developer.globalpay.com Open in urlscan Pro
2620:12a:8000::1 Public Scan

Back to summary

URL:
https://developer.globalpay.com/hpp/3d-secure-two
Submission: On March 24 via manual (March 24th 2022, 11:44:35 am UTC) from GB — Scanned from GB

Form analysis
1 forms found in the DOM

<form><span class="fieldset">
    <p class="no-closeBtn"><input type="checkbox" value="check" id="chkMain" checked="checked" class="legacy-group-status optanon-status-checkbox"><label for="chkMain">Active</label></p>
  </span></form>

Text Content

Cookie Notice

We use cookies to analyze our traffic and track user behavior to help determine
how we can best improve the Developer Portal experience to meet your needs.


Close
Accept All
Cookie Settings


 * Your Privacy

 * Strictly Necessary Cookies

 * Performance Cookies

 * More Information

Privacy Preference Centre

Active

Always Active



Save Settings

Allow All

Skip to main content
menu

GBRchevron-down
Searchsearch
search
GP-API


ENABLE GP-API (PILOT)?

The Global Payments API (GP-API) is our REST API providing a single integration
to access our worldwide payment processing product.

Some of the products and solutions documented in this portal are still in
development on this API, so please review the table below before proceeding.

Solution Available? Card Payments (CNP/CP) Yes Local Payment Methods Yes
Transaction Management Yes Data Reporting Yes Disputes Management Yes Hosted
Fields Yes Card Storage Yes SCA & 3D Secure Yes DCC Yes* Digital Wallets Yes
Fraud Management Yes*

*Available with some limitations. Please contact api.integrations@globalpay.com
or your account manager for further information.

I understand, please enable GP-APINo thanks, take me back
Success

You have successfully switched and the content has been reloaded

Dismiss
chevron-down
Developer Portal
WelcomeDocumentationIntegrationsToolsAPI ExplorerSupport

API Explorer
API Reference
Overview

Card Payments
Authorization

Validate (OTB)

Credit

Offline

Supplementary Data

Generate Hash

Check Hash

Card Storage
Authorization

Validate (OTB)

Credit

Create a Customer

Edit a Customer

Store a Card

Edit a Card

Delete a Card

3DS1 - Verify Enrollment

3DS2 - Check Version

3DS2 - Authentication

3DS2 - Authorization

Dynamic Currency Conversion

Credential on File (CoF)

Continuous Authority

Generate Hash

Check Hash

Digital Wallets
Apple Pay

Google Pay

Generate Hash

Check Hash

Payment Methods
Initiate

Redirect to APM

Status Update

Refund

Test Pay

Supported Payment Methods

Generate Hash

Check Hash

PayPal
Payment-Set

Redirect to PayPal

Response from PayPal

Payment-Get

Payment-Do

Payment-Settle

Payment-Void

Payment-Credit

Generate Hash

Check Hash

3D Secure 2
Notification URLs

Gather Device Data

Check Version

ACS Method URL

Initiate Authentication

Optional Fields

Authentication Flows

ACS Challenge

Obtain Authentication Data

Authorization

Reporting

Error Codes

Generate Hash

3D Secure 1
Verify Enrollment

Redirect to Issuer ACS

Verify Signature

Authorization with 3D Secure

Generate Hash

Check Hash

Fraud Management
Fraud Filter & Data Submission

Address Verification Service

Hold

Release

Decision Manager

Decision Manager - Device Fingerprinting

Decision Manager - Travel Data

Generate Hash

Check Hash

Transaction Management
Capture

Refund

Void

Multi-Capture

Generate Hash

Check Hash

Dynamic Currency Conversion
Rate Lookup

Authorization with DCC

Generate Hash

Check Hash

Dynamic Descriptor

Payment Scheduler
Create

Search

Delete

Get

Macros

Generate Hash

Check Hash

Account Updater
Update

Status

Reporting

Airline Data

HPP Reference
Overview

Card Payments
Authorization

Validate (OTB)

iFrame/WebView Optimization

Pay By Link

Generate Hash

Check Hash

Card Storage
Create a payer and store a card

Display stored cards to the customer

Continuous Authority

Credential on File

Generate Hash

Check Hash

Payment Methods
Initiate

Redirect response

Status update

Test Pay

Supported payment methods

Generate Hash

Check Hash

PayPal
PayPal Example

Generate Hash

Check Hash

3D Secure 2
Mandatory Fields

Optional Fields

Flows & Response

3D Secure 1
ACS Simulator

Scenarios

Fraud Management
Fraud Filter & Data Submission

Address Verification Service

Decision Manager

Decision Manager - Device Fingerprinting

Generate Hash

Check Hash

Dynamic Currency Conversion
DCC Example

Generate Hash

Check Hash

Dynamic Descriptor



 * API Explorer
 * HPP Reference
 * 3D Secure 2
   




3D SECURE 2


Updated November, 2020

3D Secure (3DS) is an authentication protocol which aims to reduce fraud,
increase cardholder security and reduce merchant liability for chargebacks. It
introduced a step in the transaction process where the customer is shown a
screen hosted by or on behalf of their Issuer and is prompted to authenticate
themselves, often via a password or similar information that is only known to
the customer.

3DS 2 is designed with the mobile checkout experience in mind by introducing new
checkout flows that better suit customers paying on mobile with new
authentication methods, such as biometrics, or the option of a fully
frictionless flow by using a more comprehensive data set provided by the
merchant to authenticate the customer without the need for their intervention.

The Global Payments Hosted Payment Page will handle the entire 3D Secure
authentication flow, including determining which version of 3D Secure to use,
gathering the necessary device information and presenting the challenge to the
customer if required. Finally, the HPP will process the authorization with the
additional authentication information passed on to the Issuer.


EXEMPTIONS

One of the key advantages of 3D Secure 2 is that it provides a framework for
merchants to benefit from SCA exemptions under certain conditions. The idea
behind these exemptions is to allow for the development of a user-friendly
payment experience in circumstances where the risk is low.

Exemptions may be applied by the Issuer based on the transaction details or may
be specifically requested by the merchant, with their Acquirer’s permission. In
the authentication message you can request an exemption by including it in the
Challenge Request Indicator field (see note below).

For more information on the available exemptions requests and when to use them,
please refer to our dedicated article.

When a merchant requests an exemption they will no longer be able to avail of a
liability shift in the event of a chargeback.

For Mastercard exemption requests, please also refer to our Mastercard Message
Extension documentation.


MANDATORY & RECOMMENDED FIELDS

In this example we’re only passing mandatory fields along with some recommended
ones. The more optional fields you send and data you supply, the more likely the
authentication for the transaction will be frictionless. For the full list of
optional fields and the allowed values in each, please see the section below.

Java
PHP
.NET
HTML POST
...
Java
PHP
.NET
HTML POST

// configure client, request and HPP settings
GatewayConfig config = new GatewayConfig();
config.setMerchantId("MerchantId");
config.setAccountId("internet");
config.setSharedSecret("secret");
config.setServiceUrl("https://pay.sandbox.realexpayments.com/pay");

HostedPaymentConfig hostedPaymentConfig = new HostedPaymentConfig();
hostedPaymentConfig.setVersion(HppVersion.Version2);
config.setHostedPaymentConfig(hostedPaymentConfig);

// Add 3D Secure 2 Mandatory and Recommended Fields
HostedPaymentData hostedPaymentData = new HostedPaymentData();
hostedPaymentData.setCustomerEmail("james.mason@example.com");
hostedPaymentData.setCustomerPhoneMobile("44|07123456789");
hostedPaymentData.setAddressesMatch(false);

Address billingAddress = new Address();
billingAddress.setStreetAddress1("Flat 123");
billingAddress.setStreetAddress2("House 456");
billingAddress.setStreetAddress3("Unit 4");
billingAddress.setCity("Halifax");
billingAddress.setPostalCode("W5 9HR");
billingAddress.setCountry("826");

Address shippingAddress = new Address();
shippingAddress.setStreetAddress1("Apartment 825");
shippingAddress.setStreetAddress2("Complex 741");
shippingAddress.setStreetAddress3("House 963");
shippingAddress.setCity("Chicago");
shippingAddress.setState("IL");
shippingAddress.setPostalCode("50001");
shippingAddress.setCountry("840");
        
HostedService service = new HostedService(config);

try {
    String hppJson = service.charge(new BigDecimal("19.99"))
    .withCurrency("EUR")
    .withHostedPaymentData(hostedPaymentData)
    .withAddress(billingAddress, AddressType.Billing)
    .withAddress(shippingAddress, AddressType.Shipping)
    .serialize();
    // TODO: pass the HPP request JSON to the JavaScript, iOS or Android Library
} catch (ApiException exce) {
    // TODO: Add your error handling here
}





REQUEST SYNTAX

Type indicates whether the element is Mandatory (M), Optional (O), or
Conditional (C) - dependent on another field.

