The endpoint supports a mode where the request undergoes full token verification and body validation, but no actual operation is performed. No data is written to the database, and no WMIDs, wallets, or messages are affected. This is useful for pre-verifying that a token has the necessary permissions and that the request body is correctly formatted.
Enable this mode using one of the following methods (your choice):
- HTTP Header: X-Dry-Run: 1
- Query Parameter: ?dryrun=1 in the URL
Accepted values to enable: 1, true, yes (case-insensitive). Any other value or the absence of the parameter means the mode is disabled.
What is validated in dry-run¶
- JWT signature, expiration date, and revocation status.
- Presence of the specific scope/permission required by the endpoint.
- Compliance of request body fields with constraints (length, format, mandatory fields, matching purse/wmid with the token—identical to "live" mode).
What does NOT happen in dry-run¶
- Keeper methods or WebMoney XML interfaces are not called.
- Invoices are not created or cancelled, transfers are not executed, messages are not sent, and transaction histories are not retrieved.
- No IDs are generated (e.g., wmtranid, wminvid, message id, etc.).
Successful dry-run response example (JSON)¶
{
"reqn": 1730486400000,
"retval": 0,
"retdesc": "OK (dry-run)",
"dryrun": true
}
The field "dryrun": true indicates that the request was processed without performing a real operation. Data fields specific to operations (invoice, operation, message, purses, etc.) are not returned in this mode.
Errors in dry-run¶
Any authorization errors (401) or body validation errors (400) are returned exactly as they would be in live mode—dry-run does not suppress them. This is the primary purpose of the mode: to get the same validation result as a live call without side effects.
Note: If you only need to verify a token (without validating a specific request body), use the dedicated POST /V1/Introspect.ashx endpoint. It returns {"active": true/false, "scope": "...", "exp": ..., ...} according to the RFC 7662 OAuth 2.0 Token Introspection schema.