Deriv API
Documentation
Payment Agent

Withdrawal Verification Code

PostAuth required

Requests a one-time verification code be sent to the client's registered contact (email or phone). Call this before submitting a withdrawal via POST /payment-agents/v1/withdraw - the code must be included as verification_code in that request. The code is valid until expires_at (epoch seconds). A new code cannot be requested before next_request_at (epoch seconds). The same agent-eligibility and business-rule checks that guard POST /payment-agents/v1/withdraw also run here - if this request succeeds, the subsequent withdrawal won't fail those checks. See the 400 response for the full list of error codes.

Endpoint

Post/payment-agents/v1/withdraw/verification_code

Base URL: https://api.derivws.com

Status Codes

200OK - Verification code dispatched. Returns next_request_at and expires_at.
400Bad request - One of: InvalidAgentID, AgentIDNotFound, AgentInactive, AgentSelfWithdraw, AgentCurrencyUnsupported, ClientCountryUnsupported, WithdrawalAmountMinimum, WithdrawalAmountMaximum, DailyWithdrawalCountLimit, DailyWithdrawalAmountLimit, InvalidCurrency, InvalidAmount, OtpRateLimitExceeded, InputError, ClientWithdrawDisabled, AgentDepositDisabled.
401Unauthorized - Invalid or missing authentication.
403Forbidden - Valid token but insufficient scope (payment scope required).
500Internal server error - One of: VerificationCodeRequestFailed, InternalError.
504Gateway timeout - Upstream service unavailable.

Error Responses

400Bad request - rate limit exceeded
{
  "data": {},
  "errors": [
    {
      "status": 400,
      "code": "OtpRateLimitExceeded",
      "detail": {
        "message": "Too many OTP requests. Please try again later.",
        "next_request_at": 1781547816
      }
    }
  ],
  "metadata": {
    "endpoint": "/payment-agents/v1/withdraw/verification_code",
    "method": "POST",
    "timing": 11
  }
}

About Withdrawal Verification Code

The POST /payment-agents/v1/withdraw/verification_code endpoint: Requests a one-time verification code be sent to the client's registered contact (email or phone). Call this before submitting a withdrawal via POST /payment-agents/v1/withdraw - the code must be included as verification_code in that request. The code is valid until expires_at (epoch seconds). A new code cannot be requested before next_request_at (epoch seconds). The same agent-eligibility and business-rule checks that guard POST /payment-agents/v1/withdraw also run here - if this request succeeds, the subsequent withdrawal won't fail those checks. See the 400 response for the full list of error codes.

Click to open live chat support. Get instant help from our support team.