Portmone API Gateway for Partners with PCI DSS level
Glossary
| Term | Definition |
|---|---|
| Merchant, Partner | Organisation which has signed a payment acceptance agreement with Portmone.com |
| Client, Customer | A person who visits the Merchant's web site in order to learn about the range of goods (services) and to make a purchase |
| Card, Payment Card | Payment cards of Visa, Mastercard international card associations and the National payment system PROSTIR |
| Authorization | The process of giving access rights or other powers to the Customer, program or process |
| Recurring Payments | Automatic payments (no participation of the client and re-entering card details required), which are carried out with the consent of the client |
| Token | A unique digital identifier of a card, which is generated during the first operation and then used for quick payment. Token can only be used to repeat a similar transaction as at the first payment |
| SHOPBILLID | A unique identifier (Id) assigned to every transaction (payment document) in the Portmone.com system |
| CVV2/CVC2 | CVV2 (Card Verification Value 2) is a three-digit card security code that helps verify legitimacy of a Visa payment card. The Mastercard payment system has similar card security code called CVC2 (Card Validation Code 2) |
| Acquiring Bank (Acquirer) | A bank that organizes banking cards acceptance points (terminals, ATM’s) and processes full range of financial operations connected with performing bank settlements and payments by banking cards at that points |
| Issuing Bank (Issuer) | A bank licensed as a member of a card association (like Visa or Mastercard), that issues and maintains payment cards |
| 3-D Secure | 3-D Secure is a protocol which used to secure handling of online bank card payments |
| PSP | PSP (Payment Service Provider) is a company that provides merchants with online services for accepting electronic payments by various payment methods. For this document this term refers to Portmone.com company |
| ACS | ACS (Access Control Server) is a tool used by card issuing banks to cardholder authentication (allow customers to verify their identity and offer a more secure transaction to the online merchants) |
| Client-Side Encryption (CSE) | Client-side encryption is a data protection technique in which information is encrypted on the Client's side using PSP provided Public key before being transmitted to a Merchant’s server. Encrypted data can’t be decrypted on Merchant’s side |
| IPS | International Payment System |
1. Introduction
Portmone Gateway API based on transparent type of integration with "Client-Side Encryption" (CSE) solution. CSE allows to reduce PCI DSS burden for merchant.
Cardholder data is encrypted on client side, so it cannot be read, and then passed to Portmone host. To decrypt the message from merchant’s side the unique client key is used.
Type of communication: host-to-host.
Type of protocol: HTTPS.
Type of messages to exchange the information: XML-messages or JSON notifications.
2. Preconditions
To get started with the API, you need:
- to have a PCI DSS certificate;
- apply for registration in the Portmone.com system;
- provide the URL-address for notifications (URL which will be used by Portmone.com system to send XML-messages by POST method via
dataparameter or notification in JSON format); - to append the rsa-co.min.js script on the payment page to use CSE solution.
The next parameters will be provided to the Merchant by Portmone.com after registration:
- payee id;
- login;
- password.
Endpoints
For payment by card or by token the following endpoint is used: https://www.portmone.com.ua/r3/pm/.
Endpoint for requests after the 3DS authorization: https://www.portmone.com.ua/r3/pm-mpi/.
2.1. Card data
To encrypt card data use rsa-co.min.js script. Methods of rsa-co.min.js should be called from PM object.
This script contained next methods:
PM.setPublicKey(publicKey) – sets the value of the public key;
PM.encrypt(cardData) – returns an object with encrypted bank card data;
cardData – object with necessary fields that describe card data, like:
{
"cardNumber":"4444333322221111",
"mm":"03",
"yy":"20",
"cvv2":"111"
}
<script type="text/javascript"
src="https://www.portmone.com.ua/r3/resources/services/js/lib/rsa-co.min.js">
</script>
<script type="text/javascript">
(function() {
PM.setPublicKey('key_value');
function encryptMyData() {
var postData = {};
var cardData = {
cardNumber : cardNumber,
mm : mm,
yy : yy,
cvv2 : cvv2
};
postData['encrypted-data'] = PM.encrypt(cardData);
// AJAX call or different handling of the post data.
}
})();
</script>
2.2. Signature
The rule to create a value for the signature field (example for PHP):
$login = 'wdishop';
$payeeId = '1185';
$password = 'wdi451';
$shopOrderNumber = 'test123';
$billAmount='150';
$key = 'BDFC166F8AE2F5323A557DB6CA16758D';
$dt = date("YmdHis");
$strToSignature = $payeeId.$dt.bin2hex($shopOrderNumber).$billAmount;
$strToSignature = strtoupper($strToSignature).strtoupper(bin2hex($login));
$signature = strtoupper(hash_hmac('sha256', $strToSignature, $key));
The set of fields to create a
signaturemay vary for different methods. In case of differences from the example above, the set of fields involved in thesignaturegeneration will be given directly in the description of the method.
