OCT transactions

OCT overview

OCT (Original Credit Transaction) - a special type of transaction for crediting funds to the recipient in real time.

The following rules are applied to all OCT transactions:

• In OCT transaction the order registration request must contain the parameter features with the value WITHOUT_FROM_CARD.
• The data of the card to be credited, i.e. toCard, is specified in OCT transaction.

OCT operation scenario

1. A cardholder (client) interacts with the online store to create an order.
2. The online store system registers the order in the Payment Gateway via registerP2P.do. The registration parameters used include the amount of the transfer, the currency, the order number in the merchant's system, and the return URL for the client.
3. In response to the registration request, the Payment Gateway returns a unique identifier of the order in the payment system and the URL to redirect the client to the form for card data collection.
4. The online store system passes the redirect URL received on step 3 to the client’s Web browser.
5. Client fills in the form and the data is sent to the Payment Gateway server.
6. Payment Gateway makes the transfer of funds via performP2P.do.
7. When the money is transferred, the Payment Gateway sends the return URL to the client’s Web browser (the URL was specified during the registration of the order by the online store on step 2).
8. The client’s Web browser requests the results of the money transfer from the online store.
9. The online store system requests the information about the order status from the payment gateway - getP2PStatus.do.
10. Payment Gateway returns the status of the order.
11. The online store system shows payment result to the client.

API calls

OCT integrations require API calls to be signed. Information about request signatures is available in our API Guide.

P2P order registration

To register an order for the card-to-card money transfer, use https://dev.bpcbt.com/payment/rest/api/p2p/registerP2P.do request.

When sending the request, you should use the header: Content-Type: application/json

Request parameters

| creditBindingId | String [0..255] | Identifier of the stored credential of the card to be credited. It is used in card-to-card transfers when the recipient's card is known in advance. This parameter should first be passed in the request for transfer register (registerP2P.do - clientId parameter should also be passed here), then in the request for transfer funds by binding (performP2PByBinding.do - the value of creditBindingId parameter passed in registerP2P.do should be passed in bindingId parameter in toCard block). |

|Mandatory

| transactionTypeIndicator | String | Indicator of transaction type. It is used in one-direction types of transaction.
There are such possible values:

• A - Account to Account (one person)
• B - Business to business transfer
• C - Transfer for the purpose of purchasing cryptocurrency
• D - Funds Disbursement
• F - Transfer for gambling betting
• G - Online gambling payout
• H - Cash Out (Withdrawal)
• I - Government disbursment
• J - Money transfer – bank-initiated
• L - Non-Card Bill Payment
• O - Credit card Bill Payment
• P - Person to Person (different persons)
• W - Transfer to own account of a staged digital wallet for payment.

| billingAndShippingAddressMatchIndicator | String [1] | Indicator for matching the cardholder's billing address and shipping address. This parameter is used for further 3DS authentication of the customer.
Possible values:

• Y - the cardholder's billing address and shipping address match;
• N - cardholder billing address and shipping address do not match.

| debitMdOrder | String [1..36] | Unique number of the order for which AFT transfer in IPay was performed. This parameter is used for OCT operations for P2P transfers (AFT+OCT). |

| debitTransactionReference | String [1..19] | Reference to AFT operation. This parameter is used for OCT operations for P2P transfers (AFT+OCT) using Mastercard. It is filled by the statusResponse.debitTransactionReference parameter from the corresponding AFT transaction. Mandatory if a Mastercard Money Funding Payment was made earlier and a Unique Transaction Reference was generated and sent. |

| transactionPurpose | String | Transaction purpose (used for OCT transactions using Mastercard). Possible values:

• FAMILY_SUPPORT or 0
• REGULAR_LABOR_TRA or 1
• TRAVEL_AND_TOURISM or 2
• EDUCATION or 3
• HOSPITALIZATION or 4
• EMERGENCY_NEED or 5
• SAVING or 6
• GIFTS or 7
• OTHER or 8
• SALARY or 9
• CROWD_LENDING or 10
• CRYPTO_CURRENCY or 11
• REFUND_ORIGINAL or 12
• REFUND_NEW_CARD or 13
• TRANSFER_SAME_WAL or 14
• BOLETO_PAYMENT or 15
• HIGH_RISK_SECURITY or 16
• RECYCLING_DEPOSIT_RETURN or 17
• VALUE_ADDED_TAX or 18

| serviceProcessingType | String | The type of processing service (used for OCT transactions using Visa). A service flag that tells Visa system how to process a transaction at their processing level. Possible values:

• NORMAL or 00
• ORIG_HOLD or 01
• VISA_DEFERRED_DEFAULT or 02
• VISA_DEFERRED_CUSTOM or 03
• CANCEL_DEFERRED or 09
• VISA_DIRECT_CUSTOM or 0I
• DEFERRED_OCT_QUERY or 0Q
• REC_PAYOUT or 0R
• ALIAS_DIRECTORY or A0

Description of parameters in shippingPayerData object:

Description of parameters in preOrderPayerData object:

Description of parameters in orderPayerData object:

Below are the parameters of the billingPayerData block (data about the client registration address).

| payerIdNumber | String [1..100] | Number of the payer's identifying document (e.g. passport) provided. |

| payerAccountNumberType | String [1..20] | Payer's account number type. Mandatory for OCT transactions using Mastercard. Possible values:

• RTN or 1 – RTN + Bank Account
• IBAN or 2 – IBAN
• CARD_ACCOUNT or 3 – Card Account
• EMAIL or 4– Email
• PHONE_NUMBER or 5 – Phone Number
• BAN_AND_BIC or 6 – Bank account number (BAN) + Bank Identification Code (BIC)
• WALLET_ID or 7 – Wallet Id
• SOCIAL_NETWORK_ID or 8 – Social Network Id
• OTHER or 100 – Other

Below are the parameters of the billingRecipientData block (data about the recipient).

