simulations

Sandbox simulations (SC-38, P-89): every asynchronous outcome on demand — incoming payments and debits, payment status, returns and recalls, inbound recalls, exchange settlement, FX rate moves, direct-debit outcomes, card events, KYC outcomes, integrator events, statements, scheduled runs and provider outages. Backed by the sandbox bank, and by the Banking Circle and Integrated Finance sandboxes where they offer a simulation.

Markdown version: simulations.md

Available simulations and sandbox rules

GET /v1/simulations

  • listSimulations
  • API key scope balances:read
  • Tenant customer

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: balances:read.

Parameters

NameInTypeDescription
X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Responses

  • 200 OK application/json

    Schema SimulationCatalogue

    • environment stringrequired

      One of: "sandbox"

    • connection object | nullrequired

      Fields of connection
      • id Uuidrequired

      • provider stringrequired

      • environment stringrequired

    • data array of objectrequired

      Fields of data
      • kind SimulationKindrequired

      • method stringrequired

        One of: "POST"

      • path stringrequired

      • summary stringrequired

      • providers array of SimulationProviderrequired

      • available booleanrequired

        Available for the caller's connection.

      • rules array of stringrequired

    • rules array of objectrequired

      Deterministic sandbox rules that need no endpoint.

      Fields of rules
      • topic stringrequired

      • rule stringrequired

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X GET "https://bank.wirebloom.com/v1/simulations" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID"

Simulate a card transaction event

POST /v1/simulations/cards/{cardId}/transactions

  • simulateCardTransaction
  • API key scope payments:write
  • Tenant customer

A neutral card event (cards/transaction) as the card processor would send it: authorisation (hold), settlement, reversal, refund or decline.

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: payments:write.

Parameters

NameInTypeDescription
cardIdrequiredpathUuid

Identifier (cardId).

X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Idempotency-Keyheaderstring

Optional idempotency key; same semantics as on money operations.

Request body

Required. application/json

Schema SimCardTransaction

  • phase stringrequired

    One of: "authorisation", "decline", "reversal", "settlement", "refund"

  • amount Moneyrequired

  • ref string

    Transaction ref (generated for an authorisation; required to reverse or settle one).

    pattern ^[A-Za-z0-9_.:-]{3,100}$

  • relatedRef string

    Refund: the settled transaction it refunds.

    pattern ^[A-Za-z0-9_.:-]{3,100}$

  • merchantName string

    min length 1 · max length 100

  • mcc string

    pattern ^\d{4}$

  • merchantCountry CountryCode

  • channel string

    One of: "pos", "contactless", "ecommerce", "atm", "moto"

  • declineReason string

    min length 1 · max length 100

Responses

  • 202 Accepted application/json

    Schema SimulationResult

    • simulationId Uuidrequired

    • kind SimulationKindrequired

    • status stringrequired

      queued: a provider event was stored and handed to the workers; submitted: the partner sandbox accepted it and notifies by webhook; applied: done synchronously.

      One of: "queued", "submitted", "applied"

    • provider SimulationProviderrequired

    • providerEventIds array of Uuidrequired

      providers.events rows written (provider event log).

    • providerReference string | nullrequired

    • details objectrequired

      Per kind (amounts, refs, rates, case id, …).

      Fields of details

      object

  • 400 Malformed request: unparseable JSON, or an invalid header, path or query parameter (`errors[].field` is `header.X`, `path.x` or `query.x`). Body validation failures are 422 `validation-error`. application/problem+json

    Body Problem; see the error catalogue.

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 404 Resource does not exist in this tenant (cross-tenant ids also return 404), or feature disabled (`feature-disabled`). application/problem+json

    Body Problem; see the error catalogue.

  • 409 State conflict: `invalid-transition`, `duplicate-recipient`, `quote-expired`, `insufficient-funds`, `idempotency-key-in-use` (with Retry-After), `not-cancellable`. application/problem+json

    Body Problem; see the error catalogue.

  • 422 Semantically invalid request; `errors[]` lists field-level problems. Also `idempotency-key-reused` when the key was used with a different payload, `limit-exceeded`, `recipient-not-approved`. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X POST "https://bank.wirebloom.com/v1/simulations/cards/{cardId}/transactions" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID" \
  -H "Content-Type: application/json" \
  --data '{
  "phase": "authorisation",
  "amount": {
    "amountMinor": "125050",
    "currency": "GBP"
  }
}'

Simulate a direct-debit collection outcome

POST /v1/simulations/direct-debits/collections/{collectionId}/status

  • simulateCollectionStatus
  • API key scope payments:write
  • Tenant customer

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: payments:write.