2.3. Asynchronous mode
In case when you are using parameter mode which set in 1111 value in your payment request, you will receive data with format and structure as follows on your notification URL:
Successful response:
{
"transactionId": "419344443",
"attemptId": "9m304ghzzl0k8c4cko08soww0sokcws",
"errorCode": "0",
"error": ""
}
Parameters description:
| Parameter | Description |
|---|---|
| transactionId | ID of the transaction in the Portmone.com system |
| attemptId | Request id which initiate payment by card. Randomly generated value, length 31 character (for example, 3wlk66m64q0wokcgkwog4040osw04ks) |
| errorCode | Error code (0 if payment was successful) |
| error | Error description |
Then, if error not occurred, on URL for the notifications will come the request with structure described in section 9.3 “Notification in JSON format”.
3. Payment methods
3.1. Payment by card
3.1.1. Create new payment
Description:
To make a payment you should send a request to the following URL: https://www.portmone.com.ua/r3/pm/.
Availability and restrictions:
Portmone.com doesn’t support cross-origin requests (CORS requests). It means that request should be sent from your server only.
Request structure:
Please, refer to "3.1.1 Payment by card request" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| paymentType | Must be set "card" value | Yes |
| payeeId | A unique identifier of the Partner. Assigned to each Partner individually when connected to the Portmone.com system | Yes |
| shopOrderNumber | Number of paid order in the Partner’s system | No |
| billAmount | Amount of the payment | Yes |
| emailAddress | Email address of the payer | No |
| shopSiteId | Digital identifier of a sales channel | No |
| billCurrency | Currency of the payment. Default value: UAH | No |
| description | Payment description (comment to the order/ payment details) | Yes |
| token | Set empty value | No |
| cardData | Encrypted value of payment card data (card number, expiration month, expiration year, CVV2) | Yes |
| preauthFlag | Payment pre-authorization flag (value "Y" indicates that this payment is carried out using the pre-authorization procedure (see section 5 "Reject/Confirm preauth payment"), value "N" is a regular payment without pre-authorization. The default is "N") | No |
| cvvVerifyFlag | The default is "Y", set "N" for payments without CVV2 | No |
| clientId | Set empty value | No |
| dt | Request creation time. Used to verify the signature. Should be sent in the following format: yyyymmddhhmmss (for example, 20181208130724) | Yes |
| signature | Request signature. Required to verify the legality of the request. Description of creating signature see above in section 2.2 "Signature" | Yes |
| mode | Set "1111" for asynchronous mode | No |
| attribute1 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute2 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute3 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute4 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) | No |
| lang | Payment system interface language: uk – Ukrainian, en – English,az – Azerbaijani, kz – Kazakh | No |
Response structure:
Please, refer to "3.1.1 Payment by card response" to study the response structure.
Response parameters description:
| Parameter | Description |
|---|---|
| shopBillId | A unique identifier (ID) assigned to each transaction (payment document) in the Portmone.com system |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system |
| description | Comment to the order/ description of payment details |
| cardMask | Payer’s Card mask |
| billAmount | Transaction amount sent in request |
| authCode | Bank authorization code (added if the order is paid) |
| status | Order status. Possible values: PAYED, PREAUTH, REJECTED, CREATED |
| token | Token value for subsequent payments |
| MD | Parameter which should be sent to acsUrl for 3D Secure check |
| PaReq | Parameter which should be sent to acsUrl for 3D Secure check |
| is3DS | 3DS-authorization flag ("Y" – 3D Secure check is required, "N" – 3D Secure check is not required) |
| acsUrl | The card issuing bank page URL to which client should be redirected to confirm payment with 3D Secure |
| attribute1 | Service field (for additional order information). Filled at company’s discretion |
| attribute2 | Service field (for additional order information). Filled at company’s discretion |
| attribute3 | Service field (for additional order information). Filled at company’s discretion |
| attribute4 | Service field (for additional order information). Filled at company’s discretion |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) |
| errorCode | Error code (0 if payment was successful) |
| error | Error description |
3.1.2. Redirect to ACS
To proceed with 3DS verification Client should be redirected to the Issuing Bank website. To do so Partner should create a form and send it by POST method to Client’s browser.