Unless otherwise stated in the description, the allowed special characters in an
alphanumeric string field are [/.-_‘,␣]

Element/Field Category Format Type Length Description
TimestampstringnumericM14Entered in the following format: YYYYMMDDHHMMSS.
If the timestamp is more than a day (86400 seconds) away from the current time,
the request will be rejected. Automatically set if using the SDK. Merchant
IDstringalphanumericM1-50Your Client ID assigned by Global Payments.
Allowed characters: [a-zA-Z0-9.] AccountstringalphanumericO0-30The sub-account
for this request to be processed through.
Allowed characters: [a-zA-Z0-9.] Order IdstringalphanumericM1-50A merchant
supplied reference to identify this transaction. Must be unique for each
attempt.
Allowed characters: [a-zA-Z0-9_-] AmountintegerM1-11The amount should be in the
smallest unit of the required currency For example, 2000 = €20.00
CurrencystringISO 4217M3The processing currency of the transaction. Please see
the list of Currency Codes. AutoSettle/AutoCapture FlagstringenumMUsed to
specify the settlement/capture type. Allowed values:
0 - Delayed Settle (Capture) / Authorize, don't automatically add to the
settlement file.
1 - Auto Settle (Capture) / Charge, automatically added to the next settlement
file.
MULTI - Multi Settle (Capture), don't automatically add to the settlement file.
Enables multiple settlement/capture requests up to 115% of the original
transaction value. CommentstringalphanumericO0-255You can submit up to two
comments about this request. This information will be displayed under the
transaction in Ecommerce Portal. HPP VersionintegerM1This must be set to 2.
ChannelstringenumON/AUsed to specify the type of transaction. Allowed values:

ECOM - E-commerce transaction
MOTO - Mail Order/Telephone Order transaction

Compatible with Global Payments and certain other Acquirers. Payer Email
AddressstringalphanumericM1-254Customer’s email address, including the full
domain name. The field must be submitted in the form name@host.domain (for
example, james.mason@example.com). The domain can be between 2-24 characters.
Allowed characters: [a-zA-Z0-9_-.]@[a-zA-Z0-9_-.].[a-zA-Z]
European merchants: mandatory for SCA. Mobile Phone NumberstringnumericC3|15 or
19The mobile phone number provided by the Cardholder. Should be In format of
'CountryCallingCode|Number' for example, '1|123456789'.

European merchants: mandatory for SCA if captured by your application or
website. Global Payments recommend you send at least one phone number (Mobile,
Home or Work). Billing Address Line 1stringalphanumericM1-50First line of the
customer's billing address.

European merchants: mandatory for SCA. Billing Address Line
2stringalphanumericM1-50Second line of the customer's billing address. Can be
submitted as blank if not relevant for the particular customer.

European merchants: mandatory for SCA. Billing Address Line
3stringalphanumericM1-50Third line of the customer's billing address. Can be
submitted as blank if not relevant for the particular customer.

European merchants: mandatory for SCA. Billing Address
CitystringalphanumericM1-40The city of the customer's billing address.

European merchants: mandatory for SCA. Billing Address StatestringISO
3166-2C0-3The state of the customer's billing address. Should be the country
subdivision code defined in ISO 3166-2 minus the country code itself. For
example, Illinois = IL. Applicable for US and CA addresses.

European merchants: if state applicable for the billing address country,
required for SCA. Billing Address Postal CodestringalphanumericM1-16ZIP or other
postal code customer's billing address.
Allowed characters: [a-zA-Z0-9-␣]

European merchants: mandatory for SCA. Billing Address CountrystringISO
3166-1M3The country of the customer's billing address. ISO 3166-1 numeric
three-digit country code. For example, US = 840.

European merchants: mandatory for SCA. Shipping Address Line
1stringalphanumericO0-50First line of the customer's shipping address.

European merchants: optional for SCA. Shipping Address Line
2stringalphanumericO0-50Second line of the customer's shipping address.

European merchants: optional for SCA. Shipping Address Line
3stringalphanumeric00-50Third line of the customer's shipping address.

European merchants: optional for SCA. Shipping Address
CitystringalphanumericO0-50The city of the customer's shipping address.

European merchants: optional for SCA. Shipping Address StatestringISO
3166-2O0-3The state of the customer's shipping address. Should be the country
subdivision code defined in ISO 3166-2 minus the country code itself. For
example, Illinois = IL. Applicable for US and CA addresses.

European merchants: if state applicable for the billing address country,
required for SCA. Shipping Address Postal CodestringalphanumericO0-16ZIP or
other postal code customer's shipping address.
Allowed characters: [a-zA-Z0-9-␣]

European merchants: optional for SCA. Shipping Address CountrystringISO
3166-1O0-3The country of the customer's shipping address. Numeric three-digit
country code. For example, US = 840.

European merchants: optional for SCA. Shipping Address Match
IndicatorBooleanN/AON/AIndicates whether the shipping address matches the
billing address.

European merchants: optional for SCA. Challenge Request
IndicatorstringenumON/AIndicates whether a challenge is requested for this
transaction. The Issuer may override whatever preference is specified in this
field. Allowed values:

NO_PREFERENCE - No preference as to whether the customer is challenged
NO_CHALLENGE_REQUESTED - Preference is for the customer not be challenged.
CHALLENGE_PREFERRED - Preference is for the customer to be challenged.
CHALLENGE_MANDATED - A challenge is required for the transaction to be
authorized due to local/regional mandates or other variables.
NO_CHALLENGE_REQUESTED_TRANSACTION_RISK_ANALYSIS_PERFORMED
NO_CHALLENGE_REQUESTED_DATA_SHARE_ONLY
NO_CHALLENGE_REQUESTED_SCA_ALREADY_PERFORMED
NO_CHALLENGE_REQUESTED_WHITELIST
CHALLENGE_REQUESTED_PROMPT_FOR_WHITELIST

European merchants: optional for SCA. Merchant Response URLstringStandard URL
FormatO0-255Used to set which URL in your application the transaction response
will be sent to. A fixed URL can also be added to your account by our support
team. Sha1hashstringalphanumericM40The signature for this request is made up of
transaction elements and your Shared Secret. Automatically set by the SDK.
Allowed characters: [0-9a-fA-F]

Show More

<?php
require_once('vendor/autoload.php');

use GlobalPayments\Api\Entities\Address;
use GlobalPayments\Api\Entities\Enums\AddressType;
use GlobalPayments\Api\ServiceConfigs\Gateways\GpEcomConfig;
use GlobalPayments\Api\HostedPaymentConfig;
use GlobalPayments\Api\Entities\HostedPaymentData;
use GlobalPayments\Api\Entities\Enums\HppVersion;
use GlobalPayments\Api\Entities\Exceptions\ApiException;
use GlobalPayments\Api\Services\HostedService;

// configure client, request and HPP settings
$config = new GpEcomConfig();
$config->merchantId = "MerchantId";
$config->accountId = "internet";
$config->sharedSecret = "secret";
$config->serviceUrl = "https://pay.sandbox.realexpayments.com/pay";

$config->hostedPaymentConfig = new HostedPaymentConfig();
$config->hostedPaymentConfig->version = HppVersion::VERSION_2;
$service = new HostedService($config);

