FleexPay API Reference

Introduction

The FleexPay API — operated by ISLA-MIA Blockchain Solutions LLC — gives approved wholesale partners programmatic access to custodial, exchange and blockchain infrastructure services. All access is restricted to partners who have completed KYB onboarding.

ℹ

Institutional access only. Credentials are issued to approved partners only. To apply: [email protected]

Protocol

HTTPS REST. JSON request and response bodies. TLS 1.2+ required on all connections.

Content-Type

All requests must send Content-Type: application/json. Responses are always JSON.

Timestamps

ISO 8601 UTC throughout. Example: 2026-05-23T14:30:00.000Z

Amounts

All monetary and crypto amounts are strings to avoid float precision loss. E.g. "1.50000000"

Idempotency

POST requests accept Idempotency-Key: <uuid-v4>. Duplicate keys return the original response safely.

Security

Authentication

Every request must carry three headers. We use API key + HMAC-SHA256 request signing — no OAuth, no sessions.

FP-API-Key

Your public API key. Format: fpk_live_xxx (production) or fpk_test_xxx (sandbox).

FP-Timestamp

Unix timestamp in milliseconds at request time. Requests outside ±30 s are rejected.

FP-Signature

HMAC-SHA256 hex digest of: timestamp + METHOD + path + rawBody using your secret.

const crypto = require('crypto');

const API_KEY    = 'fpk_live_your_key';
const API_SECRET = 'your_secret';

function sign(method, path, body = '') {
  const ts  = Date.now().toString();
  const sig = crypto
    .createHmac('sha256', API_SECRET)
    .update(ts + method.toUpperCase() + path + body)
    .digest('hex');
  return {
    'FP-API-Key'   : API_KEY,
    'FP-Timestamp' : ts,
    'FP-Signature' : sig,
    'Content-Type' : 'application/json'
  };
}

import hmac, hashlib, time, requests

API_KEY    = 'fpk_live_your_key'
API_SECRET = 'your_secret'

def sign(method, path, body=''):
    ts  = str(int(time.time() * 1000))
    sig = hmac.new(
        API_SECRET.encode(), (ts + method + path + body).encode(), hashlib.sha256
    ).hexdigest()
    return {'FP-API-Key':ts, 'FP-Timestamp':ts, 'FP-Signature':sig, 'Content-Type':'application/json'}

TS=$(date +%s000)
SIG=$(echo -n "${TS}GET/v1/custody/wallets" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')

curl https://api.fleexpay.io/v1/custody/wallets \
  -H "FP-API-Key: $API_KEY" \
  -H "FP-Timestamp: $TS" \
  -H "FP-Signature: $SIG"

Environments

Base URL

Production

https://api.fleexpay.io/v1 — Real funds. Keys prefixed fpk_live_

Sandbox

https://sandbox.api.fleexpay.io/v1 — No real funds. Keys prefixed fpk_test_

⚠

Never mix credentials. Live keys are rejected by sandbox and vice versa.

Throttling

Rate limits

Limits are per API key. Exceeding them returns 429. Response headers show current usage.

Endpoint group	Limit	Window
Default (all)	300	per minute
Exchange — quote & order	120	per minute
Custody — transfers (write)	60	per minute
Blockchain — broadcast	60	per minute
Compliance — AML screen	30	per minute
Burst cap (any endpoint)	20	per second

X-RateLimit-Limit

Total requests allowed in the window.

X-RateLimit-Remaining

Requests left in the current window.

X-RateLimit-Reset

Unix ms timestamp when the window resets.

Retry-After

Seconds to wait before retrying (429 only).

Error handling

Errors

All errors use a consistent JSON envelope. The code field is machine-readable.

{
  "success": false,
  "error": {
    "code":       "INSUFFICIENT_BALANCE",
    "message":    "Wallet balance too low to complete the transfer.",
    "details":    { "available": "0.00012", "required": "0.00050" },
    "request_id": "req_8f3a2b1c9d4e"
  }
}

HTTP	code	Meaning
400	INVALID_PARAMS	Missing or malformed request parameters.
401	INVALID_SIGNATURE	HMAC signature check failed.
401	EXPIRED_TIMESTAMP	Request timestamp outside ±30 s window.
403	INSUFFICIENT_PERMISSIONS	Key lacks scope for this operation.
403	ACCOUNT_SUSPENDED	Partner account suspended — contact support.
400	INSUFFICIENT_BALANCE	Wallet balance too low for the transfer.
400	INVALID_ADDRESS	Destination address invalid for the network.
429	RATE_LIMIT_EXCEEDED	Too many requests. See Retry-After header.
400	MARKET_CLOSED	Trading pair temporarily unavailable.
400	KYB_REQUIRED	Partner KYB not yet approved for this service.

