Card-to-card transactions

A card-to-card P2P transaction sends funds directly from one payment card (debit or credit) to another using card numbers.

Both the data of the card to be debited (fromCard) and the data of the card to be credited (toCard) are specified in a payment request.

P2P transaction flow can be displayed in the following main scenarios:

• The cardholder’s data is input on the gateway side;
• The cardholder’s data is input on the online store side.

P2P Operation scenario - inputting payment data on the side of payment gateway

1. On the merchant's site (e.g. an online store) a cardholder requests to perform a P2P money transfer.
2. The online store system registers the order in the Payment Gateway via registerP2P.do. The registration parameters used include the amount of the transfer, the currency, the order number in the merchant's system, and the return URL for the client.
   
3. In response to the registration request, the Payment Gateway returns a unique identifier of the order in the payment system and the URL to redirect the client to the form for card data collection.
4. The online store system passes the redirect URL received on step 3 to the client’s Web browser.
5. The client’s Web browser opens the URL.
6. At the specified URL, the client’s Web browser receives the form for card data collection.
7. Client fills in the form and the data is sent to the Payment Gateway server.
8. The system checks if the card belongs to 3-D Secure (SecureCode).
9. The Gateway sends the redirect link to the Access Control Server (ACS) page of the issuing bank to the client’s Web browser (this step is necessary for the implementation of 3DS).
10. The client’s Web browser requests the user authorization form from ACS.
11. ACS sends the authorization form to the client’s Web browser.
12. Client fills in the form and the information is sent to ACS.
13. ACS processes the form and, regardless of the result, sends the redirect URL of the pages of the Payment Gateway to the client’s Web browser. The encrypted parameters of the authorization result are sent together with this URL.
14. The client’s Web browser requests the Payment Gateway page when passing the encrypted parameters of the authorization result.
15. Payment Gateway transfers the money.
16. When the money is transferred, the Payment Gateway sends the return URL to the client’s Web browser (the URL was specified during the registration of the order by the online store on step 2).
17. The client’s Web browser requests the results of the money transfer from the online store.
18. The online store system requests the information about the order status from the payment gateway - getP2PStatus.do.
    
19. Payment Gateway returns the status of the order.
20. The online store system shows payment result to client.

P2P Operation scenario - inputting card data on the side of online store

1. A cardholder (client) interacts with the online store to create an order.
2. The online store system collects card data on its side.
3. The online store system registers the order in the Payment Gateway via registerP2P.do. The registration parameters used include the amount of the transfer, the currency, the order number in the merchant's system, and the return URL for the client.
   
4. In response to the registration request, the Payment Gateway returns a unique identifier of the order in the payment system.
5. Optional. If the online store works with the fees, the online store sends to the Payment Gateway a request for the fee sum via verifyP2P.do / verifyP2PByBinding.do.
   
6. Optional. Payment Gateway sends in response the fee amount.
7. The online store sends a request for transfer of funds to the Payment Gateway via performP2P.do / performP2PByBinding.do.
   At this stage, the 3DS2 operation is initiated.
   
8. Payment Gateway checks on the 3DS server whether the client can authenticate using the 3DS2 Protocol.
9. Payment Gateway sends a response to the request made in the step 6. The response also returns the following parameters:
   
   • is3DSVer2 - 3DSv2 authentication capability flag (true/false)
   • threeDSServerTransId - transaction identifier assigned by the 3DS server
   • threeDSMethodURLServer - address of the 3DS server for collecting browser data
   • threeDSMethodURL - (optional) address of the ACS server for collecting browser data
   • threeDSMethodDataPacked - (optional) data for collecting browser data on ACS
   
   (See also request description).
10. The online store calls threeDSMethodURLServer, in a separate "iframe" with the help of the POST method, using the value received from the response to the request for transfer of funds. This allows the 3DS server to collect data about the customer's browser.
11. Optional. If threeDSMethodURL and threeDSMethodDataPacked parameters were received in the response to the request for transfer of funds, the online store calls threeDSMethodURL in a separate iframe using the POST method.
    
12. Transfer of funds - stage 2. The online store resends the request to make money transfer via performP2P.do / performP2PByBinding.do.
    You must pass threeDSServerTransId parameter - transaction identifier which was created by the 3DS server and returned in the step 10.
    
13. Payment Gateway sends an authentication request to the 3DS server.
14. 3DS server sends an authentication request (AReq) to the ACS server.
15. ACS server sends an authentication request (ARes) response to the 3DS server.
16. 3DS server sends the received data to the Payment Gateway.
17. 
    
    • If the client does not need to authenticate to the ACS, the Payment Gateway returns a response to the request for transfer of funds. In this case, go to the step 27 of this flow.
    • If the client needs to authenticate to the ACS, the Payment Gateway will send a response to the payment page with the data of redirection to the ACS.
18. The payment page redirects to the acsUrl with the parameter creq=packedCReq.
19. ACS displays the authentication page to the client ("challenge" page).
20. Client is authenticated.
21. ACS server verifies the authenticity of the authentication data.
22. Data is exchanged between the ACS and 3DS servers and processing result is confirmed.
23. The ACS server redirects the client to the store's page.
24. The online store sends /p2p/finishThreeDsVer2.do request to the Payment Gateway.
25. Payment Gateway sends the online store a response to the request made.
26. The online store sends getP2PStatus.do to the Payment Gateway to find out the order status.
27. Payment Gateway sends a response to the request made.
28. The online store displays the result page to the client.

API calls

P2P card-to-card integrations require API calls to be signed. Information about request signatures is available in our API Guide.

P2P order registration

To register an order for the card-to-card money transfer, use https://dev.bpcbt.com/payment/rest/api/p2p/registerP2P.do request.

When sending the request, you should use the header: Content-Type: application/json

Request parameters

| creditBindingId | String [0..255] | Identifier of the stored credential of the card to be credited. It is used in card-to-card transfers when the recipient's card is known in advance. This parameter should first be passed in the request for transfer register (registerP2P.do - clientId parameter should also be passed here), then in the request for transfer funds by binding (performP2PByBinding.do - the value of creditBindingId parameter passed in registerP2P.do should be passed in bindingId parameter in toCard block). |

|Optional

| params | Object | Fields for storing additional order information, must be passed as follows:
"params": [ {"name": "param1", "value": "value1"}, {"name": "param2", "value": "value2"} ].
These fields can be passed to the processing bank for further display in the bank registries.
By default orderNumber (order number) and orderDescription (order description) are passed. OrderDescription must not exceed 99 characters, do not use the following characters: %, +, end of line \r and line break \n).

To enable this functionality contact the bank. |

| feeInput | String | Fee amount in minimum currency units. Must be enabled by respective Merchant-level permission in the Gateway. If merchant has special permission and performs AFT (Account Funding Transaction) operations, the Merchant's commission comes in the registration request and is sent to the message for processing.

• If feeInput is greater than 0, the externalFee attribute will be added to the TransactionModel, when the verifyP2P.do request is called, a verify request will not be sent to processing. The following tags will be added to the processing request, if they were passed in the additional parameters of the registration request: acc_number, contract, fio_sender, reference, fio_reciever.
• If the feeInput is null or 0, the usual registerP2P.do request will be executed (the externalFee attribute will not be added, when the verifyP2P.do request is called, a verify request will be sent to processing).

| billingAndShippingAddressMatchIndicator | String [1] | Indicator for matching the cardholder's billing address and shipping address. This parameter is used for further 3DS authentication of the customer.
Possible values:

• Y - the cardholder's billing address and shipping address match;
• N - cardholder billing address and shipping address do not match.