Parameters

NameInTypeDescription
collectionIdrequiredpathUuid

Identifier (collectionId).

X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Idempotency-Keyheaderstring

Optional idempotency key; same semantics as on money operations.

Request body

Required. application/json

Schema SimCollectionStatus

  • status stringrequired

    One of: "collected", "failed", "returned"

  • reasonCode string

    pattern ^[A-Z0-9]{2,8}$

Responses

  • 202 Accepted application/json

    Schema SimulationResult

    • simulationId Uuidrequired

    • kind SimulationKindrequired

    • status stringrequired

      queued: a provider event was stored and handed to the workers; submitted: the partner sandbox accepted it and notifies by webhook; applied: done synchronously.

      One of: "queued", "submitted", "applied"

    • provider SimulationProviderrequired

    • providerEventIds array of Uuidrequired

      providers.events rows written (provider event log).

    • providerReference string | nullrequired

    • details objectrequired

      Per kind (amounts, refs, rates, case id, …).

      Fields of details

      object

  • 400 Malformed request: unparseable JSON, or an invalid header, path or query parameter (`errors[].field` is `header.X`, `path.x` or `query.x`). Body validation failures are 422 `validation-error`. application/problem+json

    Body Problem; see the error catalogue.

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 404 Resource does not exist in this tenant (cross-tenant ids also return 404), or feature disabled (`feature-disabled`). application/problem+json

    Body Problem; see the error catalogue.

  • 409 State conflict: `invalid-transition`, `duplicate-recipient`, `quote-expired`, `insufficient-funds`, `idempotency-key-in-use` (with Retry-After), `not-cancellable`. application/problem+json

    Body Problem; see the error catalogue.

  • 422 Semantically invalid request; `errors[]` lists field-level problems. Also `idempotency-key-reused` when the key was used with a different payload, `limit-exceeded`, `recipient-not-approved`. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X POST "https://bank.wirebloom.com/v1/simulations/direct-debits/collections/{collectionId}/status" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID" \
  -H "Content-Type: application/json" \
  --data '{
  "status": "collected"
}'

Simulate the settlement of an exchange

POST /v1/simulations/exchanges/{exchangeId}/status

  • simulateExchangeStatus
  • API key scope exchanges:write
  • Tenant customer

Applies to an exchange still processing at the sandbox bank.

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: exchanges:write.

Parameters

NameInTypeDescription
exchangeIdrequiredpathUuid

Identifier (exchangeId).

X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Idempotency-Keyheaderstring

Optional idempotency key; same semantics as on money operations.

Request body

Required. application/json

Schema SimExchangeStatus

  • status stringrequired

    One of: "completed", "failed"

Responses

  • 202 Accepted application/json

    Schema SimulationResult

    • simulationId Uuidrequired

    • kind SimulationKindrequired

    • status stringrequired

      queued: a provider event was stored and handed to the workers; submitted: the partner sandbox accepted it and notifies by webhook; applied: done synchronously.

      One of: "queued", "submitted", "applied"

    • provider SimulationProviderrequired

    • providerEventIds array of Uuidrequired

      providers.events rows written (provider event log).

    • providerReference string | nullrequired

    • details objectrequired

      Per kind (amounts, refs, rates, case id, …).

      Fields of details

      object

  • 400 Malformed request: unparseable JSON, or an invalid header, path or query parameter (`errors[].field` is `header.X`, `path.x` or `query.x`). Body validation failures are 422 `validation-error`. application/problem+json

    Body Problem; see the error catalogue.

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 404 Resource does not exist in this tenant (cross-tenant ids also return 404), or feature disabled (`feature-disabled`). application/problem+json

    Body Problem; see the error catalogue.

  • 409 State conflict: `invalid-transition`, `duplicate-recipient`, `quote-expired`, `insufficient-funds`, `idempotency-key-in-use` (with Retry-After), `not-cancellable`. application/problem+json

    Body Problem; see the error catalogue.

  • 422 Semantically invalid request; `errors[]` lists field-level problems. Also `idempotency-key-reused` when the key was used with a different payload, `limit-exceeded`, `recipient-not-approved`. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X POST "https://bank.wirebloom.com/v1/simulations/exchanges/{exchangeId}/status" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID" \
  -H "Content-Type: application/json" \
  --data '{
  "status": "completed"
}'

Move a sandbox FX rate

POST /v1/simulations/fx-rates

  • simulateFxRateMove
  • API key scope exchanges:write
  • Tenant customer

Stored on the operator's sandbox connection (rateShiftsBps): every quote of the pair moves (the inverse pair the other way). applied; details.rate is the new rate.

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: exchanges:write.

