/api/v1/p2p/merchant/wallet/deposit-addressСтейджRead-only: returns the merchant's current active TRC-20 deposit
address used for incoming USDT collateral (topping up the
merchant's operating balance — payouts, withdrawals, and fees; in
PayIn deals clients pay to the traders' payment details, NOT to
this address). tenant_id / merchant_id in the request are
informational — with HMAC authentication the scope is always
resolved from the signed token.
Returns 404 Not Found (problem+json) if the address has not
been issued yet.
Authorization
MerchantToken MerchantSignature MerchantTimestamp The merchant's public token (64 hex characters), issued at onboarding.
In: header
HMAC-SHA256 signature (a single scheme for all endpoints).
Format: t=<unix_seconds>,v1=<hex_hmac_sha256>
where hex_hmac = HMAC-SHA256(webhook_secret, "<unix_seconds>.<raw_body>").
Replay window: 5 minutes (a 60-second drift into the future is allowed).
In: header
Unix time of the request in seconds. Signature window: 5 minutes back / 60 seconds forward.
In: header
Response Body
application/json
application/problem+json
application/problem+json
curl -X GET "https://example.com/api/v1/p2p/merchant/wallet/deposit-address" \ -H "X-Merchant-Token: <MERCHANT_TOKEN>" \ -H "X-Timestamp: <UNIX_TIMESTAMP>" \ -H "X-Signature: t=<UNIX_TIMESTAMP>,v1=<HEX_HMAC_SHA256>"{ "trc20_address": "TYHCiW3XN5sP9cWJ5T4Dfs9Y18h46t9w1a"}{ "type": "../dictionary", "title": "string", "status": 0, "detail": "string", "instance": "../dictionary", "errors": [ { "field": "amount", "message": "must be greater than 0", "code": "POSITIVE_REQUIRED" } ]}{ "type": "about:blank", "title": "Not Found", "status": 404, "detail": "deposit address not provisioned yet — POST /wallet/deposit-address to generate one", "instance": "/api/v1/p2p/merchant/wallet/deposit-address"}Withdraw USDT to a TRC-20 address POST POST
Initiates a USDT withdrawal to the provided TRC-20 address. The synchronous `status` is COMPLETED (auto-approval: the on-chain transaction has been sent to broadcast) or PENDING_MANUAL (admin approval queue — MANUAL_ONLY policy or an amount above the current auto-limit). Insufficient balance — failed precondition → HTTP 400 (not 402). Idempotency is guaranteed server-side (a deterministic key of merchant + address + amount + current fee).
Issue (or rotate) the merchant TRC-20 deposit address POST POST
Generates (first call) or rotates (subsequent calls) the merchant's TRC-20 deposit address for incoming USDT collateral. The scope is resolved from the authenticated merchant context (the canonical path, without `merchant_id` in the path). Atomically takes the next BIP44 derivation index, derives the address via tron-wallet-api, and stores the address + index in the merchant record. Rotation semantics: the new address immediately replaces the old one in the merchant record, while every previously issued address forever remains in the platform's eternal block-polling set — USDT sent to a replaced address is still detected and credited. Legacy alias with administrative impersonation: `POST /api/v1/p2p/merchants/{merchant_id}/deposit-address`.