> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Confirm a disbursement already paid to the worker > Records the gateway's own durable fact that a client bank ALREADY paid a worker. This is NOT a Dataprev operation: no rail credential is used, no government boundary is crossed, and Dataprev publishes no disbursement-confirmation operation to proxy. The gateway records what the client asserted; it asks no downstream product whether the payment is plausible. It accepts ORPHAN confirmations — money for a contract this deployment never registered locally — and a contract may be disbursed in MORE THAN ONE payment. The identity of a confirmation is (tenant, numero_contrato, payment_reference), so a second payment under a different reference on the same contract is a first acceptance with its own fact, never a conflict. X-Idempotency is mandatory, opaque, 1..128 bytes, and never defaulted. Two keys differing in one byte are two keys, and there is no X-Idempotency-Key alias. | Case | Status | X-Idempotency-Replayed | |---|---|---| | First acceptance | 202 | absent | | Same key, same request, served from the transport cache | 202, the identical bytes | true | | Same key, same request, served from the durable authority | 202, the identical bytes | absent | | Same key, divergent request | 422 — never the earlier body | whatever the shared middleware wrote | | New key, same payment | 202, the same body | absent | | New key, same payment reference, different money | 409 | whatever the shared middleware wrote | PostgreSQL is the authority on every row. The transport idempotency cache is a best-effort accelerator over it, in BOTH directions: whether that cache fails before the request is decided or after the confirmation is already committed, the answer is the durable one and the only difference on the wire is that the replay header is absent. A cache failure never turns a recorded payment into a 503. That is a different failure from a shared Redis outage, which the tenant rate limiter refuses first. ## OpenAPI ````yaml en/openapi/v3-current/consignado.yaml post /v1/consignado/contracts/{numero_contrato}/disbursement-confirmation openapi: 3.1.0 info: contact: email: contact@lerian.studio name: Lerian Studio url: https://lerian.studio description: >- OpenAPI 3.1 surface for Lerian Consignado — Dataprev. The API covers tenant credentials and rail configuration, worker margin, loan auctions and bids, contract registration and lifecycle, disbursement confirmation, portability, refinancing, renegotiation, FGTS guarantees, reconciliation, funds, assignments, usage, throughput, and event subscriptions. Secret material is written to the tenant secret store and is never returned by any operation. license: name: Lerian Studio General License title: Lerian Consignado API version: v1.0.0 servers: - url: https://consignado.sandbox.lerian.net security: - BearerAuth: [] tags: - description: >- Per-tenant Dataprev credential custody and public rail configuration (upload, status, rotation, revoke, requester code, and worker portal base URL) name: Credentials - description: >- Tenant-scoped consignado gateway usage: priced billable-unit aggregation per competência name: Consignado Usage - description: >- Per-tenant streaming-hub subscription control-plane (list, create, get, rotate, revoke, and test delivery) name: Subscriptions - description: >- Dataprev payroll-rail surface: FGTS balance and authorization reads, the FGTS guarantee execution, contract suspension, reactivation and term changes, the rail's own contract documents, and the on-demand reads of leilão solicitações, escriturações, repasses and employment terminations name: Consignado Rail - description: >- Synchronous rail command surface: the operations a bancarizador without the lender drives over HTTP. Each shares its command implementation with the equivalent lender event trigger. name: Consignado Rail Commands - description: >- Gateway-owned disbursement confirmation: a client bank recording money it has ALREADY paid to a worker. It crosses no government boundary and proxies no Dataprev operation. name: Consignado Disbursement - description: >- Per-tenant self-service outbound Dataprev rail throughput: read and set this tenant's own requests-per-second, including a deliberate pause at zero name: Consignado Throughput paths: /v1/consignado/contracts/{numero_contrato}/disbursement-confirmation: post: tags: - Consignado Disbursement summary: Confirm a disbursement already paid to the worker description: >- Records the gateway's own durable fact that a client bank ALREADY paid a worker. This is NOT a Dataprev operation: no rail credential is used, no government boundary is crossed, and Dataprev publishes no disbursement-confirmation operation to proxy. The gateway records what the client asserted; it asks no downstream product whether the payment is plausible. It accepts ORPHAN confirmations — money for a contract this deployment never registered locally — and a contract may be disbursed in MORE THAN ONE payment. The identity of a confirmation is (tenant, numero_contrato, payment_reference), so a second payment under a different reference on the same contract is a first acceptance with its own fact, never a conflict. X-Idempotency is mandatory, opaque, 1..128 bytes, and never defaulted. Two keys differing in one byte are two keys, and there is no X-Idempotency-Key alias. | Case | Status | X-Idempotency-Replayed | |---|---|---| | First acceptance | 202 | absent | | Same key, same request, served from the transport cache | 202, the identical bytes | true | | Same key, same request, served from the durable authority | 202, the identical bytes | absent | | Same key, divergent request | 422 — never the earlier body | whatever the shared middleware wrote | | New key, same payment | 