// Add 3D Secure 2 Mandatory and Recommended Fields
$hostedPaymentData = new HostedPaymentData();
$hostedPaymentData->customerEmail = "james.mason@example.com";
$hostedPaymentData->customerPhoneMobile = "44|07123456789";
$hostedPaymentData->addressesMatch = false;

$billingAddress = new Address();
$billingAddress->streetAddress1 = "Flat 123";
$billingAddress->streetAddress2 = "House 456";
$billingAddress->streetAddress3 = "Unit 4";
$billingAddress->city = "Halifax";
$billingAddress->postalCode = "W5 9HR";
$billingAddress->country = "826";

$shippingAddress = new Address();
$shippingAddress->streetAddress1 = "Apartment 825";
$shippingAddress->streetAddress2 = "Complex 741";
$shippingAddress->streetAddress3 = "House 963";
$shippingAddress->city = "Chicago";
$shippingAddress->state = "IL";
$shippingAddress->postalCode = "50001";
$shippingAddress->country = "840";

try {
   $hppJson = $service->charge(19.99)
      ->withCurrency("EUR")
      ->withHostedPaymentData($hostedPaymentData)
      ->withAddress($billingAddress, AddressType::BILLING)
      ->withAddress($shippingAddress, AddressType::SHIPPING)
      ->serialize();      
   // TODO: pass the HPP JSON to the client-side    
} catch (ApiException $e) {
   // TODO: Add your error handling here
}





REQUEST SYNTAX

Type indicates whether the element is Mandatory (M), Optional (O), or
Conditional (C) - dependent on another field.

Unless otherwise stated in the description, the allowed special characters in an
alphanumeric string field are [/.-_‘,␣]

Element/Field Category Format Type Length Description
TimestampstringnumericM14Entered in the following format: YYYYMMDDHHMMSS.
If the timestamp is more than a day (86400 seconds) away from the current time,
the request will be rejected. Automatically set if using the SDK. Merchant
IDstringalphanumericM1-50Your Client ID assigned by Global Payments.
Allowed characters: [a-zA-Z0-9.] AccountstringalphanumericO0-30The sub-account
for this request to be processed through.
Allowed characters: [a-zA-Z0-9.] Order IdstringalphanumericM1-50A merchant
supplied reference to identify this transaction. Must be unique for each
attempt.
Allowed characters: [a-zA-Z0-9_-] AmountintegerM1-11The amount should be in the
smallest unit of the required currency For example, 2000 = €20.00
CurrencystringISO 4217M3The processing currency of the transaction. Please see
the list of Currency Codes. AutoSettle/AutoCapture FlagstringenumMUsed to
specify the settlement/capture type. Allowed values:
0 - Delayed Settle (Capture) / Authorize, don't automatically add to the
settlement file.
1 - Auto Settle (Capture) / Charge, automatically added to the next settlement
file.
MULTI - Multi Settle (Capture), don't automatically add to the settlement file.
Enables multiple settlement/capture requests up to 115% of the original
transaction value. CommentstringalphanumericO0-255You can submit up to two
comments about this request. This information will be displayed under the
transaction in Ecommerce Portal. HPP VersionintegerM1This must be set to 2.
ChannelstringenumON/AUsed to specify the type of transaction. Allowed values:

ECOM - E-commerce transaction
MOTO - Mail Order/Telephone Order transaction

Compatible with Global Payments and certain other Acquirers. Payer Email
AddressstringalphanumericM1-254Customer’s email address, including the full
domain name. The field must be submitted in the form name@host.domain (for
example, james.mason@example.com). The domain can be between 2-24 characters.
Allowed characters: [a-zA-Z0-9_-.]@[a-zA-Z0-9_-.].[a-zA-Z]
European merchants: mandatory for SCA. Mobile Phone NumberstringnumericC3|15 or
19The mobile phone number provided by the Cardholder. Should be In format of
'CountryCallingCode|Number' for example, '1|123456789'.

European merchants: mandatory for SCA if captured by your application or
website. Global Payments recommend you send at least one phone number (Mobile,
Home or Work). Billing Address Line 1stringalphanumericM1-50First line of the
customer's billing address.

European merchants: mandatory for SCA. Billing Address Line
2stringalphanumericM1-50Second line of the customer's billing address. Can be
submitted as blank if not relevant for the particular customer.

European merchants: mandatory for SCA. Billing Address Line
3stringalphanumericM1-50Third line of the customer's billing address. Can be
submitted as blank if not relevant for the particular customer.

European merchants: mandatory for SCA. Billing Address
CitystringalphanumericM1-40The city of the customer's billing address.

European merchants: mandatory for SCA. Billing Address StatestringISO
3166-2C0-3The state of the customer's billing address. Should be the country
subdivision code defined in ISO 3166-2 minus the country code itself. For
example, Illinois = IL. Applicable for US and CA addresses.

European merchants: if state applicable for the billing address country,
required for SCA. Billing Address Postal CodestringalphanumericM1-16ZIP or other
postal code customer's billing address.
Allowed characters: [a-zA-Z0-9-␣]

European merchants: mandatory for SCA. Billing Address CountrystringISO
3166-1M3The country of the customer's billing address. ISO 3166-1 numeric
three-digit country code. For example, US = 840.

European merchants: mandatory for SCA. Shipping Address Line
1stringalphanumericO0-50First line of the customer's shipping address.

European merchants: optional for SCA. Shipping Address Line
2stringalphanumericO0-50Second line of the customer's shipping address.

European merchants: optional for SCA. Shipping Address Line
3stringalphanumeric00-50Third line of the customer's shipping address.

European merchants: optional for SCA. Shipping Address
CitystringalphanumericO0-50The city of the customer's shipping address.

European merchants: optional for SCA. Shipping Address StatestringISO
3166-2O0-3The state of the customer's shipping address. Should be the country
subdivision code defined in ISO 3166-2 minus the country code itself. For
example, Illinois = IL. Applicable for US and CA addresses.

European merchants: if state applicable for the billing address country,
required for SCA. Shipping Address Postal CodestringalphanumericO0-16ZIP or
other postal code customer's shipping address.
Allowed characters: [a-zA-Z0-9-␣]

European merchants: optional for SCA. Shipping Address CountrystringISO
3166-1O0-3The country of the customer's shipping address. Numeric three-digit
country code. For example, US = 840.

European merchants: optional for SCA. Shipping Address Match
IndicatorBooleanN/AON/AIndicates whether the shipping address matches the
billing address.

European merchants: optional for SCA. Challenge Request
IndicatorstringenumON/AIndicates whether a challenge is requested for this
transaction. The Issuer may override whatever preference is specified in this
field. Allowed values:

NO_PREFERENCE - No preference as to whether the customer is challenged
NO_CHALLENGE_REQUESTED - Preference is for the customer not be challenged.
CHALLENGE_PREFERRED - Preference is for the customer to be challenged.
CHALLENGE_MANDATED - A challenge is required for the transaction to be
authorized due to local/regional mandates or other variables.
NO_CHALLENGE_REQUESTED_TRANSACTION_RISK_ANALYSIS_PERFORMED
NO_CHALLENGE_REQUESTED_DATA_SHARE_ONLY
NO_CHALLENGE_REQUESTED_SCA_ALREADY_PERFORMED
NO_CHALLENGE_REQUESTED_WHITELIST
CHALLENGE_REQUESTED_PROMPT_FOR_WHITELIST

European merchants: optional for SCA. Merchant Response URLstringStandard URL
FormatO0-255Used to set which URL in your application the transaction response
will be sent to. A fixed URL can also be added to your account by our support
team. Sha1hashstringalphanumericM40The signature for this request is made up of
transaction elements and your Shared Secret. Automatically set by the SDK.
Allowed characters: [0-9a-fA-F]

Show More

// configure client, request and HPP settings
var service = new HostedService(new GpEcomConfig
{
   MerchantId = "MerchantId",
   AccountId = "internet",
   SharedSecret = "secret",
   ServiceUrl = "https://pay.sandbox.realexpayments.com/pay",
   HostedPaymentConfig = new HostedPaymentConfig
   {
      Version = "2"
   }
});

