# Technical Documentation API

Money Transfer Hub provides possibility to process Person-2-Person and Person-2-Merchant transactions in various forms. Please check details in the below documentation.

<p class="callout info">This documentation contains the methods for **mobile-server** integration. The methods included in the documentation are intended for Customers creating their own mobile SDK.</p>

<p class="callout info">The Customer creating the SDK must also remember about the integration with the <span style="text-decoration: underline;">[MobileDC](https://bookstack.verestro.dev/books/user-lifecycle-card-management-api-sdk)</span> component.</p>

## Receiver types which can be used to set Receiver.Type

Based on ReceiverType user can fill different field in Receiver object in requests.

<table id="bkmrk-receivertype-descrip"><colgroup><col style="width: 50%;"></col><col style="width: 50%;"></col></colgroup><tbody><tr class="odd"><td>**ReceiverType**

</td><td>**Description**

</td></tr><tr class="even"><td>BARE\_CARD\_NUMBER

</td><td>Bare card number in **Receiver.card** field

</td></tr><tr class="odd"><td>FRIEND\_ID

</td><td>Should pass FriendId in **Receiver.Card** field

</td></tr><tr class="even"><td>WALLET\_CARD\_ID

</td><td>Should pass DataCoreCardId to **Receiver.Card** field and UserDataCoreCardId to **Receiver.userId** field

</td></tr><tr class="odd"><td>EMPTY

</td><td>Means that the receiver have the same card data like sender. This type may be useful on [Determine Currency](#determine-currency)

</td></tr></tbody></table>

## JWE

Peer To Peer Transaction Service supports encryption of requests and responses as standard JSON Web Encryption (JWE) per RFC 7516.

Recommended to read the JWE standard: [RFC 7516](https://datatracker.ietf.org/doc/html/rfc7516).

Methods that support request encryption in the JWE standard are tagged in the documentation with the header: *Content-Type:application/x-jwe-encryption-body+json*. If the response is to be encrypted with the JWE standard then the header must be added: *X-Encryption-Public-Key* with the public key.

Processing requests and responses can be divided into 4 options listed below:

1. Base request → Base response - the following headers should be provided to pass this case:
    
    
    - *Content-Type: application/json*
2. Base request → Encrypted response - the following headers should be provided to pass this case:
    
    
    - *Content-Type: application/json*
3. Encrypted request → Base response - the following headers should be provided to pass this case:
    
    
    - *Content-Type: application/x-jwe-encryption-body+json*
4. Encrypted request → Encrypted response - the following headers should be provided to pass this case:
    
    
    - *Content-Type: application/x-jwe-encryption-body+json*

### Overview

JWE represents encrypted content using JSON data structures and Base64 encoding. The representation consists of three parts: a JWE Header, a encrypted payload, and a signature. The three parts are serialized to UTF-8 bytes, then encoded using base64url encoding. The JWE’s header, payload, and signature are concatenated with periods (.).

#### JWE typically takes the following form:

```
{Base64 encoded header}.{Base64 encoded payload}.{Base64 encoded signature}
```

#### JWE header contains:

<table id="bkmrk-type-value-constrain" style="width: 100%;"><colgroup><col style="width: 9.02247%;"></col><col style="width: 15.3258%;"></col><col style="width: 10.1802%;"></col><col style="width: 65.3367%;"></col></colgroup><tbody><tr class="odd"><td>**Type**

</td><td>**Value**

</td><td>**Constraints**

</td><td>**Description**

</td></tr><tr class="even"><td>alg

</td><td>RSA-OAEP-256

</td><td>Required

</td><td>Identifies the cryptographic algorithm used to secure the JWE Encrypted Key. Supported algorithms: **RSA-OAEP-256**, **RSA-OAEP-384**, **RSA-OAEP-512**. Recommend value: **RSA-OAEP-256**.

</td></tr><tr class="odd"><td>enc

</td><td>A256GCM

</td><td>Required

</td><td>Identifies the cryptographic algorithm used to secure the payload. Supported algorithms: **A128GCM**, **A192GCM**, **A256GCM**, **A128CBC-HS256**, **A192CBC-HS384**, **A256CBC-HS512**. Recommend value: **A256GCM**.

</td></tr><tr class="even"><td>typ

</td><td>JOSE

</td><td>Optional

</td><td>Identifies the type of encrypted payload. Recommend value: **JOSE**.

</td></tr><tr class="odd"><td>iat

</td><td>1637929226

</td><td>Optional

</td><td>Identifies the time of generation of the JWT token. Supported date format: unix time in UTC. In the case of *iat* send, the validity of JWE is validated. Recommend send the header due to the increase in the security level.

</td></tr><tr class="even"><td>kid

</td><td>5638742a5094327fcd7a5945d06a45a9d83e9006

</td><td>Optional

</td><td>Identifies the public key of use to encrypt payload. Supported format: SHA-1 value of the public key. In the case of *kid* send, the validity of public key is validated, so we can inform the client that the public key has changed.

</td></tr></tbody></table>

### Payload Encryption

Every encrypted request should include JWE token. The jwe token should be passed in the field: *value*.

In case of problems with the implementation of JWE, please contact the administrator.

To prepare the encrypted payload:

The steps may differ depending on the libraries used.

1. Get the public key using the method: \[???\](#Get publicKey). The public key is encoded with Base64.
2. Decode the public key.
3. Then create a correct object to be encrypted.
4. Encrypt the created object with the public key.
5. Create JWE header compatible with: [JWE Header](#JWE_Header)
6. Make a request on the method that supports JWE. Set the JWE token in the field: *value*. Methods supporting JWE use the following header: *Content-Type:application/x-jwe-encryption-body+json*.

### Payload Decryption

To prepare the decrypted payload:

The steps may differ depending on the libraries used.

The cryptographic algorithm used to secure the payload is: **A256GCM**, while to secure the encrypted JWE key: **RSA-OAEP-256**.

1. For the response to be encrypted you need to send *public key* in the header: *X-Encryption-Public-Key*. The header value must be encoded *Base64*.
2. After receiving the response, you should get the JWE token from the field: *value*.
3. Decrypt the JWE token from the field: *value* with the private key.

**Public key format to be encoded in Base64.**

```
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0IDAQAB...
-----END PUBLIC KEY-----
```

# P2P

Every single method should contains Authorization and Mobile-Product headers.

## Active Accounts

Method used to find users with valid mc card type (not expired, strong verified). Response will contain phone numbers with user and card identifiers. Users without accepted TOS or without valid MC card will not be returned in response. If user has multiple cards that match criteria response will contain only user’s default card id.

### Request

```
POST /mobile-api/active-accounts HTTP/1.1
Content-Type: application/json;charset=UTF-8
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjUzNGJhIiwiZXhwIjoxNjUxNzU2Njk4fQ.tBs5Os24ux-zmYNGYx5MCRAIYOg4Wtnu51NGs39doZ0
Product-Name: TestProduct
Content-Length: 56
Host: localhost:8080

{
  "phoneNumbers" : [ "487973296001", "48795005005" ]
}
```

### Request headers

<table id="bkmrk-request-body-with-he"><caption>Request body with header: *X-Encryption-Public-Key*</caption><colgroup><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col></colgroup><tbody><tr class="odd"><td>**Type**

</td><td>**Value**

</td><td>**Constraints**

</td><td>**Description**

</td></tr><tr class="even"><td>Authorization

</td><td>Mobile bG9naW46YWNrbWU=

</td><td>Required

</td><td>Device token with "Mobile " prefix

</td></tr><tr class="odd"><td>Product-Name

</td><td>TestProduct

</td><td>Required

</td><td>Application product name

</td></tr><tr class="even"><td>Content-Type

</td><td>application/x-jwe-encryption-body+json

</td><td>Optional

</td><td>Header must be present if the request body is encrypted using the JWE standard.

</td></tr><tr class="odd"><td>X-Encryption-Public-Key

</td><td>  
</td><td>Optional

</td><td>Header must be present if the response body is to be encrypted using the JWE standard. Public key must be encoded Base64.

</td></tr></tbody></table>

### Request fields

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-constraint" style="width: 100%;"><colgroup><col style="width: 15.3258%;"></col><col style="width: 9.14232%;"></col><col style="width: 31.8914%;"></col><col style="width: 43.6292%;"></col></colgroup><thead><tr><th class="tableblock halign-left valign-top">Path</th><th class="tableblock halign-left valign-top">Type</th><th class="tableblock halign-left valign-top">Constraints</th><th class="tableblock halign-left valign-top">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top">phoneNumbers

</td><td class="tableblock halign-left valign-top">Array

</td><td class="tableblock halign-left valign-top">Required, Size must be between 1 and 100 inclusive

</td><td class="tableblock halign-left valign-top">This array contains phone numbers that each identify a users

</td></tr></tbody></table>

### Response

```
HTTP/1.1 200 OK
Content-Type: application/json
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Length: 160

[ {
  "phoneNumber" : "48797001002",
  "userId" : 311957,
  "cardId" : 226794
}, {
  "phoneNumber" : "48795005005",
  "userId" : 111944,
  "cardId" : 326097
} ]
```

**Error response - ERROR\_VALIDATION.**

```
HTTP/1.1 400 BAD REQUEST
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "ERROR_VALIDATION",
    "message": "Some fields are invalid",
    "data": [
        {
            "field": "{{field_name_from_request}}",
            "message": "{{message}}"
        }
    ]
}

```

**Error response - ERROR\_BAD\_TOKEN.**

```
HTTP/1.1 400 BAD REQUEST
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "ERROR_BAD_TOKEN"
}

```

**Error response - PRODUCT\_NOT\_FOUND.**

```
HTTP/1.1 404 NOT FOUND
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "PRODUCT_NOT_FOUND",
    "message": "Product by name {{product_name}} not found."
}

```

**Error response - INTERNAL\_SERVER\_ERROR.**

```
HTTP/1.1 500 INTERNAL SERVER ERROR
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "INTERNAL_SERVER_ERROR"
}

```

### Response fields

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-descriptio"><thead><tr><th class="tableblock halign-left valign-top">Path</th><th class="tableblock halign-left valign-top">Type</th><th class="tableblock halign-left valign-top">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top">`[].phoneNumber`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Phone number

</td></tr><tr><td class="tableblock halign-left valign-top">`[].userId`

</td><td class="tableblock halign-left valign-top">`Number`

</td><td class="tableblock halign-left valign-top">User identifier

</td></tr><tr><td class="tableblock halign-left valign-top">`[].cardId`

</td><td class="tableblock halign-left valign-top">`Number`

</td><td class="tableblock halign-left valign-top">Card identifier

</td></tr></tbody></table>

### Errors

<table id="bkmrk-encrypted-response-f"><caption>Encrypted response fields when sent header: *X-Encryption-Public-Key*</caption><colgroup><col style="width: 33%;"></col><col style="width: 33%;"></col><col style="width: 33%;"></col></colgroup><tbody><tr class="odd"><td>**Http Status**

</td><td>**Error Status**

</td><td>**Description**

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>ERROR\_VALIDATION

</td><td>Some fields are invalid

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>ERROR\_BAD\_TOKEN

</td><td>Invalid authorization token

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>Error decoding public key has sent in header: *X-Encryption-Public-Key*

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>Error on decrypting request

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>Error on encrypting response

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>JWE encryption Key is invalid

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>JWE payload is expired

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>INVALID\_PHONE\_NUMBERS

</td><td>Phone numbers has incorrect format

</td></tr><tr class="even"><td>404 - Not Found

</td><td>PRODUCT\_NOT\_FOUND

</td><td>Product not found based on sent header: *Product-Name*

</td></tr><tr class="odd"><td>500 - Internal Server Error

</td><td>INTERNAL\_SERVER\_ERROR

</td><td>Internal application error

</td></tr></tbody></table>

## Determine currency

**Request body with header: *X-Encryption-Public-Key*.**

Method is used to determine currencies applied for given sender and receiver cards.

