> ## Documentation Index
> Fetch the complete documentation index at: https://docs.calmtreasury.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Execute an exchange withdrawal

> Execute a quoted withdrawal.

Executes a quoted withdrawal. A `{ requires_2fa: true }` response is not an
error — collect the code from the user and re-submit the same quote with
`twofa`.


## OpenAPI

````yaml api/openapi.json POST /v1/exchange/{exchange}/withdraw
openapi: 3.1.0
info:
  description: Fiat-to-USDC onramp API. The URL prefix (`/v1`) is the version contract.
  license:
    identifier: LicenseRef-Proprietary
    name: Proprietary
  title: Calm API
  version: v1
servers:
  - description: Production
    url: https://api.calmtreasury.xyz
  - description: Sandbox
    url: https://api.sandbox.calmtreasury.xyz
security: []
paths:
  /v1/exchange/{exchange}/withdraw:
    post:
      summary: Execute an exchange withdrawal
      description: >-
        Executes a quoted withdrawal. Returns the withdrawal (now `pending`), or
        `{ requires_2fa: true }` when the exchange demands a 2FA code —
        re-submit with `twofa`.
      operationId: executeExchangeWithdrawal
      parameters:
        - in: path
          name: exchange
          required: true
          schema:
            enum:
              - coinbase
            type: string
      requestBody:
        content:
          application/json:
            schema:
              properties:
                quote_id:
                  format: uuid
                  pattern: >-
                    ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                  type: string
                twofa:
                  type: string
                wallet:
                  pattern: ^0x[a-fA-F0-9]{40}$
                  type: string
              required:
                - wallet
                - quote_id
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                anyOf:
                  - properties:
                      completed_at:
                        format: date-time
                        type:
                          - string
                          - 'null'
                      created_at:
                        format: date-time
                        type: string
                      error_code:
                        type:
                          - string
                          - 'null'
                      error_message:
                        type:
                          - string
                          - 'null'
                      id:
                        format: uuid
                        pattern: >-
                          ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                        type: string
                      source:
                        properties:
                          amount:
                            type: string
                          network:
                            type: string
                          token:
                            type: string
                        required:
                          - token
                          - network
                          - amount
                        type: object
                      status:
                        enum:
                          - quoted
                          - pending
                          - broadcasted
                          - failed
                          - delayed
                        type: string
                      transaction_hash:
                        type:
                          - string
                          - 'null'
                    required:
                      - id
                      - status
                      - source
                      - transaction_hash
                      - error_code
                      - error_message
                      - created_at
                      - completed_at
                    type: object
                  - properties:
                      requires_2fa:
                        const: true
                        type: boolean
                    required:
                      - requires_2fa
                    type: object
          description: The withdrawal, or a 2FA challenge.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: >-
            Bad Request — `error.code` includes: generic_invalid_request,
            generic_validation_error, publishable_key_missing, quote_expired,
            quote_not_found, validation_error, withdrawal_2fa_incomplete,
            withdrawal_2fa_invalid, withdrawal_2fa_method_not_supported,
            withdrawal_2fa_required_email,
            withdrawal_2fa_required_face_recognition,
            withdrawal_2fa_required_multi_steps,
            withdrawal_2fa_required_passphrase, withdrawal_2fa_required_sms,
            withdrawal_2fa_required_yubikey, withdrawal_amount_above_maximum,
            withdrawal_amount_below_minimum, withdrawal_asset_not_supported,
            withdrawal_email_unverified, withdrawal_insufficient_balance,
            withdrawal_insufficient_balance_for_fee, withdrawal_invalid_address,
            withdrawal_kyc_required, withdrawal_network_not_supported,
            withdrawal_too_many_addresses.
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: 'Unauthorized — `error.code` includes: invalid_publishable_key.'
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: 'Forbidden — `error.code` includes: origin_not_allowed.'
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: 'Not Found — `error.code` includes: withdrawal_not_found.'
        '409':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: >-
            Conflict — `error.code` includes: exchange_reconnect_required,
            withdrawal_already_executed.
        '429':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: >-
            Too Many Requests — `error.code` includes: rate_limited,
            withdrawal_rate_limit_exceeded.
        '502':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
          description: >-
            Bad Gateway — `error.code` includes:
            apikey_insufficient_permissions, exchange_provider_error,
            generic_internal_server_error, generic_unauthorized,
            wallet_invalid_credentials, withdrawal_failed,
            withdrawal_provider_error.
      security:
        - publishableKey: []
components:
  schemas:
    Error:
      properties:
        error:
          properties:
            code:
              type: string
            message:
              type: string
          required:
            - code
            - message
          type: object
      required:
        - error
      type: object
  securitySchemes:
    publishableKey:
      description: Publishable key identifying the calling app.
      in: header
      name: x-calm-publishable-key
      type: apiKey

````