Bank accounts & withdrawals

Two capabilities are involved and they are granted separately: bank manages payout destinations, and withdraw moves money. A token can hold one without the other.

List bank accounts

curl https://api.oropocket.com/partner/users/usr_xxx/bank-accounts \
  -H "Authorization: Bearer oro_live_xxx"

Returns the user's user_code plus a bank_accounts array. Each entry:

Add a bank account

Submit the holder name, account type, account number and IFSC. The bank and branch are resolved from the IFSC for you. A UPI handle can be stored alongside.

curl -X POST https://api.oropocket.com/partner/users/usr_xxx/bank-accounts \
  -H "Authorization: Bearer oro_live_xxx" \
  -d '{
    "account_holder_name": "Anya Sharma",
    "account_type": "savings",
    "account_number": "50100123456789",
    "ifsc_code": "HDFC0000123"
  }'

{
  "success": true,
  "data": {
    "user_code": "usr_xxx",
    "bank_account": {
      "id": 4821,
      "accountHolderName": "Anya Sharma",
      "accountType": "savings",
      "accountNumber": "**********6789",
      "ifscCode": "HDFC0000123",
      "bankName": "HDFC Bank",
      "branchName": "Banjara Hills",
      "upiId": null,
      "isVerified": false,
      "isPrimary": true,
      "createdAt": "2026-08-08T09:22:00.000Z"
    }
  }
}

Remove an account

The account is deactivated, not erased — it drops out of the list immediately and can no longer be used as a withdrawal destination, but past withdrawals keep pointing at the account they actually paid out to. Scoped to the user in the path, so you cannot deactivate an account belonging to someone else; an id that isn't theirs returns 404 BANK_ACCOUNT_NOT_FOUND.

curl -X DELETE https://api.oropocket.com/partner/users/usr_xxx/bank-accounts/4821 \
  -H "Authorization: Bearer oro_live_xxx"

Create a withdrawal

Withdrawals require approved KYC. If the user hasn't finished verification the call fails with 403 KYC_REQUIRED — run them through the KYC endpoints first. Buys, sells and receiving gifts have no such requirement.

curl -X POST https://api.oropocket.com/partner/users/usr_xxx/withdrawals \
  -H "Authorization: Bearer oro_live_xxx" \
  -H "Idempotency-Key: <uuid>" \
  -d '{"amount_inr": 2500, "bank_account_id": 4821}'

The response carries the user's code and a withdrawal object:

List withdrawals

Returns user_code, a withdrawals array and a pagination object. Rows are ordered newest first by created_at, with ties broken by an internal id, so the order is stable. Sandbox and live return the same fields. Each row:

pagination is { total, limit, offset, has_more }. total counts every withdrawal the user has, whatever its status; nothing is dropped from the history. You have read to the end when has_more is false. An offset past the end returns an empty array with has_more: false.

curl "https://api.oropocket.com/partner/users/usr_xxx/withdrawals?limit=20&offset=0" \
  -H "Authorization: Bearer oro_live_xxx"

Sandbox behaviour

In sandbox the payout rail is simulated but the state machine is real. Any amount whose paise end in .01 deterministically fails and refunds the user's test INR balance — so 2500.01 exercises your failure path on demand. Every other amount starts pending and moves to completed shortly after. Sandbox KYC still has to be approved first, which the magic PAN and Aadhaar values make instant.