Parameters

NameInTypeDescription
X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Idempotency-Keyheaderstring

Optional idempotency key; same semantics as on money operations.

Request body

Required. application/json

Schema SimFxRate

  • sell CurrencyCoderequired

  • buy CurrencyCoderequired

  • moveBps integerrequired

    Basis points, ±5000; 0 resets the pair.

    min -5000 · max 5000

Responses

  • 202 Accepted application/json

    Schema SimulationResult

    • simulationId Uuidrequired

    • kind SimulationKindrequired

    • status stringrequired

      queued: a provider event was stored and handed to the workers; submitted: the partner sandbox accepted it and notifies by webhook; applied: done synchronously.

      One of: "queued", "submitted", "applied"

    • provider SimulationProviderrequired

    • providerEventIds array of Uuidrequired

      providers.events rows written (provider event log).

    • providerReference string | nullrequired

    • details objectrequired

      Per kind (amounts, refs, rates, case id, …).

      Fields of details

      object

  • 400 Malformed request: unparseable JSON, or an invalid header, path or query parameter (`errors[].field` is `header.X`, `path.x` or `query.x`). Body validation failures are 422 `validation-error`. application/problem+json

    Body Problem; see the error catalogue.

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 409 State conflict: `invalid-transition`, `duplicate-recipient`, `quote-expired`, `insufficient-funds`, `idempotency-key-in-use` (with Retry-After), `not-cancellable`. application/problem+json

    Body Problem; see the error catalogue.

  • 422 Semantically invalid request; `errors[]` lists field-level problems. Also `idempotency-key-reused` when the key was used with a different payload, `limit-exceeded`, `recipient-not-approved`. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X POST "https://bank.wirebloom.com/v1/simulations/fx-rates" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID" \
  -H "Content-Type: application/json" \
  --data '{
  "sell": "GBP",
  "buy": "GBP",
  "moveBps": -5000
}'

Simulate a direct debit taken from a balance

POST /v1/simulations/incoming-debits

  • simulateIncomingDebit
  • API key scope payments:write
  • Tenant customer

Banking Circle sandbox only (POST /api/v1/payments/simulations/debits); 409 on other connections.

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: payments:write.

Parameters

NameInTypeDescription
X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Idempotency-Keyheaderstring

Optional idempotency key; same semantics as on money operations.

Request body

Required. application/json

Schema SimIncomingDebit

  • balanceId Uuidrequired

  • amount Moneyrequired

  • scheme string

    One of: "SEPA_DD", "BACS_DD", "NPP"

  • valueDate Date

Responses

  • 202 Accepted application/json

    Schema SimulationResult

    • simulationId Uuidrequired

    • kind SimulationKindrequired

    • status stringrequired

      queued: a provider event was stored and handed to the workers; submitted: the partner sandbox accepted it and notifies by webhook; applied: done synchronously.

      One of: "queued", "submitted", "applied"

    • provider SimulationProviderrequired

    • providerEventIds array of Uuidrequired

      providers.events rows written (provider event log).

    • providerReference string | nullrequired

    • details objectrequired

      Per kind (amounts, refs, rates, case id, …).

      Fields of details

      object

  • 400 Malformed request: unparseable JSON, or an invalid header, path or query parameter (`errors[].field` is `header.X`, `path.x` or `query.x`). Body validation failures are 422 `validation-error`. application/problem+json

    Body Problem; see the error catalogue.

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 409 State conflict: `invalid-transition`, `duplicate-recipient`, `quote-expired`, `insufficient-funds`, `idempotency-key-in-use` (with Retry-After), `not-cancellable`. application/problem+json

    Body Problem; see the error catalogue.

  • 422 Semantically invalid request; `errors[]` lists field-level problems. Also `idempotency-key-reused` when the key was used with a different payload, `limit-exceeded`, `recipient-not-approved`. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X POST "https://bank.wirebloom.com/v1/simulations/incoming-debits" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID" \
  -H "Content-Type: application/json" \
  --data '{
  "balanceId": "0192a6f0-7c1e-7b3a-9d2e-5f4c3b2a1908",
  "amount": {
    "amountMinor": "125050",
    "currency": "GBP"
  }
}'

Simulate an incoming payment

POST /v1/simulations/incoming-payments

  • simulateIncomingPayment
  • API key scope payments:write
  • Tenant customer

Sandbox bank: an account.credited event through the webhook pipeline (queued). Banking Circle sandbox: POST /api/v1/payments/simulations/credits on the balance account (submitted; the IncomingPaymentProcessed notification follows). Integrated Finance sandbox: a provisioned account credit on the balance IBAN (inferred until IF-33).

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: payments:write.