Example:
var f = document.createElement("form");
f.setAttribute('method',"POST");
f.setAttribute('action',response.acsUrl);
var i = document.createElement("input");
i.setAttribute('type',"hidden");
i.setAttribute('name',"MD");
i.setAttribute('value',response.MD);
var i1 = document.createElement("input");
i1.setAttribute('type',"hidden");
i1.setAttribute('name',"TermUrl");
i1.setAttribute('value',TermUrl);
var i2 = document.createElement("input");
i2.setAttribute('type',"hidden");
i2.setAttribute('name',"PaReq");
i2.setAttribute('value',response.PaReq);
f.appendChild(i);
f.appendChild(i1);
f.appendChild(i2);
document.body.appendChild(f);
f.submit();
where acsUrl, MD, PaReq – values received in PSP response, TermUrl – your result URL to return from the bank page.
As soon as 3DS-check is passed and Client is returned on TermUrl link, Complete Payment Request to PSP should be sent (see section 3.1.3 "Complete payment").
3.1.3. Complete payment
Description:
To complete a payment you should send a request to the following URL: https://www.portmone.com.ua/r3/pm-mpi/.
Availability and restrictions:
No restrictions.
Request structure:
Please, refer to "3.1.3 Complete payment request" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| id | Order ID in the Portmone.com system | Yes |
| PaRes | The PaRes value received from the bank to your URL | Yes |
| MD | The MD value received from the bank to your URL | Yes |
Response structure:
Please, refer to "3.1.3 Complete payment response (successful)" to study the response structure.
Response parameters description:
| Parameter | Description |
|---|---|
| shopBillId | A unique identifier (ID) assigned to each transaction (payment document) in the Portmone.com system |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system |
| description | Comment to the order / description of payment details |
| cardMask | Payer’s Card mask |
| billAmount | Transaction amount sent in request |
| authCode | Bank authorization code (added if the order is paid) |
| status | Order status |
| receiptUrl | Link to get a receipt |
| attribute1 | Service field (for additional order information). Filled at company’s discretion |
| attribute2 | Service field (for additional order information). Filled at company’s discretion |
| attribute3 | Service field (for additional order information). Filled at company’s discretion |
| attribute4 | Service field (for additional order information). Filled at company’s discretion |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) |
| errorCode | Error code (0 if payment was successful) |
| error | Error description |
| is3DS | 3DS-authorization flag ("Y" – 3D Secure check is required, "N" – 3D Secure check is not required) |
3.2. Create Token
Description:
This method allows you to get a value of the Token and the Client’s card mask. After performing this payment method, you will get the Token value and the mask of the Client’s Payment Card, which you can offer to the Client as a payment method on your resource. In the process of performing token creation operation, Portmone.com will perform authorization hold for 1 UAH on the Client's card, with the subsequent return of this amount to the Client's card.
Request should be sent at: https://www.portmone.com.ua/r3/pm/.
Availability and restrictions:
The description field sent by this method is the key to further payments by Token. It must be the same for further transactions as was provided in the first transaction. If this parameter is changed in further payments by Token, Client will receive an error message.
Request structure:
Please, refer to "3.2 createToken request" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| paymentType | To create a Token, you must set the value to "createToken" for this parameter | Yes |
| payeeId | A unique identifier of the Partner. Assigned to each Partner individually when connected to the Portmone.com system | Yes |
| shopOrderNumber | Number of paid order in the Partner’s system | No |
| billAmount | Amount of the payment | Yes |
| emailAddress | Email address of the payer | No |
| shopSiteId | Digital identifier of a sales channel. Set empty value | No |
| billCurrency | Currency of the payment. Default value: UAH | No |
| description | Payment description (comment to the order /payment details) | Required, identifies the Token in subsequent payments |
| token | Set empty value | No |
| cardData | Encrypted value of payment card data (card number, expiration month, expiration year, CVV2) | Yes |
| preauthFlag | Payment pre-authorization flag. Set empty value | No |
| cvvVerifyFlag | The default is "Y", set "N" if need operation without CVV2 | No |
| clientId | Set empty value | Yes |
| dt | Request creation time. Used to verify the signature. Should be sent in the following format: yyyymmddhhmmss (for example, 20181208130724) | Yes |
| signature | Request signature. Required to verify the legality of the request. Description of creating signature see above in section 2.2 "Signature" | Yes |
| attribute1 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute2 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute3 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute4 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) | No |
Response structure:
Please, refer to "3.2 createToken response" to study the response structure.
Response parameters description:
| Parameter | Description |
|---|---|
| is3DS | 3DS-authorization flag ("Y" – 3D Secure check is required, "N" – 3D Secure check is not required) |
| shopBillId | A unique identifier (ID) assigned to each transaction (payment document) in the Portmone.com system |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system |
| description | Comment to the order / description of payment details |
| cardMask | Payer’s Card mask |
| billAmount | Transaction amount sent in request |
| status | Order status |
| token | Token value for subsequent payments |
| authCode | Bank authorization code (added if the order is paid) |
| mpiFlag | 3DS-authorization flag ("Y" – 3D Secure check is required, "N" – 3D Secure check is not required) |
| attribute1 | Service field (for additional order information). Filled at company’s discretion |
| attribute2 | Service field (for additional order information). Filled at company’s discretion |
| attribute3 | Service field (for additional order information). Filled at company’s discretion |
| attribute4 | Service field (for additional order information). Filled at company’s discretion |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) |
| errorCode | Error code (0 if payment was successful) |
| error | Error description |
3.3. Payment by Token
Description:
To make a payment via Token you should send a request to the following URL: https://www.portmone.com.ua/r3/pm/.
