---
title: "Create withdraw request"
method: POST
path: "/api/v4/main-account/withdraw"
tags: ["Withdraw"]
---

# Create withdraw request

`POST /api/v4/main-account/withdraw`

The endpoint creates withdraw for the specified ticker.

<Warning>
Rate limit: 1000 requests/10 sec.
</Warning>

<Note>
The API does not cache the response.
</Note>

<Note>
Also, fiat currencies can't be withdrawn without KYC verification.
</Note>

## Request body

- object
  - `ticker` string, required — Currency's [ticker](/glossary#ticker). Example: BTC ⚠️ Currencies ticker must have "can_deposit" status equal to "true". Use [Asset Status endpoint](/public/http-v4/asset-status-list) to know more about currency.
  - `amount` string, required — Withdraw amount (including [fee](/glossary#fee)). To add the fee to the specified amount, use the /main-account/withdraw-pay request.
  - `address` string, required — Target address (wallet address for cryptocurrencies, identifier/[card token](/glossary#card-token) for [fiat](/glossary#fiat) currencies)
  - `memo` string — [Memo](/glossary#memodestination-tag). ⚠️ Required if currency is memoable.
  - `uniqueId` string, required — Unique transaction identifier. Any string up to 255 characters; not validated as a UUID. ⚠️ Generate a new unique ID for each withdrawal request.
  - `provider` string — [Fiat](/glossary#fiat) currency [provider](/glossary#provider). Example: VISAMASTER ⚠️ Required for fiat currencies. Currency provider should be taken from [Asset Status endpoint](/public/http-v4/asset-status-list) response.
  - `network` string — Cryptocurrency network. Available for multi network currencies. Example: OMNI ⚠️ Currency network should be taken from [Asset Status endpoint](/public/http-v4/asset-status-list) response. Default for USDT is ERC20
  - `partialEnable` boolean — Optional parameter for [FIAT](/glossary#fiat) withdrawals with increased Maximum Limit if set as "true". To use this parameter, the application must support "Partially successful" withdrawal status and latest updates in deposit/withdrawal history.
  - `customerIp` string — End-customer IP address forwarded to the [fiat](/glossary#fiat) [provider](/glossary#provider) for antifraud checks before the withdrawal is processed. ⚠️ Required if currency [ticker](/glossary#ticker) is USD or EUR with VISAMASTER [provider](/glossary#provider).
  - `beneficiary` object — Beneficiary information. ⚠️ Required if currency [ticker](/glossary#ticker) is one of: UAH_IBAN, USD_VISAMASTER, EUR_VISAMASTER, USD, EUR. Per-field requirements vary by currency and provider. Card-related fields (`cardToken`, `card.*`, `cardTokenSave`, `fingerprintSession`) apply only to card-acquiring rails; bank-related fields (`bank.*`) apply to bank-rail withdrawals; `tin` is required for UAH_IBAN; `phone`, `email`, and `birthDate` are required for VISAMASTER/Mercuryo rails. See `/asset-status-list` for the active provider per currency.
    - `firstName` string — Beneficiary first name. Max length: 40 symbols, latin letters and special characters. ⚠️ Required if currency [ticker](/glossary#ticker) is one of: UAH_IBAN, USD_VISAMASTER, USD, EUR
    - `lastName` string — Beneficiary last name. Max length: 40 symbols, latin letters and special characters. ⚠️ Required if currency [ticker](/glossary#ticker) is one of: UAH_IBAN, USD_VISAMASTER, USD, EUR
    - `tin` integer — Beneficiary TAX payer number. Integer, 10 digits. ⚠️ Required if currency is UAH_IBAN.
    - `phone` string — Beneficiary phone number. ⚠️ Required if currency [ticker](/glossary#ticker) is one of: USD_VISAMASTER, EUR_VISAMASTER
    - `email` string — Beneficiary email. ⚠️ Required if currency [ticker](/glossary#ticker) is one of: USD_VISAMASTER, EUR_VISAMASTER
    - `birthDate` string, date — Beneficiary birth date. Format: YYYY-MM-DD. ⚠️ Required if currency [ticker](/glossary#ticker) is one of: USD_VISAMASTER, EUR_VISAMASTER, or when withdrawing through Mercuryo.
    - `code` string — Beneficiary verification code returned by a prior verification step. Used by some card-acquiring flows that require a one-time verification challenge before settlement.
    - `cardToken` string — Tokenized payment-card identifier for card-acquiring rails. Use instead of raw PAN; obtain from the card-tokenisation endpoint or from a prior successful settlement on the same card.
    - `cardTokenSave` boolean — If `true`, request the acquiring provider to persist the card token for reuse on subsequent withdrawals to the same beneficiary.
    - `fingerprintSession` string — Anti-fraud device-fingerprint session identifier captured at the partner's checkout surface and forwarded to the acquiring provider. Required by some VISAMASTER configurations.
    - `card` object — Card details for card-acquiring rails. Use `cardToken` instead when available; raw card details apply only when a fresh card is being added.
      - `save` boolean — If `true`, persist the card for reuse on subsequent withdrawals.
      - `name` string — Cardholder name as embossed on the card.
      - `firstName` string — Cardholder first name.
      - `lastName` string — Cardholder last name.
      - `number` string — Primary Account Number (PAN). Treat as PCI-scope sensitive data on the partner side.
      - `month` string — Card expiry month as a two-digit string (`01`-`12`).
      - `year` string — Card expiry year as a four-digit string.
    - `address` object — Beneficiary postal address. Required for several VISAMASTER/SEPA configurations.
      - `line1` string — Street address line 1.
      - `line2` string — Street address line 2.
      - `city` string — City.
      - `zip` string — Postal / ZIP code.
      - `country` string — ISO country code.
    - `bank` object — Beneficiary bank details for bank-rail withdrawals (used when the destination is an account number rather than an IBAN).
      - `routingNumber` string — Bank routing number (ABA, BSB, sort code, or equivalent for the destination country).
      - `name` string — Bank name.
      - `address` string — Bank postal address.
      - `country` string — Bank country (ISO code).
  - `travelRule` object — Travel Rule information for regulatory compliance. ⚠️ Required if currency is crypto and the account is from [EEA](/glossary#european-economic-area-eea) See [Travel Rule Overview](/api-reference/travel-rule/overview) for complete documentation. **Legacy format:** The API still accepts the old flat format (`type`, `vasp`, `name`, `address` fields), but this format will not pass Travel Rule verification. To complete Travel Rule compliance, use the new structured format with `walletType`, `beneficiary`, and `vasp` objects.
    - `walletType` 'hosted' | 'unhosted' — Destination wallet type: - `hosted` - VASP-hosted wallet (exchange, custodian). Requires `vasp` object. - `unhosted` - Self-custody wallet (hardware, software). No `vasp` required.
    - `beneficiary` object — Beneficiary information.
      - `type` 'individual' | 'entity' — Beneficiary type: - `individual` - Natural person. Requires `firstName`, `lastName`. - `entity` - Legal entity. Requires `fullName`.
      - `firstName` string — First name. Required if `type` is `individual`.
      - `lastName` string — Last name. Required if `type` is `individual`.
      - `fullName` string — Full legal name. Required if `type` is `entity`.
      - `residenceCountry` string — Beneficiary's country of residence. ISO 3166-1 alpha-3 code (3 letters).
      - `address` object — Physical address.
        - `country` string — ISO 3166-1 alpha-3 country code.
        - `city` string — City name.
        - `postCode` string — Postal code.
        - `addressLine1` string — Street address.
    - `vaspData` object — VASP (Virtual Asset Service Provider) information. Required if `walletType` is `hosted`. Use `vaspId` if the destination VASP is in the list from [Get VASPs](/api-reference/travel-rule/get-vasps), otherwise use `vaspName`.
      - `vaspId` string — VASP ID from the [Get VASPs](/api-reference/travel-rule/get-vasps) endpoint. Use this if the VASP is in the list.
      - `vaspName` string — VASP name as a string. Use this if the VASP is not in the list.
  - `paymentDescription` string — Description of withdrawal destination ⚠️ Required if currency is crypto and withdrawal from whitebit-tr.com
  - `request` string, required — Request signature
  - `nonce` integer, required — Unique request identifier

