List POPs for a referral

GET 
/referrals/:referralId/proof-of-payment

Returns every POP ever attached to the referral, newest first, including any that were rejected. Agents see only their own referrals; ZFA staff see any.

Request

Responses

200

Array of ProofOfPayment records.

401

Missing, malformed, or expired authentication token. Log in via POST /auth/login (or refresh via POST /auth/refresh) and retry with a fresh Authorization: Bearer <accessToken> header.

403

Referral is not visible to the caller.

404

Referral not found.

429

Rate limit exceeded. Global default is 120 requests/minute per IP; auth-flow, OTP, self-registration, WebAuthn, IRA lookup, and public-lead endpoints carry tighter per-endpoint limits. Retry after the delay indicated by the Retry-After header.

Response Headers

Retry-After

Seconds to wait before retrying.

500

Unhandled server error. The response carries a meta.requestId correlator you can hand to platform operations to trace the failure through structured logs and the hash-chained audit trail. Retry with the same Idempotency-Key header if the endpoint accepts idempotency.