Description of parameters in shippingPayerData object:

Description of parameters in preOrderPayerData object:

Description of parameters in orderPayerData object:

Below are the parameters of the billingPayerData block (data about the client registration address).

| payerIdNumber | String [1..100] | Number of the payer's identifying document (e.g. passport) provided. |

• RTN or 1 – RTN + Bank Account
• IBAN or 2 – IBAN
• CARD_ACCOUNT or 3 – Card Account
• EMAIL or 4– Email
• PHONE_NUMBER or 5 – Phone Number
• BAN_AND_BIC or 6 – Bank account number (BAN) + Bank Identification Code (BIC)
• WALLET_ID or 7 – Wallet Id
• SOCIAL_NETWORK_ID or 8 – Social Network Id
• OTHER or 100 – Other

Below are the parameters of the billingRecipientData block (data about the recipient).

| recipientIdNumber | String [1..99] | Number of the recipient's identifying document provided. |

| recipientBirthday | String [1..20] | Recipient's birth date in the format YYYYMMDD. |

Response parameters

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

| formUrl | String [1..512] | URL of the payment form, to which a customer will be redirected The URL is not returned if the registration of the order fails due to an error specified in errorCode. |

| orderId | String [1..36] | Order number in the payment gateway. Unique within the payment gateway. |

| orderNumber | String [1..36] | Order number (ID) in the merchant's system, must be unique for each order. |

Examples

Request example

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/registerP2P.do' 
   -H 'Content-Type: application/json' 
   --data-raw '{
  "username":"test_user",
  "password":"test_user_password",
  "amount" : 50000,
  "currency" : "978",
  "returnUrl" : "https://mybestmerchantreturnurl.com",
  "orderNumber": "1"
}'

Request example with specifying payer and recipient data

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/registerP2P.do' \
--header 'Content-Type: application/json' \
--data-raw '{ 
  "username": "test_user",
  "password": "test_user_password",
  "amount" : 1500,
  "currency" : "978",
  "returnUrl" : "https://mybestmerchantreturnurl.com",
  "failUrl" : "https://failUrl.com",
  "orderNumber": "01rthtbkuysgr",
  "email" : "test@test.com",
    "billingPayerData": {
        "payerAccount": "DE89370400440532013000",
        "payerLastName": "CHINA",
        "payerFirstName": "Mieville",
        "payerMiddleName": "Tom",
        "payerCombinedName": "CHINA Mieville",
        "payerIdType": "IDTP1",
        "payerIdNumber": "792209292",
        "billingCity": "BUD",
        "billingCountry": "348",
        "billingAddressLine1": "Terez krt",
        "billingAddressLine2": "Terez krt",
        "billingAddressLine3": "Terez krt",
        "billingPostalCode": "1067",
        "billingState": "VI",
        "payerBirthday": "19900101"
    },
    "billingRecipientData": {
        "recipientAccount": "DE89370400440532013000",
        "recipientLastName": "CHINA",
        "recipientFirstName": "Mieville",
        "recipientMiddleName": "Tom",
        "recipientCombinedName": "CHINA Mieville",
        "recipientIdType": "IDTP1",
        "recipientIdNumber": "792209292",
        "recipientCity": "BUD",
        "recipientCountry": "348",
        "recipientAddressLine1": "Terez krt",
        "recipientPostalCode": "1067",
        "recipientState": "VI",
        "recipientBirthday": "19900101"
    }
}'

Response example

{
  "errorCode": 0,
  "errorMessage": "Successful",
  "orderId": "0a4eaae8-653a-71a9-8259-46fc00a8ea58",
  "formUrl": "https://dev.bpcbt.com/payment/merchants/ecom/payment.html?mdOrder=0a4eaae8-653a-71a9-8259-46fc00a8ea58&language=en",
  "orderNumber": "2009"
}

Fee amount

To obtain the fee amount for the money transfer, use https://dev.bpcbt.com/payment/rest/api/p2p/verifyP2P.do request.

When sending the request, you should use the header: Content-Type: application/json

The structure of the verifyP2P.do request assumes the existence of the fromCard block to pass the attributes of the card to be debited and the toCard block to pass the attributes of the card to be credited.

Request parameters

The fromCard block includes the following possible parameters:

The toCard block consists of the following possible parameters:

Below are the parameters of the billingPayerData block (data about the client registration address).

| payerIdNumber | String [1..100] | Number of the payer's identifying document (e.g. passport) provided. |

Below are the parameters of the billingRecipientData block (data about the recipient).

| recipientIdNumber | String [1..99] | Number of the recipient's identifying document provided. |

| recipientBirthday | String [1..20] | Recipient's birth date in the format YYYYMMDD. |

Response parameters

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

The feeDescriptionList block includes the following parameters:

Examples

Request example

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/verifyP2P.do' -H 'Content-Type: application/json' --data-raw '{
  "username":"test_user",
  "password":"test_user_password",
  "orderId": "0a4eaae8-653a-71a9-8259-46fc00a8ea58",
  "fromCard": {
    "cardholderName": "TEST CARDHOLDER",
    "cvc": "123",
    "expirationMonth": 12,
    "expirationYear": 2030,
    "pan": "5000001111111115"
  },
  "toCard": {
    "pan": "4000001111111118"
  },

  "amount" : 50000
}'

Response example

{
  "errorCode": 0,
  "errorMessage": "Successful",
  "feeDescriptionList: [ {
    "feeAmount": 500,
    "feeCurrency": "978",
    "feeDescription": "Acquirer fee"
  } ]
}

Stored-credential P2P fee amount

To get the amount of commission when transferring funds by a stored-credential transaction, use the https://dev.bpcbt.com/payment/rest/api/p2p/verifyP2PByBinding.do request.

When sending the request, you should use the header: Content-Type: application/json

Request parameters

The fromCard block includes the following possible parameters:

The toCard block consists of the following possible parameters:

Response parameters

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

|
Optional

| feeAmount | Integer [1..12] | Fee amount. |

| feeCurrency | String [3] | The ISO 4217 code of the fee currency. |

| feeDescription | String [1..512] | The description of the fee. |

Examples

Request example

curl --location --request POST 'https://dev.bpcbt.com/payment/rest/api/p2p/verifyP2PByBinding.do' \
--header 'Content-Type: application/json' \
--data-raw '{
    "username": "test_user",
    "password": "test_user_password",
    "orderId": "fa71bf70-7c81-484e-a6fc-7db7e4283b2a",
    "bindingId": "4d792471-cee0-742c-922d-a265072e6148",
    "fromCard": {
        "seToken": "ofVx1r3aIJ3Mlx3nkfeOIJgFOnwfsgFK+V6Yzm+KxJgsq19l74GChhX0We/LEFq78Rhn9uFAEZGdeyDhnIc/KfuvObf0EzoDA65Uj1Z8FjwWyjnEwTBHZL4KmdFBCSk8jLxHt70mXwyjiHYyCVH1fT/UVOnsrkZVGrqmEG4MTi5dX9Znzf24DwRg4iezvdT8vf0dUW5lJdvY1tgOsOnBulwy6kH/YbHVsnR6yxO6d6IsdnT5f8PxaB+7ZyUqgrd6VA88FGJKJgdoxk4721pqKSG5dYroLJG96s23EDJ2Hpi4e9wU2rP7E6dlFw+qzATqX/eaJbaQ9eakkdMWnkj7aQ=="
    },
    "toCard": {
        "cardholderName": "NAME SURNAME",
        "cvc": "123",
        "expirationMonth": 12,
        "expirationYear": 2024,
        "pan": "5555555555555599"
    },
    "amount": 1000,
    "currency": "978",
    "clientId": "123",
}'

Response example

{
  "errorCode" : 0,
  "errorMessage" : "Successful",
  "feeDescriptionList" : [ {
    "feeAmount" : 10,
    "feeCurrency" : "978",
    "feeDescription" : "Acquirer fee"
  } ]
}

P2P transfer

To perform a card-to-card money transfer, use https://dev.bpcbt.com/payment/rest/api/p2p/performP2P.do request.