| recipientIdNumber | String [1..99] | Number of the recipient's identifying document provided. |

| recipientBirthday | String [1..20] | Recipient's birth date in the format YYYYMMDD. |

Response parameters

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

| formUrl | String [1..512] | URL of the payment form, to which a customer will be redirected The URL is not returned if the registration of the order fails due to an error specified in errorCode. |

| orderId | String [1..36] | Order number in the payment gateway. Unique within the payment gateway. |

| orderNumber | String [1..36] | Order number (ID) in the merchant's system, must be unique for each order. |

Examples

Request example of OCT operation

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/registerP2P.do'
-H 'Content-Type: application/json'
--data-raw '{
  "username":"test_user",
  "password":"test_user_password",
  "amount" : 50000,
  "currency" : "978",
  "returnUrl" : "https://mybestmerchantreturnurl.com",
  "orderNumber": "12",
  "clientId": "122313",
  "transactionTypeIndicator": "A",
  "features":{
      "feature":["WITHOUT_FROM_CARD"]
   }
}'

Response example

{
  "errorCode": 0,
  "errorMessage": "Successful",
  "orderId": "0a4eaae8-653a-71a9-8259-46fc00a8ea58",
  "formUrl": "https://dev.bpcbt.com/payment/merchants/ecom/payment.html?mdOrder=0a4eaae8-653a-71a9-8259-46fc00a8ea58&language=en",
  "orderNumber": "2009"
}

Fee amount

To obtain the fee amount for the money transfer, use https://dev.bpcbt.com/payment/rest/api/p2p/verifyP2P.do request.

When sending the request, you should use the header: Content-Type: application/json

The structure of the performP2P.do request assumes the presence of the toCard block to pass the attributes of the card to be credited.

Request parameters

The toCard block consists of the following possible parameters:

Below are the parameters of the billingPayerData block (data about the client registration address).

| payerIdNumber | String [1..100] | Number of the payer's identifying document (e.g. passport) provided. |

Below are the parameters of the billingRecipientData block (data about the recipient).

| recipientIdNumber | String [1..99] | Number of the recipient's identifying document provided. |

| recipientBirthday | String [1..20] | Recipient's birth date in the format YYYYMMDD. |

Response parameters

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

The feeDescriptionList block includes the following parameters:

Examples

Request example

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/verifyP2P.do' -H 'Content-Type: application/json' --data-raw '{
  "username":"test_user",
  "password":"test_user_password",
  "orderId": "0a4eaae8-653a-71a9-8259-46fc00a8ea58",
  "toCard": {
    "pan": "4000001111111118"
  },

  "amount" : 50000
}'

Response example

{
  "errorCode": 0,
  "errorMessage": "Successful",
  "feeDescriptionList: [ {
    "feeAmount": 500,
    "feeCurrency": "978",
    "feeDescription": "Acquirer fee"
  } ]
}

Stored-credential P2P fee amount

To get the amount of commission when transferring funds by a stored-credential transaction, use the https://dev.bpcbt.com/payment/rest/api/p2p/verifyP2PByBinding.do request.

When sending the request, you should use the header: Content-Type: application/json

Request parameters

The toCard block consists of the following possible parameters:

Response parameters

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

|
Optional

| feeAmount | Integer [1..12] | Fee amount. |

| feeCurrency | String [3] | The ISO 4217 code of the fee currency. |

| feeDescription | String [1..512] | The description of the fee. |

Examples

Request example

curl --location --request POST 'https://dev.bpcbt.com/payment/rest/api/p2p/verifyP2PByBinding.do' \
--header 'Content-Type: application/json' \
--data-raw '{
    "username": "test_user",
    "password": "test_user_password",
    "orderId": "fa71bf70-7c81-484e-a6fc-7db7e4283b2a",
    "bindingId": "4d792471-cee0-742c-922d-a265072e6148",
    "toCard": {
        "cardholderName": "NAME SURNAME",
        "cvc": "123",
        "expirationMonth": 12,
        "expirationYear": 2024,
        "pan": "5555555555555599"
    },
    "amount": 1000,
    "currency": "978",
    "clientId": "123"
}'

Response example

{
  "errorCode" : 0,
  "errorMessage" : "Successful",
  "feeDescriptionList" : [ {
    "feeAmount" : 10,
    "feeCurrency" : "978",
    "feeDescription" : "Acquirer fee"
  } ]
}

P2P transfer

To perform a card-to-card money transfer, use https://dev.bpcbt.com/payment/rest/api/p2p/performP2P.do request.

When sending the request, you should use the header: Content-Type: application/json

The structure of the performP2P.do request assumes the presence of the toCard block to pass the attributes of the card to be credited.

Request parameters

| originalPaymentNetRefNum | String [1..36] | The identifier of the original or previous successful transaction in the payment system in relation to the performed stored-credential transaction - TRN ID. Is passed when tii = R,U, or F.
Is mandatory when using merchant's stored credentials in stored credential transfers.|

| toCard | Object | A block with the attributes of the card to be credited. See nested parameters. |

| debitTransactionReference | String [1..19] | Reference to AFT operation. This parameter is used for OCT operations for P2P transfers (AFT+OCT) using Mastercard. It is filled by the statusResponse.debitTransactionReference parameter from the corresponding AFT transaction. Mandatory if a Mastercard Money Funding Payment was made earlier and a Unique Transaction Reference was generated and sent. |

| transactionPurpose | String | Transaction purpose (used for OCT transactions using Mastercard). Possible values:

