Verify

Authorizations

Authorization

string

header

required

All requests must be authenticated using an HMAC-signed Authorization header. Ingo Money requires HMAC-SHA512 for all new integrations. SHA-512 provides a significantly larger internal state and output length than SHA-256, making it substantially more resistant to length-extension attacks and brute-force preimage attempts — properties that matter for financial API traffic where each request authorizes a real money movement.

Legacy integrations using HMAC-SHA256 remain supported but are encouraged to upgrade. SHA-256 continues to meet the current minimum security bar; however, upgrading to SHA-512 eliminates an entire class of potential vulnerabilities before they become exploitable, and aligns with NIST guidance recommending SHA-2 family algorithms with 256-bit security strength or greater for long-term use. Contact your Ingo integration manager to coordinate an algorithm upgrade.

MD5 and SHA-1 are not accepted under any circumstances. Requests signed with either algorithm will be rejected.

Authorization header format:

Authorization: hmac username="YOUR_HMAC_USERNAME", algorithm="hmac-sha512", headers="request-line x-date content-type content-length content-sha512", signature="BASE64_SIGNATURE"

Credentials provisioned by your Ingo integration manager:

HMAC username — identifies your integration in the Authorization header username field. Distinct from your participant identifier.
HMAC secret — provisioned by your Ingo integration manager. The private key used to compute the signature. Never transmit this value — store it in a secrets manager or environment variable, never in source code.
Participant identifier — a separate value used to identify your account within the API request payload. The name and placement differs by product family. Both the HMAC username and participant identifier are provisioned at onboarding — do not substitute one for the other.
API key — required for select product families as an additional per-request credential. See product-specific documentation for applicability.

See the Ingo API Authentication Guide for the complete string-to-sign construction, body hashing requirements, and timestamp validation rules.

Body

application/json

Exactly one of the following groupings must be provided: (1) customer_account_token, (2) third_party_token, or (3) raw card fields — account, recipient_first_name, recipient_last_name, recipient_address1, recipient_city, recipient_state, recipient_zip.

participant_id

integer

required

Unique participant identifier assigned by Ingo.

Example:

12345

account_type

enum<string>

required

Always CA for card-based (debit or credit) transactions.

Available options:

CA

Minimum string length: 1

Example:

"CA"

participant_unique_id1

string

required

Participant assigned ID to be associated with customer_account_token creation. Should correlate to participant assigned values affiliated with future process requests for tracking purposes (e.g. CustomerID or AccountID). Must not contain NPI data.

Required string length: 1 - 255

Example:

"1f2739ed-3531-4af2-ae36-e6faf7936462"

timestamp

integer<int64>

required

Unix timestamp of the request.

Example:

1576097158

version

integer

required

API version of the request. Current version is 11.

Example:

11

customer_account_token

string

Alternative to raw card data when the account was previously tokenized. If provided, third_party_token and all raw card fields (account, expiration_date, recipient_first_name, recipient_last_name, recipient_address1, recipient_address2, recipient_city, recipient_state, recipient_zip) must be omitted.

Required string length: 1 - 255

Example:

"ca875cce-58c0-46a0-8f14-676190cc7df6"

third_party_token

object

Contains data about an optional third-party account token. If provided, customer_account_token and raw card fields (account, expiration_date, cvv) must be omitted. Only permitted if the client is configured for third-party token use.

Hide child attributes

third_party_token.provider

string

required

Ingo-provided identifier for the third-party tokenization service provider.

Maximum string length: 3

Example:

"1"

third_party_token.token

string

required

Third-party account token. To be de-tokenized; its associated account data is then used to create an Ingo account token.

Required string length: 1 - 100

Example:

"tok_3rdparty_abc123xyz"

amount

number<float> | null

Dollar amount of disbursement. Max value determined by participant velocity limits.

Required range: x >= 0.01

Example:

1010.5

recipient_first_name

string

Recipient first name. Required unless customer_account_token is provided. Must be omitted if customer_account_token is provided.