Lists

Pagination

Cursor-based pagination on all list endpoints. Pass the cursor value from a previous response to fetch the next page.

{
  "success": true,
  "data": [ /* items */ ],
  "pagination": {
    "cursor":   "cur_eyJpZCI6MTIzfQ",
    "has_more": true,
    "limit":    50,
    "total":    342
  }
}

Query params: limit (1–100, default 50) · cursor · sort (asc|desc)

Real-time events

Webhooks

FleexPay POSTs signed JSON events to your HTTPS endpoint. Register URLs via the Account API or institutional dashboard.

wallet.created

New custodial wallet created.

deposit.detected

Inbound on-chain deposit detected (0-conf).

deposit.confirmed

Deposit reached required confirmation threshold.

transfer.completed

Outbound transfer broadcast and confirmed.

transfer.failed

Transfer failed — see error in payload.

order.filled

Exchange order fully executed.

order.partial

Exchange order partially executed.

order.cancelled

Exchange order cancelled.

kyb.approved

KYB application approved — services now accessible.

kyb.rejected

KYB application rejected — see reason.

Events carry FP-Webhook-Signature — HMAC-SHA256 of the raw JSON body using your webhook secret. Verify before processing.

// Verify webhook signature (Node.js)
const expected = crypto.createHmac('sha256', WEBHOOK_SECRET)
  .update(rawBody).digest('hex');
if (req.headers['fp-webhook-signature'] !== expected)
  throw new Error('Signature mismatch');

Custodial API

Custodial Services

Create and manage segregated institutional wallets, generate deposit addresses and initiate outbound transfers with full policy controls.

GET

List wallets

https://api.fleexpay.io/v1/custody/wallets

Paginated list of all custodial wallets under the authenticated partner.

Param	Type	Req	Description
network	string	opt	Filter: `bitcoin` `ethereum` `solana` `tron` `polygon` `arbitrum` `base`
status	string	opt	`active` \| `frozen` \| `archived`
limit	integer	opt	1–100, default 50.
cursor	string	opt	Pagination cursor from previous response.

200Success

{
  "success": true,
  "data": [{
    "id":           "wal_3fK9mP2xQrT8",
    "label":        "Hot Wallet — EU",
    "network":      "ethereum",
    "asset":        "USDC",
    "balance":      "125000.000000",
    "status":       "active",
    "custody_type": "mpc",
    "created_at":   "2026-03-15T09:00:00.000Z"
  }],
  "pagination": { "cursor": "cur_x", "has_more": false, "limit": 50, "total": 1 }
}

POST

Create wallet

https://api.fleexpay.io/v1/custody/wallets

Creates a new segregated custodial wallet. Each wallet is isolated at the key level.

Field	Type	Req	Description
network	string	req	Target blockchain network.
asset	string	req	Asset ticker: `BTC` `ETH` `USDC` `USDT` `SOL` etc.
label	string	opt	Human-readable label, max 120 chars.
custody_type	string	opt	`mpc` (default) or `multisig`.
metadata	object	opt	Arbitrary key-value pairs, max 10 keys.

{ "network":"ethereum", "asset":"USDC", "label":"Client Pool EU", "custody_type":"mpc" }

{
  "success": true,
  "data": {
    "id":"wal_7gN1sY4wZpR3", "label":"Client Pool EU",
    "network":"ethereum", "asset":"USDC",
    "balance":"0.000000", "status":"active",
    "custody_type":"mpc", "created_at":"2026-05-23T14:30:00.000Z"
  }
}

POST

Generate deposit address

https://api.fleexpay.io/v1/custody/wallets/{wallet_id}/addresses

Returns a fresh deposit address for the wallet. Each call generates a new address for on-chain privacy.

{
  "success": true,
  "data": {
    "address":   "0x3fA8b2e9c1D7F4a52bC6e8310d9A7f2B5c0E1d3",
    "network":   "ethereum",
    "asset":     "USDC",
    "wallet_id": "wal_7gN1sY4wZpR3",
    "created_at":"2026-05-23T14:31:00.000Z"
  }
}

POST

Create transfer

https://api.fleexpay.io/v1/custody/transfers

Initiates an outbound on-chain transfer from a custodial wallet. Transfers above partner policy thresholds require multi-approver sign-off before broadcast.

Field	Type	Req	Description
wallet_id	string	req	Source wallet ID.
destination	string	req	Destination address, validated for the network.
amount	string	req	Amount as decimal string, e.g. `"500.00"`.
asset	string	req	Must match the wallet asset.
fee_priority	string	opt	`low` \| `medium` (default) \| `high`
note	string	opt	Internal memo, not broadcast on-chain.
idempotency_key	string	opt	UUID v4 for safe retries.

