12-Address Verification Failed (With Memo/Tag)

• Pre-Transaction Approval - Address Verification Failed on a memo-required network.
• GTR will send a callback request (callbackType=6) with an address and a non-empty tag (memo) whose combination should NOT be found in your system.
• Your server should return a failed verification response with the appropriate error code.
• This test targets networks whose deposits are only uniquely identified when both address and memo/tag are combined — for example HBAR, XLM, or XRP.

---

GTR Request (GTR → VASP)

• Method: POST
• Your Callback Endpoint: https://[YOUR_CALLBACK_URL]
• Authentication:
  • mTLS (Mutual Transport Layer Security) - GTR will authenticate using client certificates
• Header:
  • Content-Type: application/json
• Body:

{
    "requestId": "test-[RANDOM_ID]",
    "invokeVaspCode": "[YOUR_VASP_CODE]",
    "originatorVasp": "[TESTER_VASP_CODE]",
    "beneficiaryVasp": "[YOUR_VASP_CODE]",
    "callbackType": 6,
    "callbackData": {
        "requestId": "test-[RANDOM_ID]",
        "originatorVasp": "[TESTER_VASP_CODE]",
        "originatorVaspName": "[TESTER_VASP_NAME]",
        "ticker": "--YOU SHOULD NOT REFER THIS TICKER TO SEARCH YOUR USER--",
        "address": "[TEST_ADDRESS]",
        "tag": "[ADDRESS_TAG_MUST_BE_NON_EMPTY]-this-should-be-incorrect",
        "network": "[MEMO_REQUIRED_NETWORK_SYMBOL]",
        "initiatorVasp": "[TESTER_VASP_CODE]"
    }
}

curl -v --location --request POST 'https://[YOUR_CALLBACK_URL]' \
    -k \
    --header 'Content-Type: application/json' \
    --data-raw '{
        "requestId": "test-abc123def456",
        "invokeVaspCode": "[YOUR_VASP_CODE]",
        "originatorVasp": "[TESTER_VASP_CODE]",
        "beneficiaryVasp": "[YOUR_VASP_CODE]",
        "callbackType": 6,
        "callbackData": {
            "requestId": "test-abc123def456",
            "originatorVasp": "[TESTER_VASP_CODE]",
            "originatorVaspName": "[TESTER_VASP_NAME]",
            "ticker": "--YOU SHOULD NOT REFER THIS TICKER TO SEARCH YOUR USER--",
            "address": "[TEST_ADDRESS]",
            "tag": "[ADDRESS_TAG_MUST_BE_NON_EMPTY]-this-should-be-incorrect",
            "network": "[MEMO_REQUIRED_NETWORK_SYMBOL]",
            "initiatorVasp": "[TESTER_VASP_CODE]"
        }
    }'

Hint:

• callbackType: 6 indicates address verification for Pre-Transaction
• tag MUST NOT be null or empty in this test case — it is intentionally set to an incorrect (but non-empty) value
• Pick a network that requires a memo/tag on deposits — e.g. HBAR (memo), XLM (memo), XRP (destination tag)
• The (address, tag) pair in this test is intentionally mismatched and should NOT be found — even if the address alone could belong to a shared deposit account, the tag must not match any user
• Do NOT use the ticker field to search for users
• Your server should respond within 30 seconds

Materials:

• Receiver Callback API 1: Address Verification
• Authentication & mTLS Setup
• Callback Server Setup Guide
• Python Callback Server Example
• Golang Callback Server Example
• List of Networks
• Pre-Transaction Travel Rule Overview

---

Expected Response (VASP → GTR)

When the (address, tag) pair is not found in your system, you should return:

• HTTP Status Code: 200
• verifyStatus: 200001 (Address Not Found)

{
    "verifyStatus": 200001,
    "verifyMessage": "Address Not Found"
}

---

Test Validation

Success Criteria:

• ✅ Your callback server responds within 30 seconds
• ✅ HTTP status code 200 returned
• ✅ verifyStatus: 200001 indicates "Address Not Found"
• ✅ Lookup uses both address and tag — a mismatched tag on a memo-required network must fail verification
• ✅ Test data uses a memo-required network (HBAR / XLM / XRP / etc.) with a non-empty but incorrect tag

Common Issues:

• ⚠️ Address-only match returns success: On memo-required networks, ignoring tag will incorrectly resolve to a shared deposit address and pass a verification that should fail
• ⚠️ Null / empty tag: This test intentionally exercises a non-empty (but wrong) tag — treating it as absent is a bug
• ⚠️ Wrong Error Code: Must return verifyStatus: 200001 for address not found
• ⚠️ HTTP Status Confusion: Return HTTP 200 even for verification failures
• ⚠️ Ticker Reference: Do NOT use the ticker field to search for users