When sending the request, you should use the header: Content-Type: application/json

The structure of the performP2P.do request assumes the presence of the fromCard block to pass the attributes of the card to be debited and the toCard block to pass the attributes of the card to be credited.

Request parameters

| originalPaymentNetRefNum | String [1..36] | The identifier of the original or previous successful transaction in the payment system in relation to the performed stored-credential transaction - TRN ID. Is passed when tii = R,U, or F.
Is mandatory when using merchant's stored credentials in stored credential transfers.|

• In the recipientName parameter — the name of the money recipient.

| billingAndShippingAddressMatchIndicator | String [1] | Indicator for matching the cardholder's billing address and shipping address. This parameter is used for further 3DS authentication of the customer.
Possible values:

• Y - the cardholder's billing address and shipping address match;
• N - cardholder billing address and shipping address do not match.

| fromCard | Object | A block with the attributes of the card to be debited. See nested parameters. |

| toCard | Object | A block with the attributes of the card to be credited. See nested parameters. |

Possible values of tii parameter:

Description of parameters in shippingPayerData object:

Description of parameters in preOrderPayerData object:

Description of parameters in orderPayerData object:

Below are the parameters of the billingPayerData block (data about the client registration address).

| payerIdNumber | String [1..100] | Number of the payer's identifying document (e.g. passport) provided. |

• RTN or 1 – RTN + Bank Account
• IBAN or 2 – IBAN
• CARD_ACCOUNT or 3 – Card Account
• EMAIL or 4– Email
• PHONE_NUMBER or 5 – Phone Number
• BAN_AND_BIC or 6 – Bank account number (BAN) + Bank Identification Code (BIC)
• WALLET_ID or 7 – Wallet Id
• SOCIAL_NETWORK_ID or 8 – Social Network Id
• OTHER or 100 – Other

Below are the parameters of the billingRecipientData block (data about the recipient).

| recipientIdNumber | String [1..99] | Number of the recipient's identifying document provided. |

| recipientBirthday | String [1..20] | Recipient's birth date in the format YYYYMMDD. |

The fromCard block includes the following possible parameters:

When making payments using tokens (APPLE, SAMSUNG, GOOGLE), the fromCard block includes the following parameters instead of card details:

| protocolVersion | String | Protocol version as defined by Google for a paymentToken: ECv1 (by default) or ECv2|

Below are the parameters of the threeDsAuthResult block (data related to 3 DS authentication).

| threeDsType | String | 3DS authentication type. This parameter is required for payment via your own 3DS Server with 3DS 2. For payments with SSL, this parameter is optional and is defined automatically depending on ECI value.
Allowed values:

• 0 - SSL authentication
• 3 - SCA Cardholder authentication with 3DS 2
• 4 - RBA Cardholder authentication with 3DS 2
• 5 - Cardholder authentication attempt with 3DS 2
• 6 - 3DS 2 exemption granted
• 7 - 3RI authentication with 3DS 2
• 8 - 3RI authentication attempt with 3DS 2

| threeDSProtocolVersion | String | 3DS protocol version. Possible values are "2.1.0", "2.2.0" for 3DS2.
If threeDSProtocolVersion is not passed in the request, then the default value will be used for 3D Secure authorization (2.1.0 - for 3DS 2). |

The toCard block consists of the following possible parameters:

The following parameters are also passed during the authentication via the 3DS2 protocol:

Response parameters

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

|
Optional

| info | String | The result of an attempt to transfer funds.

The value in case of a successful transfer: "Your payment has been processed, redirecting...".

The value in case of an error: "Redirecting..." |

| acsUrl | String [1..512] | The URL address for redirecting to ACS. It is returned in a successful response in case of a 3D-Secure payment, when redirect to the ACS is needed. For details see Redirect to ACS.|

| paReq | String [1..255] | PAReq (Payment Authentication Request) - a message that should be sent to ACS together with redirect. It is returned in a successful response in case of a 3D-Secure payment, when redirect to the ACS is needed. This message contains the Base64-encoded data necessary for the cardholder authentication. For details see Redirect to ACS. |

| termUrl | String [1..512] | In a successful response in case of a 3D-Secure payment. URL address for redirecting the client after interaction with the ACS for the payment completion. |

| originalPaymentNetRefNum | String [1..36] | The identifier of the original or previous successful transaction in the payment system in relation to the performed stored-credential transaction - TRN ID. Is passed when tii = R,U, or F.
Is mandatory when using merchant's stored credentials in stored credential transfers.|

When authenticating via the 3DS2 protocol, the following parameters are returned during the initial request:

Below are the parameters to be present in the response, after a repeated request for the payment and the need to redirect the client to the ACS during the authentication via the 3DS2 protocol:

The parameters of statusResponse block:

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

| orderStatus | Integer | The value of this parameter specifies the status of the order in the payment gateway. It is missing if the order has not been found. Below is the list of available values:

• 0 - order was registered but not paid;
• 2 - order amount is fully authorized;
• 3 - authorization reversed;
• 5 - access control server of the issuing bank initiated authorization procedure;
• 6 - authorization declined;

| orderNumber | String [1..36] | Order number (ID) in the merchant's system, must be unique for each order. |

| panMaskedFrom | String [1..19] | The masked number of the card to be debited. |

| panMaskedTo | String [1..19] | The masked number of the card to be credited. |

| amount | Integer [0..12] | Payment amount in minor currency units (e.g. in cents).|

| currency | String [3] | ISO 4217 encoded currency key. If not specified, the default value is used. Only digits are allowed. |

| creationDate | Integer | Date of order registration. |

| orderDescription | String [1..600] | Order description passed to the payment gateway during the registration.
It is not allowed to fill this parameter with personal data or payment data (card numbers, etc.). This requirement is due to the fact that the order description is not masked in Merchant Portal and log files.|

| ip | String [1..39] | Buyer's IP address. IPv6 is supported in all requests. (up to 39 characters).

| resultCode | Integer | Error code on the request execution. Available values:

• 0 - in case of success;
• 1 - in case of an error.

| orderParams | Object | An object with the merchant's attributes of the order. More than one orderParams object can be presented in the response.
The object must be passed as follows: {"param":"value","param2":"value2"}. |

| operationList | Object | Object containing information on the transactions completed in the order. More than one operationList object can be present in the response.
The parameters that can be passed here are described below. |

| binding | String | Identifier of a stored credential (if it has been already created). This parameter is returned only if the getP2PStatus version is 3 or higher. |

| detokenizedPanRepresentation | String [1..19] | The detokenized card number (the last 4 digits or in a masked form). |

| detokenizedPanExpiryDate | String | The card's detokenized expiration date in the following format: "YYYYMM". |

| paymentNetRefNum | String [1..512] | Original Network Reference Number - a unique identifier assigned by the card network (e.g., Mastercard, Visa) to the original transaction (such as a purchase or authorization). When a follow-up transaction is initiated (e.g., refund, recurring payment), this number must be included to:

• Link the new transaction to the original one
• Ensure proper tracking and reconciliation
• Meet network compliance requirements

To complete the transaction use /p2p/finishThreeDsVer2.do.