### Request

**Receiver.receiverType = WALLET\_CARD\_ID.**

```
POST /mobile-api/determine-currency HTTP/1.1
Content-Type: application/json
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjg4MjIyYmEiLCJleHAiOjE2NTE3NTY2OTh9.bbGrMfHjTtvHNmHzW_IKG6lUVzVJhJX8UUQ1ZuuvwWg
Product-Name:
Content-Type: application/json
Content-Length: 56

{
    "sender": {
        "cardId": "219754"
    },
    "receiver": {
        "card": ["2","1","4","4","9","2"],
        "userId": "1223",
        "receiverType": "WALLET_CARD_ID"
    }
}
```

**Receiver.receiverType = FRIEND\_ID.**

```
POST /mobile-api/determine-currency HTTP/1.1
Content-Type: application/json
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjg4MjIyYmEiLCJleHAiOjE2NTE3NTY2OTh9.bbGrMfHjTtvHNmHzW_IKG6lUVzVJhJX8UUQ1ZuuvwWg
Product-Name: TestProduct
Content-Length: 56

{
    "sender": {
        "cardId": "219754"
    },
    "receiver": {
        "userId": "21",
        "receiverType": "FRIEND_ID"
    }
}
```

**Receiver.receiverType = EMPTY.**

```
POST /mobile-api/determine-currency HTTP/1.1
Content-Type: application/json
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjg4MjIyYmEiLCJleHAiOjE2NTE3NTY2OTh9.bbGrMfHjTtvHNmHzW_IKG6lUVzVJhJX8UUQ1ZuuvwWg
Product-Name: TestProduct
Content-Length: 56

{
    "sender": {
        "cardId": "219754"
    },
    "receiver": {
        "receiverType": "EMPTY"
    }
}
```

**Receiver.receiverType = BARE\_CARD\_NUMBER.**

```
POST /mobile-api/determine-currency HTTP/1.1
Content-Type: application/json
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjg4MjIyYmEiLCJleHAiOjE2NTE3NTY2OTh9.bbGrMfHjTtvHNmHzW_IKG6lUVzVJhJX8UUQ1ZuuvwWg
Product-Name: TestProduct
Content-Length: 56

{
    "sender": {
        "cardId": "219754"
    },
    "receiver": {
        "card": ["2","2","2","1","0","0","4","0","7","2","1","9","0","1","8","5"],
        "receiverType": "BARE_CARD_NUMBER"
    }
}
```

### Request headers

<table id="bkmrk-request-body-with-he-1"><caption>Request body with header: X-Encryption-Public-Key</caption><colgroup><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col></colgroup><tbody><tr class="odd"><td>**Type**

</td><td>**Value**

</td><td>**Constraints**

</td><td>**Description**

</td></tr><tr class="even"><td>Authorization

</td><td>Mobile bG9naW46YWNrbWU=

</td><td>Required

</td><td>Device token with "Mobile " prefix

</td></tr><tr class="odd"><td>Product-Name

</td><td>TestProduct

</td><td>Required

</td><td>Application product name

</td></tr><tr class="even"><td>Content-Type

</td><td>application/x-jwe-encryption-body+json

</td><td>Optional

</td><td>Header must be present if the request body is encrypted using the JWE standard.

</td></tr><tr class="odd"><td>X-Encryption-Public-Key

</td><td>  
</td><td>Optional

</td><td>Header must be present if the response body is to be encrypted using the JWE standard. Public key must be encoded Base64.

</td></tr></tbody></table>

### Request fields

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-constraint-0" style="width: 100%;"><thead><tr><th class="tableblock halign-left valign-top" style="width: 18.9084%;">Path</th><th class="tableblock halign-left valign-top" style="width: 8.03537%;">Type</th><th class="tableblock halign-left valign-top" style="width: 11.2472%;">Constraints</th><th class="tableblock halign-left valign-top" style="width: 61.7978%;">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top" style="width: 18.9084%;">sender

</td><td class="tableblock halign-left valign-top" style="width: 8.03537%;">Object

</td><td class="tableblock halign-left valign-top" style="width: 11.2472%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 61.7978%;">Sender

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 18.9084%;">sender.cardId

</td><td class="tableblock halign-left valign-top" style="width: 8.03537%;">String

</td><td class="tableblock halign-left valign-top" style="width: 11.2472%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 61.7978%;">Card ID

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 18.9084%;">sender.userId

</td><td class="tableblock halign-left valign-top" style="width: 8.03537%;">String

</td><td class="tableblock halign-left valign-top" style="width: 11.2472%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 61.7978%;">User ID

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 18.9084%;">receiver

</td><td class="tableblock halign-left valign-top" style="width: 8.03537%;">Object

</td><td class="tableblock halign-left valign-top" style="width: 11.2472%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 61.7978%;">Receiver

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 18.9084%;">receiver.userId

</td><td class="tableblock halign-left valign-top" style="width: 8.03537%;">String

</td><td class="tableblock halign-left valign-top" style="width: 11.2472%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 61.7978%;">Receiver wallet user id. Required if receiverType = WALLET\_CARD\_ID

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 18.9084%;">receiver.receiverType

</td><td class="tableblock halign-left valign-top" style="width: 8.03537%;">String

</td><td class="tableblock halign-left valign-top" style="width: 11.2472%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 61.7978%;">Receiver type. One of: {EMPTY, WALLET\_CARD\_ID, FRIEND\_ID, BARE\_CARD\_NUMBER}

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 18.9084%;">receiver.card

</td><td class="tableblock halign-left valign-top" style="width: 8.03537%;">String

</td><td class="tableblock halign-left valign-top" style="width: 11.2472%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 61.7978%;">Card data\[bare card number, card id\]. Depends of receiverType property

</td></tr></tbody></table>

### Response

```
HTTP/1.1 200 OK
Content-Type: application/json
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Length: 148

{
  "senderDefaultCurrencies" : "PLN",
  "receiverDefaultCurrencies" : "PLN",
  "senderCurrencies" : [ "PLN" ],
  "receiverCurrencies" : [ "PLN" ]
}
```

**Error response - ERROR\_VALIDATION.**

```
HTTP/1.1 400 BAD REQUEST
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "ERROR_VALIDATION",
    "message": "Some fields are invalid",
    "data": [
        {
            "field": "{{field_name_from_request}}",
            "message": "{{message}}"
        }
    ]
}

```

**Error response - ERROR\_BAD\_TOKEN.**

```
HTTP/1.1 400 BAD REQUEST
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "ERROR_BAD_TOKEN"
}

```

**Error response - PRODUCT\_NOT\_FOUND.**

```
HTTP/1.1 404 NOT FOUND
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "PRODUCT_NOT_FOUND",
    "message": "Product by name {{product_name}} not found."
}

```

**Error response - INTERNAL\_SERVER\_ERROR.**

```
HTTP/1.1 500 INTERNAL SERVER ERROR
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "INTERNAL_SERVER_ERROR"
}

```

### Response fields

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-descriptio-0"><thead><tr><th class="tableblock halign-left valign-top">Path</th><th class="tableblock halign-left valign-top">Type</th><th class="tableblock halign-left valign-top">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top">`senderDefaultCurrencies`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Sender Default Currencies

</td></tr><tr><td class="tableblock halign-left valign-top">`receiverDefaultCurrencies`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Receiver Default Currencies

</td></tr><tr><td class="tableblock halign-left valign-top">`senderCurrencies`

</td><td class="tableblock halign-left valign-top">`Array`

</td><td class="tableblock halign-left valign-top">Sender Currencies

</td></tr><tr><td class="tableblock halign-left valign-top">`receiverCurrencies`

</td><td class="tableblock halign-left valign-top">`Array`

</td><td class="tableblock halign-left valign-top">Receiver Currencies

</td></tr></tbody></table>

### Errors

<table id="bkmrk-encrypted-response-f-0"><caption>Encrypted response fields when sent header: *X-Encryption-Public-Key*</caption><colgroup><col style="width: 33%;"></col><col style="width: 33%;"></col><col style="width: 33%;"></col></colgroup><tbody><tr class="odd"><td>**Http Status**

</td><td>**Error Status**

</td><td>**Description**

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>ERROR\_VALIDATION

</td><td>Some fields are invalid

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>ERROR\_BAD\_TOKEN

</td><td>Invalid authorization token

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>Error decoding public key has sent in header: *X-Encryption-Public-Key*

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>Error on decrypting request

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>Error on encrypting response

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>JWE encryption Key is invalid

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>JWE payload is expired

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>ERROR\_SENDER\_CARD\_NOT\_ACTIVE

</td><td>Sender card is not active

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>ERROR\_RECEIVER\_CARD\_NOT\_ACTIVE

</td><td>Receiver card is not active

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>UNKNOWN\_ERROR

</td><td>Unknown error

</td></tr><tr class="even"><td>404 - Not Found

</td><td>PRODUCT\_NOT\_FOUND

</td><td>Product not found based on sent header: *Product-Name*

</td></tr><tr class="odd"><td>404 - Not Found

</td><td>CANT\_FIND\_CARD

</td><td>Not found card

</td></tr><tr class="even"><td>404 - Not Found

</td><td>FRIEND\_NOT\_EXISTS

</td><td>Not found friend

</td></tr><tr class="odd"><td>500 - Internal Server Error

</td><td>INTERNAL\_SERVER\_ERROR

</td><td>Internal application error

</td></tr><tr class="even"><td>500 - Internal Server Error

</td><td>ERROR\_ON\_GETTING\_DEFAULT\_CARD

</td><td>Error on getting card for friend

</td></tr><tr class="odd"><td>500 - Internal Server Error

</td><td>FENIGE\_ERROR

</td><td>Fenige error

</td></tr></tbody></table>

## Currency Rate

**Request body with header: *X-Encryption-Public-Key*.**

Method is used for determine currency rate for revaluation from funding to payment (lowerRate) and payment to funding (higherRate).  
Notice that `lowerRate` is used to transaction processing.