• FAMILY_SUPPORT or 0
• REGULAR_LABOR_TRA or 1
• TRAVEL_AND_TOURISM or 2
• EDUCATION or 3
• HOSPITALIZATION or 4
• EMERGENCY_NEED or 5
• SAVING or 6
• GIFTS or 7
• OTHER or 8
• SALARY or 9
• CROWD_LENDING or 10
• CRYPTO_CURRENCY or 11
• REFUND_ORIGINAL or 12
• REFUND_NEW_CARD or 13
• TRANSFER_SAME_WAL or 14
• BOLETO_PAYMENT or 15
• HIGH_RISK_SECURITY or 16
• RECYCLING_DEPOSIT_RETURN or 17
• VALUE_ADDED_TAX or 18

| serviceProcessingType | String | The type of processing service (used for OCT transactions using Visa). A service flag that tells Visa system how to process a transaction at their processing level. Possible values:

• NORMAL or 00
• ORIG_HOLD or 01
• VISA_DEFERRED_DEFAULT or 02
• VISA_DEFERRED_CUSTOM or 03
• CANCEL_DEFERRED or 09
• VISA_DIRECT_CUSTOM or 0I
• DEFERRED_OCT_QUERY or 0Q
• REC_PAYOUT or 0R
• ALIAS_DIRECTORY or A0

Description of parameters in shippingPayerData object:

Description of parameters in preOrderPayerData object:

Description of parameters in orderPayerData object:

Below are the parameters of the billingPayerData block (data about the client registration address).

| payerIdNumber | String [1..100] | Number of the payer's identifying document (e.g. passport) provided. |

| payerAccountNumberType | String [1..20] | Payer's account number type. Mandatory for OCT transactions using Mastercard. Possible values:

• RTN or 1 – RTN + Bank Account
• IBAN or 2 – IBAN
• CARD_ACCOUNT or 3 – Card Account
• EMAIL or 4– Email
• PHONE_NUMBER or 5 – Phone Number
• BAN_AND_BIC or 6 – Bank account number (BAN) + Bank Identification Code (BIC)
• WALLET_ID or 7 – Wallet Id
• SOCIAL_NETWORK_ID or 8 – Social Network Id
• OTHER or 100 – Other

Below are the parameters of the billingRecipientData block (data about the recipient).

| recipientIdNumber | String [1..99] | Number of the recipient's identifying document provided. |

| recipientBirthday | String [1..20] | Recipient's birth date in the format YYYYMMDD. |

The toCard block consists of the following possible parameters:

The following parameters are also passed during the authentication via the 3DS2 protocol:

Response parameters

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

|
Optional

| info | String | The result of an attempt to transfer funds.

The value in case of a successful transfer: "Your payment has been processed, redirecting...".

The value in case of an error: "Redirecting..." |

| acsUrl | String [1..512] | The URL address for redirecting to ACS. It is returned in a successful response in case of a 3D-Secure payment, when redirect to the ACS is needed. For details see Redirect to ACS.|

| paReq | String [1..255] | PAReq (Payment Authentication Request) - a message that should be sent to ACS together with redirect. It is returned in a successful response in case of a 3D-Secure payment, when redirect to the ACS is needed. This message contains the Base64-encoded data necessary for the cardholder authentication. For details see Redirect to ACS. |

| termUrl | String [1..512] | In a successful response in case of a 3D-Secure payment. URL address for redirecting the client after interaction with the ACS for the payment completion. |

| originalPaymentNetRefNum | String [1..36] | The identifier of the original or previous successful transaction in the payment system in relation to the performed stored-credential transaction - TRN ID. Is passed when tii = R,U, or F.
Is mandatory when using merchant's stored credentials in stored credential transfers.|

| debitTransactionReference | String [1..19] | Reference to AFT operation. This parameter is used for OCT operations for P2P transfers (AFT+OCT) using Mastercard. It is automatically filled by statusResponse.debitTransactionReference parameter from the corresponding AFT transaction (automatically generated by Payment Gateway) or by the corresponding parameter received in the OCT request. |

When authenticating via the 3DS2 protocol, the following parameters are returned during the initial request:

Below are the parameters to be present in the response, after a repeated request for the payment and the need to redirect the client to the ACS during the authentication via the 3DS2 protocol:

The parameters of statusResponse block:

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

| orderStatus | Integer | The value of this parameter specifies the status of the order in the payment gateway. It is missing if the order has not been found. Below is the list of available values:

• 0 - order was registered but not paid;
• 2 - order amount is fully authorized;
• 3 - authorization reversed;
• 5 - access control server of the issuing bank initiated authorization procedure;
• 6 - authorization declined;

| orderNumber | String [1..36] | Order number (ID) in the merchant's system, must be unique for each order. |

| panMaskedFrom | String [1..19] | The masked number of the card to be debited. |

| panMaskedTo | String [1..19] | The masked number of the card to be credited. |

| amount | Integer [0..12] | Payment amount in minor currency units (e.g. in cents).|

| currency | String [3] | ISO 4217 encoded currency key. If not specified, the default value is used. Only digits are allowed. |

| creationDate | Integer | Date of order registration. |

| orderDescription | String [1..600] | Order description passed to the payment gateway during the registration.
It is not allowed to fill this parameter with personal data or payment data (card numbers, etc.). This requirement is due to the fact that the order description is not masked in Merchant Portal and log files.|

| ip | String [1..39] | Buyer's IP address. IPv6 is supported in all requests. (up to 39 characters).

| resultCode | Integer | Error code on the request execution. Available values:

• 0 - in case of success;
• 1 - in case of an error.

| orderParams | Object | An object with the merchant's attributes of the order. More than one orderParams object can be presented in the response.
The object must be passed as follows: {"param":"value","param2":"value2"}. |

| operationList | Object | Object containing information on the transactions completed in the order. More than one operationList object can be present in the response.
The parameters that can be passed here are described below. |

| binding | String | Identifier of a stored credential (if it has been already created). This parameter is returned only if the getP2PStatus version is 3 or higher. |

| detokenizedPanRepresentation | String [1..19] | The detokenized card number (the last 4 digits or in a masked form). |

| detokenizedPanExpiryDate | String | The card's detokenized expiration date in the following format: "YYYYMM". |

| paymentNetRefNum | String [1..512] | Original Network Reference Number - a unique identifier assigned by the card network (e.g., Mastercard, Visa) to the original transaction (such as a purchase or authorization). When a follow-up transaction is initiated (e.g., refund, recurring payment), this number must be included to:

• Link the new transaction to the original one
• Ensure proper tracking and reconciliation
• Meet network compliance requirements

To complete the transaction use /p2p/finishThreeDsVer2.do.

