Payout

const response = await client.request({ id: ctx.id, epoch: ctx.epoch, expiresAt: ctx.expiresAt,
    command: { kind: 'payout', net: 100n, maximumFee: 1n,
      allowPartial: false, goodUntil: ctx.goodUntil } });

({
  kind: 'receipt',
  id: ctx.id,
  digest: recordedIntentDigest,
  policy: approvedPolicyVersion,
  outcome: 'accepted',
  filled: 0n,
  paid: 0n,
  railFees: 0n,
  feeCap: 1n,
  possiblyExposed: false,
  allowPartial: false,
})

({ kind: 'error', code: 'unauthorized' })

const response = await client.request({ id: ctx.id, epoch: ctx.epoch, expiresAt: ctx.expiresAt,
    command: { kind: 'payout', net: 100n, maximumFee: 1n,
      allowPartial: false, goodUntil: ctx.goodUntil } });

({
  kind: 'receipt',
  id: ctx.id,
  digest: recordedIntentDigest,
  policy: approvedPolicyVersion,
  outcome: 'accepted',
  filled: 0n,
  paid: 0n,
  railFees: 0n,
  feeCap: 1n,
  possiblyExposed: false,
  allowPartial: false,
})

({ kind: 'error', code: 'unauthorized' })

Carrier: POST /v1/exchange (encrypted binary). Permission: Owner only. Request net payment to the governed owner token account. The same command is available over WebSocket.

Fields below describe the SDK request before encryption and the decoded reply. The HTTP body is encrypted binary application/octet-stream, not JSON. Use a verified SDK client; the interactive playground is disabled.

const response = await client.request({ id: ctx.id, epoch: ctx.epoch, expiresAt: ctx.expiresAt,
    command: { kind: 'payout', net: 100n, maximumFee: 1n,
      allowPartial: false, goodUntil: ctx.goodUntil } });

({
  kind: 'receipt',
  id: ctx.id,
  digest: recordedIntentDigest,
  policy: approvedPolicyVersion,
  outcome: 'accepted',
  filled: 0n,
  paid: 0n,
  railFees: 0n,
  feeCap: 1n,
  possiblyExposed: false,
  allowPartial: false,
})

({ kind: 'error', code: 'unauthorized' })

Request fields

The client supplies the configured domain, account, policy, signer and verified session binding, and signs the canonical envelope.

Uint8Array (32 bytes)

required

Nonzero private request ID. Retain it for an exact retry; use a distinct ID for a different intent.

bigint (u64)

required

Current account authority epoch.

bigint (u64)

required

Authentication expiry in milliseconds, within the verified session and deployment limits.

"payout"

required

Command discriminator.

bigint (i128)

required

Positive net recipient quote atoms, excluding extra fees.

bigint (i128)

required

Nonnegative maximum additional customer-paid rail fee. net + maximumFee must fit i128.

boolean

required

Explicit consent to deliberately partial dispatch.

bigint (u64)

required

Financial dispatch expiry in milliseconds.

Response fields

The example uses illustrative quote atoms and configured IDs, not live venue data. A receipt records operation progress; acceptance is not execution or payment.

"receipt"

required

Response discriminator.

Uint8Array (32 bytes)

required

Durable operation ID. For an operation lookup, this is the target ID, not the query ID.

Uint8Array (32 bytes)

required

Commitment to the immutable economic intent.

number (u32)

required

Governed policy version.

Outcome

required

rejected, accepted, dispatched, acknowledged, partial, complete or unknown. See lifecycle.

bigint (i64)

required

Actual attributed signed lots, not requested quantity.

bigint (i128)

required

Qualified net payment to the beneficiary, in quote atoms.

bigint (i128)

required

Actual customer-paid payout rail fees; not ordinary trading fees.

bigint (i128)

required

Declared fee cap: absolute requested lots × fee-per-lot for orders, or extra rail-fee cap for payouts. Not the amount charged.

boolean

required

Whether the operation may have escaped for external execution. False alone is not a final settlement guarantee.

boolean

required

The recorded payout partial-dispatch consent. False for unrelated commands.

Behavior

Receipt: paid is qualified beneficiary payment; railFees actual charged customer rail fees; feeCap the declared extra fee cap. Admission reserves net + maximumFee. Acceptance/source debit is not payment. Genuine free collateral may be withdrawn with open positions subject to risk and accessible vault liquidity. No recipient override, arbitrary asset transfer or agent payout; this is not recovery activation.

Errors and reconciliation

Typed errors are returned inside the encrypted reply, not as field-specific HTTP status codes. Invalid fields, expired or out-of-scope authority, conflicting intent IDs and unavailable required evidence fail closed. A delivery error or timeout is not a rejection. Reconnect with fresh attestation and reconcile the original operation ID before any economic retry. See lifecycle, limits and availability.

Overview

Commands

Private reads

WebSocket

Request fields

Response fields

Behavior

Errors and reconciliation

​Request fields

​Response fields

​Behavior

​Errors and reconciliation

Request fields

Response fields

Behavior

Errors and reconciliation