Parameters

NameInTypeDescription
X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Idempotency-Keyheaderstring

Optional idempotency key; same semantics as on money operations.

Request body

Required. application/json

Schema SimIncomingPayment

  • balanceId Uuidrequired

  • amount Moneyrequired

  • senderName string

    min length 1 · max length 140

  • reference string

    min length 1 · max length 140

  • scheme string

    Partner scheme (Banking Circle SEPA, SEPAINST, FPS, NPP; Integrated Finance sepa, …); by currency when absent.

    pattern ^[A-Z_]{2,12}$

Responses

  • 202 Accepted application/json

    Schema SimulationResult

    • simulationId Uuidrequired

    • kind SimulationKindrequired

    • status stringrequired

      queued: a provider event was stored and handed to the workers; submitted: the partner sandbox accepted it and notifies by webhook; applied: done synchronously.

      One of: "queued", "submitted", "applied"

    • provider SimulationProviderrequired

    • providerEventIds array of Uuidrequired

      providers.events rows written (provider event log).

    • providerReference string | nullrequired

    • details objectrequired

      Per kind (amounts, refs, rates, case id, …).

      Fields of details

      object

  • 400 Malformed request: unparseable JSON, or an invalid header, path or query parameter (`errors[].field` is `header.X`, `path.x` or `query.x`). Body validation failures are 422 `validation-error`. application/problem+json

    Body Problem; see the error catalogue.

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 409 State conflict: `invalid-transition`, `duplicate-recipient`, `quote-expired`, `insufficient-funds`, `idempotency-key-in-use` (with Retry-After), `not-cancellable`. application/problem+json

    Body Problem; see the error catalogue.

  • 422 Semantically invalid request; `errors[]` lists field-level problems. Also `idempotency-key-reused` when the key was used with a different payload, `limit-exceeded`, `recipient-not-approved`. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X POST "https://bank.wirebloom.com/v1/simulations/incoming-payments" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID" \
  -H "Content-Type: application/json" \
  --data '{
  "balanceId": "0192a6f0-7c1e-7b3a-9d2e-5f4c3b2a1908",
  "amount": {
    "amountMinor": "125050",
    "currency": "GBP"
  }
}'

Simulate an inbound recall request

POST /v1/simulations/incoming-payments/{incomingPaymentId}/recall

  • simulateIncomingRecall
  • API key scope payments:write
  • Tenant customer

Opens a partner compliance case (inbound_recall, provider sandbox) in the operator's queue (applied).

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: payments:write.

Parameters

NameInTypeDescription
incomingPaymentIdrequiredpathUuid

Identifier (incomingPaymentId).

X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Idempotency-Keyheaderstring

Optional idempotency key; same semantics as on money operations.

Request body

Required. application/json

Schema SimIncomingRecall

  • reasonCode stringrequired

    One of: "AC03", "AM09", "DUPL", "DT01", "FRAD", "CUST", "TECH", "UNKF", "MS01"

Responses

  • 202 Accepted application/json

    Schema SimulationResult

    • simulationId Uuidrequired

    • kind SimulationKindrequired

    • status stringrequired

      queued: a provider event was stored and handed to the workers; submitted: the partner sandbox accepted it and notifies by webhook; applied: done synchronously.

      One of: "queued", "submitted", "applied"

    • provider SimulationProviderrequired

    • providerEventIds array of Uuidrequired

      providers.events rows written (provider event log).

    • providerReference string | nullrequired

    • details objectrequired

      Per kind (amounts, refs, rates, case id, …).

      Fields of details

      object

  • 400 Malformed request: unparseable JSON, or an invalid header, path or query parameter (`errors[].field` is `header.X`, `path.x` or `query.x`). Body validation failures are 422 `validation-error`. application/problem+json

    Body Problem; see the error catalogue.

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 404 Resource does not exist in this tenant (cross-tenant ids also return 404), or feature disabled (`feature-disabled`). application/problem+json

    Body Problem; see the error catalogue.

  • 409 State conflict: `invalid-transition`, `duplicate-recipient`, `quote-expired`, `insufficient-funds`, `idempotency-key-in-use` (with Retry-After), `not-cancellable`. application/problem+json

    Body Problem; see the error catalogue.

  • 422 Semantically invalid request; `errors[]` lists field-level problems. Also `idempotency-key-reused` when the key was used with a different payload, `limit-exceeded`, `recipient-not-approved`. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X POST "https://bank.wirebloom.com/v1/simulations/incoming-payments/{incomingPaymentId}/recall" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID" \
  -H "Content-Type: application/json" \
  --data '{
  "reasonCode": "AC03"
}'

Simulate a KYC review outcome

POST /v1/simulations/kyc

  • simulateKycOutcome
  • API key scope payments:write
  • Tenant customer

Applied as the KYC provider's applicantReviewed webhook: approved (GREEN), rejected (RED FINAL), retry (RED RETRY).

