Transfer quotes

The payer API 0.8 and generated PayerTransfersApi expose optional synthetic quote preparation. The identity service must have this feature explicitly enabled and connected to its private switch peer. A verified link proves source ownership; a quote grants no debit authority. This version collects no payment consent and sends no issuer approval request.

The payer API runs only in the local sandbox: the hosted sandbox does not serve it yet.

Send source_account_id, recipient_institution, recipient_selector, currency and amount_minor to POST /v1/payer/transfer-quotes with an active DPoP session, a fresh proof and an Idempotency-Key UUID. The source must belong to the payer, be VERIFIED and use the same currency. A REVIEW_REQUIRED account is refused, including when an older quote is read again.

Amounts are exact decimal strings in minor units, from 1 through 9000000000000; CDF values must be divisible by 100. Institutions are sim-bank and sim-wallet. Synthetic recipient selectors are synthetic-recipient-matched, synthetic-recipient-unavailable, synthetic-recipient-cdf-only and synthetic-recipient-usd-only. These fixtures are not a live recipient directory. Live fees, KYC limits and available balances are not represented.

The result contains quote, status (CURRENT or EXPIRED) and sandbox: true. Present the principal, fees, total and currency exactly. An UNAVAILABLE name check requires masked_name: null and acknowledgement_required: true; this operation does not collect that consent yet. It never bypasses an incompatible currency or an exceeded limit.

Retain the original logical mutation UUID and exact body when retrying, including after 503 QUOTE_OUTCOME_UNKNOWN. Generate fresh DPoP for every attempt and handle a returned nonce challenge. An exact retry recovers the original quote and deadline; changed bodies conflict. A new key requests a new preview and consumes a creation budget. Never present a timeout as a successful quote or a completed transfer.

GET /v1/payer/transfer-quotes/{id} is a passive read. Only the original payer, device and session, while active, can read the quote. A new session on the same device receives 404. Expired quotes stay readable as EXPIRED; reads and retries never extend the deadline or the session’s idle time.

Synthetic source evidence lasts at most 30 seconds, further bounded by session deadlines; the preview keeps the earliest evidence expiry. The original source snapshot deadline is immutable across retries. If the switch never retained a quote before it expired, a new logical request/key is needed; a retained quote can still be recovered as expired. Local budgets allow ten new intents per payer/minute and sixty/hour, plus ten unresolved dispatch attempts per intent/hour. These are sandbox request budgets, not approved financial limits. Separate explicit payment consent, issuer approval, reservations and debit/credit/reversal orchestration follow under later contracts.

The generated SDK retains amounts as strings and nullable name results. It does not sign DPoP or replace runtime validation. Android continues to use Retrofit, Room and Hilt; iOS owns its own native implementation.