Ondo Finance Sandbox API

openapi: 3.0.4
info:
  title: GM Backend Account Sandbox API
  description: An API spec for the Ondo GM Backend API.
  version: 1.0.0
servers:
- url: https://api.gm.ondo.finance
  description: GM Backend API
tags:
- name: Sandbox
paths:
  /v1/sandbox_deposit:
    post:
      summary: Sandbox Deposit
      description: Credits the account with funds in sandbox environment only.
      operationId: sandboxDeposit
      tags:
      - Sandbox
      security:
      - BearerAuth: []
      - ApiKeyAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SandboxDepositRequest'
      responses:
        '200':
          description: Deposit result
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/GenericResponse'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/SandboxDepositResult'
              example:
                success: true
                result:
                  deposit_address: '0x742d35Cc6634C0532925a3b844Bc9e7595f2bD18'
                  txn_hash: 0xabc123def456...
        '400':
          description: Bad request. The request was malformed or failed validation.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    example: false
                  error:
                    type: string
                    description: Human-readable error message
                  error_code:
                    type: string
                    enum:
                    - invalid_network
                    - invalid_symbol
              example:
                success: false
                error: Description of the error
                error_code: invalid_network
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /v1/sandbox_withdrawal:
    post:
      summary: Sandbox Withdrawal
      description: Debits the account in sandbox environment only.
      operationId: sandboxWithdrawal
      tags:
      - Sandbox
      security:
      - BearerAuth: []
      - ApiKeyAuth: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SandboxWithdrawalRequest'
      responses:
        '200':
          description: Withdrawal result
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/GenericResponse'
                - type: object
                  properties:
                    result:
                      $ref: '#/components/schemas/WithdrawalResult'
              example:
                success: true
                result:
                  withdrawal_status: WITHDRAWAL_PENDING
                  withdrawal_id: w_9f8e7d6c5b4a3210
                  customer_withdrawal_id: my-withdrawal-001
        '400':
          description: Bad request. The request was malformed or failed validation.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    example: false
                  error:
                    type: string
                    description: Human-readable error message
                  error_code:
                    type: string
                    enum:
                    - bad_withdrawal_address
                    - insufficient_funds
                    - internal_withdrawal_address
                    - invalid_network
                    - invalid_symbol
                    - invalid_withdrawal_network
                    - transfer_amount_precision_overflow
                    - withdrawal_address_not_found
                    - withdrawal_amount_too_small
                    - withdrawal_duplicate_customer_withdrawal_id
                    - withdrawal_error_insufficient_balance
                    - withdrawal_failed
                    - withdrawal_invalid_amount
                    - withdrawal_limit_exceeded
                    - withdrawal_missing_customer_withdrawal_id
                    - withdrawal_system_error
                    - withdrawal_try_later
              example:
                success: false
                error: Description of the error
                error_code: bad_withdrawal_address
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '429':
          $ref: '#/components/responses/TooManyRequests'
        '500':
          $ref: '#/components/responses/InternalServerError'
components:
  responses:
    Forbidden:
      description: Access denied. The authenticated account does not have permission.
      content:
        application/json:
          schema:
            type: object
            properties:
              success:
                type: boolean
                example: false
              error:
                type: string
                description: Human-readable error message
              error_code:
                type: string
                enum:
                - account_closed
                - account_not_allowed
                - forbidden
                - ip_not_permitted
                - key_doesnt_have_scope
          example:
            success: false
            error: Description of the error
            error_code: account_not_allowed
    TooManyRequests:
      description: Rate limit exceeded. Slow down request frequency.
      content:
        application/json:
          schema:
            type: object
            properties:
              success:
                type: boolean
                example: false
              error:
                type: string
                description: Human-readable error message
              error_code:
                type: string
                enum:
                - too_many_requests
          example:
            success: false
            error: Description of the error
            error_code: too_many_requests
    Unauthorized:
      description: Authentication required. Provide a valid JWT or API key.
      content:
        application/json:
          schema:
            type: object
            properties:
              success:
                type: boolean
                example: false
              error:
                type: string
                description: Human-readable error message
              error_code:
                type: string
                enum:
                - api_key_not_found
                - auth_expired
                - auth_invalid
                - auth_missing
                - failed_to_decode_hex_signature
                - failed_to_parse_timestamp
                - signature_mismatch
                - timestamp_too_far
          example:
            success: false
            error: Description of the error
            error_code: auth_missing
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            type: object
            properties:
              success:
                type: boolean
                example: false
              error:
                type: string
                description: Human-readable error message
              error_code:
                type: string
                enum:
                - server_is_busy
                - service_unavailable
                - unknown
          example:
            success: false
            error: Description of the error
            error_code: unknown
  schemas:
    SandboxDepositRequest:
      type: object
      required:
      - amount
      - symbol
      - deposit_destination
      - chain_id
      properties:
        amount:
          type: string
          description: Deposit amount as a decimal string
          example: '1000.00'
        symbol:
          type: string
          description: Token symbol
          example: USDC
        deposit_destination:
          $ref: '#/components/schemas/AccountWalletKey'
        chain_id:
          type: string
          description: Chain ID for the deposit
          example: eth-mainnet
          enum:
          - avax-c-chain
          - avax-fuji-c-chain
          - eth-mainnet
          - eth-sepolia
          - btc-mainnet
          - btc-testnet
          - sol-mainnet
          - sol-testnet
          - bsc-mainnet
          - bsc-testnet
    SandboxDepositResult:
      type: object
      properties:
        deposit_address:
          type: string
          description: Deposit address used
        txn_hash:
          type: string
          description: Transaction hash of the sandbox deposit
    AccountWalletKey:
      type: object
      required:
      - id
      - wallet
      properties:
        id:
          type: string
          description: The account ID
          example: '10458932786832481'
        wallet:
          type: string
          description: The wallet type
          enum:
          - main
          - margin
          example: margin
    WithdrawalResult:
      type: object
      required:
      - withdrawal_status
      - withdrawal_id
      - customer_withdrawal_id
      properties:
        withdrawal_status:
          type: string
          description: Status of the withdrawal
          example: WITHDRAWAL_PENDING
          enum:
          - WITHDRAWAL_SUCCESS
          - WITHDRAWAL_FAILURE
          - WITHDRAWAL_PENDING
          - WITHDRAWAL_CANCELLED
          - WITHDRAWAL_UNKNOWN
        withdrawal_id:
          type: string
          description: Internal withdrawal ID
        customer_withdrawal_id:
          type: string
          description: Customer-provided withdrawal ID
        hash:
          type: string
          description: On-chain transaction hash (when available)
    GenericResponse:
      type: object
      required:
      - success
      properties:
        success:
          type: boolean
          description: Whether the request was successful
          example: true
        error:
          type: string
          description: Error message, present only on failure
          example: ''
        error_code:
          type: string
          description: Semantic error code. See each endpoint's error responses for the specific codes it can return.
        deprecated:
          type: string
          description: Deprecation notice, if applicable
          example: ''
    SandboxWithdrawalRequest:
      type: object
      required:
      - customer_withdrawal_id
      - symbol
      - amount
      - from
      properties:
        customer_withdrawal_id:
          type: string
          description: User-specified withdrawal identifier
          example: my-withdrawal-001
        symbol:
          type: string
          description: Token symbol
          example: USDC
        amount:
          type: string
          description: Withdrawal amount as a decimal string
          example: '500.00'
        from:
          $ref: '#/components/schemas/AccountWalletKey'
  securitySchemes:
    apiKey:
      type: apiKey
      name: x-api-key
      in: header