Api Send-money allows users to select the direction of revaluation by providing specify type value in send-money request.  
1 - User by selecting type = SENDER defines amount of funding in given currency. This amount is collected from sender card in selected currency.  
2 - User by selecting type = RECEIVER defines amount of payment in given currency.  
This amount is transferred to receiver card in selected currency.In case there’s need revaluation from one currency to another, system uses lowerRate for situation 1 and higherRate for situation 2

### Request

```
GET /mobile-api/currency-rate/PLN/EUR HTTP/1.1
Content-Type: application/json;charset=UTF-8
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjUzNGJhIiwiZXhwIjoxNjUxNzU2Njk4fQ.tBs5Os24ux-zmYNGYx5MCRAIYOg4Wtnu51NGs39doZ0
Product-Name: TestProduct
Host: localhost:8080
```

### Request headers

<table id="bkmrk-request-body-with-he-3"><caption>Request body with header: *X-Encryption-Public-Key*</caption><colgroup><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col></colgroup><tbody><tr class="odd"><td>**Type**

</td><td>**Value**

</td><td>**Constraints**

</td><td>**Description**

</td></tr><tr class="even"><td>Authorization

</td><td>Mobile bG9naW46YWNrbWU=

</td><td>Required

</td><td>Device token with "Mobile " prefix

</td></tr><tr class="odd"><td>Product-Name

</td><td>TestProduct

</td><td>Required

</td><td>Application product name

</td></tr><tr class="even"><td>X-Encryption-Public-Key

</td><td>  
</td><td>Optional

</td><td>Header must be present if the response body is to be encrypted using the JWE standard. Public key must be encoded Base64.

</td></tr></tbody></table>

### Response

```
HTTP/1.1 200 OK
Content-Type: application/json
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Length: 61

{
  "lowerRate" : "0.2342887",
  "higherRate" : "0.2279948"
}
```

**Error response - ERROR\_BAD\_TOKEN.**

```
HTTP/1.1 400 BAD REQUEST
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "ERROR_BAD_TOKEN"
}

```

**Error response - PRODUCT\_NOT\_FOUND.**

```
HTTP/1.1 404 NOT FOUND
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "PRODUCT_NOT_FOUND",
    "message": "Product by name {{product_name}} not found."
}

```

**Error response - INTERNAL\_SERVER\_ERROR.**

```
HTTP/1.1 500 INTERNAL SERVER ERROR
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "INTERNAL_SERVER_ERROR"
}

```

### Response fields

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-descriptio-1"><thead><tr><th class="tableblock halign-left valign-top">Path</th><th class="tableblock halign-left valign-top">Type</th><th class="tableblock halign-left valign-top">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top">`lowerRate`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Lower rate exchange

</td></tr><tr><td class="tableblock halign-left valign-top">`higherRate`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Higher rate exchange

</td></tr></tbody></table>

### Errors

<table id="bkmrk-encrypted-response-f-1"><caption>Encrypted response fields when sent header: *X-Encryption-Public-Key*</caption><colgroup><col style="width: 33%;"></col><col style="width: 33%;"></col><col style="width: 33%;"></col></colgroup><tbody><tr class="odd"><td>**Http Status**

</td><td>**Error Status**

</td><td>**Description**

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>ERROR\_BAD\_TOKEN

</td><td>Invalid authorization token

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>Error decoding public key has sent in header: *X-Encryption-Public-Key*

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>Error on encrypting response

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>JWE encryption Key is invalid

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>JWE payload is expired

</td></tr><tr class="odd"><td>404 - Not Found

</td><td>PRODUCT\_NOT\_FOUND

</td><td>Product not found based on sent header: *Product-Name*

</td></tr><tr class="even"><td>500 - Internal Server Error

</td><td>INTERNAL\_SERVER\_ERROR

</td><td>Internal application error

</td></tr><tr class="odd"><td>500 - Internal Server Error

</td><td>FENIGE\_ERROR

</td><td>Fenige error

</td></tr></tbody></table>

## Calculate commission

**Request body with header: *X-Encryption-Public-Key*.**

This method is used to receive information about the commission that will be charged for the transaction. Additional description:

- If value the field: "reconciliationType" is "PLUS", the commission during the transaction will be added to the amount sent (the amount charged from the sender will be increased by a commission).
- If value the field: "reconciliationType" is "MINUS", then the commission during the transaction will be deducted from the amount received (the amount that will be received by the receiver will be reduced by the commission).
- If value the field: "reconciliationType" is "DEPOSITED", the commission during the transaction will neither be subtracted nor added (the amount to be received by the receiver is the same as the amount sent).

In addition, the user may specify in the field: type two values **SENDER** or **RECEIVER**.  
After selecting the value: **SENDER**, the transaction will be sent in the amount indicated in the field: amount. Whereas after choosing the value: **RECEIVER**, the transaction will be received in the amount indicated in the field: amount. The method allows user to calculate commissions for the currencies that have been entered.

### Request

**Receiver.receiverType = WALLET\_CARD\_ID.**

```
POST /mobile-api/calculate-commission HTTP/1.1
Content-Type: application/json
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjg4MjIyYmEiLCJleHAiOjE2NTE3NTY2OTh9.bbGrMfHjTtvHNmHzW_IKG6lUVzVJhJX8UUQ1ZuuvwWg
Product-Name: TestProduct
Content-Length: 101

{
    "amount": 200078,
    "type": "RECEIVER",
    "sender":{
    	"cardId":"219834",
    	"currency":"PLN"
    },
    "receiver":{
    	"userId": 2345,
    	"card": ["2","2","1","2","4","5"],
    	"currency": "PLN",
    	"receiverType": "WALLET_CARD_ID"
    }
}
```

**Receiver.receiverType = FRIEND\_ID.**

```
POST /mobile-api/calculate-commission HTTP/1.1
Content-Type: application/json
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjg4MjIyYmEiLCJleHAiOjE2NTE3NTY2OTh9.bbGrMfHjTtvHNmHzW_IKG6lUVzVJhJX8UUQ1ZuuvwWg
Product-Name: TestProduct
Content-Length: 101

{
    "amount": 200078,
    "type": "RECEIVER",
    "sender":{
    	"cardId":"219834",
    	"currency":"PLN"
    },
    "receiver":{
    	"userId": 2345,
    	"currency": "PLN",
    	"receiverType": "FRIEND_ID"
    }
}
```

**Receiver.receiverType = BARE\_CARD\_NUMBER.**

```
POST /mobile-api/calculate-commission HTTP/1.1
Content-Type: application/json
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjg4MjIyYmEiLCJleHAiOjE2NTE3NTY2OTh9.bbGrMfHjTtvHNmHzW_IKG6lUVzVJhJX8UUQ1ZuuvwWg
Product-Name: TestProduct
Content-Length: 101

{
    "amount": 200078,
    "type": "RECEIVER",
    "sender":{
    	"cardId":"219834",
    	"currency":"PLN"
    },
    "receiver":{
    	"card": ["5","4","9","5","9","8","4","1","7","9","0","8","2","6","4","5"],
    	"currency": "PLN",
    	"receiverType": "BARE_CARD_NUMBER"
    }
}
```

### Request headers

<table id="bkmrk-request-body-with-he-5"><caption>Request body with header: *X-Encryption-Public-Key*</caption><colgroup><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col></colgroup><tbody><tr class="odd"><td>**Type**

</td><td>**Value**

</td><td>**Constraints**

</td><td>**Description**

</td></tr><tr class="even"><td>Authorization

</td><td>Mobile bG9naW46YWNrbWU=

</td><td>Required

</td><td>Device token with "Mobile " prefix

</td></tr><tr class="odd"><td>Product-Name

</td><td>TestProduct

</td><td>Required

</td><td>Application product name

</td></tr><tr class="even"><td>Content-Type

</td><td>application/x-jwe-encryption-body+json

</td><td>Optional

</td><td>Header must be present if the request body is encrypted using the JWE standard.

</td></tr><tr class="odd"><td>X-Encryption-Public-Key

</td><td>  
</td><td>Optional

</td><td>Header must be present if the response body is to be encrypted using the JWE standard. Public key must be encoded Base64.

</td></tr></tbody></table>

### Request fields

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-constraint-1" style="width: 100%;"><colgroup><col style="width: 17.3034%;"></col><col style="width: 12.6067%;"></col><col style="width: 12.6001%;"></col><col style="width: 57.4786%;"></col></colgroup><thead><tr><th class="tableblock halign-left valign-top">Path</th><th class="tableblock halign-left valign-top">Type</th><th class="tableblock halign-left valign-top">Constraints</th><th class="tableblock halign-left valign-top">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top">amount

</td><td class="tableblock halign-left valign-top">Number

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">The total transfer amount (in pennies)

</td></tr><tr><td class="tableblock halign-left valign-top">type

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">Value of (SENDER or RECEIVER)

</td></tr><tr><td class="tableblock halign-left valign-top">sender.cardId

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">Sender card id

</td></tr><tr><td class="tableblock halign-left valign-top">sender.userId

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">User id

</td></tr><tr><td class="tableblock halign-left valign-top">sender.currency

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">Sender currency

</td></tr><tr><td class="tableblock halign-left valign-top">receiver.userId

</td><td class="tableblock halign-left valign-top">Number

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">Receiver card id

</td></tr><tr><td class="tableblock halign-left valign-top">receiver.card

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">Receiver card id

</td></tr><tr><td class="tableblock halign-left valign-top">receiver.receiverType

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">Receiver type. One of: \[EMPTY, WALLET\_CARD\_ID, FRIEND\_ID, BARE\_CARD\_NUMBER\]

</td></tr><tr><td class="tableblock halign-left valign-top">receiver.currency

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">Receiver currency

</td></tr></tbody></table>

### Response

```
HTTP/1.1 200 OK
Content-Type: application/json
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Length: 1007

{
  "commission" : 5,
  "transactionCommissions" : [ {
    "value" : 50,
    "bigDecimalValue" : 0.5,
    "currencyExponent" : 2,
    "currency" : "PLN",
    "commissionConfiguration" : {
      "currency" : "PLN",
      "commissionType" : "PROVISION",
      "reconciliationType" : "PLUS",
      "geographicScope" : "CROSSBORDER",
      "transactionType" : {
        "id" : "funding",
        "name" : "MoneySend Funding"
      }
    }
  } ],
  "revaluationResult" : {
    "revaluationFundingAmount" : 200,
    "bigDecimalRevaluationFundingAmount" : 2.0,
    "revaluationFundingTotalAmount" : 205,
    "bigDecimalRevaluationFundingTotalAmount" : 2.05,
    "fundingCurrency" : "PLN",
    "revaluationPaymentAmount" : 200,
    "bigDecimalRevaluationPaymentAmount" : 2.0,
    "revaluationPaymentTotalAmount" : 200,
    "bigDecimalRevaluationPaymentTotalAmount" : 2.0,
    "paymentCurrency" : "PLN",
    "determineCurrencyRate" : {
      "from" : "PLN",
      "to" : "PLN",
      "currencyRate" : "1"
    }
  }
}
```

**Error response - ERROR\_VALIDATION.**

```
HTTP/1.1 400 BAD REQUEST
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "ERROR_VALIDATION",
    "message": "Some fields are invalid",
    "data": [
        {
            "field": "{{field_name_from_request}}",
            "message": "{{message}}"
        }
    ]
}

```

**Error response - ERROR\_BAD\_TOKEN.**

```
HTTP/1.1 400 BAD REQUEST
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "ERROR_BAD_TOKEN"
}

