To decrease the risk of unintentional or malicious transfers in your platform, you can trigger additional reviews for transfers. Additional reviews require a member of your team to verify a transfer before Adyen processes it. You decide which members of your team are allowed to review transfers by assigning them the required API role in your Customer Area.
To complete the review, the reviewer must either approve or cancel the transfer. If the transfer is approved, then Adyen continues processing the transfer.
How it works
The following diagram shows the approval flow for a transfer when you trigger an additional review.
As shown in the previous diagram, the approval flow is the following:
- You trigger an additional review by including the review object in a POST /transfers request.
- The transfer request is pending approval until a member of your team completes the review.
- Depending on the decision of the reviewer, one of the following happens:
- If the reviewer approves the transfer, then the transfer is authorized and Adyen continues processing the request.
- If the reviewer cancels the transfer, then the transfer fails and Adyen can no longer processes the request.
- If the reviewer takes no action within 30 days after initiating the transfer request, then the transfer fails and Adyen can no longer processes the request.
A reviewer can approve or cancel multiple transfers at the same time. The following sections explain how make API requests to approve or cancel transfers.
Approve transfers
To approve initiated transfers, make a POST /transfers/approve request, specifying the following parameter:
| Parameter name | Type | Required | Description |
|---|---|---|---|
| transferIds | Body |  |
An array containing the unique identifiers of the transfers that you decide to approve. |
You can include one or multiple transferIds in the request. The following code sample shows how to make a POST /transfers/approve request with two transferIds.
If the request is successful, you receive an HTTP 200 OK response.
Strong Customer Authentication (SCA) for approving transfers
If a transfer requires SCA, you must do one of the following:
- Authenticate the user when initiating a transfer request.
- Authenticate the reviewer when approving a transfer request.
Because a reviewer can approve multiple transfers at the same time, performing SCA during approval allows you to satisfy the authentication requirements for multiple transfers with a single SCA process.
To trigger SCA during approval, you must set scaOnApproval to true in the POST /transfers request.
Cancel transfers
To cancel an initiated transfer, make a POST /transfers/cancel request, specifying the following parameter:
| Parameter name | Type | Required | Description |
|---|---|---|---|
| transferIds | Body | |
An array containing the unique identifiers of the transfers that you decide to cancel. |
You can include one or multiple transferIds in the request. The following code sample shows how to make a POST /transfers/cancel request with two transferIds.
If the request is successful, you receive an HTTP 200 OK response.
Get status updates on transfer reviews
For every transfer request, Adyen sends multiple webhooks to your server. Webhooks inform you about any status change in the transfers, including the approval status.
During the approval flow, you receive webhooks for the following events:
- The transfer is initiated and requires an additional review.
- The transfer is approved.
- The transfer is canceled.
- The transfer expires after 30 days because the review was not completed.
Adyen uses two types of webhooks to inform you about the approval status of a transfer:
- balancePlatform.transfer.created, which informs your server that a transfer was initiated in your platform.
- balancePlatform.transfer.updated, which informs your server of changes in the status of the transfer.
The following tabs explain how you can identify updates related to the approval status of a transfer.