Portmone API Gateway for Partners with PCI DSS level
Glossary
| Term | Definition |
|---|---|
| Merchant, Partner | Organisation which has signed a payment acceptance agreement with Portmone.com |
| Client, Customer | A person who visits the Merchant's web site in order to learn about the range of goods (services) and to make a purchase |
| Card, Payment Card | Payment cards of Visa, Mastercard international card associations and the National payment system PROSTIR |
| Authorization | The process of giving access rights or other powers to the Customer, program or process |
| Recurring Payments | Automatic payments (no participation of the client and re-entering card details required), which are carried out with the consent of the client |
| Token | A unique digital identifier of a card, which is generated during the first operation and then used for quick payment. Token can only be used to repeat a similar transaction as at the first payment |
| SHOPBILLID | A unique identifier (Id) assigned to every transaction (payment document) in the Portmone.com system |
| CVV2/CVC2 | CVV2 (Card Verification Value 2) is a three-digit card security code that helps verify legitimacy of a Visa payment card. The Mastercard payment system has similar card security code called CVC2 (Card Validation Code 2) |
| Acquiring Bank (Acquirer) | A bank that organizes banking cards acceptance points (terminals, ATM’s) and processes full range of financial operations connected with performing bank settlements and payments by banking cards at that points |
| Issuing Bank (Issuer) | A bank licensed as a member of a card association (like Visa or Mastercard), that issues and maintains payment cards |
| 3-D Secure | 3-D Secure is a protocol which used to secure handling of online bank card payments |
| PSP | PSP (Payment Service Provider) is a company that provides merchants with online services for accepting electronic payments by various payment methods. For this document this term refers to Portmone.com company |
| ACS | ACS (Access Control Server) is a tool used by card issuing banks to cardholder authentication (allow customers to verify their identity and offer a more secure transaction to the online merchants) |
| Client-Side Encryption (CSE) | Client-side encryption is a data protection technique in which information is encrypted on the Client's side using PSP provided Public key before being transmitted to a Merchant’s server. Encrypted data can’t be decrypted on Merchant’s side |
| IPS | International Payment System |
1. Introduction
Portmone Gateway API based on transparent type of integration with "Client-Side Encryption" (CSE) solution. CSE allows to reduce PCI DSS burden for merchant.
Cardholder data is encrypted on client side, so it cannot be read, and then passed to Portmone host. To decrypt the message from merchant’s side the unique client key is used.
Type of communication: host-to-host.
Type of protocol: HTTPS.
Type of messages to exchange the information: XML-messages or JSON notifications.
2. Preconditions
To get started with the API, you need:
- to have a PCI DSS certificate;
- apply for registration in the Portmone.com system;
- provide the URL-address for notifications (URL which will be used by Portmone.com system to send XML-messages by POST method via
dataparameter or notification in JSON format); - to append the rsa-co.min.js script on the payment page to use CSE solution.
The next parameters will be provided to the Merchant by Portmone.com after registration:
- payee id;
- login;
- password.
Endpoints
For payment by card or by token the following endpoint is used: https://www.portmone.com.ua/r3/pm/.
Endpoint for requests after the 3DS authorization: https://www.portmone.com.ua/r3/pm-mpi/.
2.1. Card data
To encrypt card data use rsa-co.min.js script. Methods of rsa-co.min.js should be called from PM object.
This script contained next methods:
PM.setPublicKey(publicKey) – sets the value of the public key;
PM.encrypt(cardData) – returns an object with encrypted bank card data;
cardData – object with necessary fields that describe card data, like:
{
"cardNumber":"4444333322221111",
"mm":"03",
"yy":"20",
"cvv2":"111"
}
<script type="text/javascript"
src="https://www.portmone.com.ua/r3/resources/services/js/lib/rsa-co.min.js">
</script>
<script type="text/javascript">
(function() {
PM.setPublicKey('key_value');
function encryptMyData() {
var postData = {};
var cardData = {
cardNumber : cardNumber,
mm : mm,
yy : yy,
cvv2 : cvv2
};
postData['encrypted-data'] = PM.encrypt(cardData);
// AJAX call or different handling of the post data.
}
})();
</script>
2.2. Signature
The rule to create a value for the signature field (example for PHP):
$login = 'WDISHOP';
$payeeId = '1185';
$shopOrderNumber = 'test123';
$billAmount='150';
$key = 'BDFC166F8AE2F5323A557DB6CA16758D';
$dt = date("YmdHis");
$strToSignature = $payeeId.$dt.bin2hex($shopOrderNumber).$billAmount;
$strToSignature = strtoupper($strToSignature).strtoupper(bin2hex($login));
$signature = strtoupper(hash_hmac('sha256', $strToSignature, $key));
The set of fields to create a
signaturemay vary for different methods. In case of differences from the example above, the set of fields involved in thesignaturegeneration will be given directly in the description of the method.
2.3. Asynchronous mode
In case when you are using parameter mode which set in 1111 value in your payment request, you will receive data with format and structure as follows on your notification URL:
Successful response:
{
"transactionId": "419344443",
"attemptId": "9m304ghzzl0k8c4cko08soww0sokcws",
"errorCode": "0",
"error": ""
}
Parameters description:
| Parameter | Description |
|---|---|
| transactionId | ID of the transaction in the Portmone.com system |
| attemptId | Request id which initiate payment by card. Randomly generated value, length 31 character (for example, 3wlk66m64q0wokcgkwog4040osw04ks) |
| errorCode | Error code (0 if payment was successful) |
| error | Error description |
Then, if error not occurred, on URL for the notifications will come the request with structure described in section 9.3 “Notification in JSON format”.
