---
title: "Withdrawal transitioned to unsent"
method: POST
path: "withdraw.unsent"
---

# Withdrawal transitioned to unsent

`POST withdraw.unsent` (webhook)

Withdrawal awaiting the DePix transfer (initial state). Creation does not emit a webhook; this event fires only on a reversal back to this state. Fires ONLY for operations attributed to an API key (human/SPA operations never dispatch) and only when the merchant has a default callback URL configured. Sandbox (sk_test_) operations create no rows, so they never fire webhooks. Outbound POST to the merchant's callback URL, signed with `X-DePix-Signature: t=<unix ts>,v1=<hex hmac-sha256>` where the HMAC is computed over `"${t}.${raw body}"` with the merchant webhook secret. Verify the signature and reject stale timestamps. Delivery is retried on failure: immediate → 1m → 10m → 1h → 4h → 12h (max 6 attempts); use `data.event_id` to deduplicate. Respond with any 2xx quickly to acknowledge.

## Headers

- `X-DePix-Signature` string, required
- `X-DePix-Event-Id` string, required

## Payload

- object: Envelope of the withdraw.unsent event.
  - `event` 'withdraw.unsent', required: Event name — fixed for this webhook.
  - `data` WithdrawalWebhookData, required: Withdrawal event payload — same EN shape as GET /api/withdrawals/{id}, plus the delivery id.
    - `id` string, required: Withdrawal id (the withdrawalId returned by POST /api/withdraw).
    - `type` 'withdraw', required: Resource discriminator — always "withdraw".
    - `amount_cents` integer, required: Provider-side deposit amount in cents.
    - `status` union, required: Withdrawal lifecycle status — the enum below is the complete, closed set. `sent` is the terminal SUCCESS state. Sandbox status reads return the sandbox-only synthetic value `confirmed` instead (see the sandbox response variant). Terminal states (safe to stop polling): sent, refunded, cancelled, expired.
      - 'unsent': Created; DePix not yet received by the provider.
      - 'sending': DePix received; PIX payout in flight.
      - 'error': The DePix arrived and the PIX payout failed. NOT terminal — the provider holds the funds and still owes an outcome, so keep polling: the withdrawal can still reach `sent` (payout retried) or `refunded`.
      - 'sent': TERMINAL — success: PIX delivered to the target key.
      - 'refunded': TERMINAL — refunded.
      - 'cancelled': TERMINAL — cancelled.
      - 'expired': TERMINAL — DePix never arrived (swept by cron).
    - `created_at` string, required: Creation timestamp (RFC 3339 UTC).
    - `updated_at` string, required: Last update timestamp (RFC 3339 UTC).
    - `liquid_txid` string: Settlement Liquid txid (the provider-reported on-chain tx that funded the withdrawal) — present once the provider reports it.
    - `event_id` string, required: Stable delivery id (evt_*) — identical across retries of the same event; use it for deduplication. Also sent as the X-DePix-Event-Id header.

## Acknowledgement `200`

Any 2xx acknowledges the delivery; anything else (or a timeout) schedules a retry.

---

[API](https://skmtc.dev/depixapp/apis/depix-api.md) · [All operations](https://skmtc.dev/depixapp/apis/depix-api/llms.txt) · [OpenAPI document](https://skmtc.dev/depixapp/apis/depix-api/revisions/04094536dd0f?raw)