Initiate transfer funds between financial accounts with OTP

Initiate Transfer Funds Between Financial Accounts with OTP

This endpoint transfers funds between financial accounts with an added layer of security via OTP (One-Time Password) authentication. It supports transfers between a user's own accounts, and for business customers, between a user's account and another Netevia account. Each transfer produces a unique transaction ID for tracking and reconciliation.

Endpoint

POST /api/fundsMovement/v2/BetweenAccounts

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when a user needs to move funds between two financial accounts and must verify the action with an OTP before the transfer is processed. This is the appropriate endpoint when security policies require step-up authentication for fund movements, such as transfers above a threshold or first-time transfers between accounts. It is suitable for both personal and business account transfers where the source and destination account IDs are known.

Request Body

{
  "fromFinancialAccountId": "fa_source_abc123",
  "toFinancialAccountId": "fa_destination_xyz789",
  "amount": 25000,
  "currencyCode": 840,
  "memo": "Rent payment Q2",
  "oneTimeCode": "847291",
  "secureOperationType": "ShortMessageCode"
}

Response

200 OK

{
  "transactionId": "txn_a1b2c3d4e5f6",
  "status": "Completed",
  "confirmationNumber": "CONF-20260608-001"
}

Error Codes

Common Mistakes

• Sending amount as a decimal (e.g., 250.00) instead of an integer in the smallest currency unit (e.g., 25000 for $250.00)
• Providing a oneTimeCode that is not exactly 6 numeric digits — the pattern ^\d{6}$ is strictly enforced
• Using an unsupported value for secureOperationType — only ShortMessageCode, TimeBasedCode, and LegacyTimeBasedCode are accepted
• Including special characters in memo — only word characters, periods, and spaces match the allowed pattern [\w. ]+
• Attempting the transfer after the OTP has expired — OTPs are time-sensitive; request a new code if the previous one is no longer valid

Related Endpoints

• POST /api/fundsMovement/v2/BetweenAccounts — this endpoint (OTP-secured between-accounts transfer)
• POST /api/auth/v2 — obtain a Bearer token for authentication
• POST /api/auth/refresh — refresh an expiring Bearer token

Example

curl -X POST https://api.banking.netevia.dev/api/fundsMovement/v2/BetweenAccounts \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "fromFinancialAccountId": "fa_source_abc123",
    "toFinancialAccountId": "fa_destination_xyz789",
    "amount": 25000,
    "currencyCode": 840,
    "memo": "Rent payment Q2",
    "oneTimeCode": "847291",
    "secureOperationType": "ShortMessageCode"
  }'