Preview

Verify receiver endpoints

POST
/providers/{providerID}/endpoint-verifications

Check each configured receiver endpoint for your provider. Moov Money sends one test request to each authorize, capture, release, and credit endpoint. The check moves no funds and does not identify a participant. You can call this while your affiliation with the provider is still being set up.

Returns 200 with a result for each of the four receiver operations. Returns 400 when providerID is malformed. Returns 401 when your API key or bearer token is missing or invalid. Returns 403 when you cannot act for the provider in the path.

Auth: API key or bearer token. An affiliated integrator needs the moov-money-config.write scope granted by the FI.

Request
cURL
curl -X POST https://api.moov.money/providers/{providerID}/endpoint-verifications \
  -u "$MOOV_API_KEY_ID:$MOOV_API_KEY_SECRET" \
  -H "X-Moov-Version: v2026.10.00"
Responses
200 400 401 403
The request completed successfully.
{
  "endpointVerifications": [
    {
      "configurationVersion": 3,
      "envelopeValid": true,
      "latencyMs": 42,
      "operation": "authorize",
      "reachable": true,
      "reason": "unreachable",
      "responseValid": true,
      "signingSecretID": "5f0c3b2a-8d4e-4b7a-9c1f-2e6d7a8b9c0d",
      "verifiedOn": "2026-10-19T15:00:00Z"
    }
  ]
}
Malformed request: the body or headers failed validation.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.
Authentication missing, invalid, or insufficient.
Authentication present but the action is forbidden for this principal/claim.

Headers

X-Moov-Version

string
Set this header to the API version being targeted (e.g. v2026.10.00). When omitted, the server applies its default version.

Path parameters

providerID

string required
Your provider account ID.

Response

Results from checking each provider receiver operation.

endpointVerifications

array<object> required
One result for each receiver operation: authorize, capture, release, and credit.
Show child attributes

endpointVerifications[]

operation

string<enum> required
The receiver operation that was checked.
Possible values: authorize, capture, release, credit

reachable

boolean required
Whether Moov Money reached the receiver endpoint.

envelopeValid

boolean required
Whether the receiver returned a valid encrypted response envelope.

responseValid

boolean required
Whether the response matched the test request.

latencyMs

integer<int64> required
Time taken to check the endpoint, in milliseconds.

configurationVersion

integer<int64> required
Configuration version used for this check. A result is stale after the endpoint configuration changes.

signingSecretID

string required
Signing secret ID used for this check. A result is stale after the signing secret changes.

verifiedOn

string<date-time> required
Time when Moov Money ran this check.

reason

string<enum>
Failure reason code. Omitted when the check succeeds.
Possible values: not_configured, credential_pending, token_failure, unreachable, receiver_rejected_test_request, not_decryptable, echo_mismatch, non_200_status, key_unavailable, request_failure