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: payments:write.

Parameters

NameInTypeDescription
X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Idempotency-Keyheaderstring

Optional idempotency key; same semantics as on money operations.

Request body

Required. application/json

Schema SimKycOutcome

  • personId Uuidrequired

  • outcome stringrequired

    One of: "approved", "rejected", "retry"

  • comment string

    min length 1 · max length 500

Responses

  • 202 Accepted application/json

    Schema SimulationResult

    • simulationId Uuidrequired

    • kind SimulationKindrequired

    • status stringrequired

      queued: a provider event was stored and handed to the workers; submitted: the partner sandbox accepted it and notifies by webhook; applied: done synchronously.

      One of: "queued", "submitted", "applied"

    • provider SimulationProviderrequired

    • providerEventIds array of Uuidrequired

      providers.events rows written (provider event log).

    • providerReference string | nullrequired

    • details objectrequired

      Per kind (amounts, refs, rates, case id, …).

      Fields of details

      object

  • 400 Malformed request: unparseable JSON, or an invalid header, path or query parameter (`errors[].field` is `header.X`, `path.x` or `query.x`). Body validation failures are 422 `validation-error`. application/problem+json

    Body Problem; see the error catalogue.

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 409 State conflict: `invalid-transition`, `duplicate-recipient`, `quote-expired`, `insufficient-funds`, `idempotency-key-in-use` (with Retry-After), `not-cancellable`. application/problem+json

    Body Problem; see the error catalogue.

  • 422 Semantically invalid request; `errors[]` lists field-level problems. Also `idempotency-key-reused` when the key was used with a different payload, `limit-exceeded`, `recipient-not-approved`. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X POST "https://bank.wirebloom.com/v1/simulations/kyc" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID" \
  -H "Content-Type: application/json" \
  --data '{
  "personId": "0192a6f0-7c1e-7b3a-9d2e-5f4c3b2a1908",
  "outcome": "approved"
}'

Simulate the outcome of a payment recall

POST /v1/simulations/payments/{paymentId}/recall

  • simulatePaymentRecall
  • API key scope payments:write
  • Tenant customer

accepted: the funds come back (a return with the recall reason); rejected: recorded on the provider event log, nothing moves.

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: payments:write.

Parameters

NameInTypeDescription
paymentIdrequiredpathUuid

Identifier (paymentId).

X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Idempotency-Keyheaderstring

Optional idempotency key; same semantics as on money operations.

Request body

Required. application/json

Schema SimPaymentRecall

  • outcome stringrequired

    One of: "accepted", "rejected"

  • reasonCode string

    pattern ^[A-Z0-9]{2,8}$

Responses

  • 202 Accepted application/json

    Schema SimulationResult

    • simulationId Uuidrequired

    • kind SimulationKindrequired

    • status stringrequired

      queued: a provider event was stored and handed to the workers; submitted: the partner sandbox accepted it and notifies by webhook; applied: done synchronously.

      One of: "queued", "submitted", "applied"

    • provider SimulationProviderrequired

    • providerEventIds array of Uuidrequired

      providers.events rows written (provider event log).

    • providerReference string | nullrequired

    • details objectrequired

      Per kind (amounts, refs, rates, case id, …).

      Fields of details

      object

  • 400 Malformed request: unparseable JSON, or an invalid header, path or query parameter (`errors[].field` is `header.X`, `path.x` or `query.x`). Body validation failures are 422 `validation-error`. application/problem+json

    Body Problem; see the error catalogue.

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 404 Resource does not exist in this tenant (cross-tenant ids also return 404), or feature disabled (`feature-disabled`). application/problem+json

    Body Problem; see the error catalogue.

  • 409 State conflict: `invalid-transition`, `duplicate-recipient`, `quote-expired`, `insufficient-funds`, `idempotency-key-in-use` (with Retry-After), `not-cancellable`. application/problem+json

    Body Problem; see the error catalogue.

  • 422 Semantically invalid request; `errors[]` lists field-level problems. Also `idempotency-key-reused` when the key was used with a different payload, `limit-exceeded`, `recipient-not-approved`. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X POST "https://bank.wirebloom.com/v1/simulations/payments/{paymentId}/recall" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID" \
  -H "Content-Type: application/json" \
  --data '{
  "outcome": "accepted"
}'

Simulate the return of a payment

POST /v1/simulations/payments/{paymentId}/return

  • simulatePaymentReturn
  • API key scope payments:write
  • Tenant customer

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: payments:write.