Examples

Example of the first request in case of 3DS2 authentication

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/performP2P.do'
-H 'Content-Type: application/json'
--data-raw '{
  "username":"test_user",
  "password":"test_user_password",
  "orderId" : "38b7a9e0-7cfa-46f7-8655-f206a8898e7a",
  "amount" : 50000,
  "fromCard": {
    "vendor": "APPLE",
    "paymentToken": "eyJkZXZpY2VNYW51ZmFjdHVyZXJJZGVudGlmaWVyIjoiMDUwMTEwMDMwMjczIiwiY3VycmVuY3lDb2RlIjoiOTc4IiwiYXBwbGljYXRpb25FeHBpcmF0aW9uRGF0ZSI6IjI3MDEzMSIsInBheW1lbnREYXRhIjp7Im9ubGluZVBheW1lbnRDcnlwdG9ncmFtIjoiQUc5WW5Pak1YOUJXQUFSaElJOFBBb0FCRkE9PSJ9LCJwYXltZW50RGF0YVR5cGUiOiIzRFNlY3VyZSIsInRyYW5zYWN0aW9uQW1vdW50IjoxMDAsImFwcGxpY2F0aW9uUHJpbWFyeUFjY291bnROdW1iZXIiOiI1NTU1NTU1NTU1NTU1NTk5In0=",
    "decryptedToken":true,
    "protocolVersion":"ECv1"
  },
  "toCard" : {
    "pan" : "4111111111111111"
  },
  "params" : [
        {"name" : "recipientName", "Name" : "Surname"},
        {"name" : "payerName", "value" : "Name1 Surname1"},
        {"name" : "payerCity", "value" : "City"},
        {"name" : "payerCountry", "value" : "Country"},
        {"name" : "payerPostalCode", "value" : "777777"},
        {"name" : "payerState", "value" : "State"},
        {"name" : "payerAddress", "value" : "street, 18"
  },

 ] 
}

Example of the second request in case of 3DS2 authentication

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/performP2P.do' -H 'Content-Type: application/json' --data-raw '{
  "username":"test_user",
  "password":"test_user_password",
  "orderId": "0a4eaae8-653a-71a9-8259-46fc00a8ea58",
  "fromCard": {
    "cardholderName": "TEST CARDHOLDER",
    "cvc": "123",
    "expirationMonth": 12,
    "expirationYear": 2030,
    "pan": "5000001111111115"
  },
  "toCard": {
    "pan": "4111111111111111"
  },

  "amount" : 50000,
  "params" : [
        {"name" : "recipientName", "Name" : "Surname"},
        {"name" : "payerName", "value" : "Name1 Surname1"},
        {"name" : "payerCity", "value" : "City"},
        {"name" : "payerCountry", "value" : "Country"},
        {"name" : "payerPostalCode", "value" : "777777"},
        {"name" : "payerState", "value" : "State"},
        {"name" : "payerAddress", "value" : "street, 18"
  "threeDSServerTransId" : "3afc168a-94b4-4eb3-8e2e-80f6c186669d",
  "threeDSVer2FinishUrl" : "https://example.com/acs2/acs/3dsMethod"
}'

Example of the response to the first request in case of 3DS2 authentication

{
  "errorCode": 0,
  "is3DSVer2": true,
  "threeDSServerTransId": "3afc168a-94b4-4eb3-8e2e-80f6c186669d",
  "threeDSMethodURL": "https://example.com/acs2/acs/3dsMethod",
  "threeDSMethodURLServer": "https://example.com/3dsserver/api/v1/client/gather?threeDSServerTransID=3afc168a-94b4-4eb3-8e2e-80f6c186669d",
  "threeDSMethodDataPacked": "eyJ0aHJlZURTTWV0aG9kTm90aWZpY2F0aW9uVVJMIjoiaHR0cHM6Ly9hY3F1aXJlci5jb20vM2Rzc2VydmVyL2FwaS92MS9hY3Mvbm90aWZpY2F0aW9uP3RocmVlRFNTZXJ2ZXJUcmFuc0lEPTNhZmMxNjhhLTk0YjQtNGViMy04ZTJlLTgwZjZjMTg2NjY5ZCIsInRocmVlRFNTZXJ2ZXJUcmFuc0lEIjoiM2FmYzE2OGEtOTRiNC00ZWIzLThlMmUtODBmNmMxODY2NjlkIn0="
}

Example of the response to the second request in case of 3DS2 authentication

{
  "errorCode": 0,
  "info": "Your order is proceeded, redirecting...",
  "acsUrl": "https://example.com/acs2/acs/creq",
  "is3DSVer2": true,
  "packedCReq": "eyJ0aHJlZURTU2VydmVyVHJhbnNJRCI6IjNhZmMxNjhhLTk0YjQtNGViMy04ZTJlLTgwZjZjMTg2NjY5ZCIsIm1lc3NhZ2VUeXBlIjoiQ1JlcSIsIm1lc3NhZ2VWZXJzaW9uIjoiMi4xLjAiLCJhY3NUcmFuc0lEIjoiOWM3NTkxMmEtZTg0NC00ODgyLWI5YzctYzZmYmMzNjIyNGQ3IiwiY2hhbGxlbmdlV2luZG93U2l6ZSI6IjA1In0"
}

Stored-credential P2P transfer

To perform a card-to-card transfer by binding, use https://dev.bpcbt.com/payment/rest/api/p2p/performP2PByBinding.do request.

When sending the request, you should use the header: Content-Type: application/json

Request parameters

| originalPaymentNetRefNum | String [1..36] | The identifier of the original or previous successful transaction in the payment system in relation to the performed stored-credential transaction - TRN ID. Is passed when tii = R,U, or F.
Is mandatory when using merchant's stored credentials in stored credential transfers.|

| mcc | Integer [4] | Merchant Category Code. Using this parameter requires a special permission. You can use only the values from the predefined list of allowed MCC values. Contact the support team for details. |

| originalSchemeTransactionId | String [1..22] | The identifier of the original successful Mastercard transaction.
Is mandatory when using merchant's stored credentials in stored credential transfers. |

| params | Object | Fields for storing additional order information, must be passed as follows {"param":"value","param2":"value2"}.
These fields can be passed to the processing bank for further display in the bank registries.
By default orderNumber (order number) and orderDescription (order description) are passed. OrderDescription must not exceed 99 characters, do not use the following characters: %, +, end of line \r and line break \n).
To enable this functionality contact the bank.

The following customer data can be passed in the params object within a request for a card-to-card money transfer (the format of values depends on the data processing method used):

• In the parameter called payerName — the name of the sender of money.
• In the parameter called payerAddress — the address of the sender.
• In the parameter called payerCity — the home city of the sender.
• In the parameter called payerCountry — the country of the sender in ISO 3166-1 alpha-3 format (3 characters).
• In the parameter called payerPostalCode — the postal code of the sender.
• In a parameter called payerState — the region of the sender.