// Add 3D Secure 2 Mandatory and Recommended Fields
var hostedPaymentData = new HostedPaymentData
{
   CustomerEmail = "james.mason@example.com",
   CustomerPhoneMobile = "44|07123456789",
   AddressesMatch = false
};

var billingAddress = new Address
{
   StreetAddress1 = "Flat 123",
   StreetAddress2 = "House 456",
   StreetAddress3 = "Unit 4",
   City = "Halifax",
   PostalCode = "W5 9HR",
   Country = "826"
};

var shippingAddress = new Address
{
   StreetAddress1 = "Apartment 825",
   StreetAddress2 = "Complex 741",
   StreetAddress3 = "House 963",
   City = "Chicago",
   State = "IL",
   PostalCode = "50001",
   Country = "840",          
};

try
{
   var hppJson = service.Charge(19.99m)
      .WithCurrency("EUR")
      .WithHostedPaymentData(hostedPaymentData)
      .WithAddress(billingAddress, AddressType.Billing)
      .WithAddress(shippingAddress, AddressType.Shipping)
      .Serialize();

   // TODO: pass the HPP request JSON to the JavaScript, iOS or Android Library
}

catch (ApiException exce)
{
   // TODO: Add your error handling here
}





REQUEST SYNTAX

Type indicates whether the element is Mandatory (M), Optional (O), or
Conditional (C) - dependent on another field.

Unless otherwise stated in the description, the allowed special characters in an
alphanumeric string field are [/.-_‘,␣]

Element/Field Category Format Type Length Description
TimestampstringnumericM14Entered in the following format: YYYYMMDDHHMMSS.
If the timestamp is more than a day (86400 seconds) away from the current time,
the request will be rejected. Automatically set if using the SDK. Merchant
IDstringalphanumericM1-50Your Client ID assigned by Global Payments.
Allowed characters: [a-zA-Z0-9.] AccountstringalphanumericO0-30The sub-account
for this request to be processed through.
Allowed characters: [a-zA-Z0-9.] Order IdstringalphanumericM1-50A merchant
supplied reference to identify this transaction. Must be unique for each
attempt.
Allowed characters: [a-zA-Z0-9_-] AmountintegerM1-11The amount should be in the
smallest unit of the required currency For example, 2000 = €20.00
CurrencystringISO 4217M3The processing currency of the transaction. Please see
the list of Currency Codes. AutoSettle/AutoCapture FlagstringenumMUsed to
specify the settlement/capture type. Allowed values:
0 - Delayed Settle (Capture) / Authorize, don't automatically add to the
settlement file.
1 - Auto Settle (Capture) / Charge, automatically added to the next settlement
file.
MULTI - Multi Settle (Capture), don't automatically add to the settlement file.
Enables multiple settlement/capture requests up to 115% of the original
transaction value. CommentstringalphanumericO0-255You can submit up to two
comments about this request. This information will be displayed under the
transaction in Ecommerce Portal. HPP VersionintegerM1This must be set to 2.
ChannelstringenumON/AUsed to specify the type of transaction. Allowed values:

ECOM - E-commerce transaction
MOTO - Mail Order/Telephone Order transaction

Compatible with Global Payments and certain other Acquirers. Payer Email
AddressstringalphanumericM1-254Customer’s email address, including the full
domain name. The field must be submitted in the form name@host.domain (for
example, james.mason@example.com). The domain can be between 2-24 characters.
Allowed characters: [a-zA-Z0-9_-.]@[a-zA-Z0-9_-.].[a-zA-Z]
European merchants: mandatory for SCA. Mobile Phone NumberstringnumericC3|15 or
19The mobile phone number provided by the Cardholder. Should be In format of
'CountryCallingCode|Number' for example, '1|123456789'.

European merchants: mandatory for SCA if captured by your application or
website. Global Payments recommend you send at least one phone number (Mobile,
Home or Work). Billing Address Line 1stringalphanumericM1-50First line of the
customer's billing address.

European merchants: mandatory for SCA. Billing Address Line
2stringalphanumericM1-50Second line of the customer's billing address. Can be
submitted as blank if not relevant for the particular customer.

European merchants: mandatory for SCA. Billing Address Line
3stringalphanumericM1-50Third line of the customer's billing address. Can be
submitted as blank if not relevant for the particular customer.

European merchants: mandatory for SCA. Billing Address
CitystringalphanumericM1-40The city of the customer's billing address.

European merchants: mandatory for SCA. Billing Address StatestringISO
3166-2C0-3The state of the customer's billing address. Should be the country
subdivision code defined in ISO 3166-2 minus the country code itself. For
example, Illinois = IL. Applicable for US and CA addresses.

European merchants: if state applicable for the billing address country,
required for SCA. Billing Address Postal CodestringalphanumericM1-16ZIP or other
postal code customer's billing address.
Allowed characters: [a-zA-Z0-9-␣]

European merchants: mandatory for SCA. Billing Address CountrystringISO
3166-1M3The country of the customer's billing address. ISO 3166-1 numeric
three-digit country code. For example, US = 840.

European merchants: mandatory for SCA. Shipping Address Line
1stringalphanumericO0-50First line of the customer's shipping address.

European merchants: optional for SCA. Shipping Address Line
2stringalphanumericO0-50Second line of the customer's shipping address.

European merchants: optional for SCA. Shipping Address Line
3stringalphanumeric00-50Third line of the customer's shipping address.

European merchants: optional for SCA. Shipping Address
CitystringalphanumericO0-50The city of the customer's shipping address.

European merchants: optional for SCA. Shipping Address StatestringISO
3166-2O0-3The state of the customer's shipping address. Should be the country
subdivision code defined in ISO 3166-2 minus the country code itself. For
example, Illinois = IL. Applicable for US and CA addresses.

European merchants: if state applicable for the billing address country,
required for SCA. Shipping Address Postal CodestringalphanumericO0-16ZIP or
other postal code customer's shipping address.
Allowed characters: [a-zA-Z0-9-␣]

European merchants: optional for SCA. Shipping Address CountrystringISO
3166-1O0-3The country of the customer's shipping address. Numeric three-digit
country code. For example, US = 840.

European merchants: optional for SCA. Shipping Address Match
IndicatorBooleanN/AON/AIndicates whether the shipping address matches the
billing address.

European merchants: optional for SCA. Challenge Request
IndicatorstringenumON/AIndicates whether a challenge is requested for this
transaction. The Issuer may override whatever preference is specified in this
field. Allowed values:

NO_PREFERENCE - No preference as to whether the customer is challenged
NO_CHALLENGE_REQUESTED - Preference is for the customer not be challenged.
CHALLENGE_PREFERRED - Preference is for the customer to be challenged.
CHALLENGE_MANDATED - A challenge is required for the transaction to be
authorized due to local/regional mandates or other variables.
NO_CHALLENGE_REQUESTED_TRANSACTION_RISK_ANALYSIS_PERFORMED
NO_CHALLENGE_REQUESTED_DATA_SHARE_ONLY
NO_CHALLENGE_REQUESTED_SCA_ALREADY_PERFORMED
NO_CHALLENGE_REQUESTED_WHITELIST
CHALLENGE_REQUESTED_PROMPT_FOR_WHITELIST

European merchants: optional for SCA. Merchant Response URLstringStandard URL
FormatO0-255Used to set which URL in your application the transaction response
will be sent to. A fixed URL can also be added to your account by our support
team. Sha1hashstringalphanumericM40The signature for this request is made up of
transaction elements and your Shared Secret. Automatically set by the SDK.
Allowed characters: [0-9a-fA-F]