Availability and restrictions:
The description field should be the same as in initial payment (see section 3.2 "Create Token").
Request structure:
Please, refer to "3.3 Payment by Token request" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| paymentType | Set the value to "token" for this parameter | Yes |
| payeeId | A unique identifier of the Partner. Assigned to each Partner individually when connected to the Portmone.com system | Yes |
| shopOrderNumber | Number of paid order in the Partner’s system | No |
| billAmount | Amount of the payment | Yes |
| emailAddress | Email address of the payer | No |
| shopSiteId | Digital identifier of a sales channel | No |
| billCurrency | Currency of the payment. Default value: UAH | No |
| description | Payment description (comment to the order /payment details) | Yes |
| token | Set Token value | Yes |
| cardData | Encrypted value of CVV2 | Yes |
| preauthFlag | Payment pre-authorization flag (the value "Y" indicates that this payment is carried out using the pre-authorization procedure (see section 5 "Reject/Confirm preauth payment"), the value "N" is a regular payment without pre-authorization. The default is "N") | No |
| cvvVerifyFlag | The default is "Y", set "N" if need operation without CVV2 | No |
| clientId | Set empty value | Yes |
| dt | Request creation time. Used to verify the signature. Should be sent in the following format: yyyymmddhhmmss (for example, 20181208130724) | Yes |
| signature | Request signature. Required to verify the legality of the request. Description of creating signature see above in section 2.2 "Signature" | Yes |
| mode | Set "1111" for asynchronous mode | No |
| attribute1 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute2 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute3 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute4 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) | No |
Response structure:
Please, refer to "3.3 Payment by Token response (successful)" to study the response structure.
Response parameters description:
| Parameter | Description |
|---|---|
| shopBillId | A unique identifier (ID) assigned to each transaction (payment document) in the Portmone.com system |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system |
| description | Comment to the order /description of payment details |
| authCode | Bank authorization code |
| receiptUrl | Link to get a receipt |
| token | Token value |
| mpiFlag | Return "N" |
| cardMask | Payer’s Card mask |
| billAmount | Transaction amount sent in request |
| status | PAYED – successful transaction, PREAUTH – successful transaction with pre-authorization |
| attribute1 | Service field (for additional order information). Filled at company’s discretion |
| attribute2 | Service field (for additional order information). Filled at company’s discretion |
| attribute3 | Service field (for additional order information). Filled at company’s discretion |
| attribute4 | Service field (for additional order information). Filled at company’s discretion |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) |
| errorCode | Error code (0 if payment was successful) |
3.4. Payment by Token without CVV2 (recurring payment)
Description:
To make a recurring payment you should send a request to the following URL: https://www.portmone.com.ua/r3/recurrent/.
Availability and restrictions:
No restrictions.
Request structure:
Please, refer to "3.4 Recurring payment request" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| paymentType | Must be set "recurrent" value | Yes |
| payeeId | A unique identifier of the Partner. Assigned to each Partner individually when connected to the Portmone.com system | Yes |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system | No |
| billAmount | Amount of the payment | Yes |
| emailAddress | Email address of the payer | No |
| shopSiteId | Digital identifier of a sales channel | No |
| billCurrency | Currency of the payment. Default value: UAH | No |
| description | Comment to the order/ description of payment details (should be the same as in initial payment) | Yes |
| token | Set Token value | Yes |
| cardData | Set empty value | No |
| preauthFlag | Payment pre-authorization flag (the value "Y" indicates that this payment is carried out using the pre-authorization procedure (see section 5 "Reject/Confirm preauth payment"), the value "N" is a regular payment without pre-authorization. The default is "N") | No |
| cvvVerifyFlag | Set "N" if need operation without CVV2 | Yes |
| clientId | Set empty value | Yes |
| dt | Request creation time. Used to verify the signature. Should be sent in the following format: yyyymmddhhmmss (for example, 20181208130724) | Yes |
| signature | Request signature. Required to verify the legality of the request. Description of creating signature see above in section 2.2 "Signature" | Yes |
| mode | Set "1111" for asynchronous mode | No |
| attribute1 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute2 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute3 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute4 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) | No |