Required string length: 1 - 255

Example:

"Johnny"

recipient_last_name

string

Recipient last name. Required unless customer_account_token is provided. Must be omitted if customer_account_token is provided.

Required string length: 1 - 255

Example:

"Rockets"

recipient_business_name

string | null

Optional recipient business name.

Maximum string length: 150

Example:

"Rockets LLC"

account

string

Card account number. Required unless customer_account_token or third_party_token is provided. Must be omitted if either token is provided.

Required string length: 1 - 255

Example:

"4111111111111111"

expiration_date

string | null

Card expiration date in YYMM format. Conditionally required based on client configuration (expiration_date_enabled). Not required if customer_account_token or third_party_token is provided.

Maximum string length: 4

Pattern: ^[0-9]{2}(0[1-9]|1[0-2])$

Example:

"2612"

cvv

string | null

CVV value (3–4 digits depending on card type). Conditionally required based on client configuration (cvv_enabled). Never required if customer_account_token or third_party_token is provided.

Pattern: ^[0-9]{3,4}$

Example:

"123"

recipient_address1

string

Recipient billing address line 1. Required unless customer_account_token is provided.

Required string length: 1 - 255

Example:

"123 Main St"

recipient_address2

string | null

Recipient billing address line 2.

Maximum string length: 255

Example:

"Apt 2"

recipient_city

string

Recipient billing city. Required unless customer_account_token is provided.

Required string length: 1 - 255

Example:

"Atlanta"

recipient_state

string

Recipient billing state (standard US postal abbreviation). Required unless customer_account_token is provided.

Required string length: 2

Pattern:

^(?:A[LKSZRAEP]|C[AOT]|D[EC]|F[LM]|G[AU]|HI|I[ADLN]|K[SY]|LA|M[ADEHINOPST]|N[CDEHJMVY]|O[HKR]|P[ARW]|RI|S[CD]|T[NX]|UT|V[AIT]|W[AIVY])$

Example:

"GA"

recipient_zip

string

Recipient billing zip code. 5-digit zip or zip+4 in xxxxx-xxxx format. Required unless customer_account_token is provided.

Maximum string length: 10

Pattern: ^[0-9]{5}(?:-[0-9]{4})?$

Example:

"30313"

recipient_phone

string | null

10-digit recipient phone number.

Maximum string length: 10

Example:

"1231231234"

participant_unique_id2

string | null

Optional second participant assigned ID to be associated with customer_account_token creation. Should be carried forward to future process requests for tracking purposes. Must not contain NPI data.

Maximum string length: 255

Example:

"90759390-01c7-47e7-8a90-6faa89b18ff6"

store_id

string | null

Client assigned store ID. Required for Retail client participants.

Maximum string length: 255

Example:

"STORE-001"

terminal_id

string | null

Client assigned terminal ID. Required for Retail client participants.

Maximum string length: 255

Example:

"TERM-042"

clerk_id

string | null

Client assigned clerk ID. Required for Retail client participants.

Maximum string length: 255

Example:

"CLK-007"

Response

Verification successful — token returned

status

integer

Numeric code describing the status of the API request. 100 = Success.

Example:

100

client_message

string

Text description associated with the status code.

Example:

"Success"

data

object

Hide child attributes

data.customer_account_token

string

GUID — unique value generated based upon account and recipient data. Use this token in all subsequent Process requests for this account.

Example:

"ca875cce-58c0-46a0-8f14-676190cc7df6"

data.last_4

string

The last 4 digits of the card.

Example:

"1111"

data.request_timestamp

integer<int64>

Unix timestamp of the request.

Example:

1576097360

data.issuers

object[]

Information about the issuer of the card.

Hide child attributes

data.issuers.payee_id

string

The Ingo assigned ID for the payee.

Example:

"526263"

data.issuers.payee_name

string

Name of the payee (issuer).

Example:

"Bank of America - Platinum MasterCard and Visa"

data.issuers.payee_address

string | null

Payee address.

Example:

"PO Box 15019"

data.issuers.payee_city

string | null

Payee city.

Example:

"Wilmington"

data.issuers.payee_state

string | null

Payee state.

