> ## Documentation Index > Fetch the complete documentation index at: https://help.dash.fi/llms.txt > Use this file to discover all available pages before exploring further. # Get payments > Retrieves a list of payments within a specified date range (max 1 year). Requires 'from' and 'to' query parameters in YYYY-MM-DD format. ## OpenAPI ````yaml https://api.dash.fi/v1/public/swagger/doc.json get /payments openapi: 3.1.0 info: contact: email: support@dash.fi name: Dash.fi Support description: >- Service allows to fetch or operate on the data from the Dash.fi API. Requires API key authentication via Bearer token. Provide your API key as a Bearer token in the `Authorization` header. Example: `Authorization: Bearer YOUR_API_KEY` title: Public Dash.fi API version: '1.0' servers: - url: https://api.dash.fi/v1/public security: - BearerAuth: [] tags: - description: > Subscribe URLs to receive POSTed events as they happen in your account. Each endpoint subscribes to one or more **topics**; when a topic fires, Dash.fi delivers the event to your URL with a JSON body matching the topic's payload schema. There is no envelope — the body is the event payload directly. Event metadata (id, topic, timestamp, signature) is carried in headers. ### Topic → payload schema Topics are versioned: the format is `..v`. Breaking changes ship as a **new** topic (`.v2`) — the old version keeps delivering its existing schema until it's retired, so subscriptions are pinned and never shift schema underneath you. | Topic | Body schema | |---|---| | `card.financial_event.v1` | `CardFinancialEvent` — see `GET /cards/{id}/financial-events` in the **Card** section for the authoritative field list. | ### Delivery shape ``` POST HTTP/1.1 Content-Type: application/json X-Outpost-Event-Id: evt_abc123 X-Outpost-Topic: card.financial_event.v1 X-Outpost-Timestamp: 2026-05-05T10:00:00Z X-Outpost-Signature: v0= { ...payload matching the topic's schema... } ``` | Header | Meaning | |---|---| | `X-Outpost-Event-Id` | Stable event identifier — the same id is sent on retries. Use it to deduplicate; delivery is **at-least-once**. | | `X-Outpost-Topic` | The topic that fired this delivery. | | `X-Outpost-Timestamp` | RFC 3339 time the event was emitted. Reject deliveries where this drifts too far from your clock to mitigate replay. | | `X-Outpost-Signature` | `v0=` HMAC-SHA256 of the raw request body, keyed with your endpoint's signing secret. | ### Verifying the signature The signature is computed over the **raw request body**: ``` HMAC-SHA256(signing_secret, raw_body) ``` Encoded as hex, prefixed with `v0=`. **Use a constant-time comparison** to avoid timing attacks. `rawBody` is the unparsed request body — the exact `Buffer` or string you received over the wire, not a re-serialised JSON object. ```js import { createHmac, timingSafeEqual } from 'node:crypto'; function verify(rawBody, signatureHeader, secret) { if (!signatureHeader) return false; const expected = 'v0=' + createHmac('sha256', secret).update(rawBody).digest('hex'); // Header may carry multiple comma-separated signatures during a rotation window. return signatureHeader.split(',').some((sig) => { const got = Buffer.from(sig.trim()); const want = Buffer.from(expected); return got.length === want.length && timingSafeEqual(got, want); }); } ``` ### Secret rotation Rotating a signing secret keeps the previous secret valid for 24 hours so you can roll the new one out without dropped deliveries. During that window, the `X-Outpost-Signature` header carries comma-separated signatures (`v0=,v0=`); accept either. The new secret is shown **once** at rotation and is never retrievable later. name: Webhooks externalDocs: description: OpenAPI JSON Specification url: /v1/public/swagger/doc.json paths: /payments: get: tags: - Financial summary: Get payments description: >- Retrieves a list of payments within a specified date range (max 1 year). Requires 'from' and 'to' query parameters in YYYY-MM-DD format. parameters: - description: 'Start date for the query range (inclusive), Format: YYYY-MM-DD' example: '2024-01-01' in: query name: from required: true schema: type: string - description: 'End date for the