Show More

<form action="https://pay.sandbox.realexpayments.com/pay" method="POST" target="iframe">
  <input type="hidden" name="TIMESTAMP" value="20180613110737">
  <input type="hidden" name="MERCHANT_ID" value="MerchantId">
  <input type="hidden" name="ACCOUNT" value="internet">
  <input type="hidden" name="ORDER_ID" value="N6qsk4kYRZihmPrTXWYS6g">
  <input type="hidden" name="AMOUNT" value="1999">
  <input type="hidden" name="CURRENCY" value="EUR">
  <input type="hidden" name="AUTO_SETTLE_FLAG" value="1">
  <input type="hidden" name="COMMENT1" value="Mobile Channel">
  <input type="hidden" name="HPP_VERSION" value="2">
  <input type="hidden" name="HPP_CHANNEL" value="ECOM">
  <!-- Begin 3D Secure 2 Mandatory and Recommended Fields -->
  <input type="hidden" name="HPP_CUSTOMER_EMAIL" value="test@example.com">
  <input type="hidden" name="HPP_CUSTOMER_PHONENUMBER_MOBILE" value="44|789456123">
  <input type="hidden" name="HPP_BILLING_STREET1" value="Flat 123">
  <input type="hidden" name="HPP_BILLING_STREET2" value="House 456">
  <input type="hidden" name="HPP_BILLING_STREET3" value="Unit 4">
  <input type="hidden" name="HPP_BILLING_CITY" value="Halifax">
  <input type="hidden" name="HPP_BILLING_POSTALCODE" value="W5 9HR">
  <input type="hidden" name="HPP_BILLING_COUNTRY" value="826">
  <input type="hidden" name="HPP_SHIPPING_STREET1" value="Apartment 852">
  <input type="hidden" name="HPP_SHIPPING_STREET2" value="Complex 741">
  <input type="hidden" name="HPP_SHIPPING_STREET3" value="House 963">
  <input type="hidden" name="HPP_SHIPPING_CITY" value="Chicago">
  <input type="hidden" name="HPP_SHIPPING_STATE" value="IL">
  <input type="hidden" name="HPP_SHIPPING_POSTALCODE" value="50001">
  <input type="hidden" name="HPP_SHIPPING_COUNTRY" value="840">
  <input type="hidden" name="HPP_ADDRESS_MATCH_INDICATOR" value="FALSE">
  <input type="hidden" name="HPP_CHALLENGE_REQUEST_INDICATOR" value="NO_PREFERENCE">
  <!-- End 3D Secure 2 Mandatory and Recommended Fields -->
  <input type="hidden" name="MERCHANT_RESPONSE_URL" value="https://www.example.com/responseUrl">
  <input type="hidden" name="SHA1HASH" value="308bb8dfbbfcc67c28d602d988ab104c3b08d012">
  <input type="submit" value="Click To Pay">
</form>





REQUEST SYNTAX

Type indicates whether the element is Mandatory (M), Optional (O), or
Conditional (C) - dependent on another field.

Unless otherwise stated in the description, the allowed special characters in an
alphanumeric string field are [/.-_‘,␣]

Element/Field Category Format Type Length Description
TimestampstringnumericM14Entered in the following format: YYYYMMDDHHMMSS.
If the timestamp is more than a day (86400 seconds) away from the current time,
the request will be rejected. Automatically set if using the SDK. Merchant
IDstringalphanumericM1-50Your Client ID assigned by Global Payments.
Allowed characters: [a-zA-Z0-9.] AccountstringalphanumericO0-30The sub-account
for this request to be processed through.
Allowed characters: [a-zA-Z0-9.] Order IdstringalphanumericM1-50A merchant
supplied reference to identify this transaction. Must be unique for each
attempt.
Allowed characters: [a-zA-Z0-9_-] AmountintegerM1-11The amount should be in the
smallest unit of the required currency For example, 2000 = €20.00
CurrencystringISO 4217M3The processing currency of the transaction. Please see
the list of Currency Codes. AutoSettle/AutoCapture FlagstringenumMUsed to
specify the settlement/capture type. Allowed values:
0 - Delayed Settle (Capture) / Authorize, don't automatically add to the
settlement file.
1 - Auto Settle (Capture) / Charge, automatically added to the next settlement
file.
MULTI - Multi Settle (Capture), don't automatically add to the settlement file.
Enables multiple settlement/capture requests up to 115% of the original
transaction value. CommentstringalphanumericO0-255You can submit up to two
comments about this request. This information will be displayed under the
transaction in Ecommerce Portal. HPP VersionintegerM1This must be set to 2.
ChannelstringenumON/AUsed to specify the type of transaction. Allowed values:

ECOM - E-commerce transaction
MOTO - Mail Order/Telephone Order transaction

Compatible with Global Payments and certain other Acquirers. Payer Email
AddressstringalphanumericM1-254Customer’s email address, including the full
domain name. The field must be submitted in the form name@host.domain (for
example, james.mason@example.com). The domain can be between 2-24 characters.
Allowed characters: [a-zA-Z0-9_-.]@[a-zA-Z0-9_-.].[a-zA-Z]
European merchants: mandatory for SCA. Mobile Phone NumberstringnumericC3|15 or
19The mobile phone number provided by the Cardholder. Should be In format of
'CountryCallingCode|Number' for example, '1|123456789'.

European merchants: mandatory for SCA if captured by your application or
website. Global Payments recommend you send at least one phone number (Mobile,
Home or Work). Billing Address Line 1stringalphanumericM1-50First line of the
customer's billing address.

European merchants: mandatory for SCA. Billing Address Line
2stringalphanumericM1-50Second line of the customer's billing address. Can be
submitted as blank if not relevant for the particular customer.

European merchants: mandatory for SCA. Billing Address Line
3stringalphanumericM1-50Third line of the customer's billing address. Can be
submitted as blank if not relevant for the particular customer.

European merchants: mandatory for SCA. Billing Address
CitystringalphanumericM1-40The city of the customer's billing address.

European merchants: mandatory for SCA. Billing Address StatestringISO
3166-2C0-3The state of the customer's billing address. Should be the country
subdivision code defined in ISO 3166-2 minus the country code itself. For
example, Illinois = IL. Applicable for US and CA addresses.

European merchants: if state applicable for the billing address country,
required for SCA. Billing Address Postal CodestringalphanumericM1-16ZIP or other
postal code customer's billing address.
Allowed characters: [a-zA-Z0-9-␣]

European merchants: mandatory for SCA. Billing Address CountrystringISO
3166-1M3The country of the customer's billing address. ISO 3166-1 numeric
three-digit country code. For example, US = 840.

European merchants: mandatory for SCA. Shipping Address Line
1stringalphanumericO0-50First line of the customer's shipping address.

European merchants: optional for SCA. Shipping Address Line
2stringalphanumericO0-50Second line of the customer's shipping address.

European merchants: optional for SCA. Shipping Address Line
3stringalphanumeric00-50Third line of the customer's shipping address.

European merchants: optional for SCA. Shipping Address
CitystringalphanumericO0-50The city of the customer's shipping address.

European merchants: optional for SCA. Shipping Address StatestringISO
3166-2O0-3The state of the customer's shipping address. Should be the country
subdivision code defined in ISO 3166-2 minus the country code itself. For
example, Illinois = IL. Applicable for US and CA addresses.

European merchants: if state applicable for the billing address country,
required for SCA. Shipping Address Postal CodestringalphanumericO0-16ZIP or
other postal code customer's shipping address.
Allowed characters: [a-zA-Z0-9-␣]

European merchants: optional for SCA. Shipping Address CountrystringISO
3166-1O0-3The country of the customer's shipping address. Numeric three-digit
country code. For example, US = 840.

European merchants: optional for SCA. Shipping Address Match
IndicatorBooleanN/AON/AIndicates whether the shipping address matches the
billing address.