Parameters

NameInTypeDescription
paymentIdrequiredpathUuid

Identifier (paymentId).

X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Idempotency-Keyheaderstring

Optional idempotency key; same semantics as on money operations.

Request body

Required. application/json

Schema SimPaymentReturn

Partial return with amount; the payment amount otherwise.

  • reasonCode string

    pattern ^[A-Z0-9]{2,8}$

  • amount Money

Responses

  • 202 Accepted application/json

    Schema SimulationResult

    • simulationId Uuidrequired

    • kind SimulationKindrequired

    • status stringrequired

      queued: a provider event was stored and handed to the workers; submitted: the partner sandbox accepted it and notifies by webhook; applied: done synchronously.

      One of: "queued", "submitted", "applied"

    • provider SimulationProviderrequired

    • providerEventIds array of Uuidrequired

      providers.events rows written (provider event log).

    • providerReference string | nullrequired

    • details objectrequired

      Per kind (amounts, refs, rates, case id, …).

      Fields of details

      object

  • 400 Malformed request: unparseable JSON, or an invalid header, path or query parameter (`errors[].field` is `header.X`, `path.x` or `query.x`). Body validation failures are 422 `validation-error`. application/problem+json

    Body Problem; see the error catalogue.

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 404 Resource does not exist in this tenant (cross-tenant ids also return 404), or feature disabled (`feature-disabled`). application/problem+json

    Body Problem; see the error catalogue.

  • 409 State conflict: `invalid-transition`, `duplicate-recipient`, `quote-expired`, `insufficient-funds`, `idempotency-key-in-use` (with Retry-After), `not-cancellable`. application/problem+json

    Body Problem; see the error catalogue.

  • 422 Semantically invalid request; `errors[]` lists field-level problems. Also `idempotency-key-reused` when the key was used with a different payload, `limit-exceeded`, `recipient-not-approved`. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X POST "https://bank.wirebloom.com/v1/simulations/payments/{paymentId}/return" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID" \
  -H "Content-Type: application/json" \
  --data '{}'

Simulate the provider status of a payment

POST /v1/simulations/payments/{paymentId}/status

  • simulatePaymentStatus
  • API key scope payments:write
  • Tenant customer

A payment sent through the sandbox bank (409 before it is sent or on a partner connection). The worker applies the stated status without asking the sandbox bank.

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: payments:write.

Parameters

NameInTypeDescription
paymentIdrequiredpathUuid

Identifier (paymentId).

X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Idempotency-Keyheaderstring

Optional idempotency key; same semantics as on money operations.

Request body

Required. application/json

Schema SimPaymentStatus

  • status stringrequired

    One of: "processing", "completed", "rejected", "cancelled"

  • failureReason string

    min length 1 · max length 140

Responses

  • 202 Accepted application/json

    Schema SimulationResult

    • simulationId Uuidrequired

    • kind SimulationKindrequired

    • status stringrequired

      queued: a provider event was stored and handed to the workers; submitted: the partner sandbox accepted it and notifies by webhook; applied: done synchronously.

      One of: "queued", "submitted", "applied"

    • provider SimulationProviderrequired

    • providerEventIds array of Uuidrequired

      providers.events rows written (provider event log).

    • providerReference string | nullrequired

    • details objectrequired

      Per kind (amounts, refs, rates, case id, …).

      Fields of details

      object

  • 400 Malformed request: unparseable JSON, or an invalid header, path or query parameter (`errors[].field` is `header.X`, `path.x` or `query.x`). Body validation failures are 422 `validation-error`. application/problem+json

    Body Problem; see the error catalogue.

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 404 Resource does not exist in this tenant (cross-tenant ids also return 404), or feature disabled (`feature-disabled`). application/problem+json

    Body Problem; see the error catalogue.

  • 409 State conflict: `invalid-transition`, `duplicate-recipient`, `quote-expired`, `insufficient-funds`, `idempotency-key-in-use` (with Retry-After), `not-cancellable`. application/problem+json

    Body Problem; see the error catalogue.

  • 422 Semantically invalid request; `errors[]` lists field-level problems. Also `idempotency-key-reused` when the key was used with a different payload, `limit-exceeded`, `recipient-not-approved`. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X POST "https://bank.wirebloom.com/v1/simulations/payments/{paymentId}/status" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID" \
  -H "Content-Type: application/json" \
  --data '{
  "status": "processing"
}'

Simulate a sandbox bank outage

POST /v1/simulations/provider-outage

  • simulateProviderOutage
  • API key scope payments:write
  • Tenant customer

Bank calls fail with a retryable provider error until the time given (applied): rehearse retries and backoff.