query range (exclusive), Format: YYYY-MM-DD' example: '2024-12-31' in: query name: to required: true schema: type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/GetPaymentsResponse' description: A list of payments matching the criteria '400': content: application/json: schema: $ref: '#/components/schemas/ValidationErrorResponse' description: Validation error for query parameters (format, range, etc.) '401': content: application/json: schema: $ref: '#/components/schemas/UnauthorizedErrorResponse' description: Unauthorized access '500': content: application/json: schema: $ref: '#/components/schemas/InternalServerErrorResponse' description: Internal server error components: schemas: GetPaymentsResponse: properties: data: items: $ref: '#/components/schemas/Payment' type: array uniqueItems: false required: - data type: object ValidationErrorResponse: properties: code: type: string message: type: string required: - code type: object UnauthorizedErrorResponse: properties: code: example: unauthorized type: string message: example: authorization header not provided type: string required: - code type: object InternalServerErrorResponse: properties: code: example: internal-server-error type: string message: type: string required: - code type: object Payment: properties: amount: description: The monetary amount of the payment. example: '123.45' format: decimal multiple of 0.01 type: string descriptor: description: Optional descriptor that may appear on statements. example: Serious Media Group type: string dueDate: description: >- The date when the payment is due, represented as YYYY-MM-DD in UTC timezone. example: '2024-10-28' format: YYYY-MM-DD type: string id: description: The unique identifier for the payment. example: a1b2c3d4-e5f6-7890-1234-567890abcdef format: uuid type: string status: $ref: '#/components/schemas/payments.DisplayPaymentStatus' type: $ref: '#/components/schemas/payments.PaymentType' required: - amount - dueDate - id - status - type type: object payments.DisplayPaymentStatus: description: >- The current status of the payment. See array of constants for possible values. enum: - Completed - Scheduled - Failed - Cancelled - Informational example: Scheduled type: string x-enum-varnames: - DisplayPaymentStatusCompleted - DisplayPaymentStatusScheduled - DisplayPaymentStatusFailed - DisplayPaymentStatusCanceled - DisplayPaymentStatusInformational payments.PaymentType: description: >- The type category of the payment. See array of constants for possible values. enum: - net-1-repayment - net-3-repayment - net-7-repayment - net-15-repayment - net-20-repayment - net-30-repayment - net-45-repayment - net-60-repayment - net-90-repayment - account-fee - dispute-fee - late-payment-fee - failed-payment-fee - net-3-term-fee - net-7-term-fee - net-15-term-fee - net-20-term-fee - net-30-term-fee - net-45-term-fee - net-60-term-fee - net-90-term-fee - dispute-customer-event - net-1-ca-payment - net-30-ca-fee - net-60-ca-fee - net-90-ca-fee - net-30-ca-repayment - net-60-ca-repayment - net-90-ca-repayment example: net-30-repayment type: string x-enum-varnames: - PaymentTypeNet1Repayment - PaymentTypeNet3Repayment - PaymentTypeNet7Repayment - PaymentTypeNet15Repayment - PaymentTypeNet20Repayment - PaymentTypeNet30Repayment - PaymentTypeNet45Repayment - PaymentTypeNet60Repayment - PaymentTypeNet90Repayment - PaymentTypeAccountFee - PaymentTypeDisputeFee - PaymentTypeLatePaymentFee - PaymentTypeFailedPaymentFee - PaymentTypeNet3TermFee - PaymentTypeNet7TermFee - PaymentTypeNet15TermFee - PaymentTypeNet20TermFee - PaymentTypeNet30TermFee - PaymentTypeNet45TermFee - PaymentTypeNet60TermFee - PaymentTypeNet90TermFee - PaymentTypeDisputeCustomerEvent - PaymentTypeNet1CashAdvancePayment - PaymentTypeNet30CashAdvanceFee - PaymentTypeNet60CashAdvanceFee - PaymentTypeNet90CashAdvanceFee - PaymentTypeNet30CashAdvanceRepayment - PaymentTypeNet60CashAdvanceRepayment - PaymentTypeNet90CashAdvanceRepayment securitySchemes: BearerAuth: description: >- Type "Bearer" followed by a space and your API token. Obtain your key from the Dash.fi dashboard. Example: "Bearer YOUR_API_KEY" in: header name: Authorization type: apiKey ````