3. Payment methods
3.1. Payment by card
3.1.1. Create new payment
Description:
To make a payment you should send a request to the following URL: https://www.portmone.com.ua/r3/pm/.
Availability and restrictions:
Portmone.com doesn’t support cross-origin requests (CORS requests). It means that request should be sent from your server only.
Request structure:
Please, refer to "3.1.1 Payment by card request" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| paymentType | Must be set "card" value | Yes |
| payeeId | A unique identifier of the Partner. Assigned to each Partner individually when connected to the Portmone.com system | Yes |
| shopOrderNumber | Number of paid order in the Partner’s system | No |
| billAmount | Amount of the payment | Yes |
| emailAddress | Email address of the payer | No |
| shopSiteId | Digital identifier of a sales channel | No |
| billCurrency | Currency of the payment. Default value: UAH | No |
| description | Payment description (comment to the order/ payment details) | Yes |
| token | Set empty value | No |
| cardData | Encrypted value of payment card data (card number, expiration month, expiration year, CVV2) | Yes |
| preauthFlag | Payment pre-authorization flag (value "Y" indicates that this payment is carried out using the pre-authorization procedure (see section 5 "Reject/Confirm preauth payment"), value "N" is a regular payment without pre-authorization. The default is "N") | No |
| cvvVerifyFlag | The default is "Y", set "N" for payments without CVV2 | No |
| clientId | Set empty value | No |
| dt | Request creation time. Used to verify the signature. Should be sent in the following format: yyyymmddhhmmss (for example, 20181208130724) | Yes |
| signature | Request signature. Required to verify the legality of the request. Description of creating signature see above in section 2.2 "Signature" | Yes |
| mode | Set "1111" for asynchronous mode | No |
| attribute1 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute2 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute3 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute4 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) | No |
| lang | Payment system interface language: uk – Ukrainian, en – English,az – Azerbaijani, kz – Kazakh | No |
| clientIp | Payer's IP address | Yes |
Response structure:
Please, refer to "3.1.1 Payment by card response" to study the response structure.
Response parameters description:
| Parameter | Description |
|---|---|
| shopBillId | A unique identifier (ID) assigned to each transaction (payment document) in the Portmone.com system |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system |
| description | Comment to the order/ description of payment details |
| cardMask | Payer’s Card mask |
| billAmount | Transaction amount sent in request |
| authCode | Bank authorization code (added if the order is paid) |
| status | Order status. Possible values: PAYED, PREAUTH, REJECTED, CREATED |
| token | Token value for subsequent payments |
| MD | Parameter which should be sent to acsUrl for 3D Secure check |
| PaReq | Parameter which should be sent to acsUrl for 3D Secure check |
| is3DS | 3DS-authorization flag ("Y" – 3D Secure check is required, "N" – 3D Secure check is not required) |
| acsUrl | The card issuing bank page URL to which client should be redirected to confirm payment with 3D Secure |
| attribute1 | Service field (for additional order information). Filled at company’s discretion |
| attribute2 | Service field (for additional order information). Filled at company’s discretion |
| attribute3 | Service field (for additional order information). Filled at company’s discretion |
| attribute4 | Service field (for additional order information). Filled at company’s discretion |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) |
| errorCode | Error code (0 if payment was successful) |
| error | Error description |
3.1.2. Redirect to ACS
To proceed with 3DS verification Client should be redirected to the Issuing Bank website. To do so Partner should create a form and send it by POST method to Client’s browser.
Example:
var f = document.createElement("form");
f.setAttribute('method',"POST");
f.setAttribute('action',response.acsUrl);
var i = document.createElement("input");
i.setAttribute('type',"hidden");
i.setAttribute('name',"MD");
i.setAttribute('value',response.MD);
var i1 = document.createElement("input");
i1.setAttribute('type',"hidden");
i1.setAttribute('name',"TermUrl");
i1.setAttribute('value',TermUrl);
var i2 = document.createElement("input");
i2.setAttribute('type',"hidden");
i2.setAttribute('name',"PaReq");
i2.setAttribute('value',response.PaReq);
f.appendChild(i);
f.appendChild(i1);
f.appendChild(i2);
document.body.appendChild(f);
f.submit();
where acsUrl, MD, PaReq – values received in PSP response, TermUrl – your result URL to return from the bank page.
As soon as 3DS-check is passed and Client is returned on TermUrl link, Complete Payment Request to PSP should be sent (see section 3.1.3 "Complete payment").
3.1.3. Complete payment
Description:
To complete a payment you should send a request to the following URL: https://www.portmone.com.ua/r3/pm-mpi/.
Availability and restrictions:
No restrictions.
Request structure:
Please, refer to "3.1.3 Complete payment request" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| id | Order ID in the Portmone.com system | Yes |
| PaRes | The PaRes value received from the bank to your URL | Yes |
| MD | The MD value received from the bank to your URL | Yes |
| clientIp | Payer's IP address | Yes |
Response structure:
Please, refer to "3.1.3 Complete payment response (successful)" to study the response structure.
