Verify

Authorizations

Authorization

string

header

required

All requests must be authenticated using an HMAC-signed Authorization header. Ingo Money requires HMAC-SHA512 for all new integrations. SHA-512 provides a significantly larger internal state and output length than SHA-256, making it substantially more resistant to length-extension attacks and brute-force preimage attempts — properties that matter for financial API traffic where each request authorizes a real money movement.

Legacy integrations using HMAC-SHA256 remain supported but are encouraged to upgrade. SHA-256 continues to meet the current minimum security bar; however, upgrading to SHA-512 eliminates an entire class of potential vulnerabilities before they become exploitable, and aligns with NIST guidance recommending SHA-2 family algorithms with 256-bit security strength or greater for long-term use. Contact your Ingo integration manager to coordinate an algorithm upgrade.

MD5 and SHA-1 are not accepted under any circumstances. Requests signed with either algorithm will be rejected.

Authorization header format:

Authorization: hmac username="YOUR_HMAC_USERNAME", algorithm="hmac-sha512", headers="request-line x-date content-type content-length content-sha512", signature="BASE64_SIGNATURE"

Credentials provisioned by your Ingo integration manager:

HMAC username — identifies your integration in the Authorization header username field. Distinct from your participant identifier.
HMAC secret — provisioned by your Ingo integration manager. The private key used to compute the signature. Never transmit this value — store it in a secrets manager or environment variable, never in source code.
Participant identifier — a separate value used to identify your account within the API request payload. The name and placement differs by product family. Both the HMAC username and participant identifier are provisioned at onboarding — do not substitute one for the other.
API key — required for select product families as an additional per-request credential. See product-specific documentation for applicability.

See the Ingo API Authentication Guide for the complete string-to-sign construction, body hashing requirements, and timestamp validation rules.

Body

application/json

participant_id

integer

required

Unique participant identifier assigned by Ingo.

Example:

12345

account_type

enum<string>

required

Always CK for check by mail transactions.

Available options:

CK

Minimum string length: 1

Example:

"CK"

recipient

object

required

Information about the recipient (payee) of the check — used for the pay-to line and mailing address. Required when recipient_is_beneficiary = 0. When recipient_is_beneficiary = 1, this object is auto-populated from beneficiary fields and may be omitted.

Hide child attributes

recipient.recipient_line1

string

required

Recipient / Pay To line 1 for the check and the mailing.

Required string length: 1 - 75

Example:

"Ace Ventura"

recipient.recipient_address1

string

required

Remittance address line 1 for the mailing.

Required string length: 1 - 40

Example:

"123 Main St."

recipient.recipient_city

string

required

Remittance city for the mailing.

Required string length: 1 - 25

Example:

"Atlanta"

recipient.recipient_state

string

required

Remittance state for the mailing (standard US postal abbreviation).

Required string length: 2

Pattern:

^(?:A[LKSZRAEP]|C[AOT]|D[EC]|F[LM]|G[AU]|HI|I[ADLN]|K[SY]|LA|M[ADEHINOPST]|N[CDEHJMVY]|O[HKR]|P[ARW]|RI|S[CD]|T[NX]|UT|V[AIT]|W[AIVY])$

Example:

"GA"

recipient.recipient_zip

string

required

Remittance zip for the mailing. 5-digit zip or zip+4 in xxxxx-xxxx format.

Maximum string length: 10

Pattern: ^[0-9]{5}(?:-[0-9]{4})?$

Example:

"30033"

recipient.recipient_line2

string | null

Optional recipient / Pay To line 2 for the check and the mailing.

Maximum string length: 75

Example:

"c/o Pet Detective Agency"

recipient.recipient_address2

string | null

Optional remittance address line 2 for the mailing.

Maximum string length: 40

Example:

"Apt 3"

recipient.recipient_phone

string | null

Recipient phone number.

Maximum string length: 25

Example:

"5551234567"

recipient_is_beneficiary

enum<integer>

required

Flag indicating whether the recipient is the beneficiary. 1 = Recipient is the beneficiary (default). 0 = Recipient is not the beneficiary — a separate recipient mailing address must be provided.

Available options:

0,

1

Example:

1

beneficiary

object

required

Information about the beneficiary associated with the payment. Only persistent data should be provided — data that can be used again for payments on the same account. All information provided is included in the remittance data printed and sent with the check. When recipient_is_beneficiary = 1, this information is also used for the pay-to line and mailing address.

Hide child attributes

beneficiary.beneficiary_account

string

required

Account number or other identifier used to ensure the payment is applied to the correct beneficiary account. Should be a value that can be used on repeat or subsequent payments with the same generated customer_account_token.

Required string length: 1 - 30

Example:

"3000000038"

beneficiary.beneficiary_first_name

string

required

First name of person associated with the beneficiary account.