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: payments:write.

Parameters

NameInTypeDescription
X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Idempotency-Keyheaderstring

Optional idempotency key; same semantics as on money operations.

Request body

Required. application/json

Schema SimOutage

  • durationSeconds integerrequired

    Seconds from now; 0 ends the outage.

    min 0 · max 900

Responses

  • 202 Accepted application/json

    Schema SimulationResult

    • simulationId Uuidrequired

    • kind SimulationKindrequired

    • status stringrequired

      queued: a provider event was stored and handed to the workers; submitted: the partner sandbox accepted it and notifies by webhook; applied: done synchronously.

      One of: "queued", "submitted", "applied"

    • provider SimulationProviderrequired

    • providerEventIds array of Uuidrequired

      providers.events rows written (provider event log).

    • providerReference string | nullrequired

    • details objectrequired

      Per kind (amounts, refs, rates, case id, …).

      Fields of details

      object

  • 400 Malformed request: unparseable JSON, or an invalid header, path or query parameter (`errors[].field` is `header.X`, `path.x` or `query.x`). Body validation failures are 422 `validation-error`. application/problem+json

    Body Problem; see the error catalogue.

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 409 State conflict: `invalid-transition`, `duplicate-recipient`, `quote-expired`, `insufficient-funds`, `idempotency-key-in-use` (with Retry-After), `not-cancellable`. application/problem+json

    Body Problem; see the error catalogue.

  • 422 Semantically invalid request; `errors[]` lists field-level problems. Also `idempotency-key-reused` when the key was used with a different payload, `limit-exceeded`, `recipient-not-approved`. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X POST "https://bank.wirebloom.com/v1/simulations/provider-outage" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID" \
  -H "Content-Type: application/json" \
  --data '{
  "durationSeconds": 0
}'

Run a scheduled payment now

POST /v1/simulations/scheduled-payments/{scheduledPaymentId}/run-now

  • simulateScheduledRun
  • API key scope payments:write
  • Tenant customer

An active schedule with a next occurrence is made due now and handed to the worker (409 otherwise).

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: payments:write.

Parameters

NameInTypeDescription
scheduledPaymentIdrequiredpathUuid

Identifier (scheduledPaymentId).

X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Idempotency-Keyheaderstring

Optional idempotency key; same semantics as on money operations.

Responses

  • 202 Accepted application/json

    Schema SimulationResult

    • simulationId Uuidrequired

    • kind SimulationKindrequired

    • status stringrequired

      queued: a provider event was stored and handed to the workers; submitted: the partner sandbox accepted it and notifies by webhook; applied: done synchronously.

      One of: "queued", "submitted", "applied"

    • provider SimulationProviderrequired

    • providerEventIds array of Uuidrequired

      providers.events rows written (provider event log).

    • providerReference string | nullrequired

    • details objectrequired

      Per kind (amounts, refs, rates, case id, …).

      Fields of details

      object

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 404 Resource does not exist in this tenant (cross-tenant ids also return 404), or feature disabled (`feature-disabled`). application/problem+json

    Body Problem; see the error catalogue.

  • 409 State conflict: `invalid-transition`, `duplicate-recipient`, `quote-expired`, `insufficient-funds`, `idempotency-key-in-use` (with Retry-After), `not-cancellable`. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X POST "https://bank.wirebloom.com/v1/simulations/scheduled-payments/{scheduledPaymentId}/run-now" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID"

Simulate a statement becoming available

POST /v1/simulations/statements

  • simulateStatement
  • API key scope webhooks:manage
  • Tenant customer

A statement.available integrator event for the balance.

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: webhooks:manage.

Parameters

NameInTypeDescription
X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Idempotency-Keyheaderstring

Optional idempotency key; same semantics as on money operations.

Request body

Required. application/json

Schema SimStatement

Responses

  • 202 Accepted application/json

    Schema SimulationResult

    • simulationId Uuidrequired

    • kind SimulationKindrequired

    • status stringrequired

      queued: a provider event was stored and handed to the workers; submitted: the partner sandbox accepted it and notifies by webhook; applied: done synchronously.

      One of: "queued", "submitted", "applied"

    • provider SimulationProviderrequired

    • providerEventIds array of Uuidrequired

      providers.events rows written (provider event log).

    • providerReference string | nullrequired

    • details objectrequired

      Per kind (amounts, refs, rates, case id, …).

      Fields of details

      object

  • 400 Malformed request: unparseable JSON, or an invalid header, path or query parameter (`errors[].field` is `header.X`, `path.x` or `query.x`). Body validation failures are 422 `validation-error`. application/problem+json

    Body Problem; see the error catalogue.