202, the same body | absent | | New key, same payment reference, different money | 409 | whatever the shared middleware wrote | PostgreSQL is the authority on every row. The transport idempotency cache is a best-effort accelerator over it, in BOTH directions: whether that cache fails before the request is decided or after the confirmation is already committed, the answer is the durable one and the only difference on the wire is that the replay header is absent. A cache failure never turns a recorded payment into a 503. That is a different failure from a shared Redis outage, which the tenant rate limiter refuses first. operationId: confirmConsignadoDisbursement parameters: - description: >- The rail contract number the money was paid against (Manual 004 §2.2.2 p.18: Texto, 15). Exact, control-free UTF-8, bounded in BYTES: no trimming and no case folding. Nothing looks it up — an orphan confirmation for a contract this deployment never registered is first-class. in: path name: numero_contrato required: true schema: description: >- The rail contract number the money was paid against (Manual 004 §2.2.2 p.18: Texto, 15). Exact, control-free UTF-8, bounded in BYTES: no trimming and no case folding. Nothing looks it up — an orphan confirmation for a contract this deployment never registered is first-class. examples: - 99999999999AN1 maxLength: 15 minLength: 1 type: string - description: >- Mandatory opaque replay key, 1..128 bytes of valid UTF-8, preserved byte for byte. There is no default, no X-Idempotency-Key alias, no case folding and no normalization: two keys differing in one byte are two keys. in: header name: X-Idempotency required: true schema: description: >- Mandatory opaque replay key, 1..128 bytes of valid UTF-8, preserved byte for byte. There is no default, no X-Idempotency-Key alias, no case folding and no normalization: two keys differing in one byte are two keys. examples: - idem-desembolso-0001 maxLength: 128 minLength: 1 type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/DisbursementConfirmationRequest' required: true responses: '202': content: application/json: schema: $ref: '#/components/schemas/DisbursementConfirmationResponse' description: >- The confirmation is durably recorded. A replay of the same payment — under the same key or a new one — answers with the identical body. '401': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Authentication is required to access this resource. '403': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: You do not have permission to access this resource. '409': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: >- The key is in flight, or this payment reference already holds an immutable confirmation carrying different money. '413': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: The raw body exceeds the 1 KiB wire guard. '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: >- The transport key, the contract number or the body is refused. A key that already bought a DIFFERENT confirmation lands here too, and the earlier body is never returned. '501': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: This deployment records no disbursement confirmations. '503': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: >- Disbursement confirmation persistence is temporarily unavailable. Only mandatory persistence counts — PostgreSQL and the outbox. An idempotency-cache failure never produces this answer, in either direction: before the request is decided the cache is bypassed, and after the confirmation is committed the recorded 202 stands. security: - BearerAuth: [] components: schemas: DisbursementConfirmationRequest: additionalProperties: false properties: amount: description: >- The BRL amount already paid to the worker, as a canonical positive decimal string matching ^[1-9][0-9]*\.[0-9]{2}$ (at most 13 bytes). A string, never a JSON number: money never passes through a float. examples: - '2000.00' maxLength: 13 type: string paid_at: description: >- When the money was paid, strict RFC 3339 UTC with a literal Z (2026-08-01T12:00:00Z). Exactly one spelling per instant: a +00:00 offset, a lowercase z, fractional seconds or a missing zone are refused, never normalized. examples: - '2026-08-01T12:00:00Z' maxLength: 20 type: string payment_reference: description: >- The client's opaque payment reference — a Pix EndToEndId, a TED protocol number, an internal settlement id. Valid UTF-8, 1..256 bytes, preserved byte for byte with no trimming, case folding or normalization. examples: - E32074986202608011200A1B2C3D4E5F maxLength: 256 type: string required: - amount - paid_at - payment_reference type: object DisbursementConfirmationResponse: additionalProperties: false properties: amount: description: The confirmed amount, echoed verbatim. examples: - '2000.00' type: string confirmation_id: description: The gateway's identity for this immutable confirmation. examples: - 1f5b9c26-6f5a-4f77-9c1c-5d1c0f0a9b21 type: string confirmed_at: description: >- When the gateway durably recorded the confirmation, strict RFC 3339 UTC. examples: - '2026-08-01T12:00:05Z' type: string numero_contrato: description: >- The rail contract number the confirmation was addressed to, echoed from the path. examples: - 99999999999AN1 type: string paid_at: description: When the money was paid, echoed verbatim. examples: - '2026-08-01T12:00:00Z' type: string payment_reference: description: The client's payment reference, echoed verbatim. examples: - E32074986202608011200A1B2C3D4E5F type: string required: - confirmation_id - numero_contrato - amount - paid_at - payment_reference - confirmed_at type: object Detail: additionalProperties: false properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). examples: - ERR-0001 type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ````