "x-api-key: $API_KEY" \
  -H "x-signature: $SIG" \
  --data-binary "$CANONICAL"

import crypto from "node:crypto";
 
const API_KEY = "YOUR_API_KEY";
const SECRET_KEY = "YOUR_SECRET_KEY";
const BASE_URL = "https://api-sandbox.inspay.dev/merchant";
 
function jsonString(value) {
  let out = '"';
  for (const ch of String(value)) {
    const cp = ch.codePointAt(0);
    if (ch === '"') out += '\\"';
    else if (ch === "\\") out += "\\\\";
    else if (ch === "\b") out += "\\b";
    else if (ch === "\f") out += "\\f";
    else if (ch === "\n") out += "\\n";
    else if (ch === "\r") out += "\\r";
    else if (ch === "\t") out += "\\t";
    else if (cp < 0x20 || cp > 0x7e) {
      if (cp > 0xffff) {
        const adj = cp - 0x10000;
        const hi = 0xd800 + (adj >> 10);
        const lo = 0xdc00 + (adj & 0x3ff);
        out += "\\u" + hi.toString(16).padStart(4, "0");
        out += "\\u" + lo.toString(16).padStart(4, "0");
      } else {
        out += "\\u" + cp.toString(16).padStart(4, "0");
      }
    } else out += ch;
  }
  return out + '"';
}
 
function canonicalJSON(body) {
  const keys = Object.keys(body)
    .filter((key) => body[key] !== null && body[key] !== undefined)
    .sort();
  return "{" + keys.map((key) => jsonString(key) + ":" + jsonString(String(body[key]))).join(",") + "}";
}
 
const body = {
  amount: 100000,
  channel: "BANK_TRANSFER",
  currency: "JPY",
  callbackUrl: "https://merchant.example.com/callbacks/withdraw",
  referenceId: "WD-" + Date.now(),
  playerId: "player_abc123",
  destination: "0005",
  destinationName: "MUFG Bank",
  destinationBranchCode: "001",
  destinationBranchName: "Head Office",
  destinationAccountType: "1",
  destinationAccount: "0987654",
  destinationAccountName: "タナカ ユキ",
  timestamp: Math.floor(Date.now() / 1000),
  nonce: crypto.randomBytes(8).toString("hex"),
};
 
const canonical = canonicalJSON(body);
const signature = crypto.createHmac("sha256", SECRET_KEY).update(canonical).digest("hex");
const res = await fetch(BASE_URL + "/withdraw", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "x-api-key": API_KEY,
    "x-signature": signature,
  },
  body: canonical,
});
console.log(res.status, await res.text());

import hashlib
import hmac
import json
import secrets
import time
import urllib.error
import urllib.request
 
API_KEY = "YOUR_API_KEY"
SECRET_KEY = "YOUR_SECRET_KEY"
BASE_URL = "https://api-sandbox.inspay.dev/merchant"
 
body = {
    "amount": 100000,
    "channel": "BANK_TRANSFER",
    "currency": "JPY",
    "callbackUrl": "https://merchant.example.com/callbacks/withdraw",
    "referenceId": f"WD-{int(time.time())}",
    "playerId": "player_abc123",
    "destination": "0005",
    "destinationName": "MUFG Bank",
    "destinationBranchCode": "001",
    "destinationBranchName": "Head Office",
    "destinationAccountType": "1",
    "destinationAccount": "0987654",
    "destinationAccountName": "タナカ ユキ",
    "timestamp": int(time.time()),
    "nonce": secrets.token_hex(8),
}
payload = {k: str(v) for k, v in body.items() if v is not None}
canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"))
signature = hmac.new(SECRET_KEY.encode(), canonical.encode(), hashlib.sha256).hexdigest()
request = urllib.request.Request(
    BASE_URL + "/withdraw",
    data=canonical.encode(),
    method="POST",
    headers={
        "Content-Type": "application/json",
        "x-api-key": API_KEY,
        "x-signature": signature,
    },
)
try:
    with urllib.request.urlopen(request) as response:
        print(response.status, response.read().decode())
except urllib.error.HTTPError as error:
    print(error.code, error.read().decode())