Response parameters description:
| Parameter | Description |
|---|---|
| shopBillId | A unique identifier (ID) assigned to each transaction (payment document) in the Portmone.com system |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system |
| description | Comment to the order / description of payment details |
| cardMask | Payer’s Card mask |
| billAmount | Transaction amount sent in request |
| authCode | Bank authorization code (added if the order is paid) |
| status | Order status |
| receiptUrl | Link to get a receipt |
| attribute1 | Service field (for additional order information). Filled at company’s discretion |
| attribute2 | Service field (for additional order information). Filled at company’s discretion |
| attribute3 | Service field (for additional order information). Filled at company’s discretion |
| attribute4 | Service field (for additional order information). Filled at company’s discretion |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) |
| errorCode | Error code (0 if payment was successful) |
| error | Error description |
| is3DS | 3DS-authorization flag ("Y" – 3D Secure check is required, "N" – 3D Secure check is not required) |
3.2. Create Token
Description:
This method allows you to get a value of the Token and the Client’s card mask. After performing this payment method, you will get the Token value and the mask of the Client’s Payment Card, which you can offer to the Client as a payment method on your resource. In the process of performing token creation operation, Portmone.com will perform authorization hold for 1 UAH on the Client's card, with the subsequent return of this amount to the Client's card.
Request should be sent at: https://www.portmone.com.ua/r3/pm/.
Availability and restrictions:
The description field sent by this method is the key to further payments by Token. It must be the same for further transactions as was provided in the first transaction. If this parameter is changed in further payments by Token, Client will receive an error message.
Request structure:
Please, refer to "3.2 createToken request" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| paymentType | To create a Token, you must set the value to "createToken" for this parameter | Yes |
| payeeId | A unique identifier of the Partner. Assigned to each Partner individually when connected to the Portmone.com system | Yes |
| shopOrderNumber | Number of paid order in the Partner’s system | No |
| billAmount | Amount of the payment | Yes |
| emailAddress | Email address of the payer | No |
| shopSiteId | Digital identifier of a sales channel. Set empty value | No |
| billCurrency | Currency of the payment. Default value: UAH | No |
| description | Payment description (comment to the order /payment details) | Required, identifies the Token in subsequent payments |
| token | Set empty value | No |
| cardData | Encrypted value of payment card data (card number, expiration month, expiration year, CVV2) | Yes |
| preauthFlag | Payment pre-authorization flag. Set empty value | No |
| cvvVerifyFlag | The default is "Y", set "N" if need operation without CVV2 | No |
| clientId | Set empty value | Yes |
| clientIp | Payer's IP address | Yes |
| dt | Request creation time. Used to verify the signature. Should be sent in the following format: yyyymmddhhmmss (for example, 20181208130724) | Yes |
| signature | Request signature. Required to verify the legality of the request. Description of creating signature see above in section 2.2 "Signature" | Yes |
| attribute1 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute2 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute3 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute4 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) | No |
Response structure:
Please, refer to "3.2 createToken response" to study the response structure.
Response parameters description:
| Parameter | Description |
|---|---|
| is3DS | 3DS-authorization flag ("Y" – 3D Secure check is required, "N" – 3D Secure check is not required) |
| shopBillId | A unique identifier (ID) assigned to each transaction (payment document) in the Portmone.com system |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system |
| description | Comment to the order / description of payment details |
| cardMask | Payer’s Card mask |
| billAmount | Transaction amount sent in request |
| status | Order status |
| token | Token value for subsequent payments |
| authCode | Bank authorization code (added if the order is paid) |
| mpiFlag | 3DS-authorization flag ("Y" – 3D Secure check is required, "N" – 3D Secure check is not required) |
| attribute1 | Service field (for additional order information). Filled at company’s discretion |
| attribute2 | Service field (for additional order information). Filled at company’s discretion |
| attribute3 | Service field (for additional order information). Filled at company’s discretion |
| attribute4 | Service field (for additional order information). Filled at company’s discretion |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) |
| errorCode | Error code (0 if payment was successful) |
| error | Error description |
3.3. Payment by Token
Description:
To make a payment via Token you should send a request to the following URL: https://www.portmone.com.ua/r3/pm/.
Availability and restrictions:
The description field should be the same as in initial payment (see section 3.2 "Create Token").
Request structure:
Please, refer to "3.3 Payment by Token request" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| paymentType | Set the value to "token" for this parameter | Yes |
| payeeId | A unique identifier of the Partner. Assigned to each Partner individually when connected to the Portmone.com system | Yes |
| shopOrderNumber | Number of paid order in the Partner’s system | No |
| billAmount | Amount of the payment | Yes |
| emailAddress | Email address of the payer | No |
| shopSiteId | Digital identifier of a sales channel | No |
| billCurrency | Currency of the payment. Default value: UAH | No |
| description | Payment description (comment to the order /payment details) | Yes |
| token | Set Token value | Yes |
| cardData | Encrypted value of CVV2 | Yes |
| preauthFlag | Payment pre-authorization flag (the value "Y" indicates that this payment is carried out using the pre-authorization procedure (see section 5 "Reject/Confirm preauth payment"), the value "N" is a regular payment without pre-authorization. The default is "N") | No |
| cvvVerifyFlag | The default is "Y", set "N" if need operation without CVV2 | No |
| clientId | Set empty value | Yes |
| clientIp | Payer's IP address | Yes |
| dt | Request creation time. Used to verify the signature. Should be sent in the following format: yyyymmddhhmmss (for example, 20181208130724) | Yes |
| signature | Request signature. Required to verify the legality of the request. Description of creating signature see above in section 2.2 "Signature" | Yes |
| mode | Set "1111" for asynchronous mode | No |
| attribute1 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute2 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute3 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute4 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) | No |
Response structure:
Please, refer to "3.3 Payment by Token response (successful)" to study the response structure.