• In the recipientName parameter — the name of the money recipient.

| billingAndShippingAddressMatchIndicator | String [1] | Indicator for matching the cardholder's billing address and shipping address. This parameter is used for further 3DS authentication of the customer.
Possible values:

• Y - the cardholder's billing address and shipping address match;
• N - cardholder billing address and shipping address do not match.

| fromCard | Object | A block with the attributes of the card to be debited. See nested parameters. |

| toCard | Object | A block with the attributes of the card to be credited. See nested parameters. |

Possible values of tii parameter:

The fromCard block includes the following possible parameters:

Below are the parameters of the threeDsAuthResult block (data related to 3 DS authentication).

| threeDsType | String | 3DS authentication type. This parameter is required for payment via your own 3DS Server with 3DS 2. For payments with SSL, this parameter is optional and is defined automatically depending on ECI value.
Allowed values:

• 0 - SSL authentication
• 3 - SCA Cardholder authentication with 3DS 2
• 4 - RBA Cardholder authentication with 3DS 2
• 5 - Cardholder authentication attempt with 3DS 2
• 6 - 3DS 2 exemption granted
• 7 - 3RI authentication with 3DS 2
• 8 - 3RI authentication attempt with 3DS 2

| threeDSProtocolVersion | String | 3DS protocol version. Possible values are "2.1.0", "2.2.0" for 3DS2.
If threeDSProtocolVersion is not passed in the request, then the default value will be used for 3D Secure authorization (2.1.0 - for 3DS 2). |

The toCard block (if crediting is done by a third-party system, this block must be absent) consists of the following possible parameters:

Description of parameters in shippingPayerData object:

Description of parameters in preOrderPayerData object:

Description of parameters in orderPayerData object:

Below are the parameters of the billingPayerData block (data about the client registration address).

| payerIdNumber | String [1..100] | Number of the payer's identifying document (e.g. passport) provided. |

• RTN or 1 – RTN + Bank Account
• IBAN or 2 – IBAN
• CARD_ACCOUNT or 3 – Card Account
• EMAIL or 4– Email
• PHONE_NUMBER or 5 – Phone Number
• BAN_AND_BIC or 6 – Bank account number (BAN) + Bank Identification Code (BIC)
• WALLET_ID or 7 – Wallet Id
• SOCIAL_NETWORK_ID or 8 – Social Network Id
• OTHER or 100 – Other

Below are the parameters of the billingRecipientData block (data about the recipient).

| recipientIdNumber | String [1..99] | Number of the recipient's identifying document provided. |

| recipientBirthday | String [1..20] | Recipient's birth date in the format YYYYMMDD. |

The following parameters are also passed during the authentication via the 3DS2 protocol:

Response parameters

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

| info | String | The result of an attempt to transfer funds.

The value in case of a successful transfer: "Your payment has been processed, redirecting...".

The value in case of an error: "Redirecting..." |

| acsUrl | String [1..512] | The URL address for redirecting to ACS. It is returned in a successful response in case of a 3D-Secure payment, when redirect to the ACS is needed. For details see Redirect to ACS.|

| paReq | String [1..255] | PAReq (Payment Authentication Request) - a message that should be sent to ACS together with redirect. It is returned in a successful response in case of a 3D-Secure payment, when redirect to the ACS is needed. This message contains the Base64-encoded data necessary for the cardholder authentication. For details see Redirect to ACS. |

| termUrl | String [1..512] | In a successful response in case of a 3D-Secure payment. The URL address to which ACS redirects the cardholder after authentication. For details see Redirect to ACS. |

When authenticating via the 3DS2 protocol, the following parameters are returned during the initial request:

Below are the parameters to be present in the response, after a repeated request for the payment and the need to redirect the client to the ACS during the authentication via the 3DS2 protocol:

The parameters of statusResponse block:

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

| orderStatus | Integer | The value of this parameter specifies the status of the order in the payment gateway. It is missing if the order has not been found. Below is the list of available values:

• 0 - order was registered but not paid;
• 2 - order amount is fully authorized;
• 3 - authorization reversed;
• 5 - access control server of the issuing bank initiated authorization procedure;
• 6 - authorization declined;

| orderNumber | String [1..36] | Order number (ID) in the merchant's system, must be unique for each order. |

| panMaskedFrom | String [1..19] | The masked number of the card to be debited. |

| panMaskedTo | String [1..19] | The masked number of the card to be credited. |

| amount | Integer [0..12] | Payment amount in minor currency units (e.g. in cents).|

| currency | String [3] | ISO 4217 encoded currency key. If not specified, the default value is used. Only digits are allowed. |

| creationDate | Integer | Date of order registration. |

| orderDescription | String [1..600] | Order description passed to the payment gateway during the registration.
It is not allowed to fill this parameter with personal data or payment data (card numbers, etc.). This requirement is due to the fact that the order description is not masked in Merchant Portal and log files.|

| ip | String [1..39] | Buyer's IP address. IPv6 is supported in all requests. (up to 39 characters).

| resultCode | Integer | Error code on the request execution. Available values:

• 0 - in case of success;
• 1 - in case of an error.

| orderParams | Object | An object with the merchant's attributes of the order. More than one orderParams object can be presented in the response.
The object must be passed as follows: {"param":"value","param2":"value2"}. |

| operationList | Object | Object containing information on the transactions completed in the order. More than one operationList object can be present in the response.
The parameters that can be passed here are described below. |

| binding | String | Identifier of a stored credential (if it has been already created). This parameter is returned only if the getP2PStatus version is 3 or higher. |

| detokenizedPanRepresentation | String [1..19] | The detokenized card number (the last 4 digits or in a masked form). |

| detokenizedPanExpiryDate | String | The card's detokenized expiration date in the following format: "YYYYMM". |

| paymentNetRefNum | String [1..512] | Original Network Reference Number - a unique identifier assigned by the card network (e.g., Mastercard, Visa) to the original transaction (such as a purchase or authorization). When a follow-up transaction is initiated (e.g., refund, recurring payment), this number must be included to:

• Link the new transaction to the original one
• Ensure proper tracking and reconciliation
• Meet network compliance requirements

Examples

Request example

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/performP2PByBinding.do' 
-H 'Content-Type: application/json' 
--data-raw '{ 
  "amountInput" : 1000,
  "bindingId" : "03e9492a-536c-7ab4-85e6-b44000f26b04",
  "fromCard" : {
     "seToken": "ofVx1r3aIJ3Mlx3nkfeOIJgFOnwfsgFK+V6Yzm+KxJgsq19l74GChhX0We/LEFq78Rhn9uFAEZGdeyDhnIc/KfuvObf0EzoDA65Uj1Z8FjwWyjnEwTBHZL4KmdFBCSk8jLxHt70mXwyjiHYyCVH1fT/UVOnsrkZVGrqmEG4MTi5dX9Znzf24DwRg4iezvdT8vf0dUW5lJdvY1tgOsOnBulwy6kH/YbHVsnR6yxO6d6IsdnT5f8PxaB+7ZyUqgrd6VA88FGJKJgdoxk4721pqKSG5dYroLJG96s23EDJ2Hpi4e9wU2rP7E6dlFw+qzATqX/eaJbaQ9eakkdMWnkj7aQ=="
  },
  "toCard": {
        "cardholderName": "TEST CARDHOLDER",
        "cvc": "123",
        "expirationMonth": 12,
        "expirationYear": 2029,
        "pan": "5555555555555599"
  },
  "orderId" : "3dbaf8bb-1d68-76b3-b4e6-784700f26b04",
  "password" : "test_user_password",
  "type" : "WITHOUT_TO_CARD",
  "username" : "test_user"
}'