Examples

Example of the OCT request

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/performP2P.do'
-H 'Content-Type: application/json'
--data-raw '{
  "username":"test_user",
  "password":"test_user_password",
  "orderId" : "38b7a9e0-7cfa-46f7-8655-f206a8898e7a",
  "amount" : 50000,
  "toCard" : {
    "pan" : "4111111111111111"
  }
}'

Example of the response to the request

{
  "errorCode": 0,
  "info": "Your order is proceeded, redirecting...",
  "acsUrl": "https://example.com/acs2/acs/creq",
  "is3DSVer2": true,
  "packedCReq": "eyJ0aHJlZURTU2VydmVyVHJhbnNJRCI6IjNhZmMxNjhhLTk0YjQtNGViMy04ZTJlLTgwZjZjMTg2NjY5ZCIsIm1lc3NhZ2VUeXBlIjoiQ1JlcSIsIm1lc3NhZ2VWZXJzaW9uIjoiMi4xLjAiLCJhY3NUcmFuc0lEIjoiOWM3NTkxMmEtZTg0NC00ODgyLWI5YzctYzZmYmMzNjIyNGQ3IiwiY2hhbGxlbmdlV2luZG93U2l6ZSI6IjA1In0"
}

Stored-credential P2P transfer

To perform a card-to-card transfer by binding, use https://dev.bpcbt.com/payment/rest/api/p2p/performP2PByBinding.do request.

When sending the request, you should use the header: Content-Type: application/json

Request parameters

| originalPaymentNetRefNum | String [1..36] | The identifier of the original or previous successful transaction in the payment system in relation to the performed stored-credential transaction - TRN ID. Is passed when tii = R,U, or F.
Is mandatory when using merchant's stored credentials in stored credential transfers.|

| mcc | Integer [4] | Merchant Category Code. Using this parameter requires a special permission. You can use only the values from the predefined list of allowed MCC values. Contact the support team for details. |

| originalSchemeTransactionId | String [1..22] | The identifier of the original successful Mastercard transaction.
Is mandatory when using merchant's stored credentials in stored credential transfers. |

| billingAndShippingAddressMatchIndicator | String [1] | Indicator for matching the cardholder's billing address and shipping address. This parameter is used for further 3DS authentication of the customer.
Possible values:

• Y - the cardholder's billing address and shipping address match;
• N - cardholder billing address and shipping address do not match.

| toCard | Object | A block with the attributes of the card to be credited. See nested parameters. |

| debitTransactionReference | String [1..19] | Reference to AFT operation. This parameter is used for OCT operations for P2P transfers (AFT+OCT) using Mastercard. It is filled by the statusResponse.debitTransactionReference parameter from the corresponding AFT transaction. Mandatory if a Mastercard Money Funding Payment was made earlier and a Unique Transaction Reference was generated and sent. |

| transactionPurpose | String | Transaction purpose (used for OCT transactions using Mastercard). Possible values:

• FAMILY_SUPPORT or 0
• REGULAR_LABOR_TRA or 1
• TRAVEL_AND_TOURISM or 2
• EDUCATION or 3
• HOSPITALIZATION or 4
• EMERGENCY_NEED or 5
• SAVING or 6
• GIFTS or 7
• OTHER or 8
• SALARY or 9
• CROWD_LENDING or 10
• CRYPTO_CURRENCY or 11
• REFUND_ORIGINAL or 12
• REFUND_NEW_CARD or 13
• TRANSFER_SAME_WAL or 14
• BOLETO_PAYMENT or 15
• HIGH_RISK_SECURITY or 16
• RECYCLING_DEPOSIT_RETURN or 17
• VALUE_ADDED_TAX or 18

| serviceProcessingType | String | The type of processing service (used for OCT transactions using Visa). A service flag that tells Visa system how to process a transaction at their processing level. Possible values:

• NORMAL or 00
• ORIG_HOLD or 01
• VISA_DEFERRED_DEFAULT or 02
• VISA_DEFERRED_CUSTOM or 03
• CANCEL_DEFERRED or 09
• VISA_DIRECT_CUSTOM or 0I
• DEFERRED_OCT_QUERY or 0Q
• REC_PAYOUT or 0R
• ALIAS_DIRECTORY or A0

The toCard block (if crediting is done by a third-party system, this block must be absent) consists of the following possible parameters:

Description of parameters in shippingPayerData object:

Description of parameters in preOrderPayerData object:

Description of parameters in orderPayerData object:

Below are the parameters of the billingPayerData block (data about the client registration address).

| payerIdNumber | String [1..100] | Number of the payer's identifying document (e.g. passport) provided. |

| payerAccountNumberType | String [1..20] | Payer's account number type. Mandatory for OCT transactions using Mastercard. Possible values:

• RTN or 1 – RTN + Bank Account
• IBAN or 2 – IBAN
• CARD_ACCOUNT or 3 – Card Account
• EMAIL or 4– Email
• PHONE_NUMBER or 5 – Phone Number
• BAN_AND_BIC or 6 – Bank account number (BAN) + Bank Identification Code (BIC)
• WALLET_ID or 7 – Wallet Id
• SOCIAL_NETWORK_ID or 8 – Social Network Id
• OTHER or 100 – Other

Below are the parameters of the billingRecipientData block (data about the recipient).

| recipientIdNumber | String [1..99] | Number of the recipient's identifying document provided. |

| recipientBirthday | String [1..20] | Recipient's birth date in the format YYYYMMDD. |

The following parameters are also passed during the authentication via the 3DS2 protocol:

Response parameters

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

| info | String | The result of an attempt to transfer funds.