Response parameters description:
| Parameter | Description |
|---|---|
| shopBillId | A unique identifier (ID) assigned to each transaction (payment document) in the Portmone.com system |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system |
| description | Comment to the order /description of payment details |
| authCode | Bank authorization code |
| receiptUrl | Link to get a receipt |
| token | Token value |
| mpiFlag | Return "N" |
| cardMask | Payer’s Card mask |
| billAmount | Transaction amount sent in request |
| status | PAYED – successful transaction, PREAUTH – successful transaction with pre-authorization |
| attribute1 | Service field (for additional order information). Filled at company’s discretion |
| attribute2 | Service field (for additional order information). Filled at company’s discretion |
| attribute3 | Service field (for additional order information). Filled at company’s discretion |
| attribute4 | Service field (for additional order information). Filled at company’s discretion |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) |
| errorCode | Error code (0 if payment was successful) |
3.4. Payment by Token without CVV2 (recurring payment)
Description:
To make a recurring payment you should send a request to the following URL: https://www.portmone.com.ua/r3/recurrent/.
Availability and restrictions:
No restrictions.
Request structure:
Please, refer to "3.4 Recurring payment request" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| paymentType | Must be set "recurrent" value | Yes |
| payeeId | A unique identifier of the Partner. Assigned to each Partner individually when connected to the Portmone.com system | Yes |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system | No |
| billAmount | Amount of the payment | Yes |
| emailAddress | Email address of the payer | No |
| shopSiteId | Digital identifier of a sales channel | No |
| billCurrency | Currency of the payment. Default value: UAH | No |
| description | Comment to the order/ description of payment details (should be the same as in initial payment) | Yes |
| token | Set Token value | Yes |
| cardData | Set empty value | No |
| preauthFlag | Payment pre-authorization flag (the value "Y" indicates that this payment is carried out using the pre-authorization procedure (see section 5 "Reject/Confirm preauth payment"), the value "N" is a regular payment without pre-authorization. The default is "N") | No |
| cvvVerifyFlag | Set "N" if need operation without CVV2 | Yes |
| clientId | Set empty value | Yes |
| clientIp | Payer's IP address | Yes |
| dt | Request creation time. Used to verify the signature. Should be sent in the following format: yyyymmddhhmmss (for example, 20181208130724) | Yes |
| signature | Request signature. Required to verify the legality of the request. Description of creating signature see above in section 2.2 "Signature" | Yes |
| mode | Set "1111" for asynchronous mode | No |
| attribute1 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute2 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute3 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute4 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute5 | Used to send the split parameters of the payment (see section "Splitting the payment" for details) | No |
3.5. Processing payment by MPS token
3.5.1. Processing payment with 3D Secure authentication
Description:
To process a payment using an MPS Token, you must send a request to the following URL: https://www.portmone.com.ua/r3/pm/.
Availability and restrictions:
Available for synchronous and asynchronous modes (corresponding mode values 1101 and 1111).
Request structure:
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| paymentType | Must be set "ips_token" value | Yes |
| payeeId | A unique identifier of the Partner. Assigned to each Partner individually when connected to the Portmone.com system | Yes |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system | No |
| billAmount | Amount of the payment | Yes |
| shopSiteId | Digital identifier of a sales channel | No |
| billCurrency | Currency of the payment. Default value: UAH | No |
| description | Comment to the order/ description of payment details (should be the same as in initial payment) | Yes |
| token | Set Token value | Yes |
| cardData | Payment data | Yes |
| cardNumber | Card number | Yes |
| mm | Card expiry (month) | Yes |
| yy | Card expiry (year) | Yes |
| cvv2 | Cryptogram | Yes |
| ipsTokenType | MPS identifier: MasterCard M4M, Visa VTS | Yes |
| cvvVerifyFlag | Set "N" if need operation without CVV2 | Yes |
| clientId | Set empty value | Yes |
| dt | Request creation time. Used to verify the signature. Should be sent in the following format: yyyymmddhhmmss (for example, 20181208130724) | Yes |
| signature | Request signature. Required to verify the legality of the request. Description of creating signature see above in section 2.2 "Signature" | Yes |
| clientIp | Payer's IP address | Yes |
| mode | Set "1111" for asynchronous mode | No |
Example of a request:
{
"description": "test",
"paymentType": "ips_token",
"billAmount": "1.1",
"billCurrency": "UAH",
"payeeId": "1185",
"shopOrderNumber": "1424371175",
"cvvVerifyFlag": "N",
"token": "<MPS_TOKEN>",
"cardData": {
"cardNumber": "5622734587535180",
"mm": "08",
"yy": "28",
"cvv2": "AIL3Y/7Yh7r1AIKьssPUAAADFA==",
"ipsTokenType": "M4M"
},
"dt": "20251002170015",
"signature": "652431DD041F8B4B5CDD384B1C33BA5776E39DF45095CBCC5692BE2E8BE5B98F",
"clientIp": "111.111.111.11",
"mode": "1101"
} https://docs.portmone.com.ua/docs/en/PortmoneHostToHostEng/#313-complete-payment
Response structure:
Examples of responses and their analysis are described in «3.1. Payment by card»