Response example

{
  "errorCode" : 0,
  "errorMessage" : "Successful",
  "info" : "Your order is proceeded, redirecting...",
  "redirect" : "https://example.com/?orderId=47743354-be15-7c70-b9ef-4bfc482e68dc&lang=en",
  "is3DSVer2" : false
}

Request example with authentication via the 3DS2 protocol

Example of the first request:

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/performP2PByBinding.do' -H 'Content-Type: application/json' --data-raw '{ 
  "amountInput" : 1000,
  "currency" : "978",
  "fromCard" : {
    "bindingId" : "fd3afc57-c6d0-4e08-aaef-1b7cfeb093dc"
  },
  "orderId" : "38b7a9e0-7cfa-46f7-8655-f206a8898e7a",
  "password" : "test_user_password",
  "type" : "WITHOUT_TO_CARD",
  "username" : "test_user",
  "params" : {
    "name" : "payerAddress",
    "value" : "payer Address"
  }
}'

Example of the second request:

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/performP2PByBinding.do' -H 'Content-Type: application/json' --data-raw '{ 
  "amountInput" : 1000,
  "currency" : "978",
  "fromCard" : {
    "bindingId" : "fd3afc57-c6d0-4e08-aaef-1b7cfeb093dc"
  },
  "orderId" : "38b7a9e0-7cfa-46f7-8655-f206a8898e7a",
  "password" : "test_user_password",
  "type" : "WITHOUT_TO_CARD",
  "username" : "test_user",
  "params" : {
    "name" : "payerAddress",
    "value" : "payer Address"
  },
  "threeDSServerTransId" : "f44d6d21-1874-45a5-aeb0-1c710dd6e134",
  "threeDSVer2FinishUrl" : "https://example.com/acs2/acs/3dsMethod"
}'

Response example with authentication via the 3DS2 protocol

Example of the response to the first request:

{
  "errorCode": 0,
  "is3DSVer2": true,
  "threeDSServerTransId": "f44d6d21-1874-45a5-aeb0-1c710dd6e134",
  "threeDSMethodURLServer": "https://example.com/3dsserver/api/v1/client/gather?threeDSServerTransID=f44d6d21-1874-45a5-aeb0-1c710dd6e134",
}

Example of the response to the second request:

{
  "errorCode": 0,
  "info": "Your order is proceeded, redirecting...",
  "acsUrl": "https://example.com/acs2/acs/creq",
  "is3DSVer2": true,
  "packedCReq" : "eyJ0aHJlZURTU2VydmVyVHJhbnNJRCI6IjVmMzEyMjdlLTljZmQtNDQwYi1hNDNjLTE4NjljMzNhNGI5YiIsImFjc1RyYW5zSUQiOiI5YTQyYzQ4ZC1hNWRiLTQ3NjEtYmI4Mi05ZmY5MmM0NzZiM2QiLCJjaGFsbGVuZ2VXaW5kb3dTaXplIjoiMDQiLCJtZXNzYWdlVHlwZSI6IkNSZXEiLCJtZXNzYWdlVmVyc2lvbiI6IjIuMS4wIn0="
}

Instant P2P transfer

To perform an instant P2P money transfer without order registration request, use https://dev.bpcbt.com/payment/rest/api/p2p/instantPerformP2P.do request.

When sending request, you should use header: Content-Type: application/json

{ The structure of the instantPerformP2P.do request assumes the presence of the fromCard block to pass the attributes of the card to be debited and the toCard block to pass the attributes of the card to be credited. Depending on the business processes of the bank and the online store, the following options are possible when carrying out a card-to-card money transfer:

• The online store passes the data of the card to be debited and of the card to be credited to the payment gateway. In this case both blocks of parameters — fromCard and toCard — must be present in the request.
• If the money is transferred to a third-party system (AFT transfer), the online store passes only the data of the card to be debited to the payment gateway. In this case the request must include only one block of parameters — fromCard.
• If debiting is performed by a third-party system (OCT transfer), the online store passes only the data on the card to be credited to the payment gateway. In this case the request must include only one block of parameters — toCard.

Request parameters

| originalSchemeTransactionId | String [1..22] | The identifier of the original successful Mastercard transaction.
Is mandatory when using merchant's stored credentials in stored credential transfers. |

|Optional

| creditBindingId | String [0..255] | Identifier of the stored credential of the card to be credited. It is used in card-to-card transfers when the recipient's card is known in advance. This parameter should first be passed in the request for transfer register (registerP2P.do - clientId parameter should also be passed here), then in the request for transfer funds by binding (performP2PByBinding.do - the value of creditBindingId parameter passed in registerP2P.do should be passed in bindingId parameter in toCard block). |

| email | String [1..40] | The payer's email address. |

| amount | String [0..12] | Transfer amount in minor currency units (e.g. in cents).
This parameter is passed if the payer decides to change the transfer amount when carrying out the money transfer.|

| currency | String [3] | ISO 4217 encoded currency key. If not specified, the default value is used. Only digits are allowed. |

| orderDescription | String [1..600] | Order description passed to the payment gateway during the registration.
It is not allowed to fill this parameter with personal data or payment data (card numbers, etc.). This requirement is due to the fact that the order description is not masked in Merchant Portal and log files.|

| params | Object | Fields for storing additional order information, must be passed as follows:
"params": [ {"name": "param1", "value": "value1"}, {"name": "param2", "value": "value2"} ].
These fields can be passed to the processing bank for further display in the bank registries.
By default orderNumber (order number) and orderDescription (order description) are passed. OrderDescription must not exceed 99 characters, do not use the following characters: %, +, end of line \r and line break \n).

To enable this functionality contact the bank. |

| feeInput | Integer [0..8] | Fee amount in minimum currency units. Must be enabled by respective Merchant-level permission in the Gateway. |

| returnUrl | String [1..512] | The address to which the user will be redirected if the payment is successful. The address must be specified in full including the protocol used (for example, https://mybestmerchantreturnurl.com instead of mybestmerchantreturnurl.com). Otherwise, the user will be redirected to the address of the following type https://dev.bpcbt.com/payment/<merchant_address>.

| failUrl | String [1..512] | The address to which the user is to be redirected in case of a failed payment. The address must be specified in full including the protocol used (for example, https://mybestmerchantreturnurl.com instead of mybestmerchantreturnurl.com). Otherwise, the user will be redirected to the address of the following type https://dev.bpcbt.com/payment/<merchant_address>.

| mcc | Integer [4] | Merchant Category Code. Using this parameter requires a special permission. You can use only the values from the predefined list of allowed MCC values. Contact the support team for details. |

| merchantLogin | String [1..255] | To register an order on behalf of another merchant, specify the merchant's API account login in this parameter.
Can be used only if you have the permission to see the transactions of other merchants or if the specified merchant is your child merchant. |

| dynamicCallbackUrl | String [1..512] | This parameter allows you to use the functionality of sending callback notifications dynamically. Here you can pass the address to which all "payment" callback notifications activated for the merchant will be sent. "Payment" notifications are callback notifications related to the following events: successful hold, payment declined by timeout, cardpresent payment is declined, successful debit, refund, cancellation. At the same time, callback notifications activated for the merchant that are not related to payments (enabling/disabling a stored credential, storing a credential) will be sent to a static address for callbacks. Whether the parameter is mandatory or not depends on the merchant configuration on Payment Gateway side. |

| ip | String [1..39] | Buyer's IP address. IPv6 is supported in all requests. (up to 39 characters).

| captcha | String | CAPTCHA (a text intended to distinguish human from machine input) |

| threeDSSDK | Boolean | Possible values: true or false. Flag showing that payment comes from 3DS SDK. |

| threeDSSDKEncData | String | Encrypted data about device.