European merchants: optional for SCA. Challenge Request
IndicatorstringenumON/AIndicates whether a challenge is requested for this
transaction. The Issuer may override whatever preference is specified in this
field. Allowed values:

NO_PREFERENCE - No preference as to whether the customer is challenged
NO_CHALLENGE_REQUESTED - Preference is for the customer not be challenged.
CHALLENGE_PREFERRED - Preference is for the customer to be challenged.
CHALLENGE_MANDATED - A challenge is required for the transaction to be
authorized due to local/regional mandates or other variables.
NO_CHALLENGE_REQUESTED_TRANSACTION_RISK_ANALYSIS_PERFORMED
NO_CHALLENGE_REQUESTED_DATA_SHARE_ONLY
NO_CHALLENGE_REQUESTED_SCA_ALREADY_PERFORMED
NO_CHALLENGE_REQUESTED_WHITELIST
CHALLENGE_REQUESTED_PROMPT_FOR_WHITELIST

European merchants: optional for SCA. Merchant Response URLstringStandard URL
FormatO0-255Used to set which URL in your application the transaction response
will be sent to. A fixed URL can also be added to your account by our support
team. Sha1hashstringalphanumericM40The signature for this request is made up of
transaction elements and your Shared Secret. Automatically set by the SDK.
Allowed characters: [0-9a-fA-F]

Show More


OPTIONAL FIELDS

3D Secure 2 allows submission of a much greater data set than its predecessor,
the more data submitted the more information the Issuer will have when making
the decision whether the transaction authentication should proceed through a
Frictionless or a Challenge flow.

The types of data available to submit include:

 * Customer account with the merchant (creation date and history)
 * Gift card
 * Recurring and installment information
 * Prior 3D Secure 2 authentication
 * Merchant authentication of the customer

HTML POST
...
HTML POST

<input type="hidden" name="HPP_CUSTOMER_PHONENUMBER_HOME" value="44|789456123">
<input type="hidden" name="HPP_CUSTOMER_PHONENUMBER_WORK" value="44|1801555888">
<input type="hidden" name="HPP_CARDHOLDER_ACCOUNT_AGE_DATE" value="20190110">
<input type="hidden" name="HPP_CARDHOLDER_ACCOUNT_AGE_INDICATOR" value="LESS_THAN_THIRTY_DAYS">
<input type="hidden" name="HPP_CARDHOLDER_ACCOUNT_CHANGE_DATE" value="20190128">
<input type="hidden" name="HPP_CARDHOLDER_ACCOUNT_CHANGE_INDICATOR" value="THIS_TRANSACTION">
<input type="hidden" name="HPP_CARDHOLDER_ACCOUNT_PASSWORD_CHANGE_DATE" value="20190115">
<input type="hidden" name="HPP_CARDHOLDER_ACCOUNT_PASSWORD_CHANGE_INDICATOR" value="LESS_THAN_THIRTY_DAYS">
<input type="hidden" name="HPP_CARDHOLDER_ACCOUNT_PURCHASE_COUNT" value="3">
<input type="hidden" name="HPP_TRANSACTION_TYPE" value="GOODS_SERVICE_PURCHASE">
<input type="hidden" name="HPP_CARDHOLDER_ACCOUNT_IDENTIFIER" value="1f0aae6b-0bac-479f-9ee5-29b9b6cf3aa0">
<input type="hidden" name="HPP_SUSPICIOUS_ACTIVITY" value="NO_SUSPICIOUS_ACTIVITY">
<input type="hidden" name="HPP_PROVISION_ATTEMPTS_DAY" value="1">
<input type="hidden" name="HPP_PAYMENT_ACCOUNT_AGE" value="201901101">
<input type="hidden" name="HPP_PAYMENT_ACCOUNT_AGE_INDICATOR" value="LESS_THAN_THIRTY_DAYS">
<input type="hidden" name="HPP_DELIVERY_EMAIL" value="test@example.com">
<input type="hidden" name="HPP_DELIVERY_TIMEFRAME" value="TWO_DAYS_OR_MORE">
<input type="hidden" name="HPP_SHIP_INDICATOR" value="UNVERIFIED_ADDRESS">
<input type="hidden" name="HPP_SHIPPING_ADDRESS_USAGE" value="20190128">
<input type="hidden" name="HPP_SHIPPING_ADDRESS_USAGE_INDICATOR" value="THIS_TRANSACTION">
<input type="hidden" name="HPP_SHIPPING_NAME_INDICATOR" value="TRUE">
<input type="hidden" name="HPP_PREORDER_DATE" value="20190212">
<input type="hidden" name="HPP_PREORDER_PURCHASE_INDICATOR" value="MERCHANDISE_AVAILABLE">
<input type="hidden" name="HPP_REORDER_ITEM_INDICATOR" value="FIRST_TIME_ORDER">
<input type="hidden" name="HPP_TRANSACTION_ACTIVITY_DAY" value="1">
<input type="hidden" name="HPP_TRANSACTION_ACTIVITY_YEAR" value="3">
<input type="hidden" name="HPP_GIFT_CARD_AMOUNT" value="250">
<input type="hidden" name="HPP_GIFT_CARD_COUNT" value="1">
<input type="hidden" name="HPP_GIFT_CARD_CURRENCY" value="EUR">
<input type="hidden" name="HPP_RECURRING_MAX_INSTALLMENTS" value="5">
<input type="hidden" name="HPP_RECURRING_EXPIRY" value="20190205">
<input type="hidden" name="HPP_RECURRING_FREQUENCY" value="25">
<input type="hidden" name="HPP_PRIOR_TRANSACTION_AUTHENTICATION_METHOD" value="FRICTIONLESS_AUTHENTICATION">
<input type="hidden" name="HPP_PRIOR_TRANSACTION_AUTHENTICATION_IDENTIFIER" value="26c3f619-39a4-4040-bf1f-6fd433e6d615">
<input type="hidden" name="HPP_PRIOR_TRANSACTION_AUTHENTICATION_TIMESTAMP" value="20190110125733">
<input type="hidden" name="HPP_PRIOR_TRANSACTION_AUTHENTICATION_DATA" value="string">
<input type="hidden" name="HPP_CARDHOLDER_LOGIN_AUTHENTICATION_TYPE" value="MERCHANT_SYSTEM_AUTHENTICATION">
<input type="hidden" name="HPP_CARDHOLDER_LOGIN_AUTHENTICATION_TIMESTAMP" value="20180613110212">
<input type="hidden" name="HPP_CARDHOLDER_LOGIN_AUTHENTICATION_DATA" value="string">
<input type="hidden" name="HPP_WHITELIST_STATUS" value="FALSE">





REQUEST SYNTAX

Type indicates whether the element is Mandatory (M), Optional (O), or
Conditional (C) - dependent on another field.

Unless otherwise stated in the description, the allowed special characters in an
alphanumeric string field are [/.-_‘,␣]

Element/Field Category Format Type Length Description Home Phone
NumberstringnumericC3|15 or 19The home phone number provided by the Cardholder.
Should be In format: of 'CountryCallingCode|Number' for example, '1|123456789'.

European merchants: mandatory for SCA if captured by your application or
website. Global Payments recommend you send at least one phone number (Mobile,
Home or Work). Work Phone NumberstringnumericC3|15 or 19The work phone number
provided by the Cardholder. Should be In format: of 'CountryCallingCode|Number'
for example, '1|123456789'.

European merchants: mandatory for SCA if captured by your application or
website. Global Payments recommend you send at least one phone number (Mobile,
Home or Work). Gift Card CountintegerO0-2The total number of prepaid or gift
cards purchased.

European merchants: optional for SCA. Gift Card CurrencystringISO 4217O0-3The
currency code of prepaid or gift cards purchased. For example, Euro should be
submitted as EUR.

European merchants: optional for SCA. Gift Card AmountintegerO0-15The total
amount of prepaid or gift cards purchased. Format: major units, for example, USD
123.45 = 123.
European merchants: optional for SCA. Delivery EmailstringalphanumericC0-254For
ELECTRONIC_DELIVERY, the email address to which the merchandise was delivered.
The field must be submitted in the form name@host.domain (for example,
james.mason@example.com ).

European merchants: optional for SCA. Delivery TimeframestringenumON/AIndicates
the delivery timeframe for the order. Allowed values:

ELECTRONIC_DELIVERY
SAME_DAY
OVERNIGHT
TWO_DAYS_OR_MORE

European merchants: optional for SCA. Shipping MethodstringenumON/AIndicates
shipping method chosen for the transaction. Must be speific to this transaction,
not generally to the merchant. If one or more items are included in the sale,
use the Shipping Indicator code for the physical goods. If all the goods are
digital, use the Shipping Method code that describes the most expensive item.
Allowed values:

BILLING_ADDRESS
ANOTHER_VERIFIED_ADDRESS UNVERIFIED_ADDRESS
SHIP_TO_STORE
DIGITAL_GOODS
TRAVEL_AND_EVENT_TICKETS
OTHER

European merchants: optional for SCA. Shipping Name Matches Cardholder
NameBooleanN/AON/AIndicates whether the account customer name matches the
shipping address name.