The value in case of a successful transfer: "Your payment has been processed, redirecting...".

The value in case of an error: "Redirecting..." |

| acsUrl | String [1..512] | The URL address for redirecting to ACS. It is returned in a successful response in case of a 3D-Secure payment, when redirect to the ACS is needed. For details see Redirect to ACS.|

| paReq | String [1..255] | PAReq (Payment Authentication Request) - a message that should be sent to ACS together with redirect. It is returned in a successful response in case of a 3D-Secure payment, when redirect to the ACS is needed. This message contains the Base64-encoded data necessary for the cardholder authentication. For details see Redirect to ACS. |

| termUrl | String [1..512] | In a successful response in case of a 3D-Secure payment. The URL address to which ACS redirects the cardholder after authentication. For details see Redirect to ACS. |

| debitTransactionReference | String [1..19] | Reference to AFT operation. This parameter is used for OCT operations for P2P transfers (AFT+OCT) using Mastercard. It is automatically filled by statusResponse.debitTransactionReference parameter from the corresponding AFT transaction (automatically generated by Payment Gateway) or by the corresponding parameter received in the OCT request. |

When authenticating via the 3DS2 protocol, the following parameters are returned during the initial request:

Below are the parameters to be present in the response, after a repeated request for the payment and the need to redirect the client to the ACS during the authentication via the 3DS2 protocol:

The parameters of statusResponse block:

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

| orderStatus | Integer | The value of this parameter specifies the status of the order in the payment gateway. It is missing if the order has not been found. Below is the list of available values:

• 0 - order was registered but not paid;
• 2 - order amount is fully authorized;
• 3 - authorization reversed;
• 5 - access control server of the issuing bank initiated authorization procedure;
• 6 - authorization declined;

| orderNumber | String [1..36] | Order number (ID) in the merchant's system, must be unique for each order. |

| panMaskedFrom | String [1..19] | The masked number of the card to be debited. |

| panMaskedTo | String [1..19] | The masked number of the card to be credited. |

| amount | Integer [0..12] | Payment amount in minor currency units (e.g. in cents).|

| currency | String [3] | ISO 4217 encoded currency key. If not specified, the default value is used. Only digits are allowed. |

| creationDate | Integer | Date of order registration. |

| orderDescription | String [1..600] | Order description passed to the payment gateway during the registration.
It is not allowed to fill this parameter with personal data or payment data (card numbers, etc.). This requirement is due to the fact that the order description is not masked in Merchant Portal and log files.|

| ip | String [1..39] | Buyer's IP address. IPv6 is supported in all requests. (up to 39 characters).

| resultCode | Integer | Error code on the request execution. Available values:

• 0 - in case of success;
• 1 - in case of an error.

| orderParams | Object | An object with the merchant's attributes of the order. More than one orderParams object can be presented in the response.
The object must be passed as follows: {"param":"value","param2":"value2"}. |

| operationList | Object | Object containing information on the transactions completed in the order. More than one operationList object can be present in the response.
The parameters that can be passed here are described below. |

| binding | String | Identifier of a stored credential (if it has been already created). This parameter is returned only if the getP2PStatus version is 3 or higher. |

| detokenizedPanRepresentation | String [1..19] | The detokenized card number (the last 4 digits or in a masked form). |

| detokenizedPanExpiryDate | String | The card's detokenized expiration date in the following format: "YYYYMM". |

| paymentNetRefNum | String [1..512] | Original Network Reference Number - a unique identifier assigned by the card network (e.g., Mastercard, Visa) to the original transaction (such as a purchase or authorization). When a follow-up transaction is initiated (e.g., refund, recurring payment), this number must be included to:

• Link the new transaction to the original one
• Ensure proper tracking and reconciliation
• Meet network compliance requirements

Examples

Request example

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/performP2PByBinding.do' 
-H 'Content-Type: application/json' 
--data-raw '{ 
  "amountInput" : 1000,
  "bindingId" : "03e9492a-536c-7ab4-85e6-b44000f26b04",
  "toCard": {
        "cardholderName": "TEST CARDHOLDER",
        "cvc": "123",
        "expirationMonth": 12,
        "expirationYear": 2029,
        "pan": "5555555555555599"
  },
  "orderId" : "3dbaf8bb-1d68-76b3-b4e6-784700f26b04",
  "password" : "test_user_password",
  "type" : "WITHOUT_FROM_CARD",
  "username" : "test_user"
}'

Response example

{
  "errorCode" : 0,
  "errorMessage" : "Successful",
  "info" : "Your order is proceeded, redirecting...",
  "redirect" : "https://example.com/?orderId=47743354-be15-7c70-b9ef-4bfc482e68dc&lang=en",
  "is3DSVer2" : false
}

Instant P2P transfer

To perform an instant P2P money transfer without order registration request, use https://dev.bpcbt.com/payment/rest/api/p2p/instantPerformP2P.do request.

When sending request, you should use header: Content-Type: application/json

The structure of the instantPerformP2P.do request assumes the presence of the toCard block to pass the attributes of the card to be credited.