Required string length: 1 - 30

Example:

"Ace"

beneficiary.beneficiary_last_name

string

required

Last name of person associated with the beneficiary account.

Required string length: 1 - 30

Example:

"Ventura"

beneficiary.beneficiary_address1

string

required

Beneficiary address line 1.

Required string length: 1 - 40

Example:

"123 Main St."

beneficiary.beneficiary_city

string

required

Beneficiary city.

Required string length: 1 - 25

Example:

"Atlanta"

beneficiary.beneficiary_state

string

required

Beneficiary state (standard US postal abbreviation).

Required string length: 2

Pattern:

^(?:A[LKSZRAEP]|C[AOT]|D[EC]|F[LM]|G[AU]|HI|I[ADLN]|K[SY]|LA|M[ADEHINOPST]|N[CDEHJMVY]|O[HKR]|P[ARW]|RI|S[CD]|T[NX]|UT|V[AIT]|W[AIVY])$

Example:

"GA"

beneficiary.beneficiary_zip

string

required

Beneficiary zip. 5-digit zip or zip+4 in xxxxx-xxxx format.

Required string length: 1 - 10

Pattern: ^[0-9]{5}(?:-[0-9]{4})?$

Example:

"30033"

beneficiary.beneficiary_company

string | null

Optional company name of business associated with the beneficiary account.

Maximum string length: 75

Example:

null

beneficiary.beneficiary_address2

string | null

Optional beneficiary address line 2.

Maximum string length: 40

Example:

"Apt 3"

beneficiary.beneficiary_phone

string | null

Phone number associated with the beneficiary.

Maximum string length: 25

Example:

"5551234567"

beneficiary.beneficiary_email

string | null

Email address associated with the beneficiary.

Maximum string length: 60

Example:

"ace.ventura@example.com"

beneficiary.customer_account_token

string

Alternative to raw beneficiary data when the account was previously tokenized. If provided, beneficiary_account and beneficiary identification fields are not required.

Required string length: 1 - 255

Example:

"6218c726-3989-40ab-af84-fa6f4c932cb6"

participant_unique_id1

string

required

Participant assigned ID to be associated with customer_account_token creation. Should correlate to participant assigned values affiliated with future process requests for tracking purposes (e.g. CustomerID or AccountID). Must not contain NPI data.

Required string length: 1 - 255

Example:

"35a792a5-39e6-46fa-add1-419a75d3aa9a"

timestamp

integer<int64>

required

Unix timestamp of the request.

Example:

1597862420

version

integer

required

API version of the request. Current version is 11.

Example:

11

participant_unique_id2

string | null

Optional second participant assigned ID. Should be carried forward to future process requests for tracking purposes. Must not contain NPI data.

Maximum string length: 255

Example:

"2d4ebd46-616b-4212-bc54-1f7f68514e1a"

store_id

string | null

Client assigned store ID. Required for Retail client participants.

Maximum string length: 255

Example:

"STORE-001"

terminal_id

string | null

Client assigned terminal ID. Required for Retail client participants.

Maximum string length: 255

Example:

"TERM-042"

clerk_id

string | null

Client assigned clerk ID. Required for Retail client participants.

Maximum string length: 255

Example:

"CLK-007"

Response

Verification successful — token returned

status

integer

Numeric code describing the status of the API request. 100 = Success.

Example:

100

client_message

string

Text description associated with the status code.

Example:

"Success"

data

object

Hide child attributes

data.customer_account_token

string

GUID — unique value generated based upon account and recipient data. Use this token in all subsequent Process requests for this account.

Example:

"6218c726-3989-40ab-af84-fa6f4c932cb6"

data.last_4

string

The last 4 digits of the beneficiary_account value.

Example:

"0038"

data.estimated_posting_date

string

Estimated posting date of the payment.

Example:

"08/29/2020"

data.estimated_posting_time

string

Estimated posting time narrative.

Example:

"Payment will post 7-10 Days"

data.participant_unique_id1

string

Echo of participant assigned ID for the verify request.

Example:

"35a792a5-39e6-46fa-add1-419a75d3aa9a"

data.participant_unique_id2

string | null

Echo of optional second participant assigned ID for the verify request.

Example:

"2d4ebd46-616b-4212-bc54-1f7f68514e1a"

data.request_timestamp

integer<int64>

Unix timestamp of the request.

Example:

1597867738

time

string

Time in seconds to complete the request.

Example:

"1.4295"

Overview

Process

Debit

Risk

Ancillary

Webhooks

Verify — Check by Mail

Authorizations

Body

Response

Overview

Verify

Process

Debit

Risk

Ancillary

Webhooks

Documentation Index

Authorizations

Body

Response