European merchants: optional for SCA. Preorder IndicatorstringenumON/AIndicates
whether the customer is paying for merchandise that will be available at a
future date.
Allowed values:

MERCHANDISE_AVAILABLE
FUTURE_AVAILABILITY

European merchants: optional for SCA. Preorder Availability
DatestringYYYY-MM-DDO0-10In the case of a preorder; the expected date when the
merchandise will be available.

European merchants: optional for SCA. Reorder IndicatorstringenumON/AIndicates
whether the customer is reordering previous purchased items.
Allowed values:

FIRST_TIME_ORDER
REORDER

European merchants: optional for SCA. Transaction TypestringenumON/AThe type of
transaction being authenticated. Allowed values:

GOODS_SERVICE_PURCHASE
CHECK_ACCEPTANCE
ACCOUNT_FUNDING
QUASI_CASH_TRANSACTION
PREPAID_ACTIVATION_AND_LOAD

European merchants: optional for SCA. Payer Account
IdentifierstringalphanumericO0-64Optional field to pass additional information
about the customer

European merchants: optional for SCA. Account Age IndicatorstringenumOLength of
time the customer has had an account with the merchant. Allowed values:

NO_ACCOUNT
THIS_TRANSACTION
LESS_THAN_THIRTY_DAYS
THIRTY_TO_SIXTY_DAYS
MORE_THAN_SIXTY_DAYS

European merchants: optional for SCA. Account Creation
DatestringYYYY-MM-DDO0-10Date the customer opened their account with the
merchant.

European merchants: optional for SCA. Account Change
DatestringYYYY-MM-DDO0-10Date the customer's account with the merchant was last
changed. For example, if the billing or shipping details changed, new payment
account or new users added.

European merchants: optional for SCA. Account Change IndicatorstringenumOLength
of time since the account has changed.
Allowed values:

THIS_TRANSACTION
LESS_THAN_THIRTY_DAYS
THIRTY_TO_SIXTY_DAYS
MORE_THAN_SIXTY_DAYS

European merchants: optional for SCA. Password Change
DatestringYYYY-MM-DDO0-10Date the customer's account with the merchant had a
password change or account reset.

European merchants: optional for SCA. Password Change IndicatorstringenumOLength
of time since the customer's account with the merchant has had a password change
or account reset. Allowed values:

NO_CHANGE
THIS_TRANSACTION
LESS_THAN_THIRTY_DAYS
THIRTY_TO_SIXTY_DAYS
MORE_THAN_SIXTY_DAYS

European merchants: optional for SCA. Payment Account Creation
DatestringYYYY-MM-DDO0-10Date the payment account was associated with the
customer's account.

European merchants: optional for SCA. Payment Account Age
IndicatorstringenumOLength of time the customer has had an account with the
merchant. Allowed values:

NO_ACCOUNT - The customer does not have an account, for example, guest checkout
THIS_TRANSACTION
LESS_THAN_THIRTY_DAYS
THIRTY_TO_SIXTY_DAYS.
MORE_THAN_SIXTY_DAYS

European merchants: optional for SCA. Previous Suspicious
ActivitystringenumON/AIndicates whether there has been suspicious activity on
this customer's account, including fraudulent activity. (Note this is a boolean
in the SDK). Allowed values:

SUSPICIOUS_ACTIVITY.
NO_SUSPICIOUS_ACTIVITY

European merchants: optional for SCA. Purchases in the last six
monthsintegerO0-4Number of purchases with this customer's account during the
previous six months.

European merchants: optional for SCA. Number of Transactions in the Last 24
HoursintegerO0-3Number of transactions (successful and abandoned) for this
customer account with the merchant in the previous 24 hours.

European merchants: optional for SCA. Number of Transactions in the Last
YearintegerO0-3Number of transactions (successful and abandoned) for this
customer account with the merchant in the previous year.

European merchants: optional for SCA. Add Card AttemptsintegerO0-3Number of Add
Card attempts in the last 24 hours.

European merchants: optional for SCA. Shipping Address Creation
DatestringYYYY-MM-DDO0-10Date the shipping address was first used with the
merchant.
European merchants: optional for SCA.
Shipping Address Usage IndicatorstringenumON/AWhen the shipping address was
first used with the merchant.
Allowed values:

THIS_TRANSACTION
LESS_THAN_THIRTY_DAYS
THIRTY_TO_SIXTY_DAYS
MORE_THAN_SIXTY_DAYS

European merchants: optional for SCA. Prior Authentication
MethodstringenumOMethod used by the customer previously to authenticate. Allowed
values:

FRICTIONLESS_AUTHENTICATION
CHALLENGE_OCCURRED
AVS_VERIFIED
OTHER_ISSUER_METHOD

European merchants: optional for SCA. Prior Authentication Transaction
IDstringUUIDO0-36ACS Transaction ID for a prior 3DS authenticated transaction.

European merchants: optional for SCA. Prior Authentication
TimestamptimestampnumericO0-32Date and time in UTC of the prior customer
authentication. Minimum of 3 microseconds precision, can be up to 6. Must also
include timezone.

Format: yyyy-MM-ddTHH:mm:ss.SSS(Z|±hh:mm)

European merchants: optional for SCA. Prior Authentication
DatastringalphanumericO0-2048Data that documents and supports a specific
authentication process.

European merchants: optional for SCA. Max Number of
InstalmentsintegerC0-3Indicates the maximum number of authorizations permitted
for instalment payments.

European merchants: required for instalment transactions for SCA. Recurring
Authorization FrequencyintegerC0-4The minimum number of days between recurring
authorizations.

European merchants: required for recurring transactions for SCA. Recurring
Authorization Expiry DatetimestampnumericC0-10Date after which no further
recurring authorizations shall be performed.

European merchants: required for recurring transactions for SCA. Customer
Authentication DatastringalphanumericO0-2048Not currently in use.

European merchants: optional for SCA. Customer Authentication
TimestamptimestampnumericO0-32The timestamp of the authentication with the
merchant. Minimum of 3 microseconds precision, can be up to 6. Must also include
timezone.

Format: yyyy-MM-ddTHH:mm:ss.SSS(Z|±hh:mm)

European merchants: optional for SCA. Customer Authentication
MethodstringenumOMethod used by the customer previously to authenticate with the
merchant. Allowed values:

NOT_AUTHENTICATED
MERCHANT_SYSTEM_AUTHENTICATION
FEDERATED_ID_AUTHENTICATION
ISSUER_CREDENTIAL_AUTHENTICATION
THIRD_PARTY_AUTHENTICATION
FIDO_AUTHENTICATION

European merchants: optional for SCA. Whitelist StatusBooleanN/AON/AAllows you
to communicate the status of trusted beneficiary/whitelist between the Issuer
ACSt. Values accepted:

TRUE = Merchant is whitelisted by cardholder
FALSE = Merchant is not whitelisted by cardholder

European merchants: optional for SCA.

Show More


FLOWS & RESPONSE

The HPP will handle the call to the Global Payments 3D Secure 2 solution while
gathering the necessary device data and contacting the Issuer Access Control
Server (ACS). Numerous data points make up the decision whether to present the
customer with a 3D Secure authentication challenge or to proceed with a
frictionless flow, these include but are not limited to:

 * Transaction variables such as amount and the time of day being consistent
   with previous behavior for that customer.
 * The amount of data provided including billing and shipping details.


FRICTIONLESS FLOW

In a frictionless flow the Issuer can determine that no further authentication
is required, that the transaction qualifies for Strong Customer Authentication
(SCA) and can proceed. Or based on the information that it has received so far,
that the transaction should not proceed any further.