Example:

"DE"

data.issuers.payee_zip

string | null

Payee zip code.

Example:

"19850-5019"

data.issuers.credit_info

object

Information regarding limits for push (credit to card) transactions. Returned if participant is enabled for push and card is enabled for push processing.

Hide child attributes

data.issuers.credit_info.min

string

Minimum amount issuer will accept for a push transaction.

Example:

"0.05"

data.issuers.credit_info.max

string

Maximum amount issuer will accept for a push transaction.

Example:

"1500.00"

data.issuers.credit_info.card_type

string

The type of card (e.g. Debit, Prepaid).

Example:

"Debit"

data.issuers.credit_info.estimated_posting_time

string

Estimated posting time narrative.

Example:

"Payment will post within 5 minutes."

data.issuers.credit_info.estimated_posting_date

string

Estimated posting date in date format.

Example:

"04/21/2026"

data.issuers.debit_info

object

Information regarding limits for pull (debit from card) transactions. Returned if participant is enabled for pull and card is enabled for pull processing.

Hide child attributes

data.issuers.debit_info.min

string

Minimum amount issuer will accept for a pull transaction.

Example:

"0.05"

data.issuers.debit_info.max

string

Maximum amount issuer will accept for a pull transaction.

Example:

"1500.00"

data.issuers.debit_info.card_type

string

The type of card (e.g. Debit, Prepaid).

Example:

"Debit"

data.issuers.issuing_network

string

Information regarding the issuing network of the card.

Example:

"Visa"

data.issuers.credit_enabled

enum<integer>

Whether the card is enabled for push (credit) transactions. 1 = Enabled, 0 = Not enabled.

Available options:

0,

1

Example:

1

data.issuers.debit_enabled

enum<integer>

Whether the card is enabled for pull (debit) transactions. 1 = Enabled, 0 = Not enabled.

Available options:

0,

1

Example:

0

data.issuers.network_validation

object

Reference data from network card validation. Present when network validation was performed for this account.

Hide child attributes

data.issuers.network_validation.validation_provider_id

string

Card validation service provider. 1 = Visa, 3 = MasterCard.

Maximum string length: 3

Example:

"1"

data.issuers.network_validation.name_validation

object

Name match validation results.

Hide child attributes

data.issuers.network_validation.name_validation.name_match_status

string

Whether name match was performed. 1 = Performed, 2 = Not performed, 3 = Not supported by provider, 4 = Client not configured.

Maximum string length: 3

data.issuers.network_validation.name_validation.name_match_decision

string | null

Overall name match result. 1 = Match, 2 = Partial Match, 3 = No Match.

Maximum string length: 3

data.issuers.network_validation.name_validation.first_name_match_decision

string | null

First name match result. 1 = Match, 2 = Partial Match, 3 = No Match.

Maximum string length: 3

data.issuers.network_validation.name_validation.last_name_match_decision

string | null

Last name match result. 1 = Match, 2 = Partial Match, 3 = No Match.

Maximum string length: 3

data.issuers.network_validation.name_validation.middle_name_match_decision

string | null

Middle name match result. 1 = Match, 2 = Partial Match, 3 = No Match.

Maximum string length: 3

data.participant_unique_id1

string

Echo of participant assigned ID for the verify request.

Example:

"1f2739ed-3531-4af2-ae36-e6faf7936462"

data.participant_unique_id2

string | null

Echo of optional second participant assigned ID for the verify request.

Example:

"90759390-01c7-47e7-8a90-6faa89b18ff6"

data.expiration_date

string

Expiration date of the card associated with the customer_account_token in YYMM format. Retain this to provide expiration alerts to the cardholder.

Example:

"2612"

data.count

integer

Always returns 1.

Example:

1

time

string

Time in seconds to complete the request.

Example:

"2.4505"

Overview

Process

Debit

Risk

Ancillary

Webhooks

Verify — Card

Authorizations

Body

Response

Overview

Verify

Process

Debit

Risk

Ancillary

Webhooks

Documentation Index

Authorizations

Body

Response