Parameter is mandatory for SDK flow.

| threeDSSDKReferenceNumber | String | 3DS2 SDK official identifier |

| threeDSSDKEphemPubKey | String | Public part of ephemeral key. Required to etablish session with ACS.

Parameter is mandatory for SDK flow.

| threeDSSDKAppId | String | Unique identifier of SDK.

Parameter is mandatory for SDK flow.

| threeDSSDKTransId | String | Unique identifier of transaction within SDK.

Parameter is mandatory for SDK flow.

| threeDSMethodNotificationUrl | String [1..512] | URL where notification about performed 3DS-method should be sent to. |

| threeDSServerTransId | String [1..36] | Transaction identifier created on 3DS Server. Mandatory for 3DS authentication. |

| threeDSVer2FinishUrl | String [1..512] | URL where Customer should be redirected after authentication on ACS Server. |

| threeDSVer2MdOrder | String [1..36] | Order number which was registered in the first part of the request within 3DS2 transaction. Mandatory for 3DS2 authentication.
If this parameter is present in the request, the mdOrder value passed in it overrides, and in this case the order gets paid right away instead of being registered.
This parameter is used only for instant payments, i.e., when the order is registered and payed via the same request. |

| bindingNotNeeded | Boolean | Allowed values:

• true – storing the credential after the payment is disabled (a stored credential is a customer identifier passed in order registration request — after payment it will be deleted from order details);
• false – if payment is successful the credential can be stored (if the necessary conditions are met). This is the default value.

| externalScaExemptionIndicator | String | The type of SCA (Strong Customer Authentication) excemption. Used for AFT transactions. If this parameter is specified, the transaction will be processed depending on your settings in the payment gateway: either forced SSL operation will be done, or the issuer bank will get the information about SCA excemption and decide to perform operation with or without 3DS authentication (for details, contact our support team). Allowed values:

• LVP – Low Value Payments transaction. You can consider a transaction as low risk based on the transaction amount, the client's transactions per day or the client's total daily amount.
• TRA – Transaction Risk Analysis transaction, i.e., the transaction that has passed successful anti-fraud check.

| originalPaymentNetRefNum | String [1..36] | The identifier of the original or previous successful transaction in the payment system in relation to the performed stored-credential transaction - TRN ID. Is passed when tii = R,U, or F.
Is mandatory when using merchant's stored credentials in stored credential transfers.|

| billingAndShippingAddressMatchIndicator | String [1] | Indicator for matching the cardholder's billing address and shipping address. This parameter is used for further 3DS authentication of the customer.
Possible values:

• Y - the cardholder's billing address and shipping address match;
• N - cardholder billing address and shipping address do not match.

| fromCard | Object | A block with the attributes of the card to be debited. See nested parameters. |

| toCard | Object | A block with the attributes of the card to be credited. See nested parameters. |

Possible values of tii parameter:

Description of parameters in shippingPayerData object:

Description of parameters in preOrderPayerData object:

Description of parameters in orderPayerData object:

Below are the parameters of the billingPayerData block (data about the client registration address).

| payerIdNumber | String [1..100] | Number of the payer's identifying document (e.g. passport) provided. |

• RTN or 1 – RTN + Bank Account
• IBAN or 2 – IBAN
• CARD_ACCOUNT or 3 – Card Account
• EMAIL or 4– Email
• PHONE_NUMBER or 5 – Phone Number
• BAN_AND_BIC or 6 – Bank account number (BAN) + Bank Identification Code (BIC)
• WALLET_ID or 7 – Wallet Id
• SOCIAL_NETWORK_ID or 8 – Social Network Id
• OTHER or 100 – Other

Below are the parameters of the billingRecipientData block (data about the recipient).

| recipientIdNumber | String [1..99] | Number of the recipient's identifying document provided. |

| recipientBirthday | String [1..20] | Recipient's birth date in the format YYYYMMDD. |

The fromCard block includes the following possible parameters:

When making payments using tokens (APPLE, SAMSUNG, GOOGLE), the fromCard block includes the following parameters instead of card details:

| protocolVersion | String | Protocol version as defined by Google for a paymentToken: ECv1 (by default) or ECv2|

Below are the parameters of the threeDsAuthResult block (data related to 3 DS authentication).

| threeDsType | String | 3DS authentication type. This parameter is required for payment via your own 3DS Server with 3DS 2. For payments with SSL, this parameter is optional and is defined automatically depending on ECI value.
Allowed values:

• 0 - SSL authentication
• 3 - SCA Cardholder authentication with 3DS 2
• 4 - RBA Cardholder authentication with 3DS 2
• 5 - Cardholder authentication attempt with 3DS 2
• 6 - 3DS 2 exemption granted
• 7 - 3RI authentication with 3DS 2
• 8 - 3RI authentication attempt with 3DS 2

| threeDSProtocolVersion | String | 3DS protocol version. Possible values are "2.1.0", "2.2.0" for 3DS2.
If threeDSProtocolVersion is not passed in the request, then the default value will be used for 3D Secure authorization (2.1.0 - for 3DS 2). |

The toCard block (if crediting is done by a third-party system, this block must be absent) consists of the following possible parameters:

The following parameters are also passed during the authentication via the 3DS2 protocol:

Response parameters

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

The parameters of statusResponse block:

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

|
Optional

| orderStatus | Integer | The value of this parameter specifies the status of the order in the payment gateway. It is missing if the order has not been found. Below is the list of available values:

• 0 - order was registered but not paid;
• 2 - order amount is fully authorized;
• 3 - authorization reversed;
• 5 - access control server of the issuing bank initiated authorization procedure;
• 6 - authorization declined;

| orderNumber | String [1..36] | Order number (ID) in the merchant's system, must be unique for each order. |

| panMaskedFrom | String [1..19] | The masked number of the card to be debited. |

| panMaskedTo | String [1..19] | The masked number of the card to be credited. |

| amount | Integer [0..12] | Payment amount in minor currency units (e.g. in cents).|

| currency | String [3] | ISO 4217 encoded currency key. If not specified, the default value is used. Only digits are allowed. |

| creationDate | Integer | Date of order registration. |

| orderDescription | String [1..600] | Order description passed to the payment gateway during the registration.
It is not allowed to fill this parameter with personal data or payment data (card numbers, etc.). This requirement is due to the fact that the order description is not masked in Merchant Portal and log files.|

| ip | String [1..39] | Buyer's IP address. IPv6 is supported in all requests. (up to 39 characters).

| resultCode | Integer | Error code on the request execution. Available values:

• 0 - in case of success;
• 1 - in case of an error.

| orderParams | Object | An object with the merchant's attributes of the order. More than one orderParams object can be presented in the response.
The object must be passed as follows: {"param":"value","param2":"value2"}. |

| operationList | Object | Object containing information on the transactions completed in the order. More than one operationList object can be present in the response.
The parameters that can be passed here are described below. |

| binding | String | Identifier of a stored credential (if it has been already created). This parameter is returned only if the getP2PStatus version is 3 or higher. |

| detokenizedPanRepresentation | String [1..19] | The detokenized card number (the last 4 digits or in a masked form). |

| detokenizedPanExpiryDate | String | The card's detokenized expiration date in the following format: "YYYYMM". |

| paymentNetRefNum | String [1..512] | Original Network Reference Number - a unique identifier assigned by the card network (e.g., Mastercard, Visa) to the original transaction (such as a purchase or authorization). When a follow-up transaction is initiated (e.g., refund, recurring payment), this number must be included to:

• Link the new transaction to the original one
• Ensure proper tracking and reconciliation
• Meet network compliance requirements

When authenticating via the 3DS2 protocol, the following parameters are returned during the initial request:

Below are the parameters to be present in the response, after a repeated request for the payment and the need to redirect the client to the ACS during the authentication via the 3DS2 protocol:

To complete the transaction use /p2p/finishThreeDsVer2.do.