Example of a successful response after payment completion (example of a request for payment completion «3.1.3 Complete payment»
Response parameters description:
| Parameter | Description |
|---|---|
| shopBillId | A unique identifier (ID) assigned to each transaction (payment document) in the Portmone.com system |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system |
| description | Comment to the order /description of payment details |
| tokenExpDate | Token expiration date |
| bankRecurrentId | Acquirer payment ID |
| authCode | Bank authorization code |
| receiptUrl | Link to get a receipt |
| bank_name | Name of the acquiring bank |
| terminal_id | Acquire terminal number |
| merchant_id | Terminal name |
| rrn | Transaction identifierї (RRN) |
| token | Token value |
| mpiFlag | Return "N" |
| cardMask | Payer’s Card mask |
| billAmount | Transaction amount sent in request |
| status | PAYED – successful transaction, PREAUTH – successful transaction with pre-authorization |
| attribute1 | Service field (for additional order information). Filled at company’s discretion |
| attribute2 | Service field (for additional order information). Filled at company’s discretion |
| attribute3 | Service field (for additional order information). Filled at company’s discretion |
| attribute4 | Service field (for additional order information). Filled at company’s discretion |
| errorCode | Error code (0 if payment was successful) |
{
"notificationType": "success",
"receiptUrl": "https://www.portmone.com.ua/r3/services/receipts/get-receipts/shop-bill-id/30303537639b81147db3596bd1c2a5f5513f9a22d124b6d9d0deb9f92d8d1e4202dca9dcdb743dc0182185abea39cade2c4abf3bd3713a54c4b97637efb32c735469f1648a",
"token": "2032323333343035373031128848A92023070EB65A3CFD092629B03F47740FB4AD6A43E714AE8C839CD68A347F5ACA1D61F12CA67543841FE9BE40AFD30FD554FD76F51ACA267207A6",
"tokenExpDate": "12/26",
"bankRecurrentId": "MDHAE8GG87815",
"shopBillId": "2233405701",
"shopOrderNumber": "test123",
"description": "test",
"cardMask": "535562******1111",
"billAmount": "1.1",
"authCode": "628904",
"status": "PAYED",
"bank_name": "АТ «Райффайзен Банк»",
"terminal_id": "E0175922",
"merchant_id": "6650926",
"rrn": "601519698607",
"attribute1": "",
"attribute2": "",
"attribute3": "",
"attribute4": "",
"is3DS": "N",
"errorCode": "0",
"error": ""
}
3.5.2. Processing a recurring payment using an MPS Token
Description:
To process a payment using an MPS Token without CVV2, you must send a request to the following URL: https://www.portmone.com.ua/r3/pm/.
Availability and restrictions:
Available for synchronous and asynchronous modes (corresponding mode values 1101 and 1111).
Request structure:
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| paymentType | Must be set "ips_token_recurrent" value | Yes |
| payeeId | A unique identifier of the Partner. Assigned to each Partner individually when connected to the Portmone.com system | Yes |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system | No |
| billAmount | Amount of the payment | Yes |
| shopSiteId | Digital identifier of a sales channel | No |
| billCurrency | Currency of the payment. Default value: UAH | No |
| description | Comment to the order/ description of payment details (should be the same as in initial payment) | Yes |
| token | Set Token value | Yes |
| cardData | Payment data | Yes |
| cardNumber | Card number | Yes |
| mm | Card expiry (month) | Yes |
| yy | Card expiry (year) | Yes |
| cvv2 | Cryptogram | Yes |
| ipsTokenType | MPS identifier: MasterCard M4M, Visa VTS | Yes |
| cvvVerifyFlag | Set "N" if need operation without CVV2 | Yes |
| clientId | Set empty value | Yes |
| dt | Request creation time. Used to verify the signature. Should be sent in the following format: yyyymmddhhmmss (for example, 20181208130724) | Yes |
| signature | Request signature. Required to verify the legality of the request. Description of creating signature see above in section 2.2 "Signature" | Yes |
| clientIp | Payer's IP address | Yes |
| mode | Set "1111" for asynchronous mode | No |
Example of a request:
{
"description": "test",
"paymentType": "ips_token",
"billAmount": "1.1",
"billCurrency": "UAH",
"payeeId": "1185",
"shopOrderNumber": "1424371175",
"cvvVerifyFlag": "N",
"token": "<MPS_TOKEN>",
"cardData": {
"cardNumber": "4322734587535180",
"mm": "08",
"yy": "28",
"cvv2": "AIL3Y/7Yh7r1AIKьssPUAAADFA==",
"ipsTokenType": "VTS"
},
"dt": "20251002170015",
"signature": "652431DD041F8B4B5CDD384B1C33BA5776E39DF45095CBCC5692BE2E8BE5B98F",
"clientIp": "111.111.111.11",
"mode": "1101"
}
4. Payment via Privat24
4.1. Payment by card
Description:
To make a transaction through the Privat24 system you should send a request to the following URL: https://www.portmone.com.ua/r3/secure/gate/liq-pay.
Availability and restrictions:
No restrictions.
Request structure:
Please, refer to "4.1 Payment by card request" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| payee_Id | A unique identifier of the Partner | Yes |
| shop_order_number | Number of paid order (bill) in the Partner’s system | No |
| bill_amount | Amount of the order. Currency – hryvnia (UAH) | Yes |
| description | Comment to the order / description of payment details | Yes |
| lang | Privat24 system interface language. Possible values: en – English, uk – Ukrainian | Yes |
| encoding | Encoding | Yes |
| success_url | The Merchant URL address to which the client will be redirected after a successful payment | Yes |
| failure_url | The Merchant URL address to which the client will be redirected in case of payment rejection | Yes |
| clientIp | Payer's IP address | Yes |
4.2. Create Token
Description:
To create a Token through the Privat24 system you should send a request to the following URL: https://www.portmone.com.ua/r3/secure/gate/liq-pay.
