Disbursement API

Creates a payout to a mobile wallet, bank account or till on any channel. Creating a payout does not send it: every payout, on every channel and at every amount, is created in AWAITING_APPROVAL and no money moves until you approve it.

Use zonmpay.com specifically (without www the request is redirected and some HTTP clients drop the POST body — which causes a server error).

curl -X POST https://zonmpay.com/api/v2/payment/disbursement \
  -H "apiToken: SPP_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "Mobile disbursement",
    "amount": 50000,
    "service": "mobile",
    "account": "255684118011"
  }'

Note: Code 1120 with AWAITING_APPROVAL is the normal, healthy outcome. Keep data.reference — it is the only thing the approval step needs.

This one call approves and dispatches. There is no separate confirm step and no OTP, because the request must come from an IP address you registered on your project. Money leaving your wallet needs a second factor on top of the API key.

Use zonmpay.com specifically (without www the request is redirected and some HTTP clients drop the POST body — which causes a server error).

curl -X POST https://zonmpay.com/api/v2/payment/approve \
  -H "apiToken: SPP_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "reference": "SP009142" }'

Note: The debit block is the authoritative record of what left your wallet. Reconcile against totalDebit, not against amount. Re-approving an already APPROVED payout is safe and does not pay twice. On a 502, do not re-submit — poll the reference.

Creates many payouts in one request, and the records may mix channels. Each record becomes its own payment in AWAITING_APPROVAL and is approved individually by its own reference — a batch is a convenience for creation, not a way to approve in bulk.

Use zonmpay.com specifically (without www the request is redirected and some HTTP clients drop the POST body — which causes a server error).

curl -X POST https://zonmpay.com/api/v2/payment/disbursement/batch \
  -H "apiToken: SPP_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "March payouts",
    "records": [
      { "provider": "VODACOM", "service": "mobile", "account": "255712345678", "amount": 25000 }
    ]
  }'

Register every public IP your servers can call from. Entries are matched as exact strings: there is no CIDR or wildcard support, so 196.192.0.0/24 will never match. Register each application server, each NAT gateway, both addresses of any active/standby pair, and any outbound proxy.

Use zonmpay.com specifically (without www the request is redirected and some HTTP clients drop the POST body — which causes a server error).

curl -X POST https://zonmpay.com/api/v2/project/whitelist \
  -H "apiToken: SPP_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "ip_address": "196.192.0.10", "name": "Production API server" }'

Note: GET the same path to list entries and DELETE /api/v2/project/whitelist/{id} to remove one. Whitelisting applies only to the approve endpoint — collections, payout creation and every read endpoint work from anywhere.