Client Postman collection

Use the client collection to inspect the client API's request methods, paths, and example field names. It contains 27 requests in 8 groups: 14 reads and 13 requests that require review before use because they change account state, configure routes, or initiate payments.

Production endpoint

This collection uses placeholders for credentials, identifiers and request values. It is an endpoint starter collection, not an exhaustive payload contract. The base URL points to production, and the collection includes payment requests. Review and authorize each request individually before use.

Download client collection ↓

The download is a Postman Collection v2.1 JSON file. Browse the endpoint inventory before importing it.

What is included

Group	Requests
Status	2
Wallets	4
Deposit accounts	4
Recipients	6
Deposits	1
Transfers	5
Payouts	2
FX and corridors	3

Every request is labeled [READ] or [REVIEW BEFORE USE]. The latter label is a review aid. The service enforces read, resources:write and payments:write; see permissions.

Prepare it for inspection

1. Import the JSON file into a private workspace.
2. Review the production baseUrl and the empty variables. The artifact contains no usable API key, account identifiers, beneficiary details, or populated body values.
3. Keep any approved credential local to your environment through your organization's secrets workflow. Do not save a real key in a shared collection or exported JSON.
4. Start with Health, Me, and List wallets, one request at a time, following the quickstart.
5. Review a specific use case and verify its released contract before entering other identifiers or sending further requests.

Collection contents

All 27 source request methods and paths are retained. The download remains fully parameterized rather than including example recipient details or amounts. Body field names are retained as an aid to review; literal field values are replaced with empty variables. Descriptions explain authentication, permissions and production use. The three scripts that automatically stored response identifiers have been removed. No saved response examples are included.

sync=true has been removed from all list-request defaults, including wallets. Other source query fields use empty placeholders and need deliberate review before use. The collection does not automatically populate identifiers from responses.

Credentials and permissions

Authorized client administrators manage their business’s keys in the portal, with separate read, payment and resource-management permissions. The secret is displayed once; the portal subsequently shows a masked identifier. Follow credentials and access to create, store, revoke or replace a key. XDC staff do not need your raw secret.

Before enabling writes

Confirm the required fields, valid values, organization and route eligibility, approval requirements, and error/retry behavior for each endpoint. In particular, do not automatically resubmit a payment after a timeout. The presence of a request or sample field is not a promise of a sandbox, idempotency, or a supported permission scope.