Availability and restrictions:
No restrictions.
Request structure:
Please, refer to "4.2 Create token request" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| payee_Id | A unique identifier of the Partner | Yes |
| shop_order_number | Number of paid order (bill) in the Partner’s system | No |
| bill_amount | Amount of the order. Currency – hryvnia (UAH). Must be set "1" value | Yes |
| description | Comment to the order / description of payment details | Yes |
| success_url | The Merchant URL address to which the client will be redirected after a successful payment | Yes |
| failure_url | The Merchant URL address to which the client will be redirected in case of payment rejection | Yes |
| revert | "Y" – refund | Yes |
| lang | Privat24 system interface language. Possible values: en – English, uk – Ukrainian | Yes |
| encoding | Encoding | Yes |
| clientIp | Payer's IP address | Yes |
4.3. Payment by Token
Description:
To make a payment via Token you should send a request to the following URL: https://www.portmone.com.ua/r3/pm/.
Availability and restrictions:
No restrictions.
Request structure:
Please, refer to "4.3 Payment by Token request" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| paymentType | Set the value to "token" for this parameter | Yes |
| payeeId | A unique identifier of the Partner. Assigned to each Partner individually when connected to the Portmone.com system | Yes |
| shopOrderNumber | Number of paid order in the Partner’s system | No |
| billAmount | Amount of the payment | Yes |
| emailAddress | Email address of the payer | No |
| shopSiteId | Digital identifier of a sales channel | No |
| billCurrency | Currency of the payment. Default value: UAH | No |
| description | Payment description (in case of payment by token description should be the same as in initial payment) | Yes |
| token | Set Token value | Yes |
| cardData | Encrypted value of CVV2 | Yes |
| preauthFlag | Payment pre-authorization flag (the value "Y" indicates that this payment is carried out using the pre-authorization procedure (see section 5 "Reject/Confirm preauth payment"), the value "N" is a regular payment without pre-authorization. The default is "N") | No |
| cvvVerifyFlag | The default is "Y", set "N" if need operation without CVV2 | No |
| clientId | Set empty value | Yes |
| dt | Request creation time. Used to verify the signature. Should be sent in the following format: yyyymmddhhmmss (for example, 20181208130724) | Yes |
| signature | Request signature. Required to verify the legality of the request. Description of creating signature see above in section 2.2 "Signature" | Yes |
| clientIp | Payer's IP address | Yes |
| mode | Set "1111" for asynchronous mode | No |
| attribute1 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute2 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute3 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute4 | Service field (for additional order information). Filled at company’s discretion | No |
4.4. Payment by Token without CVV2 (recurring payment)
Description:
To make a recurring payment you should send a request to the following URL: https://www.portmone.com.ua/r3/recurrent/.
Availability and restrictions:
No restrictions.
Request structure:
Please, refer to "3.4 Recurring payment request" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| paymentType | Must be set "recurrent" value | Yes |
| payeeId | A unique identifier of the Partner. Assigned to each Partner individually when connected to the Portmone.com system | Yes |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system | No |
| billAmount | Amount of the payment | Yes |
| emailAddress | Email address of the payer | No |
| shopSiteId | Digital identifier of a sales channel | No |
| billCurrency | Currency of the payment. Default value: UAH | No |
| description | Comment to the order/ description of payment details (should be the same as in initial payment) | Yes |
| token | Set Token value | Yes |
| cardData | Set empty value | No |
| preauthFlag | Payment pre-authorization flag (the value "Y" indicates that this payment is carried out using the pre-authorization procedure (see section 5 "Reject/Confirm preauth payment"), the value "N" is a regular payment without pre-authorization. The default is "N") | No |
| cvvVerifyFlag | Set "N" if need operation without CVV2 | Yes |
| clientId | Set empty value | Yes |
| dt | Request creation time. Used to verify the signature. Should be sent in the following format: yyyymmddhhmmss (for example, 20181208130724) | Yes |
| signature | Request signature. Required to verify the legality of the request. Description of creating signature see above in section 2.2 "Signature" | Yes |
| clientIp | Payer's IP address | Yes |
| mode | Set "1111" for asynchronous mode | No |
| attribute1 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute2 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute3 | Service field (for additional order information). Filled at company’s discretion | No |
| attribute4 | Service field (for additional order information). Filled at company’s discretion | No |
5. Reject/Confirm preauth payment
5.1. Confirm preauth payment
Description:
To confirm preauth payment you should send the request to the following URL: https://www.portmone.com.ua/gateway/.
Availability and restrictions:
No restrictions.
Request structure:
Please, refer to "5.1 confirmPreauth request" to study the request structure.
Request parameters description:
| Parameter | Description |
|---|---|
| login | The Partner login to access account management |
| password | The Partner password |
| payeeId | A unique identifier of the Partner. Assigned to each Partner individually when connected to the Portmone.com system |
| shopOrderNumber | Number of paid order (bill) in the Online Store system. Maximum length is 120 symbols |
| token | Set token value |
| postauthAmount | Amount of the payment. It can not be more than the amount for which pre-authorization was carried out |
| id | ID of the request from the Partner to the Portmone.com system |
Response structure:
Please, refer to "5.1 confirmPreauth response" to study the response structure.