```

**Error response - PRODUCT\_NOT\_FOUND.**

```
HTTP/1.1 404 NOT FOUND
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "PRODUCT_NOT_FOUND",
    "message": "Product by name {{product_name}} not found."
}

```

**Error response - INTERNAL\_SERVER\_ERROR.**

```
HTTP/1.1 500 INTERNAL SERVER ERROR
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "INTERNAL_SERVER_ERROR"
}

```

### Errors

<table id="bkmrk-encrypted-response-f-2"><caption>Encrypted response fields when sent header: *X-Encryption-Public-Key*</caption><colgroup><col style="width: 33%;"></col><col style="width: 33%;"></col><col style="width: 33%;"></col></colgroup><tbody><tr class="odd"><td>**Http Status**

</td><td>**Error Status**

</td><td>**Description**

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>ERROR\_VALIDATION

</td><td>Some fields are invalid

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>ERROR\_BAD\_TOKEN

</td><td>Invalid authorization token

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>Error decoding public key has sent in header: *X-Encryption-Public-Key*

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>Error on decrypting request

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>Error on encrypting response

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>JWE encryption Key is invalid

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>JWE payload is expired

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>ERROR\_WHILE\_GETTING\_COUNTRY\_CODE

</td><td>Could not get card country code

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>ERROR\_WHILE\_GETTING\_SENDER\_COUNTRY\_CODE

</td><td>Could not get card country code for sender

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>ERROR\_WHILE\_GETTING\_RECEIVER\_COUNTRY\_CODE

</td><td>Could not get card country code for receiver

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>ERROR\_SENDER\_CARD\_NOT\_ACTIVE

</td><td>Sender card is not active

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>ERROR\_RECEIVER\_CARD\_NOT\_ACTIVE

</td><td>Receiver card is not active

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>UNKNOWN\_ERROR

</td><td>Unknown error

</td></tr><tr class="odd"><td>404 - Not Found

</td><td>PRODUCT\_NOT\_FOUND

</td><td>Product not found based on sent header: *Product-Name*

</td></tr><tr class="even"><td>404 - Not Found

</td><td>CANT\_FIND\_CARD

</td><td>Not found card

</td></tr><tr class="odd"><td>404 - Not Found

</td><td>FRIEND\_NOT\_EXISTS

</td><td>Not found friend

</td></tr><tr class="even"><td>500 - Internal Server Error

</td><td>INTERNAL\_SERVER\_ERROR

</td><td>Internal application error

</td></tr><tr class="odd"><td>500 - Internal Server Error

</td><td>ERROR\_ON\_GETTING\_DEFAULT\_CARD

</td><td>Error on getting card for friend

</td></tr><tr class="even"><td>500 - Internal Server Error

</td><td>FENIGE\_ERROR

</td><td>Fenige error

</td></tr></tbody></table>

## Send Money

**Request body with header: *X-Encryption-Public-Key*.**

This method is used to full MoneySend transaction (funding and payment).  
Transfers can be make in any currency.  
1 - User by selecting type = **SENDER** defines amount of funding in given currency.  
This amount is collected from sender card in selected currency. 2 - User by selecting type = **RECEIVER** defines amount of payment in given currency.  
This amount is transferred to receiver card in selected currency.

In case there’s need revaluation from one currency to another, system uses lowerRate for situation 1 and higherRate for situation 2. For more details about specific rates please refer to Currency Rate method.  
**This method adds friend to sender after successful transaction.**

Additionally, you can perform full MoneySend transaction with externalAuthentication (see: [???](#send-money-with-external-authentication) and [Authentication](#authentication))

### Request

**Receiver.receiverType = WALLET\_CARD\_ID.**

```
POST /mobile-api/send-money HTTP/1.1
Content-Type: application/json
Authorization: Mobile bG9nzW46YWNrbWU=
Product-Name: TestProduct
Content-Length: 56

{
    "amount": 1000,
    "cvc2": ["1","2","3"],
    "type": "RECEIVER",
    "addressIp": "192.168.0.1",
    "sender": {
        "firstName": "Mark",
        "lastName": "Wards",
        "street": "Olszewskiego",
        "houseNumber": "17A",
        "city": "Lublin",
        "postalCode": "20-400",
        "flatNumber": "2",
        "email": "senderEmail@fenige.pl",
        "currency": "PLN",
        "expirationDate": "03/20",
        "personalId": "AGC688910",
        "cardId": "219708"
    },
    "receiver": {
        "firstName": "Rob",
        "lastName": "Wring",
        "currency": "PLN",
        "card": ["2","1","9","7","0","8"],
        "displayName": "Rob W.",
        "phoneNumber": "48718222333",
        "receiverType": "WALLET_CARD_ID",
        "userId": "13001"
    }
}

```

**Receiver.receiverType = FRIEND\_ID.**

```
POST /mobile-api/send-money HTTP/1.1
Content-Type: application/json
Authorization: Mobile bG9nzW46YWNrbWU=
Product-Name: TestProduct
Content-Length: 56

{
    "amount": 1000,
    "cvc2": ["1","2","3"],
    "type": "RECEIVER",
    "addressIp": "192.168.0.1",
    "sender": {
        "firstName": "Mark",
        "lastName": "Wards",
        "street": "Olszewskiego",
        "houseNumber": "17A",
        "city": "Lublin",
        "postalCode": "20-400",
        "flatNumber": "2",
        "email": "senderEmail@fenige.pl",
        "currency": "PLN",
        "expirationDate": "03/20",
        "personalId": "AGC688910",
        "cardId": "219708"
    },
    "receiver": {
        "firstName": "Rob",
        "lastName": "Wring",
        "currency": "PLN",
        "displayName": "Rob W.",
        "receiverType": "FRIEND_ID",
        "userId": "123"
    }
}

```

**Receiver.receiverType = BARE\_CARD\_NUMBER.**

```
POST /mobile-api/send-money HTTP/1.1
Content-Type: application/json
Authorization: Mobile bG9nzW46YWNrbWU=
Product-Name: TestProduct
Content-Length: 56

{
    "amount": 1000,
    "cvc2": ["1","2","3"],
    "type": "RECEIVER",
    "addressIp": "192.168.0.1",
    "sender": {
        "firstName": "Mark",
        "lastName": "Wards",
        "street": "Olszewskiego",
        "houseNumber": "17A",
        "city": "Lublin",
        "postalCode": "20-400",
        "flatNumber": "2",
        "email": "senderEmail@fenige.pl",
        "currency": "PLN",
        "expirationDate": "03/20",
        "personalId": "AGC688910",
        "cardId": "219708"
    },
    "receiver": {
        "firstName": "Rob",
        "lastName": "Wring",
        "currency": "PLN",
        "card": ["5","1","4","2","3","3","3","6","2","9","5","2","3","7","3","2"],
        "displayName": "displayName",
        "phoneNumber": "48299000111",
        "receiverType": "BARE_CARD_NUMBER"
    }
}

```

**ExternalAuthentication.authenticationId.**

```
POST /mobile-api/send-money HTTP/1.1
Content-Type: application/json
Authorization: Mobile bG9nzW46YWNrbWU=
Product-Name: TestProduct
Content-Length: 56

{
  "amount" : 1000,
  "cvc2" : [ "1", "2", "3" ],
  "type" : "RECEIVER",
  "addressIp" : "192.168.0.1",
  "sender" : {
    "firstName" : "Mark",
    "lastName" : "Asdasd",
    "street" : "Olszewskiego",
    "houseNumber" : "17A",
    "city" : "Lublin",
    "postalCode" : "20-400",
    "flatNumber" : "2",
    "email" : "senderEmail@fenige.pl",
    "currency" : "PLN",
    "expirationDate" : "03/20",
    "personalId" : "AGC688910",
    "cardId" : "219708"
  },
  "receiver" : {
    "firstName" : "Rob",
    "lastName" : "Wring",
    "currency" : "PLN",
    "card" : [ "2", "1", "9", "7", "0", "8" ],
    "displayName" : "displayName",
    "phoneNumber" : "phoneNumber",
    "receiverType" : "WALLET_CARD_ID",
    "userId" : "123"
  },
  "externalAuthentication" : {
    "authenticationId" : "authenticationId"
  }
}

```

**ExternalAuthentication.cavv, eci, transactionXId, authenticationStatus.**

```
POST /mobile-api/send-money HTTP/1.1
Content-Type: application/json
Authorization: Mobile bG9nzW46YWNrbWU=
Product-Name: TestProduct
Content-Length: 56

{
  "amount" : 1000,
  "cvc2" : [ "1", "2", "3" ],
  "type" : "RECEIVER",
  "addressIp" : "192.168.0.1",
  "sender" : {
    "firstName" : "Mark",
    "lastName" : "Asdasd",
    "street" : "Olszewskiego",
    "houseNumber" : "17A",
    "city" : "Lublin",
    "postalCode" : "20-400",
    "flatNumber" : "2",
    "email" : "senderEmail@fenige.pl",
    "currency" : "PLN",
    "expirationDate" : "03/20",
    "personalId" : "AGC688910",
    "cardId" : "219708"
  },
  "receiver" : {
    "firstName" : "Rob",
    "lastName" : "Wring",
    "currency" : "PLN",
    "card" : [ "2", "1", "9", "7", "0", "8" ],
    "displayName" : "displayName",
    "phoneNumber" : "phoneNumber",
    "receiverType" : "WALLET_CARD_ID",
    "userId" : "123"
  },
  "externalAuthentication" : {
    "cavv" : "jEu04WZns7pbARAApU4qgNdJTag",
    "eci" : "PLN",
    "authenticationStatus" : "Y",
    "transactionXId" : "9742432a-dfdc-41ca-9ae9-b6595de65f1d"
  }
}

```

### Request headers

<table id="bkmrk-type-value-constrain-0"><colgroup><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col></colgroup><tbody><tr class="odd"><td>**Type**

</td><td>**Value**

</td><td>**Constraints**

</td><td>**Description**

</td></tr><tr class="even"><td>Authorization

</td><td>Mobile bG9naW46YWNrbWU=

</td><td>Required

</td><td>Device token with "Mobile " prefix

</td></tr><tr class="odd"><td>Product-Name

</td><td>TestProduct

</td><td>Required

</td><td>Application product name

</td></tr><tr class="even"><td>Content-Type

</td><td>application/x-jwe-encryption-body+json

</td><td>Optional

</td><td>Header must be present if the request body is encrypted using the JWE standard.

</td></tr><tr class="odd"><td>X-Encryption-Public-Key

</td><td>  
</td><td>Optional

</td><td>Header must be present if the response body is to be encrypted using the JWE standard. Public key must be encoded Base64.