Examples

Example of card-to-card transaction:

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/instantPerformP2P.do' '
--header 'Content-Type: application/json' \
--data '{
  "username": "test_user",
  "password": "test_user_password",
  "email" : "test@example.com",
  "orderNumber" : "abcd1234abchh",
  "amount" : 1500,
  "currency" : "978",
  "returnUrl" : "https://mybestmerchantreturnurl.com",
  "failUrl" : "https://failUrl.com",

  "fromCard" : {
    "cardholderName": "TEST CARDHOLDER",
    "pan" : "5000001111111115",
    "cvc" : "123",
    "expirationYear" : "2024",
    "expirationMonth" : "12"
        },
  "toCard": {
        "pan": "4000001111111118"
    },
  "amountInput": "6000",
  "billingPayerData": {
    "billingCountry":"CYP",
    "billingCity":"Larnaka",
    "billingAddressLine1":"Stadiou 1",
    "payerBirthday": "20211512",
    "payerAccount": "DE1051078567",
    "payerLastName": "Kostas",
    "payerFirstName": "Parnas",
    "payerMiddleName": "Illigel",
    "payerCombinedName": "Kostas Parnas Illigel"
    },
  "billingRecipientData": {
    "recipientFirstName": "Rodetos",
    "recipientLastName": "Castinos",
    "recipientMiddleName": "Internal",
    "recipientCombinedName": "Rodetos Castinos Internal",
    "recipientCountry": "CYP",

    "recipientAccount": "DE3840401048",
    "recipientAccountNumberType": 1
    }
  }'

Example of the response to the request:

{
    "errorCode": 0,
    "info": "Your order is proceeded, redirecting...",
    "acsUrl": "https://example.com/acs2/acs/creq",
    "is3DSVer2": true,
    "packedCReq": "eyJ0aHJlZURTU2VydmVyVHJhbnNJRCI6IjNhZmMxNjhhLTk0YjQtNGViMy04ZTJlLTgwZjZjMTg2NjY5ZCIsIm1lc3NhZ2VUeXBlIjoiQ1JlcSIsIm1lc3NhZ2VWZXJzaW9uIjoiMi4xLjAiLCJhY3NUcmFuc0lEIjoiOWM3NTkxMmEtZTg0NC00ODgyLWI5YzctYzZmYmMzNjIyNGQ3IiwiY2hhbGxlbmdlV2luZG93U2l6ZSI6IjA1In0"
}

P2P transfer status

To obtain the status of a registered P2P order, use https://dev.bpcbt.com/payment/rest/api/p2p/getP2PStatus.do request.

When sending the request, you should use the header: Content-Type: application/json

Request parameters

Response parameters

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

|
Optional

| orderStatus | Integer | The value of this parameter specifies the status of the order in the payment gateway. It is missing if the order has not been found. Below is the list of available values:

• 0 - order was registered but not paid;
• 2 - order amount is fully authorized;
• 3 - authorization reversed;
• 5 - access control server of the issuing bank initiated authorization procedure;
• 6 - authorization declined;

| orderNumber | String [1..36] | Order number (ID) in the merchant's system, must be unique for each order. |

| panMaskedFrom | String [1..19] | The masked number of the card to be debited. |

| panMaskedTo | String [1..19] | The masked number of the card to be credited. |

| amount | Integer [0..12] | Payment amount in minor currency units (e.g. in cents).|

| currency | String [3] | ISO 4217 encoded currency key. If not specified, the default value is used. Only digits are allowed. |

| creationDate | Integer | Date of order registration. |

| orderDescription | String [1..600] | Order description passed to the payment gateway during the registration.
It is not allowed to fill this parameter with personal data or payment data (card numbers, etc.). This requirement is due to the fact that the order description is not masked in Merchant Portal and log files.|

| ip | String [1..39] | Buyer's IP address. IPv6 is supported in all requests. (up to 39 characters).

| resultCode | Integer | Error code on the request execution. Available values:

• 0 - in case of success;
• 1 - in case of an error.

| orderParams | Object | An object with the merchant's attributes of the order. More than one orderParams object can be presented in the response.
The object must be passed as follows: {"param":"value","param2":"value2"}. |

| operationList | Object | Object containing information on the transactions completed in the order. More than one operationList object can be present in the response.
The parameters that can be passed here are described below. |

| binding | String | Identifier of a stored credential (if it has been already created). This parameter is returned only if the getP2PStatus version is 3 or higher. |

| detokenizedPanRepresentation | String [1..19] | The detokenized card number (the last 4 digits or in a masked form). |

| detokenizedPanExpiryDate | String | The card's detokenized expiration date in the following format: "YYYYMM". |

| paymentNetRefNum | String [1..512] | Original Network Reference Number - a unique identifier assigned by the card network (e.g., Mastercard, Visa) to the original transaction (such as a purchase or authorization). When a follow-up transaction is initiated (e.g., refund, recurring payment), this number must be included to:

• Link the new transaction to the original one
• Ensure proper tracking and reconciliation
• Meet network compliance requirements

payerData element contains the following parameters.

Below are possible parameters of the operationList block.

|

| amount | Integer [0..12] | Payment amount in minor currency units (e.g. in cents).|

|
Optional

| currency | String [3] | ISO 4217 encoded currency key. If not specified, the default value is used. Only digits are allowed. |

Examples

Request example

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/getP2PStatus.do' -H 'Content-Type: application/json' --data-raw '{ 
  "username": "test_user",
  "password": "test_user_password",
  "orderId" : "0a4eaae8-653a-71a9-8259-46fc00a8ea58"
}'

Response example

{
  "orderStatus": 0,
  "errorCode": 0,
  "errorMessage": "Successful",
  "orderNumber": "2009",
  "amount": 50000,
  "currency": "978",
  "creationDate": 1674137044330,
  "orderParams": [],
  "operationList": [],
  "resultCode": 0
}

Finishing a 3DS2 P2P transaction via API

To complete a transaction, the merchant sends a transaction ID to the gateway using the https://dev.bpcbt.com/payment/rest/api/p2p/finishThreeDsVer2.do method.

When sending the request, you should use the header: Content-type: application/x-www-form-urlencoded

Request parameters

Response parameters

This request does not return any JSON parameters in response. Instead, it redirects the customer to one of the following URLs:

• If the request processing succeeds, Payment Gateway redirects the customer to the the URL specified in the returnUrl parameter during the order registration, with appended orderId and lang parameters;
• If the request processing fails, Payment Gateway redirects the customer to the URL specified in the failUrl parameter during the order registration, with appended orderId and lang parameters.

Examples

Request example

curl --request POST \
  --url https://dev.bpcbt.com/payment/rest/api/p2p/finishThreeDsVer2.do \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data '{
    "username": "test_user",
    "password": "test_user_password",
    "threeDSServerTransId": "65020d0c-2627-4a45-8eab-b93b58fc52ae"
}'

Redirect URL example