{
  "wallet_id":       "wal_7gN1sY4wZpR3",
  "destination":     "0xAbC123...def456",
  "amount":          "5000.00",
  "asset":           "USDC",
  "fee_priority":    "medium",
  "idempotency_key": "550e8400-e29b-41d4-a716-446655440000"
}

{
  "success": true,
  "data": {
    "id":           "txf_9pL2kR7mWs4A",
    "status":       "pending_approval",
    "wallet_id":    "wal_7gN1sY4wZpR3",
    "destination":  "0xAbC123...def456",
    "amount":       "5000.00",
    "asset":        "USDC",
    "fee_estimate": "0.00420000",
    "tx_hash":      null,
    "created_at":   "2026-05-23T14:35:00.000Z"
  }
}

Exchange API

Crypto Exchange

Institutional spot and OTC execution with aggregated liquidity. Quotes are firm for 30 seconds — pass the quote ID to execute at the locked rate.

POST

Get quote

https://api.fleexpay.io/v1/exchange/quote

Returns a firm, 30-second locked quote. Pass the quote_id to POST /orders to execute at the guaranteed rate.

{ "from_asset":"USDC", "to_asset":"BTC", "amount":"100000.00", "side":"buy" }

{
  "success": true,
  "data": {
    "quote_id":    "qt_5mXaB3pLwT2K",
    "from_asset":  "USDC", "to_asset": "BTC",
    "from_amount": "100000.00", "to_amount": "1.56823412",
    "rate":        "63764.00",
    "fee":         "100.00", "fee_asset": "USDC",
    "expires_at":  "2026-05-23T14:30:30.000Z"
  }
}

POST

Create order

https://api.fleexpay.io/v1/exchange/orders

Executes an order against a locked quote or as a market order. Fund from a custodial wallet via source_wallet_id or use exchange balance.

{
  "quote_id":         "qt_5mXaB3pLwT2K",
  "from_asset":       "USDC", "to_asset": "BTC",
  "amount":           "100000.00", "side": "buy",
  "source_wallet_id": "wal_7gN1sY4wZpR3"
}

{
  "success": true,
  "data": {
    "id":          "ord_2bW8nC6yKp5Q", "status": "filled",
    "from_amount": "100000.00",      "to_amount": "1.56823412",
    "rate":        "63764.00",         "fee": "100.00",
    "filled_at":   "2026-05-23T14:30:15.412Z"
  }
}

GET

Ticker

https://api.fleexpay.io/v1/exchange/ticker/{pair}

Current best bid, ask and last price for a pair. Use underscore notation: BTC_USDC.

{
  "pair":"BTC_USDC", "bid":"63750.00", "ask":"63775.00", "last":"63764.00",
  "volume_24h":"8423104.50", "change_24h":"+1.42",
  "high_24h":"64100.00", "low_24h":"62800.00"
}

Blockchain API

Blockchain Infrastructure

Direct multi-chain node access: broadcast raw transactions, query status, inspect blocks and estimate fees — no need to run your own node estate.

GET

Supported chains

https://api.fleexpay.io/v1/blockchain/chains

All supported networks with current block height and operational status.

{
  "data": [
    { "id":"bitcoin",  "block_height":844123,   "status":"operational", "confirmations":3   },
    { "id":"ethereum", "block_height":20104892, "status":"operational", "confirmations":12  },
    { "id":"solana",   "block_height":291044012,"status":"operational", "confirmations":32  },
    { "id":"polygon",  "block_height":57823441, "status":"operational", "confirmations":128 },
    { "id":"arbitrum", "block_height":221045612,"status":"operational", "confirmations":1   },
    { "id":"base",     "block_height":15892312, "status":"operational", "confirmations":1   },
    { "id":"tron",     "block_height":62184210, "status":"operational", "confirmations":20  }
  ]
}

POST

Broadcast transaction

https://api.fleexpay.io/v1/blockchain/{chain}/broadcast

Broadcasts a raw signed transaction. Returns the hash immediately; poll GET /tx/{hash} for confirmation.

// Request
{ "raw_tx": "0x02f8..." }

// Response 200
{ "tx_hash":"0x4e3a8f2b...", "chain":"ethereum", "status":"pending" }

POST

Gas estimate

https://api.fleexpay.io/v1/blockchain/{chain}/estimate-gas

Returns low/medium/high fee scenarios based on current mempool conditions.