</td></tr></tbody></table>

### Request fields

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-constraint-2" style="width: 100%;"><thead><tr><th class="tableblock halign-left valign-top" style="width: 19.1573%;">Path</th><th class="tableblock halign-left valign-top" style="width: 10.1321%;">Type</th><th class="tableblock halign-left valign-top" style="width: 34.6095%;">Constraints</th><th class="tableblock halign-left valign-top" style="width: 36.2135%;">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">amount

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">Number

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Transaction amount

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">cvc2

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Card CVC

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">type

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">SENDER or RECEIVER type transaction payer

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">addressIp

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Address Ip

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">sender

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">Object

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">  
</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">sender.street

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required, Must match length: min = 1 max = 55, Must match pattern: ^\[^\\s\]+(\\s+\[^\\s\]+)\*$

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Street

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">sender.houseNumber

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required, Must match length: min = 1, max = 10, Must match pattern: "^\[0-9\]{1,5}\[A-z\]?(?:/\[0-9\]{1,5}\[A-z\]?)?$"

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">House number

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">sender.city

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required, Must match length: min = 1 max = 55

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">City

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">sender.postalCode

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required, Must match length: min = 1, max = 10, Must match pattern: "^(?=.\*\\d)(?=.\*\[1-9,a-zA-Z\]).{1,10}$"

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Postal code

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">sender.flatNumber

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Optional, Must match length: min = 1 max = 5, Must match pattern: "^\[a-zA-Z0-9 \]\*$"

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Flat number

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">sender.email

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Optional, Must match length: min = 1 max = 128, Must match pattern: "^(?:\[A-Za-z0-9\]{1,}\[\\\\.!#$%&amp;'\*/=?`{|}~^\\\\-\_\]?){1,}\[A-Za-z0-9\]{1,}@((?:\[a-zA-Z0-9\](?:-\[a-zA-Z0-9\]+)\*\\\\.){1,}\[a-zA-Z\]{2,})$", Email cannot be the same for 2 different persons sender and receiver

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Email

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">sender.currency

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required, Must match length: min = 3 max = 3

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Transaction currency

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">sender.expirationDate

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Card expiration date

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">sender.personalId

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Personal ID

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">sender.cardId

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Card ID

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">sender.userId

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">User ID

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">sender.addressId

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Conditional

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Address ID. Required when one of field: sender.street, sender.houseNumber, sender.city, sender.postalCode, sender.flatNumber is null.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">receiver

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">Object

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">  
</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">receiver.firstName

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required, Must match length: min = 2 max = 35, Must match pattern: "^\[^0-9\]+$", FirstName cannot be the same as lastName

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">First name

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">receiver.lastName

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required, Must match length: min = 2 max = 35, Must match pattern: "^\[^0-9\]+$", LastName cannot be the same as firstName

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Last name

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">receiver.phoneNumber

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Receiver phone number

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">receiver.displayName

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Display name

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">receiver.currency

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required, Must match length: min = 3 max = 3

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Transaction currency

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">receiver.userId

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Receiver wallet user id. Required if receiverType = FRIEND\_ID

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">receiver.receiverType

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Receiver type. One of: \[WALLET\_CARD\_ID, FRIEND\_ID, BARE\_CARD\_NUMBER\]

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">receiver.card

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Card data\[bare card number, card id\]. Depends of receiverType property

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">externalAuthentication

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">Object

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">External authentication object.

This parameter have 2 options:

Send authenticationId if [Authentication](https://p2ptransactions.upaidtest.pl/docs/index.html#authentication) process has been performed by this system.

Send remaining parameters (cavv, cavvAlgorithm, eci, transactionXId, authenticationStatus), but without authenticationId if authentication process was performed in another system.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">externalAuthentication.authenticationId

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Value returned from the [Authentication](https://p2ptransactions.upaidtest.pl/docs/index.html#authentication) process. Unique external authentication identifier.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">externalAuthentication.cavv

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">This property is determined by the Access Control Server. This property will be valid if the TransactionStatus is "Y" or "A". The value may be used to provide proof of authentication.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">externalAuthentication.eci

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">This property is determined by the Access Control Server. This property contains the two digit Electronic Commerce Indicator (ECI) value, which is to be submitted in a credit card authorization message. This value indicates to the processor that the customer data in the authorization message has been authenticated. The data contained within this property is only valid if the TransactionStatus is "Y" or "A".

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">externalAuthentication.authenticationStatus

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">Indicates whether a transaction qualifies as an authenticated transaction or account verification. Possible values are:

**Y** - Authentication/account verification successful

**N** - Not authenticated/account not verified; transaction denied

**U** - Authentication/account verification could not be performed; technical or other problem as indicated in ARes or RReq

**A** - Attempts processing performed; not authenticated/verified, but a proof of attempted authentication/verification is provided

**C** - Challenge required; additional authentication is required using the CReq/CRes

**R** - Authentication/account verification rejected; issuer is rejecting authentication/verification and request that authorization not be attempted

**D** - Challenge required; decoupled authentication confirmed

**I** - Informational only; 3DS Requestor challenge preference acknowledged

The CRes message can contain only a value of Y or N. Values of D and I are only applicable for 3DS version 2.2.0.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.1573%;">externalAuthentication.transactionXId

</td><td class="tableblock halign-left valign-top" style="width: 10.1321%;">String

</td><td class="tableblock halign-left valign-top" style="width: 34.6095%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 36.2135%;">This field indicates the transactionXid from recurring finalize authentication.

</td></tr></tbody></table>

### Response

```
HTTP/1.1 200 OK
Location: /api/send-money/4979532e-dca1-40f6-b13a-0f3039d26e71
Content-Type: application/json
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Length: 56

{
  "orderId" : "4979532e-dca1-40f6-b13a-0f3039d26e71"
}
```

**Error response - ERROR\_VALIDATION.**

```
HTTP/1.1 400 BAD REQUEST
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "ERROR_VALIDATION",
    "message": "Some fields are invalid",
    "data": [
        {
            "field": "{{field_name_from_request}}",
            "message": "{{message}}"
        }
    ]
}

```

**Error response - ERROR\_BAD\_TOKEN.**

```
HTTP/1.1 400 BAD REQUEST
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "ERROR_BAD_TOKEN"
}

```

**Error response - PRODUCT\_NOT\_FOUND.**

```
HTTP/1.1 404 NOT FOUND
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "PRODUCT_NOT_FOUND",
    "message": "Product by name {{product_name}} not found."
}

```

**Error response - INTERNAL\_SERVER\_ERROR.**

```
HTTP/1.1 500 INTERNAL SERVER ERROR
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "INTERNAL_SERVER_ERROR"
}

```

### Response fields

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-descriptio-2"><thead><tr><th class="tableblock halign-left valign-top">Path</th><th class="tableblock halign-left valign-top">Type</th><th class="tableblock halign-left valign-top">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top">`orderId`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Transaction Id

</td></tr></tbody></table>

### Errors

<table id="bkmrk-encrypted-response-f-3"><caption>Encrypted response fields when sent header: *X-Encryption-Public-Key*</caption><colgroup><col style="width: 33%;"></col><col style="width: 33%;"></col><col style="width: 33%;"></col></colgroup><tbody><tr class="odd"><td>**Http Status**

</td><td>**Error Status**

</td><td>**Description**

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>ERROR\_VALIDATION

</td><td>Some fields are invalid

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>ERROR\_BAD\_TOKEN

</td><td>Invalid authorization token

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>Error decoding public key has sent in header: *X-Encryption-Public-Key*

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>Error on decrypting request

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>Error on encrypting response

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>JWE encryption Key is invalid

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>CRYPTOGRAPHY\_ERROR

</td><td>JWE payload is expired

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>ERROR\_WHILE\_GETTING\_COUNTRY\_CODE

</td><td>Could not get card country code

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>ERROR\_MERCHANT\_NOT\_SUPPORT\_CARD\_PROVIDER

</td><td>Merchant not support card provider

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>ERROR\_SENDER\_CARD\_NOT\_ACTIVE

</td><td>Sender card is not active

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>ERROR\_RECEIVER\_CARD\_NOT\_ACTIVE

</td><td>Receiver card is not active

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>ERROR\_SENDER\_CARD\_IS\_BLOCKED

</td><td>Sender card is blocked

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>ERROR\_RECEIVER\_CARD\_IS\_BLOCKED

</td><td>Receiver card is blocked

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>UNKNOWN\_ERROR

</td><td>Unknown error

</td></tr><tr class="even"><td>404 - Not Found

</td><td>PRODUCT\_NOT\_FOUND

</td><td>Product not found based on sent header: *Product-Name*

</td></tr><tr class="odd"><td>404 - Not Found

</td><td>CANT\_FIND\_CARD

</td><td>Not found card

</td></tr><tr class="even"><td>404 - Not Found

</td><td>FRIEND\_NOT\_EXISTS

</td><td>Not found friend

</td></tr><tr class="odd"><td>500 - Internal Server Error

</td><td>INTERNAL\_SERVER\_ERROR

</td><td>Internal application error

</td></tr><tr class="even"><td>500 - Internal Server Error

</td><td>FENIGE\_ERROR

</td><td>Fenige error

</td></tr><tr class="odd"><td>500 - Internal Server Error

</td><td>ERROR\_ON\_GETTING\_DEFAULT\_CARD

</td><td>Error on getting card for friend

</td></tr></tbody></table>

## Send Money Details

This method allow user to get transaction details using orderId. Parameter *orderId* is returned by method decribed above: POST Send Money.

### Request

```
GET /mobile-api/send-money/6c476efe-71d6-4d9d-b14a-0c311743b0d8 HTTP/1.1
Content-Type: application/json;charset=UTF-8
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjUzNGJhIiwiZXhwIjoxNjUxNzU2Njk4fQ.tBs5Os24ux-zmYNGYx5MCRAIYOg4Wtnu51NGs39doZ0
Product-Name: TestProduct
Host: localhost:8080
```

### Request headers

<table class="tableblock frame-all grid-all stretch" id="bkmrk-type-value-constrain-1" style="width: 100%;"><tbody><tr><td class="tableblock halign-left valign-top" style="width: 14.3333%;">**Type**

</td><td class="tableblock halign-left valign-top" style="width: 33.3799%;">**Value**

</td><td class="tableblock halign-left valign-top" style="width: 12.7318%;">**Constraints**

</td><td class="tableblock halign-left valign-top" style="width: 39.555%;">**Description**

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 14.3333%;">Authorization

</td><td class="tableblock halign-left valign-top" style="width: 33.3799%;">Mobile eyJhbGciOiJIUzI1NiJ9. eyJzdWIiOiJiNjUzNGJhIiwiZXhwIjoxNjUxNzU2Njk4fQ. tBs5Os24ux-zmYNGYx5MCRAIYOg4Wtnu51NGs39doZ0

</td><td class="tableblock halign-left valign-top" style="width: 12.7318%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 39.555%;">Device token with "Mobile " prefix

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 14.3333%;">Product-Name

</td><td class="tableblock halign-left valign-top" style="width: 33.3799%;">TestProduct

</td><td class="tableblock halign-left valign-top" style="width: 12.7318%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 39.555%;">Application product name

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 14.3333%;">X-Encryption-Public-Key

</td><td class="tableblock halign-left valign-top" style="width: 33.3799%;">{{base64\_encoded\_public\_key}}

</td><td class="tableblock halign-left valign-top" style="width: 12.7318%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 39.555%;">Header must be present if the response body is to be encrypted using the JWE standard. Public key must be encoded Base64.