Response parameters description:
| Parameter | Description |
|---|---|
| shop_bill_id | Order ID in the Portmone.com system |
| shop_order_number | Number of paid order (bill) in the Online Store system. Maximum length is 120 symbols |
| description | Order description |
| bill_date | Bill date |
| pay_date | Payment date |
| pay_order_date | Banking memorial order date |
| bill_amount | Bill amount |
| auth_code | Bank authorization code (added if the order is paid) |
| status | Order status |
| attribute1 | Service field. Filled at the company’s discretion |
| attribute2 | Service field. Filled at the company’s discretion |
| error_code | Error code |
| error_message | Error message |
5.2.Reject preauth payment
Description:
If the transaction has status "PREAUTH" use this method to move the transaction to "REJECTED" status.
URL for request: https://www.portmone.com.ua/gateway/.
Availability and restrictions:
No restrictions.
Request structure:
Please, refer to "5.2 rejectPreauth request" to study the request structure.
Request parameters description:
| Parameter | Description |
|---|---|
| method | Required parameter to call the cancellation of payment with pre-authorization procedure. Value: rejectPreauth |
| login | The Partner login to access account management |
| password | The Partner password |
| payeeId | A unique identifier of the Partner. Assigned to each Partner individually when connected to the Portmone.com system |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system |
| id | ID of the request from the Partner to the Portmone.com system |
Response structure:
Please, refer to "5.2 rejectPreauth response (successful)" to study the response structure.
Response parameters description:
| Parameter | Description |
|---|---|
| description | Order description |
| status | Order status |
| attribute1-4 | Service fields (for additional order information) |
| commission | The value of the refunded commission from payment |
| shopBillId | Order ID in the Portmone.com system |
| shopOrderNumber | Number of paid order (bill) in the Partner’s system |
| billAmount | Bill amount |
| errorCode | Error code |
| errorMessage | Error message |
| authCode | Bank authorization code (added if the order is paid) |
| cardMask | Payer’s Card mask |
| token | Token value |
6. Receipt of payment token after payment
6.1. getToken
Description:
This method is used to obtain the Token by order number (shopOrderNumber).
You should send a request to the following URL: https://www.portmone.com.ua/r3/recurrent/.
Availability and restrictions:
No restrictions.
Request structure:
Please, refer to "6.1 getToken request (example for PHP)" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| method | To obtain a Token, you must set the value to "getToken" for this parameter | Yes |
| login | The Partner login to access account management | Yes |
| password | The Partner password | Yes |
| shopOrderNumber | Number of paid order (bill) in the Partnet’s system. Maximum length is 120 symbols | Yes |
| id | ID of the request from the Partner to the Portmone.com system | Yes |
Response structure:
Please, refer to "6.1 getToken response (tokenType: CARD)" and to "6.1 getToken response (tokenType: PRIVAT24)" to study the response structure.
Response parameters description:
| Parameter | Description |
|---|---|
| cardMask | Payer’s Card mask |
| billAmount | Transaction amount sent in request |
| billCurrency | Currency of the payment |
| token | Token value for subsequent payments |
| tokenType | CARD – in case of card payments, PRIVAT24 – in case of Privat24 payments |
| id | ID of the request from the Partner to the Portmone.com system |
6.2. getTokens
Description:
This method is used to obtain all tokens by description (description).
You should send a request to the following URL: https://www.portmone.com.ua/r3/api/gateway/.
Availability and restrictions:
No restrictions.
Request structure:
Please, refer to "6.2 getTokens request (example for PHP)" to study the request structure.
Request parameters description:
| Parameter | Description | Required |
|---|---|---|
| method | Must be set "getTokens" value | Yes |
| login | The Partner login to access account management | Yes |
| password | The Partner password | Yes |
| description | Payment description (comment to the order /payment details) | Yes |
| signature | Request signature. Required to verify the legality of the request. Description of creating signature see above in section 2.2 "Signature" and use fields from the example of signature below | Yes |
| dt | Request creation time. Should be sent in the following format: yyyymmddhhmmss (for example, 20181208130724) | Yes |
| payeeId | A unique identifier of the Partner. Assigned to each Partner individually when connected to the Portmone.com system | Yes |
| id | ID of the request from the Partner to the Portmone.com system | Yes |
Example of signature [PHP]:
$strToSignature = $payeeId.$dt.bin2hex($clientId);
$strToSignature = strtoupper($strToSignature).strtoupper(bin2hex($login));
$signature = strtoupper(hash_hmac('sha256', $strToSignature, $key));
Response structure:
Please, refer to "6.2 getTokens response to study the response structure.
Response parameters description:
| Parameter | Description |
|---|---|
| cardMask | Payer’s Card mask |
| billAmount | Amount of the payment |
| billCurrency | Currency of the payment. Default value: UAH |
| token | Token value |
| tokenType | CARD – in case of card payments, PRIVAT24 – in case of Privat24 payments |
| id | ID of the request from the Partner to the Portmone.com system |
6.3. Getting IPS data by Portmone token
Description:
The request must be sent to the URL: https://www.portmone.com.ua/r3/api/gateway.
Availability and restrictions:
Available after a card payment is made.