Request parameters

| originalSchemeTransactionId | String [1..22] | The identifier of the original successful Mastercard transaction.
Is mandatory when using merchant's stored credentials in stored credential transfers. |

| creditBindingId | String [0..255] | Identifier of the stored credential of the card to be credited. It is used in card-to-card transfers when the recipient's card is known in advance. This parameter should first be passed in the request for transfer register (registerP2P.do - clientId parameter should also be passed here), then in the request for transfer funds by binding (performP2PByBinding.do - the value of creditBindingId parameter passed in registerP2P.do should be passed in bindingId parameter in toCard block). |

| email | String [1..40] | The payer's email address. |

| amount | String [0..12] | Transfer amount in minor currency units (e.g. in cents).
This parameter is passed if the payer decides to change the transfer amount when carrying out the money transfer.|

| currency | String [3] | ISO 4217 encoded currency key. If not specified, the default value is used. Only digits are allowed. |

| orderDescription | String [1..600] | Order description passed to the payment gateway during the registration.
It is not allowed to fill this parameter with personal data or payment data (card numbers, etc.). This requirement is due to the fact that the order description is not masked in Merchant Portal and log files.|

| feeInput | Integer [0..8] | Fee amount in minimum currency units. Must be enabled by respective Merchant-level permission in the Gateway. |

| returnUrl | String [1..512] | The address to which the user will be redirected if the payment is successful. The address must be specified in full including the protocol used (for example, https://mybestmerchantreturnurl.com instead of mybestmerchantreturnurl.com). Otherwise, the user will be redirected to the address of the following type https://dev.bpcbt.com/payment/<merchant_address>.

| failUrl | String [1..512] | The address to which the user is to be redirected in case of a failed payment. The address must be specified in full including the protocol used (for example, https://mybestmerchantreturnurl.com instead of mybestmerchantreturnurl.com). Otherwise, the user will be redirected to the address of the following type https://dev.bpcbt.com/payment/<merchant_address>.

| transactionTypeIndicator | String | Indicator of transaction type. It is used in one-direction types of transaction.
There are such possible values:

• A - Account to Account (one person)
• B - Business to business transfer
• C - Transfer for the purpose of purchasing cryptocurrency
• D - Funds Disbursement
• F - Transfer for gambling betting
• G - Online gambling payout
• H - Cash Out (Withdrawal)
• I - Government disbursment
• J - Money transfer – bank-initiated
• L - Non-Card Bill Payment
• O - Credit card Bill Payment
• P - Person to Person (different persons)
• W - Transfer to own account of a staged digital wallet for payment.

| mcc | Integer [4] | Merchant Category Code. Using this parameter requires a special permission. You can use only the values from the predefined list of allowed MCC values. Contact the support team for details. |

| merchantLogin | String [1..255] | To register an order on behalf of another merchant, specify the merchant's API account login in this parameter.
Can be used only if you have the permission to see the transactions of other merchants or if the specified merchant is your child merchant. |

| dynamicCallbackUrl | String [1..512] | This parameter allows you to use the functionality of sending callback notifications dynamically. Here you can pass the address to which all "payment" callback notifications activated for the merchant will be sent. "Payment" notifications are callback notifications related to the following events: successful hold, payment declined by timeout, cardpresent payment is declined, successful debit, refund, cancellation. At the same time, callback notifications activated for the merchant that are not related to payments (enabling/disabling a stored credential, storing a credential) will be sent to a static address for callbacks. Whether the parameter is mandatory or not depends on the merchant configuration on Payment Gateway side. |

| ip | String [1..39] | Buyer's IP address. IPv6 is supported in all requests. (up to 39 characters).

| captcha | String | CAPTCHA (a text intended to distinguish human from machine input) |

| threeDSSDK | Boolean | Possible values: true or false. Flag showing that payment comes from 3DS SDK. |

| threeDSSDKEncData | String | Encrypted data about device.

Parameter is mandatory for SDK flow.

| threeDSSDKReferenceNumber | String | 3DS2 SDK official identifier |

| threeDSSDKEphemPubKey | String | Public part of ephemeral key. Required to etablish session with ACS.

Parameter is mandatory for SDK flow.

| threeDSSDKAppId | String | Unique identifier of SDK.

Parameter is mandatory for SDK flow.

| threeDSSDKTransId | String | Unique identifier of transaction within SDK.

Parameter is mandatory for SDK flow.

| threeDSMethodNotificationUrl | String [1..512] | URL where notification about performed 3DS-method should be sent to. |

| threeDSServerTransId | String [1..36] | Transaction identifier created on 3DS Server. Mandatory for 3DS authentication. |

| threeDSVer2FinishUrl | String [1..512] | URL where Customer should be redirected after authentication on ACS Server. |

| threeDSVer2MdOrder | String [1..36] | Order number which was registered in the first part of the request within 3DS2 transaction. Mandatory for 3DS2 authentication.
If this parameter is present in the request, the mdOrder value passed in it overrides, and in this case the order gets paid right away instead of being registered.
This parameter is used only for instant payments, i.e., when the order is registered and payed via the same request. |

| bindingNotNeeded | Boolean | Allowed values:

• true – storing the credential after the payment is disabled (a stored credential is a customer identifier passed in order registration request — after payment it will be deleted from order details);
• false – if payment is successful the credential can be stored (if the necessary conditions are met). This is the default value.

| originalPaymentNetRefNum | String [1..36] | The identifier of the original or previous successful transaction in the payment system in relation to the performed stored-credential transaction - TRN ID. Is passed when tii = R,U, or F.
Is mandatory when using merchant's stored credentials in stored credential transfers.|

| billingAndShippingAddressMatchIndicator | String [1] | Indicator for matching the cardholder's billing address and shipping address. This parameter is used for further 3DS authentication of the customer.
Possible values:

• Y - the cardholder's billing address and shipping address match;
• N - cardholder billing address and shipping address do not match.

| toCard | Object | A block with the attributes of the card to be credited. See nested parameters. |

| debitMdOrder | String [1..36] | Unique number of the order for which AFT transfer in IPay was performed. This parameter is used for OCT operations for P2P transfers (AFT+OCT). |

| debitTransactionReference | String [1..19] | Reference to AFT operation. This parameter is used for OCT operations for P2P transfers (AFT+OCT) using Mastercard. It is filled by the statusResponse.debitTransactionReference parameter from the corresponding AFT transaction. Mandatory if a Mastercard Money Funding Payment was made earlier and a Unique Transaction Reference was generated and sent. |

| transactionPurpose | String | Transaction purpose (used for OCT transactions using Mastercard). Possible values:

• FAMILY_SUPPORT or 0
• REGULAR_LABOR_TRA or 1
• TRAVEL_AND_TOURISM or 2
• EDUCATION or 3
• HOSPITALIZATION or 4
• EMERGENCY_NEED or 5
• SAVING or 6
• GIFTS or 7
• OTHER or 8
• SALARY or 9
• CROWD_LENDING or 10
• CRYPTO_CURRENCY or 11
• REFUND_ORIGINAL or 12
• REFUND_NEW_CARD or 13
• TRANSFER_SAME_WAL or 14
• BOLETO_PAYMENT or 15
• HIGH_RISK_SECURITY or 16
• RECYCLING_DEPOSIT_RETURN or 17
• VALUE_ADDED_TAX or 18

| serviceProcessingType | String | The type of processing service (used for OCT transactions using Visa). A service flag that tells Visa system how to process a transaction at their processing level. Possible values:

• NORMAL or 00
• ORIG_HOLD or 01
• VISA_DEFERRED_DEFAULT or 02
• VISA_DEFERRED_CUSTOM or 03
• CANCEL_DEFERRED or 09
• VISA_DIRECT_CUSTOM or 0I
• DEFERRED_OCT_QUERY or 0Q
• REC_PAYOUT or 0R
• ALIAS_DIRECTORY or A0

Description of parameters in shippingPayerData object:

Description of parameters in preOrderPayerData object:

Description of parameters in orderPayerData object:

Below are the parameters of the billingPayerData block (data about the client registration address).

| payerIdNumber | String [1..100] | Number of the payer's identifying document (e.g. passport) provided. |

| payerAccountNumberType | String [1..20] | Payer's account number type. Mandatory for OCT transactions using Mastercard. Possible values:

• RTN or 1 – RTN + Bank Account
• IBAN or 2 – IBAN
• CARD_ACCOUNT or 3 – Card Account
• EMAIL or 4– Email
• PHONE_NUMBER or 5 – Phone Number
• BAN_AND_BIC or 6 – Bank account number (BAN) + Bank Identification Code (BIC)
• WALLET_ID or 7 – Wallet Id
• SOCIAL_NETWORK_ID or 8 – Social Network Id
• OTHER or 100 – Other

Below are the parameters of the billingRecipientData block (data about the recipient).

| recipientIdNumber | String [1..99] | Number of the recipient's identifying document provided. |

| recipientBirthday | String [1..20] | Recipient's birth date in the format YYYYMMDD. |

The toCard block (if crediting is done by a third-party system, this block must be absent) consists of the following possible parameters:

The following parameters are also passed during the authentication via the 3DS2 protocol:

Response parameters

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

The parameters of statusResponse block:

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

|
Optional

| orderStatus | Integer | The value of this parameter specifies the status of the order in the payment gateway. It is missing if the order has not been found. Below is the list of available values:

• 0 - order was registered but not paid;
• 2 - order amount is fully authorized;
• 3 - authorization reversed;
• 5 - access control server of the issuing bank initiated authorization procedure;
• 6 - authorization declined;

| orderNumber | String [1..36] | Order number (ID) in the merchant's system, must be unique for each order. |

| panMaskedFrom | String [1..19] | The masked number of the card to be debited. |

| panMaskedTo | String [1..19] | The masked number of the card to be credited. |

| amount | Integer [0..12] | Payment amount in minor currency units (e.g. in cents).|

| currency | String [3] | ISO 4217 encoded currency key. If not specified, the default value is used. Only digits are allowed. |

| creationDate | Integer | Date of order registration. |

| orderDescription | String [1..600] | Order description passed to the payment gateway during the registration.
It is not allowed to fill this parameter with personal data or payment data (card numbers, etc.). This requirement is due to the fact that the order description is not masked in Merchant Portal and log files.|

| ip | String [1..39] | Buyer's IP address. IPv6 is supported in all requests. (up to 39 characters).

| resultCode | Integer | Error code on the request execution. Available values:

• 0 - in case of success;
• 1 - in case of an error.

| orderParams | Object | An object with the merchant's attributes of the order. More than one orderParams object can be presented in the response.
The object must be passed as follows: {"param":"value","param2":"value2"}. |

| operationList | Object | Object containing information on the transactions completed in the order. More than one operationList object can be present in the response.
The parameters that can be passed here are described below. |

| binding | String | Identifier of a stored credential (if it has been already created). This parameter is returned only if the getP2PStatus version is 3 or higher. |

| detokenizedPanRepresentation | String [1..19] | The detokenized card number (the last 4 digits or in a masked form). |

| detokenizedPanExpiryDate | String | The card's detokenized expiration date in the following format: "YYYYMM". |

| paymentNetRefNum | String [1..512] | Original Network Reference Number - a unique identifier assigned by the card network (e.g., Mastercard, Visa) to the original transaction (such as a purchase or authorization). When a follow-up transaction is initiated (e.g., refund, recurring payment), this number must be included to:

• Link the new transaction to the original one
• Ensure proper tracking and reconciliation
• Meet network compliance requirements

When authenticating via the 3DS2 protocol, the following parameters are returned during the initial request:

Below are the parameters to be present in the response, after a repeated request for the payment and the need to redirect the client to the ACS during the authentication via the 3DS2 protocol:

To complete the transaction use /p2p/finishThreeDsVer2.do.