</td></tr></tbody></table>

### Response

```
HTTP/1.1 200 OK
Content-Type: application/json
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Length: 130

{
  "orderId" : "6c476efe-71d6-4d9d-b14a-0c311743b0d8",
  "createdAt" : "2023-06-23T08:08:01.983233981Z",
  "status" : "SUCCESS"
}
```

**Error response - ERROR\_BAD\_TOKEN.**

```
HTTP/1.1 400 BAD REQUEST
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "ERROR_BAD_TOKEN"
}
```

**Error response - PRODUCT\_NOT\_FOUND.**

```
HTTP/1.1 404 NOT FOUND
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "PRODUCT_NOT_FOUND",
    "message": "Product by name {{product_name}} not found."
}
```

**Error response - INTERNAL\_SERVER\_ERROR.**

```
HTTP/1.1 500 INTERNAL SERVER ERROR
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "INTERNAL_SERVER_ERROR"
}
```

### Response fields

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-descriptio-3"><thead><tr><th class="tableblock halign-left valign-top">Path</th><th class="tableblock halign-left valign-top">Type</th><th class="tableblock halign-left valign-top">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top">`orderId`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Transaction identifier

</td></tr><tr><td class="tableblock halign-left valign-top">`createdAt`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Transaction creation date

</td></tr><tr><td class="tableblock halign-left valign-top">`status`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Transaction status. One of: PENDING, FAILURE, SUCCESS

</td></tr></tbody></table>

### Errors

<table class="tableblock frame-all grid-all stretch" id="bkmrk-http-status-error-st"><tbody><tr><td class="tableblock halign-left valign-top">**Http Status**

</td><td class="tableblock halign-left valign-top">**Error Status**

</td><td class="tableblock halign-left valign-top">**Description**

</td></tr><tr><td class="tableblock halign-left valign-top">400 - Bad Request

</td><td class="tableblock halign-left valign-top">ERROR\_BAD\_TOKEN

</td><td class="tableblock halign-left valign-top">Invalid authorization token

</td></tr><tr><td class="tableblock halign-left valign-top">400 - Bad Request

</td><td class="tableblock halign-left valign-top">CRYPTOGRAPHY\_ERROR

</td><td class="tableblock halign-left valign-top">Error decoding public key has sent in header: *X-Encryption-Public-Key*

</td></tr><tr><td class="tableblock halign-left valign-top">400 - Bad Request

</td><td class="tableblock halign-left valign-top">CRYPTOGRAPHY\_ERROR

</td><td class="tableblock halign-left valign-top">Error on encrypting response

</td></tr><tr><td class="tableblock halign-left valign-top">400 - Bad Request

</td><td class="tableblock halign-left valign-top">CRYPTOGRAPHY\_ERROR

</td><td class="tableblock halign-left valign-top">JWE encryption Key is invalid

</td></tr><tr><td class="tableblock halign-left valign-top">404 - Not Found

</td><td class="tableblock halign-left valign-top">PRODUCT\_NOT\_FOUND

</td><td class="tableblock halign-left valign-top">Product not found based on sent header: \_Product-Name

</td></tr><tr><td class="tableblock halign-left valign-top">404 - Not Found

</td><td class="tableblock halign-left valign-top">TRANSACTION\_NOT\_FOUND

</td><td class="tableblock halign-left valign-top">Transation not found

</td></tr><tr><td class="tableblock halign-left valign-top">500 - Internal Server Error

</td><td class="tableblock halign-left valign-top">INTERNAL\_SERVER\_ERROR

</td><td class="tableblock halign-left valign-top">Internal application error

</td></tr></tbody></table>

## Add Friend

**Request body with header: *X-Encryption-Public-Key*.**

This method allow user to add Friend.

### Request

**friendType = WALLET.**

```
POST /mobile-api/wallet-users/friends HTTP/1.1
Content-Type: application/json
Authorization: Mobile bG9nzW46YWNrbWU=
Product-Name: TestProduct
Content-Length: 56

{
  "friendWalletDataCoreId": 1,
  "displayName": "Display name",
  "phoneNumber": "48999111222",
  "friendType": "WALLET",
  "firstName": "First",
  "lastName": "Last",
}

```

**friendType = EXTERNAL.**

```
POST /mobile-api/wallet-users/friends HTTP/1.1
Content-Type: application/json
Authorization: Mobile bG9nzW46YWNrbWU=
Product-Name: TestProduct
Content-Length: 56

{
  "displayName": "Display name",
  "phoneNumber": "48999111222",
  "friendType": "EXTERNAL",
  "firstName": "First",
  "lastName": "Last",
  "cardNumber": ["5","5","2","7","4","7","9","6","6","8","3","9","0","9","5","7"]
}

```

### Request headers

<table id="bkmrk-request-body-with-he-8" style="width: 100%;"><caption>Request body with header: *X-Encryption-Public-Key*</caption><colgroup><col style="width: 24.9691%;"></col><col style="width: 24.9691%;"></col><col style="width: 24.9691%;"></col><col style="width: 24.9691%;"></col></colgroup><tbody><tr class="odd"><td>**Type**

</td><td>**Value**

</td><td>**Constraints**

</td><td>**Description**

</td></tr><tr class="even"><td>Authorization

</td><td>Mobile bG9naW46YWNrbWU=

</td><td>Required

</td><td>Device token with "Mobile " prefix

</td></tr><tr class="odd"><td>Product-Name

</td><td>TestProduct

</td><td>Required

</td><td>Application product name

</td></tr><tr class="even"><td>Content-Type

</td><td>application/x-response-body+json

</td><td>Optional

</td><td>Header must be present if the response body must have body.

</td></tr><tr class="odd"><td>Content-Type

</td><td>application/x-jwe-encryption-body+json

</td><td>Optional

</td><td>Header must be present if the request body is encrypted using the JWE standard.

</td></tr><tr class="even"><td>X-Encryption-Public-Key

</td><td>  
</td><td>Optional

</td><td>Header must be present if the response body is to be encrypted using the JWE standard. Public key must be encoded Base64.

</td></tr></tbody></table>

### Request fields

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-constraint-3"><thead><tr><th class="tableblock halign-left valign-top">Path</th><th class="tableblock halign-left valign-top">Type</th><th class="tableblock halign-left valign-top">Constraints</th><th class="tableblock halign-left valign-top">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top">friendWalletDataCoreId

</td><td class="tableblock halign-left valign-top">Number

</td><td class="tableblock halign-left valign-top">Optional

</td><td class="tableblock halign-left valign-top">Friend wallet data core id

</td></tr><tr><td class="tableblock halign-left valign-top">displayName

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">Display name

</td></tr><tr><td class="tableblock halign-left valign-top">phoneNumber

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">Phone number

</td></tr><tr><td class="tableblock halign-left valign-top">friendType

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">Type of friend \[WALLET, EXTERNAL\]

</td></tr><tr><td class="tableblock halign-left valign-top">firstName

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Optional

</td><td class="tableblock halign-left valign-top">First name

</td></tr><tr><td class="tableblock halign-left valign-top">lastName

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Optional

</td><td class="tableblock halign-left valign-top">Last name

</td></tr><tr><td class="tableblock halign-left valign-top">cardNumber

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Optional

</td><td class="tableblock halign-left valign-top">Card number

</td></tr></tbody></table>

### Response

```
HTTP/1.1 204 No Content
Content-Type: application/json
Location: /api/wallet-users/1/friends
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
```

## Get User friends

**Request body with header: *X-Encryption-Public-Key*.**

This method allow user to get all his friends

### Request

```
GET /mobile-api/wallet-users/friends HTTP/1.1
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjUzNGJhIiwiZXhwIjoxNjUxNzU2Njk4fQ.tBs5Os24ux-zmYNGYx5MCRAIYOg4Wtnu51NGs39doZ0
Product-Name: TestProduct
Host: localhost:8080
```

### Request headers

<table id="bkmrk-encrypted-request-bo"><caption>Encrypted request body with header: Content-Type: application/x-jwe-encryption-body+json</caption><colgroup><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col></colgroup><tbody><tr class="odd"><td>**Type**

</td><td>**Value**

</td><td>**Constraints**

</td><td>**Description**

</td></tr><tr class="even"><td>Authorization

</td><td>Mobile bG9naW46YWNrbWU=

</td><td>Required

</td><td>Device token with "Mobile " prefix

</td></tr><tr class="odd"><td>Product-Name

</td><td>TestProduct

</td><td>Required

</td><td>Application product name

</td></tr><tr class="even"><td>X-Encryption-Public-Key

</td><td>  
</td><td>Optional

</td><td>Header must be present if the response body is to be encrypted using the JWE standard. Public key must be encoded Base64.

</td></tr></tbody></table>

### Response

```
HTTP/1.1 200 OK
Content-Type: application/json
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Length: 251

{
  "friends" : [ {
    "friendId" : 2,
    "firstName" : "First",
    "lastName" : "Last",
    "displayName" : "Display name",
    "phoneNumber" : "48991193211",
    "friendType" : "WALLET",
    "lastFourDigits" : "4444",
    "bin" : "666222"
  } ]
}
```

### Response fields

<table class="tableblock frame-all grid-all stretch" id="bkmrk-friends-array-friend"><tbody><tr><td class="tableblock halign-left valign-top">`friends`

</td><td class="tableblock halign-left valign-top">`Array`

</td><td class="tableblock halign-left valign-top">  
</td></tr><tr><td class="tableblock halign-left valign-top">`friends[].friendId`

</td><td class="tableblock halign-left valign-top">`Number`

</td><td class="tableblock halign-left valign-top">Id of Friend

</td></tr><tr><td class="tableblock halign-left valign-top">`friends[].firstName`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Friend first name

</td></tr><tr><td class="tableblock halign-left valign-top">`friends[].lastName`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Friend last name

</td></tr><tr><td class="tableblock halign-left valign-top">`friends[].displayName`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Friend display name

</td></tr><tr><td class="tableblock halign-left valign-top">`friends[].phoneNumber`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Friend phone number

</td></tr><tr><td class="tableblock halign-left valign-top">`friends[].lastFourDigits`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Card last 4 digits. Empty for WALLET Friend type

</td></tr><tr><td class="tableblock halign-left valign-top">`friends[].bin`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Card bin. Empty for WALLET Friend type

</td></tr><tr><td class="tableblock halign-left valign-top">`friends[].friendType`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Type of friend \[WALLET, EXTERNAL\]

</td></tr></tbody></table>

## Update Friend

**Request body with header: *X-Encryption-Public-Key*.**

This method allow user to update friend. For a friend of the type: WALLET, can update only the field: displayName. For a friend of the type: EXTERNAL, can update the fields: phoneNumber, displayName, firstName, lastName, cardNumber.