## Response `201`

Validation succeeded and withdraw creation process is started. Check the request status by uniqueId in deposit/withdraw history.

- unknown[] — Empty array indicates success
  - unknown

## Other responses

- `400` — Request validation failed. Request-shape errors always carry `code: 0`; the business-rule codes 1–9 are returned with HTTP 422 (see below), not 400.
- `412` — Two-Factor Authentication (2FA) is required for this action but is not enabled on the account. Enable 2FA in account security settings, then retry. The HTTP 412 status distinguishes this precondition failure from the business-rule codes at 422.
- `422` — Inner validation failed. Business-rule codes (returned with HTTP 422): - 1 - currency is not withdrawable - 2 - specified address is invalid - 3 - amount is too small - 4 - amount is too small for the payment system - 5 - not enough balance - 6 - amount is less than or equals [fee](/glossary#fee) - 7 - amount should be integer (can happen for currencies with zero [precision](/glossary#precision) like Neo) - 8 - target withdraw amount without [fee](/glossary#fee) equals zero - 9 - address is unavailable (occurs for withdraws to own address) Additional account-state outcomes are also returned here with `code: 0` (the message is localized, so match on the condition rather than the exact string): - **Daily / monthly withdrawal limit reached** — on field `amount`. - **Withdrawals temporarily restricted** — after a security event (e.g. password change); on field `error`, e.g. `Withdrawals restricted until {time}`. - **Address blocked by compliance** — the request is accepted but the withdrawal transitions to an `AML_FROZEN` state (no distinct error body); check the request status by `uniqueId` in deposit/withdraw history.

---

[API](https://skmtc.net/whitebit/apis/whitebit-private-http-api-v4.md) · [All operations](https://skmtc.net/whitebit/apis/whitebit-private-http-api-v4/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/whitebit/whitebit-private-http-api-v4/revisions/76c9def9942f/schema)