Examples

Example of OCT transaction

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/instantPerformP2P.do' '
--header 'Content-Type: application/json' \
--data '{
  "username": "test_user",
  "password": "test_user_password",
  "email" : "test@example.com",
  "orderNumber" : "abcd1234abchh",
  "amount" : 1500,
  "currency" : "978",
  "returnUrl" : "https://mybestmerchantreturnurl.com",
  "failUrl" : "https://failUrl.com",
  "toCard": {
        "pan": "4000001111111118"
    },
    "transactionTypeIndicator": "G",
    "features": {
        "feature": [
            "WITHOUT_FROM_CARD"
        ]
    }
  }'

Example of the response to the request:

{
    "errorCode": 0,
    "info": "Your order is proceeded, redirecting...",
    "acsUrl": "https://example.com/acs2/acs/creq",
    "is3DSVer2": true,
    "packedCReq": "eyJ0aHJlZURTU2VydmVyVHJhbnNJRCI6IjNhZmMxNjhhLTk0YjQtNGViMy04ZTJlLTgwZjZjMTg2NjY5ZCIsIm1lc3NhZ2VUeXBlIjoiQ1JlcSIsIm1lc3NhZ2VWZXJzaW9uIjoiMi4xLjAiLCJhY3NUcmFuc0lEIjoiOWM3NTkxMmEtZTg0NC00ODgyLWI5YzctYzZmYmMzNjIyNGQ3IiwiY2hhbGxlbmdlV2luZG93U2l6ZSI6IjA1In0"
}

P2P transfer status

To obtain the status of a registered P2P order, use https://dev.bpcbt.com/payment/rest/api/p2p/getP2PStatus.do request.

When sending the request, you should use the header: Content-Type: application/json

Request parameters

Response parameters

| errorMessage | String [1..512] | Information parameter that is an error description in a case of error occurance. errorMessage value can vary, so it should not be hardcoded.
Language of the description is set in language parameter of the request. |

|
Optional

| orderStatus | Integer | The value of this parameter specifies the status of the order in the payment gateway. It is missing if the order has not been found. Below is the list of available values:

• 0 - order was registered but not paid;
• 2 - order amount is fully authorized;
• 3 - authorization reversed;
• 5 - access control server of the issuing bank initiated authorization procedure;
• 6 - authorization declined;

| orderNumber | String [1..36] | Order number (ID) in the merchant's system, must be unique for each order. |

| panMaskedFrom | String [1..19] | The masked number of the card to be debited. |

| panMaskedTo | String [1..19] | The masked number of the card to be credited. |

| amount | Integer [0..12] | Payment amount in minor currency units (e.g. in cents).|

| currency | String [3] | ISO 4217 encoded currency key. If not specified, the default value is used. Only digits are allowed. |

| creationDate | Integer | Date of order registration. |

| orderDescription | String [1..600] | Order description passed to the payment gateway during the registration.
It is not allowed to fill this parameter with personal data or payment data (card numbers, etc.). This requirement is due to the fact that the order description is not masked in Merchant Portal and log files.|

| ip | String [1..39] | Buyer's IP address. IPv6 is supported in all requests. (up to 39 characters).

| resultCode | Integer | Error code on the request execution. Available values:

• 0 - in case of success;
• 1 - in case of an error.

| orderParams | Object | An object with the merchant's attributes of the order. More than one orderParams object can be presented in the response.
The object must be passed as follows: {"param":"value","param2":"value2"}. |

| operationList | Object | Object containing information on the transactions completed in the order. More than one operationList object can be present in the response.
The parameters that can be passed here are described below. |

| binding | String | Identifier of a stored credential (if it has been already created). This parameter is returned only if the getP2PStatus version is 3 or higher. |

| detokenizedPanRepresentation | String [1..19] | The detokenized card number (the last 4 digits or in a masked form). |

| detokenizedPanExpiryDate | String | The card's detokenized expiration date in the following format: "YYYYMM". |

| paymentNetRefNum | String [1..512] | Original Network Reference Number - a unique identifier assigned by the card network (e.g., Mastercard, Visa) to the original transaction (such as a purchase or authorization). When a follow-up transaction is initiated (e.g., refund, recurring payment), this number must be included to:

• Link the new transaction to the original one
• Ensure proper tracking and reconciliation
• Meet network compliance requirements

payerData element contains the following parameters.

Below are possible parameters of the operationList block.

|

| amount | Integer [0..12] | Payment amount in minor currency units (e.g. in cents).|

|
Optional

| currency | String [3] | ISO 4217 encoded currency key. If not specified, the default value is used. Only digits are allowed. |

Examples

Request example

curl -X POST 'https://dev.bpcbt.com/payment/rest/api/p2p/getP2PStatus.do' -H 'Content-Type: application/json' --data-raw '{ 
  "username": "test_user",
  "password": "test_user_password",
  "orderId" : "0a4eaae8-653a-71a9-8259-46fc00a8ea58"
}'

Response example

{
  "orderStatus": 0,
  "errorCode": 0,
  "errorMessage": "Successful",
  "orderNumber": "2009",
  "amount": 50000,
  "currency": "978",
  "creationDate": 1674137044330,
  "orderParams": [],
  "operationList": [],
  "resultCode": 0
}

Finishing a 3DS2 P2P transaction via API

To complete a transaction, the merchant sends a transaction ID to the gateway using the https://dev.bpcbt.com/payment/rest/api/p2p/finishThreeDsVer2.do method.

When sending the request, you should use the header: Content-type: application/x-www-form-urlencoded

Request parameters

Response parameters

This request does not return any JSON parameters in response. Instead, it redirects the customer to one of the following URLs:

• If the request processing succeeds, Payment Gateway redirects the customer to the the URL specified in the returnUrl parameter during the order registration, with appended orderId and lang parameters;
• If the request processing fails, Payment Gateway redirects the customer to the URL specified in the failUrl parameter during the order registration, with appended orderId and lang parameters.

Examples

Request example

curl --request POST \
  --url https://dev.bpcbt.com/payment/rest/api/p2p/finishThreeDsVer2.do \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data '{
    "username": "test_user",
    "password": "test_user_password",
    "threeDSServerTransId": "65020d0c-2627-4a45-8eab-b93b58fc52ae"
}'

Redirect URL example