### Request

**friendType = WALLET.**

```
PUT /mobile-api/wallet-users/friends/24 HTTP/1.1
Content-Type: application/json
Authorization: Mobile bG9naW46YWNrbWU=
Product-Name: TestProduct
Content-Length: 101

{
   "displayName":"Display name"
}

```

**friendType = EXTERNAL.**

```
PUT /mobile-api/wallet-users/friends/24 HTTP/1.1
Content-Type: application/json
Authorization: Mobile bG9naW46YWNrbWU=
Product-Name: TestProduct
Content-Length: 101

{
   "phoneNumber":"48999000111",
   "displayName":"Display name",
   "firstName":"First",
   "lastName":"Last",
   "cardNumber":["4","4","4","0","0","0","0","4","4","4","0","4","0"]
}

```

### Request headers

<table id="bkmrk-encrypted-request-bo-0"><caption>Encrypted request body with header: *Content-Type: application/x-jwe-encryption-body+json*</caption><colgroup><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col></colgroup><tbody><tr class="odd"><td>**Type**

</td><td>**Value**

</td><td>**Constraints**

</td><td>**Description**

</td></tr><tr class="even"><td>Authorization

</td><td>Mobile bG9naW46YWNrbWU=

</td><td>Required

</td><td>Device token with "Mobile " prefix

</td></tr><tr class="odd"><td>Product-Name

</td><td>TestProduct

</td><td>Required

</td><td>Application product name

</td></tr><tr class="even"><td>Content-Type

</td><td>application/x-jwe-encryption-body+json

</td><td>Optional

</td><td>Header must be present if the request body is encrypted using the JWE standard.

</td></tr></tbody></table>

### Request fields

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-constraint-4"><colgroup><col></col><col></col><col></col><col></col></colgroup><thead><tr><th class="tableblock halign-left valign-top">Path</th><th class="tableblock halign-left valign-top">Type</th><th class="tableblock halign-left valign-top">Constraints</th><th class="tableblock halign-left valign-top">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top">displayName

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">Display name

</td></tr><tr><td class="tableblock halign-left valign-top">phoneNumber

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">Phone number

</td></tr><tr><td class="tableblock halign-left valign-top">firstName

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Optional

</td><td class="tableblock halign-left valign-top">First name

</td></tr><tr><td class="tableblock halign-left valign-top">lastName

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Optional

</td><td class="tableblock halign-left valign-top">Last name

</td></tr><tr><td class="tableblock halign-left valign-top">cardNumber

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Optional

</td><td class="tableblock halign-left valign-top">Card number

</td></tr></tbody></table>

### Response

```
HTTP/1.1 204 No Content
Content-Type: application/json
Location: /mobile-api/wallet-users/friends/24
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
```

## Delete friend

**Encrypted request body with header: *Content-Type: application/x-jwe-encryption-body+json*.**

This method allow user to delete friend

### Request

```
DELETE /mobile-api/wallet-users/friends/24 HTTP/1.1
Content-Type: application/json;charset=UTF-8
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjUzNGJhIiwiZXhwIjoxNjUxNzU2Njk4fQ.tBs5Os24ux-zmYNGYx5MCRAIYOg4Wtnu51NGs39doZ0
Product-Name: TestProduct
Host: localhost:8080
```

### Request headers

<table id="bkmrk-type-value-constrain-2" style="width: 100%; height: 128.562px;"><colgroup><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col></colgroup><tbody><tr class="odd" style="height: 35.3906px;"><td style="height: 35.3906px;">**Type**

</td><td style="height: 35.3906px;">**Value**

</td><td style="height: 35.3906px;">**Constraints**

</td><td style="height: 35.3906px;">**Description**

</td></tr><tr class="even" style="height: 57.7812px;"><td style="height: 57.7812px;">Authorization

</td><td style="height: 57.7812px;">Mobile bG9naW46YWNrbWU=

</td><td style="height: 57.7812px;">Required

</td><td style="height: 57.7812px;">Device token with "Mobile " prefix

</td></tr><tr class="odd" style="height: 35.3906px;"><td style="height: 35.3906px;">Product-Name

</td><td style="height: 35.3906px;">TestProduct

</td><td style="height: 35.3906px;">Required

</td><td style="height: 35.3906px;">Application product name

</td></tr></tbody></table>

### Response

```
HTTP/1.1 200 OK
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
```

## Get publicKey

This method allow user to get publicKey

### Request

```
GET /mobile-api/public-key HTTP/1.1
Content-Type: application/json;charset=UTF-8
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjUzNGJhIiwiZXhwIjoxNjUxNzU2Njk4fQ.tBs5Os24ux-zmYNGYx5MCRAIYOg4Wtnu51NGs39doZ0
Product-Name: TestProduct
Host: localhost:8080
```

### Request headers

<table id="bkmrk-type-value-constrain-3"><colgroup><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col></colgroup><tbody><tr class="odd"><td>**Type**

</td><td>**Value**

</td><td>**Constraints**

</td><td>**Description**

</td></tr><tr class="even"><td>Authorization

</td><td>Mobile bG9naW46YWNrbWU=

</td><td>Required

</td><td>Device token with "Mobile " prefix

</td></tr><tr class="odd"><td>Product-Name

</td><td>TestProduct

</td><td>Required

</td><td>Application product name

</td></tr></tbody></table>

### Response

```
HTTP/1.1 200 OK
Content-Type: application/json
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Length: 610

{
  "value" : "LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUE5QXdvaDlzRW1CeDFUK2llb0lVMWpLUVJuUmg3SGFBS0tHdGdPTFQ3WDIyYlVuaHNDbld0SEVSR2pOcVBsQ205Wmh5SHo2ajFlSi9UVmdhQ1NEYmtKZFNUMmpCVDZDKzBKb0NnYld0S2EwbllIMVI4NWNVWUgzT3dYcFBZSHhGMW1MRlRVU2doUXFBVXZ1QzVla2FTQi9lTGV2WmRXTTcyazAybTZ0bGJUVWRhbUtQRnp1VzhxMGpZYUZ0Z01XYXlZUG81WXJJU1ZWWVZTVGdVZjZqR2ZCQUZ3N2d5dHVBaFlUMTVpT2g0NWtpc2pZb1BzaEd2RitqQ0FSbzlDMDhKSTdubVVGSEUrczNYQm84S0t0THNNKzhvcWNZdy9maVhIbkljSHNvcTQ2bnBWMEtTWW9MZm5pa0hnTnoxUFR0dnpBZ29NeXdSSDVrdURhYmNEeVRoZVFJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0t"
}
```

### Response fields

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-descriptio-4"><colgroup><col></col><col></col><col></col></colgroup><thead><tr><th class="tableblock halign-left valign-top">Path</th><th class="tableblock halign-left valign-top">Type</th><th class="tableblock halign-left valign-top">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top">`value`

</td><td class="tableblock halign-left valign-top">`String`

</td><td class="tableblock halign-left valign-top">Public key encoded with Base64

</td></tr></tbody></table>

### Examples

# MC Send

Every single method should contains Authorization and Mobile-Product headers.

## Master Card Send

Methods allow sending money in MasterCard Send 2.0

### Request

**Sender.paymentAccountType = WALLET\_CARD\_ID.**

```
POST /mobile-api/mc-send HTTP/1.1
Content-Type: application/json
Authorization: Mobile bG9naW46YWNrbWU=
Product-Name: TestProduct
Content-Length: 885

{
  "transactionId" : "bbb8597d-582c-4a12-a1c8-be9377aed6f9",
  "amount" : 40,
  "currency" : "INR",
  "sender" : {
    "account" : "walletCardId",
    "cvc2": ["3","2","1"],
    "addressId" : "123",
    "paymentAccountType" : "WALLET_CARD_ID"
  },
  "recipient" : {
    "name" : "Juniper Jane",
    "accountUri" : "402414000000006",
    "nationality" : "USA",
    "dateOfBirth" : "2011-05-13",
    "address" : {
      "city" : "Cape Girardeau",
      "country" : "USA",
      "state" : "MO",
      "postalCode" : "23232",
      "street" : "Mastercard Blvd"
    },
    "phone" : "1234567890",
    "email" : "jane.doe@mastercard.com",
    "governmentIds" : [ "123456789", "123456789" ],
    "receiverType" : "BARE_CARD_NUMBER"
  },
  "qrData" : "12",
  "transactionPurpose" : "07",
  "additionalMessage" : "message",
  "merchantCategoryCode" : "6536"
}

```

**Sender.paymentAccountType = IBAN\_ID.**

```
POST /mobile-api/mc-send HTTP/1.1
Content-Type: application/json
Authorization: Mobile bG9naW46YWNrbWU=
Product-Name: TestProduct
Content-Length: 885

{
  "transactionId" : "bbb8597d-582c-4a12-a1c8-be9377aed6f9",
  "amount" : 40,
  "currency" : "INR",
  "sender" : {
    "account" : "ibanId",
    "addressId" : "123",
    "paymentAccountType" : "IBAN_ID"
  },
  "recipient" : {
    "name" : "Juniper Jane",
    "accountUri" : "402414000000006",
    "nationality" : "USA",
    "dateOfBirth" : "2011-05-13",
    "address" : {
      "city" : "Cape Girardeau",
      "country" : "USA",
      "state" : "MO",
      "postalCode" : "23232",
      "street" : "Mastercard Blvd"
    },
    "phone" : "1234567890",
    "email" : "jane.doe@mastercard.com",
    "governmentIds" : [ "123456789", "123456789" ],
    "receiverType" : "BARE_CARD_NUMBER"
  },
  "qrData" : "12",
  "transactionPurpose" : "07",
  "additionalMessage" : "message",
  "merchantCategoryCode" : "6536"
}

```

**Recipient.receiverType = WALLET\_CARD\_ID.**

```
POST /mobile-api/mc-send HTTP/1.1
Content-Type: application/json
Authorization: Mobile bG9naW46YWNrbWU=
Product-Name: TestProduct
Content-Length: 885

{
  "transactionId" : "bbb8597d-582c-4a12-a1c8-be9377aed6f9",
  "amount" : 40,
  "currency" : "INR",
  "sender" : {
    "account" : "ibanId",
    "addressId" : "123",
    "paymentAccountType" : "IBAN_ID"
  },
  "recipient" : {
    "name" : "Juniper Jane",
    "accountUri" : "4024",
    "nationality" : "USA",
    "dateOfBirth" : "2011-05-13",
    "address" : {
      "city" : "Cape Girardeau",
      "country" : "USA",
      "state" : "MO",
      "postalCode" : "23232",
      "street" : "Mastercard Blvd"
    },
    "phone" : "1234567890",
    "email" : "jane.doe@mastercard.com",
    "governmentIds" : [ "123456789", "123456789" ],
    "userId" : 13001,
    "receiverType" : "WALLET_CARD_ID"
  },
  "qrData" : "12",
  "transactionPurpose" : "07",
  "additionalMessage" : "message",
  "merchantCategoryCode" : "6536"
}

```

**Recipient.receiverType = FRIEND\_ID.**

```
POST /mobile-api/mc-send HTTP/1.1
Content-Type: application/json
Authorization: Mobile bG9naW46YWNrbWU=
Product-Name: TestProduct
Content-Length: 885

{
  "transactionId" : "bbb8597d-582c-4a12-a1c8-be9377aed6f9",
  "amount" : 40,
  "currency" : "INR",
  "sender" : {
    "account" : "ibanId",
    "addressId" : "123",
    "paymentAccountType" : "IBAN_ID"
  },
  "recipient" : {
    "name" : "Juniper Jane",
    "nationality" : "USA",
    "dateOfBirth" : "2011-05-13",
    "address" : {
      "city" : "Cape Girardeau",
      "country" : "USA",
      "state" : "MO",
      "postalCode" : "23232",
      "street" : "Mastercard Blvd"
    },
    "phone" : "1234567890",
    "email" : "jane.doe@mastercard.com",
    "governmentIds" : [ "123456789", "123456789" ],
    "userId" : 13001,
    "receiverType" : "FRIEND_ID"
  },
  "qrData" : "12",
  "transactionPurpose" : "07",
  "additionalMessage" : "message",
  "merchantCategoryCode" : "6536"
}

