---
title: "Read deposit status"
method: GET
path: "/api/deposits/{id}"
tags: ["pay"]
---

# Read deposit status

`GET /api/deposits/{id}`

## Request

- Base URL: `https://api.depixapp.com`
- URL: `https://api.depixapp.com/api/deposits/{id}`
- Auth: HTTP bearer

Pay-side status read (ownership enforced — foreign ids are 404). Poll every 5–15 s until a terminal status; `depix_sent` is terminal success. With sk_test_, sandbox_* ids return a fixed synthetic terminal state; any other id is 404 (test keys never read live rows).

## Path parameters

- `id` string, required

## Response `200`

Deposit status.

- union: Deposit status read (stable English subset of the row). Live rows and the fixed synthetic sandbox variant.
  - object: Live deposit row (JWT or sk_live_).
    - `id` string, required: Deposit id (the id returned by POST /api/deposit).
    - `type` 'deposit', required: Resource discriminator — always "deposit" here.
    - `amount_cents` integer, required: Deposit amount in cents (BRL).
    - `status` union, required: Deposit lifecycle status — the enum below is the complete, closed set. `depix_sent` is the terminal SUCCESS state. Terminal states (safe to stop polling): depix_sent, refunded, canceled, expired.
      - 'pending': QR code generated; PIX not paid yet.
      - 'under_review': PIX paid; payment in pre-settlement review.
      - 'pending_pix2fa': PIX paid; waiting for the payer to complete PIX 2FA.
      - 'approved': PIX approved by the provider; DePix not yet sent.
      - 'delayed': Settlement held by the delay policy (new/high-value accounts).
      - 'will_refund': Refund flow started; the deposit will be refunded.
      - 'error': Upstream processing error. NOT terminal — the provider still owes an outcome, so keep polling: the deposit can still reach `depix_sent` or `refunded`.
      - 'depix_sent': TERMINAL — success: DePix delivered to the target Liquid address.
      - 'refunded': TERMINAL — deposit refunded to the payer.
      - 'canceled': TERMINAL — canceled upstream.
      - 'expired': TERMINAL — QR expired unpaid.
    - `created_at` string, required: Creation timestamp (RFC 3339 UTC, `YYYY-MM-DDTHH:MM:SS.sssZ`).
    - `updated_at` string, required: Last update timestamp (RFC 3339 UTC). Only settlement is individually timestamped today, so this equals created_at until depix_sent.
    - `rejection_reasons` string[], required: Provider reasons a deposit was refused/held — e.g. PAYER_MISMATCH, PAST_DAILY_LIMIT, BLOCKED_USER, HIGH_VELOCITY. Empty array when the deposit was not refused. New reason codes may appear; display unknown codes as-is.
  - object: Sandbox synthetic status (sk_test_ key + sandbox_* id): a fixed, stateless terminal success so agents can exercise the full polling loop in test mode. Echoes amount_cents + deterministic timestamps so the shape matches the live variant.
    - `id` string, required: The sandbox_* id passed in the path.
    - `type` 'deposit', required: Resource discriminator — always "deposit" here.
    - `amount_cents` integer, nullable, required: Deposit amount in cents (BRL), decoded from the sandbox_* id minted at creation — mirrors the live read so agents can confirm the value in test mode. null only for legacy/malformed sandbox ids that carry no embedded amount.
    - `status` 'depix_sent', required: Fixed synthetic terminal success state (always depix_sent in sandbox).
    - `created_at` string, required: Deterministic synthetic creation timestamp (RFC 3339 UTC, `YYYY-MM-DDTHH:MM:SS.sssZ`) — fixed in sandbox (stateless).
    - `updated_at` string, required: Deterministic synthetic update timestamp (RFC 3339 UTC, `YYYY-MM-DDTHH:MM:SS.sssZ`) — equals created_at in sandbox.
    - `sandbox` true, required: Marks the synthetic sandbox response.
    - `rejection_reasons` string[], required: Always an empty array in sandbox — the synthetic terminal state is a success, so there is never a reason. Present so agents learn the field's shape in test mode.

## Other responses

- `401`: Missing/invalid credentials. `invalid_api_key` for a failed sk_* lookup (revoked/expired/unknown); `invalid_token` for a bad or missing JWT/Authorization header.
- `403`: The API key lacks the `wallet_read` scope required by this operation. May also be `account_blocked`, or an operation-specific 403 — see the error catalog.
- `404`: Deposit not found — includes rows owned by another account (ownership is never disclosed).
- `429`: Rate limited (per-IP, per-key or per-merchant window). Retry after `retry_after` seconds (also in the Retry-After header).

---

[API](https://skmtc.dev/depixapp/apis/depix-api.md) · [All operations](https://skmtc.dev/depixapp/apis/depix-api/llms.txt) · [OpenAPI document](https://skmtc.dev/depixapp/apis/depix-api/revisions/04094536dd0f?raw)