JSON request structure:
{
"method":"getDataTokenIPS",
"params":{
"data":{
"login":${MERCHANT_LOGIN},
"password":${MERCHANT_PASSWORD},
"tokenType":"PORTMONE",
"tokenReference":${TOKEN_REFERENCE}
}
},
"id":"1"
}
Request parameters description:
| Parameter | Description |
|---|---|
| MERCHANT_LOGIN | Merchant's login in the Portmone system |
| MERCHANT_PASSWORD | Merchant's password in the Portmone system |
| TOKEN_REFERENCE | Card token, returned by the Portmone system |
Response structure and example (Mastercard):
{
"result": {
"token_type": "M4M",
"token_info": {
"tokenUniqueReference": "DM4MMC0000****ed8d7249e",
"panUniqueReference": "FM4MMC000012971373*****6a75a3cf",
"productConfig": {
"termsAndConditionsUrl": "",
"issuerName": ",
"cardBackgroundCombinedAssetId": "954e89****8655a",
"iconAssetId": "7fcf53be****cf1fbfe",
"foregroundColor": "ffffff",
"issuerLogoAssetId": "cd90eb72****5cc1",
"shortDescription": "",
"customerServiceEmail": "",
"customerServicePhoneNumber": "",
"customerServiceUrl": "",
"isCoBranded": "false",
"brandLogoAssetId": "3789637f****c509"
},
"tokenInfo": {
"tokenPanSuffix": "4444",
"accountPanSuffix": "4444",
"tokenExpiry": "0823",
"accountPanExpiry": "",
"productCategory": "DEBIT",
"dsrpCapable": true,
"tokenAssuranceLevel": ""
}
}
},
"id": "1"
}
Response key parameters description:
| Parameter | Description |
|---|---|
| TOKEN_TYPE | Token type depending on the IPS |
| id | Unique response ID |
Response structure and example (Visa):
{
"result": {
"token_type": "VTS",
"token_info": {
"vPanEnrollmentID": "724bfc****38701",
"paymentInstrument": {
"expirationDate": {
"month": "11",
"year": "2023"
},
"last4": "1111",
"cvv2PrintedInd": "Y",
"expDatePrintedInd": "Y",
"enabledServices": {
"merchantPresentedQR": "N"
}
},
"cardMetaData": {
"backgroundColor": "0xffff00",
"foregroundColor": "0x000000",
"labelColor": "0x000000",
"contactWebsite": "https://www.aval.ua",
"contactEmail": "[email protected]",
"contactNumber": "+380444908888",
"contactName": "Raiffeisen Bank Aval",
"privacyPolicyURL": "https://www.aval.ua/storage/files/politika-konfidencijnosti-04042019_1554448866.pdf",
"termsAndConditionsURL": "https://aval.ua/storage/files/wallet-pi.pdf",
"shortDescription": "Visa Classic",
"cardData": [
{
"guid": "8407fa4e5****d705f6cb07",
"contentType": "cardSymbol",
"content": [
{
"mimeType": "image/png",
"width": "100",
"height": "100"
}
]
},
{
"guid": "09e037d****c17995ddf6",
"contentType": "digitalCardArt",
"content": [
{
"mimeType": "image/png",
"width": "1536",
"height": "969"
}
]
}
],
"issuerFlags": {
"deviceBinding": false,
"cardholderVerification": false,
"trustedBeneficiaryEnrollment": false,
"delegatedAuthenticationSupported": true
}
},
"vProvisionedTokenID": "ebc77cd5****bcc8885e01",
"tokenInfo": {
"tokenRequestorID": "1111111111",
"tokenStatus": "ACTIVE",
"last4": "",
"expirationDate": {
"month": "",
"year": ""
}
}
}
},
"id": "1"
}
Response key parameters description:
| Parameter | Description |
|---|---|
| TOKEN_TYPE | Token type depending on the IPS |
| id | Unique response ID |
| tokenInfo, cardMetaData, cardData | Card meta data |
6.4. Getting an asset by the unique IPS ID
Description:
The request must be sent to the URL: https://www.portmone.com.ua/r3/api/gateway.
Availability and restrictions:
Available after getting the IPS ID using getDataTokenIPS method according to p. 4.5. For getting an asset of each type it is necessary to make unique request containing the corresponding ID.
JSON request structure and example:
{
"method":"getMetaDataTokenIPS",
"params":{
"data":{
"login":${MERCHANT_LOGIN},
"password":${MERCHANT_PASSWORD},
"tokenType":${TOKEN_TYPE},
"metaDataId":${ASSET_ID}
}
},
"id":"1"
}
Request parameters description:
| Parameter | Description |
|---|---|
| MERCHANT_LOGIN | Merchant’s login in the Portmone system |
| MERCHANT_PASSWORD | Merchant’s password in the Portmone system |
| TOKEN_TYPE | Token type received using getDataTokenIPS method according to p. 4.5 |
| ASSET_ID: | Asset ID received using getDataTokenIPS method according to p. 4.5 (AssetId\guid) |
Response structure and example:
{
"result": {
"mediaContents": [
{
"data": "", //Base64 encoded content
"width": 1536,
"type": "image\/png",
"height": 969
}
]
},
"id": "1"
}
7. Transfer of funds from account to card (token)
Description: Allows you to transfer funds from an account to a Card or a Card Token. Merchant needs to sign an agreement with Bank.
** Important! ** When using this service, merchants become tax agents and are obliged to pay taxes (Income tax, SSC, Military tax). Exceptions are companies that have a license to carry out a special type of activity such as: MFIs (microcredit organizations), insurance companies .