{
  "chain":         "ethereum",
  "base_fee_gwei": "12.4",
  "low":    { "max_fee_gwei":"14.0", "priority_gwei":"1.0", "eta_seconds":120 },
  "medium": { "max_fee_gwei":"16.0", "priority_gwei":"1.5", "eta_seconds":30  },
  "high":   { "max_fee_gwei":"20.0", "priority_gwei":"2.5", "eta_seconds":12  }
}

Compliance API

Compliance & KYB

Partner KYB submission, AML address screening and Travel Rule data exchange. Mandatory for regulated use of the platform.

⚠

Regulatory obligation. AML screening and Travel Rule submission are required for transfers above applicable thresholds under FinCEN and FATF guidelines. Non-compliance may result in account suspension.

POST

Submit KYB

https://api.fleexpay.io/v1/compliance/kyb

Submits a KYB application for a new entity. Returns an application ID to track via webhooks or polling.

Field	Type	Req	Description
legal_name	string	req	Registered entity name.
jurisdiction	string	req	ISO 3166-1 alpha-2 code, e.g. `US` `DE` `SG`.
registration_number	string	req	Company registration or license number.
business_type	string	req	`exchange` `fintech` `bank` `fund` `payment` `other`
beneficial_owners	array	req	UBOs >25%: `name`, `dob`, `nationality`, `ownership_pct`.
documents	array	req	Base64 documents. Types: `certificate_of_incorporation` `license` `ubo_declaration`.

POST

AML address screening

https://api.fleexpay.io/v1/compliance/aml/screen

Screens a blockchain address against OFAC, EU and UN sanctions lists, dark-web entity databases and on-chain risk heuristics.

{ "address":"0x3fA8b2e9c1D7F4...", "chain":"ethereum" }

{
  "address":    "0x3fA8b2e9c1D7F4...",
  "risk_score": 12, "risk_level": "low",
  "sanctions":  false, "categories": [],
  "sources": [
    { "name":"OFAC SDN",    "hit":false },
    { "name":"EU Sanctions", "hit":false },
    { "name":"UN Sanctions", "hit":false }
  ]
}

POST

Travel Rule submission

https://api.fleexpay.io/v1/compliance/travel-rule

FATF Travel Rule originator and beneficiary data for transfers above threshold (USD 1,000). FleexPay handles secure exchange with the counterparty VASP.

{
  "transfer_id": "txf_9pL2kR7mWs4A",
  "originator": { "name":"Acme Fintech GmbH", "account_id":"ACME-DE-00421" },
  "beneficiary": {
    "name":"Partner Exchange Ltd",
    "vasp_did":"did:ethr:0xAbC123...",
    "address":"0x3fA8b2e9c1D7F4..."
  }
}

Account API

Account & API Keys

Manage your partner account, trading limits and the full lifecycle of API credentials.

GET

Account info

https://api.fleexpay.io/v1/account

{
  "partner_id":  "ptr_4xK9mQ2rBs7W",
  "legal_name":  "Acme Fintech GmbH",
  "status":      "active",
  "kyb_status":  "approved",
  "tier":        "institutional",
  "services":    ["custody", "exchange", "blockchain"],
  "jurisdiction":"DE"
}

POST

Create API key

https://api.fleexpay.io/v1/account/api-keys

Creates a new key pair. The api_secret is returned once only. Store it in a secrets manager immediately.

Field	Type	Req	Description
label	string	req	Human-readable key name.
scopes	array	req	`custody:read` `custody:write` `exchange:read` `exchange:write` `blockchain:read` `blockchain:write` `compliance:read` `compliance:write` `account:read`
ip_whitelist	array	opt	Restrict to IPv4/IPv6 addresses or CIDR ranges.
expires_at	string	opt	ISO 8601 expiry. Omit for non-expiring key.

// Response 201
{
  "key_id":     "key_6tN3wS8vYc2P",
  "api_key":    "fpk_live_6tN3wS8vYc2P...",
  "api_secret": "fps_sk_eyJhbGci...",
  "scopes":     ["custody:read", "custody:write"],
  "created_at": "2026-05-23T14:30:00.000Z",
  "warning":    "Store api_secret now — will not be shown again."
}

!

Secret shown once. Store it immediately in AWS Secrets Manager, HashiCorp Vault or equivalent. FleexPay cannot recover a lost secret — revoke and issue a new key if lost.

Access

Request API access

API credentials are issued exclusively to approved institutional and wholesale partners following KYB onboarding. Contact our institutional desk to apply.

✉

Apply: Email [email protected] with your company name, jurisdiction, license details and intended use. We respond to qualified enquiries only.

Node.js SDK

Available to approved partners on request.

Python SDK

Available to approved partners on request.

Postman

Full collection shared post-onboarding, covering all endpoints.

Sandbox

Available immediately upon KYB approval. No real funds.

← Back to FleexPay · Privacy Policy · Terms & Conditions