In a blocked transaction scenario, HPP will return a failure response message to
your application/website and you may choose to redirect the customer back to the
payment page while informing them of the outcome. Otherwise, the HPP will
complete the authentication process and proceed to authorization, including the
3D Secure authentication data.


CHALLENGE FLOW

In the case of a challenge flow, the Issuer has determined that the customer
must further authenticate the transaction. The HPP will display the Issuer ACS
to the customer. The challenge may involve a number of steps, including the
customer entering a one-time password sent to their phone or answering some
questions only they would know the answer to.

The type of challenge displayed to the customer will be determined by the Issuer
ACS and will align with at least two elements of Strong Customer Authentication
(SCA):

 * Possession - something only the customer has, for example their mobile device
   registered with their bank to which they will receive a code in an SMS.
 * Inherence - something only the customer is, for example their fingerprint or
   other form of biometric data.
 * Knowledge - something only the customer knows, for example a unique
   passphrase or answer to a personal question.


ACS SIMULATOR

In the Sandbox environment, Global Payments provides an Issuer ACS simulator
which allows you to test different challenge outcomes.

Once the challenge has loaded, after ten seconds the simulator will
automatically complete the authentication and generate an Authentication
Successful response (transStatus = “Y”). This is intended to mimic a scenario
where a customer has received a notification on their phone to authenticate
using their banking app.

Alternatively, clicking the Cancel button will generate an Authentication Failed
response (transStatus = “N”). In either scenario the response will be sent in
the Challenge Response message (CRes) to the Challenge Notification Endpoint. 




CHALLENGE OUTCOME

With the customer on the ACS, the following outcomes may occur:

 * The authentication is successful
 * The authentication fails and the customer is not given another chance.
 * The authentication fails and the customer is given another chance

If the customer has successfully completed the challenge and authenticated, the
HPP will proceed to authorization and include the 3D Secure authentication data.
Alternatively, in a blocked transaction scenario, HPP will return a failure
response message (110).

At this point, in both frictionless and challenge scenarios, the transaction may
authorize or decline as normal based on whether the customer has sufficient
funds in their account or entered their security code correctly and so on. The
HPP will return the transaction response along with the additional 3D Secure
authentication data you can capture in your website/application.


HPP RESPONSE

The Timestamp returned in the response will be identical to the one sent in the
request JSON. This, combined with the Order ID and other transaction variables,
can be used to definitively link the response received with the transaction
request and order created in your application. You should also check the other
transaction variables, for example the Amount, against what was stored in your
application at the time the request JSON was sent.

A 111 result code indicates that the Issuer requires Strong Customer
Authentication (SCA) for a transaction. In order to avoid this outcome, please
ensure you enable 3D Secure 2 on the HPP.

HTTP POST
...
HTTP POST

[RESULT=00,
 AUTHCODE=12345,
 MESSAGE=[ test system ] Authorised,
 PASREF=14631546336115597,
 AVSPOSTCODERESULT=M,
 AVSADDRESSRESULT=M,
 CVNRESULT=M,
 ACCOUNT=internet,
 MERCHANT_ID=MerchantId,
 ORDER_ID=N6qsk4kYRZihmPrTXWYS6g,
 TIMESTAMP=20180613113227,
 AMOUNT=1001,
 BATCHID=691175,
 CARD_PAYMENT_BUTTON=Pay Invoice,
 MERCHANT_RESPONSE_URL=https://www.example.com/responseUrl,
 HPP_LANG=GB,
 BILLING_CODE=59|123,
 BILLING_CO=GB,
 SHIPPING_CODE=50001|Apartment 852,
 SHIPPING_CO=US,
 COMMENT1=Mobile Channel,
 ECI=5
 AUTHENTICATION_VALUE=ODQzNjgwNjU0ZjM3N2JmYTg0NTM=,
 DS_TRANS_ID=c272b04f-6e7b-43a2-bb78-90f4fb94aa25,
 MESSAGE_VERSION=2.1.0,
 SRD=MMC0F00YE4000000715,
 SHA1HASH=8ab81d4437e24a88a08cffb51c15151846bd7b61]





RESPONSE SYNTAX

Element/Field Category Format Description ResultstringnumericThe result code
indicating the outcome of the transaction. Please see the list of Messages &
Error Codes. AuthcodestringalphanumericThe authorization code returned by the
Issuer.
Allowed characters: [a-zA-Z0-9␣] MessagestringalphanumericText of the response
from the Gateway, Acquirer, Issuer or Payment Method. Payments
ReferencestringalphanumericA unique Global Payments assigned reference for the
transaction.
Allowed characters: [a-zA-Z0-9␣] AVS Postcode ResponsestringenumThe result of
the Address Verification Service (AVS) check on the postcode and first line of
the billing address:
M - Matched
N - Not Matched
I - Problem with check
U - Unable to check - Issuer not certified, for example
P - Partial Match
Available for US, CA and GB cardholders only. AVS Address ResponsestringenumSee
AVS Postcode Response CVN ResultstringenumThe result of the Security Code (CVN,
CVV) check:
M - Matched
N - Not Matched
I - Not checked due to circumstances
U - Not checked - issuer not certified
P - Not Processed AccountstringalphanumericThe sub-account for this request to
be processed through.
Allowed characters: [a-zA-Z0-9.] Merchant IDstringalphanumericYour Client ID
assigned by Global Payments.
Allowed characters: [a-zA-Z0-9.] Order IdstringalphanumericA merchant supplied
reference to identify this transaction. Must be unique for each attempt.
Allowed characters: [a-zA-Z0-9_-] TimestampstringnumericEntered in the following
format: YYYYMMDDHHMMSS.
If the timestamp is more than a day (86400 seconds) away from the current time,
the request will be rejected. Automatically set if using the SDK.
AmountintegerThe amount should be in the smallest unit of the required currency
For example, 2000 = €20.00 Card Payment ButtonstringalphanumericUsed to set what
text is displayed on the payment button for card transactions. If this field is
not sent in, “Pay Now” is displayed on the button by default. Merchant Response
URLstringStandard URL FormatUsed to set which URL in your application the
transaction response will be sent to. A fixed URL can also be added to your
account by our support team. HPP LangstringenumUsed to set what language HPP is
displayed in. If the field is not sent, the default language set on your account
will be displayed. This can be configured by your account manager. Please see
the list of HPP Language Codes. Billing or Shipping CodestringalphanumericThe
Postal Code concatenated with the first line of the billing or shipping address.
The billing code can be used for the Address Verification Service (AVS).
Allowed characters: [a-zA-Z0-9_-] Billing or Shipping
CountrystringalphanumericThe country of the billing or shipping address.
Allowed characters: [a-zA-Z0-9.-] CommentstringalphanumericYou can submit up to
two comments about this request. This information will be displayed under the
transaction in Ecommerce Portal. EcistringalphanumericThe E-Commerce Indicator
indicates whether chargeback protection is available for the transaction or not.
Sha1hashstringalphanumericThe signature for this request is made up of
transaction elements and your Shared Secret. Automatically set by the SDK.
Allowed characters: [0-9a-fA-F] Directory Server Transaction
IDstringalphanumericUnique identifier for the authentication assigned by the DS
(Card Scheme). Authentication ValuestringalphanumericUnique value for the
authentication provided by the ACS. May be used to provide proof of
authentication. Message Versionstringnumeric3DS protocol version identifier set
by Global Payments. Scheme Reference DatastringenumThis is the Scheme ID
provided by Visa and Mastercard. Provides a link to the payment history between
a customer and a merchant.



Show More



© 2022 Global Payments. All rights reserved.


POLICIES

 * Developer's Agreement
 * Terms of Use
 * Cookies
 * Privacy


COMPANY

 * About Us


CONNECT

 * Contact Us
 * Stack Overflow
 * GitHub

developer.globalpay.com Open in urlscan Pro 2620:12a:8000::1 Public Scan

Form analysis 1 forms found in the DOM

Text Content

developer.globalpay.com Open in urlscan Pro
2620:12a:8000::1 Public Scan

Form analysis
1 forms found in the DOM