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 409 State conflict: `invalid-transition`, `duplicate-recipient`, `quote-expired`, `insufficient-funds`, `idempotency-key-in-use` (with Retry-After), `not-cancellable`. application/problem+json

    Body Problem; see the error catalogue.

  • 422 Semantically invalid request; `errors[]` lists field-level problems. Also `idempotency-key-reused` when the key was used with a different payload, `limit-exceeded`, `recipient-not-approved`. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X POST "https://bank.wirebloom.com/v1/simulations/statements" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID" \
  -H "Content-Type: application/json" \
  --data '{
  "balanceId": "0192a6f0-7c1e-7b3a-9d2e-5f4c3b2a1908"
}'

Send an integrator event to your endpoints

POST /v1/simulations/webhook-events

  • simulateWebhookEvent
  • API key scope webhooks:manage
  • Tenant customer

Delivered to the customer's active endpoints subscribed to the type, with data.sandbox: true.

Sandbox only: 404 feature-disabled wherever the sandbox is off (always in production). Callers: a wb_test_ API key of the customer, or a member session of a developer sandbox workspace (403 for live keys and other sessions). Every simulation answers 202 SimulationResult; queued outcomes arrive through the normal pipeline (ledger, notifications, integrator webhooks) within seconds. Rules: docs/SANDBOX.md.

API key scope: webhooks:manage.

Parameters

NameInTypeDescription
X-Tenant-IdrequiredheaderUuid

Tenant context: the operator tenant id (staff operations) or customer tenant id (customer operations). Validated against the caller's memberships; mismatch → 403. For API keys it must equal the key's customer id (customer-level keys are bound to one customer) or, for operator-level keys (P9-T08b), the operator id.

X-Request-Idheaderstring

Client-supplied correlation id. Generated by the server when absent; always echoed in the response and in problem details.

Idempotency-Keyheaderstring

Optional idempotency key; same semantics as on money operations.

Request body

Required. application/json

Schema SimWebhookEvent

Responses

  • 202 Accepted application/json

    Schema SimulationResult

    • simulationId Uuidrequired

    • kind SimulationKindrequired

    • status stringrequired

      queued: a provider event was stored and handed to the workers; submitted: the partner sandbox accepted it and notifies by webhook; applied: done synchronously.

      One of: "queued", "submitted", "applied"

    • provider SimulationProviderrequired

    • providerEventIds array of Uuidrequired

      providers.events rows written (provider event log).

    • providerReference string | nullrequired

    • details objectrequired

      Per kind (amounts, refs, rates, case id, …).

      Fields of details

      object

  • 400 Malformed request: unparseable JSON, or an invalid header, path or query parameter (`errors[].field` is `header.X`, `path.x` or `query.x`). Body validation failures are 422 `validation-error`. application/problem+json

    Body Problem; see the error catalogue.

  • 401 Missing, expired or invalid credentials (`unauthenticated`, `session-expired` with `reason` `idle` / `revoked` / `expired`, `invalid-api-key`, `mfa-required`). application/problem+json

    Body Problem; see the error catalogue.

  • 403 Authenticated but not allowed: missing capability or scope, tenant not in memberships, `step-up-required`, IP not allow-listed, impersonation restriction. application/problem+json

    Body Problem; see the error catalogue.

  • 409 State conflict: `invalid-transition`, `duplicate-recipient`, `quote-expired`, `insufficient-funds`, `idempotency-key-in-use` (with Retry-After), `not-cancellable`. application/problem+json

    Body Problem; see the error catalogue.

  • 422 Semantically invalid request; `errors[]` lists field-level problems. Also `idempotency-key-reused` when the key was used with a different payload, `limit-exceeded`, `recipient-not-approved`. application/problem+json

    Body Problem; see the error catalogue.

  • 429 Rate limit exceeded. application/problem+json

    Body Problem; see the error catalogue.

  • default Unexpected error (`500 internal-error`, `501 not-implemented`, `502 provider-error`, `503 service-unavailable`, `504 provider-timeout`). Money operations that time out at the provider are never retried blindly; their state becomes `exception`/unknown and is reconciled. application/problem+json

    Body Problem; see the error catalogue.

Code samples

Against the sandbox (https://bank.wirebloom.com/v1).

curl -X POST "https://bank.wirebloom.com/v1/simulations/webhook-events" \
  -H "Authorization: Bearer $WIREBLOOM_API_KEY" \
  -H "X-Tenant-Id: $WIREBLOOM_CUSTOMER_ID" \
  -H "Content-Type: application/json" \
  --data '{
  "type": "webhook.test"
}'