```

**Recipient.receiverType = BARE\_CARD\_NUMBER.**

```
POST /mobile-api/mc-send HTTP/1.1
Content-Type: application/json
Authorization: Mobile bG9naW46YWNrbWU=
Product-Name: TestProduct
Content-Length: 885

{
  "transactionId" : "bbb8597d-582c-4a12-a1c8-be9377aed6f9",
  "amount" : 40,
  "currency" : "INR",
  "sender" : {
    "account" : "ibanId",
    "addressId" : "123",
    "paymentAccountType" : "IBAN_ID"
  },
  "recipient" : {
    "name" : "Juniper Jane",
    "accountUri" : "402414000000006",
    "nationality" : "USA",
    "dateOfBirth" : "2011-05-13",
    "address" : {
      "city" : "Cape Girardeau",
      "country" : "USA",
      "state" : "MO",
      "postalCode" : "23232",
      "street" : "Mastercard Blvd"
    },
    "phone" : "1234567890",
    "email" : "jane.doe@mastercard.com",
    "governmentIds" : [ "123456789", "123456789" ],
    "receiverType" : "BARE_CARD_NUMBER"
  },
  "qrData" : "12",
  "transactionPurpose" : "07",
  "additionalMessage" : "message",
  "merchantCategoryCode" : "6536"
}

```

### Request headers

<table id="bkmrk-request-body-with-he-11"><caption>Request body with header: *X-Encryption-Public-Key*</caption><colgroup><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col></colgroup><tbody><tr class="odd"><td>**Type**

</td><td>**Value**

</td><td>**Constraints**

</td><td>**Description**

</td></tr><tr class="even"><td>Authorization

</td><td>Mobile bG9naW46YWNrbWU=

</td><td>Required

</td><td>Device token with "Mobile " prefix

</td></tr><tr class="odd"><td>Product-Name

</td><td>TestProduct

</td><td>Required

</td><td>Application product name

</td></tr><tr class="even"><td>Content-Type

</td><td>application/x-jwe-encryption-body+json

</td><td>Optional

</td><td>Header must be present if the request body is encrypted using the JWE standard.

</td></tr><tr class="odd"><td>X-Encryption-Public-Key

</td><td>  
</td><td>Optional

</td><td>Header must be present if the response body is to be encrypted using the JWE standard. Public key must be encoded Base64.

</td></tr></tbody></table>

### Request fields

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-constraint-5" style="width: 100%;"><thead><tr><th class="tableblock halign-left valign-top" style="width: 13.4711%;">Path</th><th class="tableblock halign-left valign-top" style="width: 8.28412%;">Type</th><th class="tableblock halign-left valign-top" style="width: 17.6761%;">Constraints</th><th class="tableblock halign-left valign-top" style="width: 60.5686%;">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">transactionId

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">A unique transaction reference ID for the transaction

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">amount

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">Number

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Required, Must match length: min = 1 max = 12

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">The transaction amount, in the currency identified by the currency field. The decimal point is implied based on the currency. For example, a $1 transaction will be a value of 100.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">currency

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">The 3-character ISO 4217 alpha-3 code identifying the currency for the transaction amount in the amount field. See Currency Codes. For example, for U.S. Dollars, the value is USD.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">merchantCategoryCode

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">Mastercard-defined merchant category code. This identifies the type of business of the merchant. If provided, this merchant category code should match one of the valid codes set by the Mastercard rules.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">sender

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">Object

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">Sender information

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">sender.account

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">One of: {Iban id - represented as sha256Hex(iban), Wallet Card ID}

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">sender.cvc2

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">Array

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Conditional

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">Cvc2 data. Depends of receiver.paymentAccountType property. Required for receiver.paymentAccountType = WALLET\_CARD\_ID

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">sender.addressId

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">Address id of user address. If addressId will be null, one of the user’s addresses will be chosen. If addressId is not null, the address matching the specified id will be chosen.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">sender.paymentAccountType

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">One of: { WALLET\_CARD\_ID - if sender account is type of wallet card id, IBAN\_ID - if sender.account is type of iban\_id}. Depends of sender.account

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">Object

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">Recipient information object

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient.name

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Required, Must match length: min = 1 max = 120

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">The full name of the Recipient. Recommended format: Last Name/Family Name + space + First Name + space

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient.accountUri

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Conditional

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">A deposit account or generic account number. Depends of recipient.receiverType property. Required for receiver.receiverType = WALLET\_CARD\_ID or BARE\_CARD\_NUMBER

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient.nationality

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">The 3-character ISO 3166-1 alpha-3 code for the country in which the Recipient is a citizen;

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient.dateOfBirth

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">The date of birth of the Recipient, in ISO 8601 full date format (YYYY-MM-DD)

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient.userId

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">Number

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Conditional

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">Receiver wallet user id. Required if recipient.receiverType = FRIEND\_ID

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient.receiverType

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">Receiver type. One of: \[BARE\_CARD\_NUMBER, FRIEND\_ID, WALLET\_CARD\_ID\]. **Default value: BARE\_CARD\_NUMBER.**

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient.address

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">Object

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">Address information object

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient.address.city

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Optional, Must match length: min = 1 max = 25

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">The city of the individual or merchant.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient.address.country

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">The 3-character ISO 3166-1 alpha-3 code for the country of the individual

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient.address.state

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Conditional, Must match length: min = 2 max = 3

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">State or province of the individual or merchant. If the recipient’s country is USA or CAN, the country’s state or Province is required.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient.address.postalCode

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Optional, Must match length: min = 1 max = 10

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">The ZIP Code or postal code of the individual or merchant.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient.address.street

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Optional, Must match length: min = 1 max = 50

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">The street address of the individual or merchant.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient.phone

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Optional, Must match length: max = 15

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">The phone number of the receiver.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient.email

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Optional, Must match length: max = 254

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">The email address of the Recipient.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">recipient.governmentIds\[\]

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">Array

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">This array contains data strings that each identify a Government ID number for the Recipient;

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">qrData

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">The Mastercard QR data for P2M payments. MaxLength: 237.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">transactionPurpose

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">The purpose of the transaction. Valid numeric values:

00 = Family Support, 01 = Regular Labor Transfers (expatriates), 02 = Travel &amp; Tourism, 03 = Education, 04 = Hospitalization and Medical Treatment, 05 = Emergency Need, 06 = Savings, 07 = Gifts, 08 = Other, 09 – 15 = Reserved

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">additionalMessage

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">Message a financial institution will associate to the transfer and may display. Max length is 65.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 13.4711%;">paymentType

</td><td class="tableblock halign-left valign-top" style="width: 8.28412%;">String

</td><td class="tableblock halign-left valign-top" style="width: 17.6761%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 60.5686%;">The appropriate payment type for the funds transfer taking place. **Default value: P2M.**

Valid values: P2M = Merchant payment, P2P = Person to person

</td></tr></tbody></table>

### Response

```
HTTP/1.1 200 OK
Content-Type: application/json
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Length: 255

{
  "transactionId" : "68f59ba2-9cbb-4ab9-8606-5f483f97482d",
  "transactionStatus" : "APPROVED",
  "transactionStatusReason" : "APPROVED",
  "processingCode" : "28",
  "fundsAvailability" : "IMMEDIATE",
  "transmissionDateTime" : "2019-06-17T18:05:02Z"
}
```

**errorStatus = INVALID\_INPUT\_FORMAT.**

```
HTTP/1.1 400 BAD REQUEST
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "b4ce7ad5-758d-444f-90b3-ffbadb757e3f",
    "errorStatus": "INVALID_INPUT_FORMAT",
    "message": "Invalid Format",
    "data": {
        "error": [
            {
                "source": "recipient.accountURI.Expiration date",
                "reasonCode": "INVALID_INPUT_FORMAT",
                "errorDetailCode": "062000",
                "description": "Invalid Format"
            }
        ]
    }
}

```

<table id="bkmrk-a-formal-table-with-"><caption>A formal table with Reason Code</caption><colgroup><col style="width: 33%;"></col><col style="width: 33%;"></col><col style="width: 33%;"></col></colgroup><tbody><tr class="odd"><td>**Error Detail Code**

</td><td>**Reason Code**

</td><td>**Description**

</td></tr><tr class="even"><td>062000

</td><td>INVALID\_INPUT\_FORMAT

</td><td>Value contains invalid character

</td></tr><tr class="odd"><td>072000

</td><td>INVALID\_INPUT\_LENGTH

</td><td>Invalid length

</td></tr><tr class="even"><td>082000

</td><td>INVALID\_INPUT\_VALUE

</td><td>Invalid value

</td></tr><tr class="odd"><td>092000

</td><td>MISSING\_REQUIRED\_INPUT

</td><td>Value is required

</td></tr><tr class="even"><td>110501

</td><td>RESOURCE\_ERROR

</td><td>Duplicate value

</td></tr><tr class="odd"><td>110503

</td><td>RESOURCE\_ERROR

</td><td>Account not eligible

</td></tr><tr class="even"><td>110505

</td><td>RESOURCE\_ERROR

</td><td>Invalid currency

</td></tr><tr class="odd"><td>110507

</td><td>RESOURCE\_UNKNOWN

</td><td>Record not found

</td></tr><tr class="even"><td>110510

</td><td>RESOURCE\_ERROR

</td><td>Invalid Request

</td></tr><tr class="odd"><td>110537

</td><td>RESOURCE\_ERROR

</td><td>Value is not supported for the merchant

</td></tr><tr class="even"><td>130004

</td><td>DECLINE

</td><td>Per transaction maximum amount limit reached

</td></tr><tr class="odd"><td>130006

</td><td>DECLINE

</td><td>Transaction Limit is less than the minimum configured for the partner

</td></tr><tr class="even"><td>130010

</td><td>DECLINE

</td><td>Partner not onboarded for the network to reach the account

</td></tr></tbody></table>

**errorStatus = ERROR\_BAD\_TOKEN.**

```
HTTP/1.1 400 BAD REQUEST
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "{{traceId}}",
    "errorStatus": "ERROR_BAD_TOKEN"
}

```

**errorStatus = CANT\_FIND\_PAYMENT\_TOKEN.**

```
HTTP/1.1 404 NOT FOUND
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "89cdfc2b-346e-42d0-b20d-f3afa01cec68",
    "errorStatus": "CANT_FIND_PAYMENT_TOKEN",
    "message": "Payment token with given id was not found"
}

```

**errorStatus = SYSTEM\_ERROR.**

```
HTTP/1.1 500 INTERNAL SERVER ERROR
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "traceId": "1c8d4f1f-16db-4c43-bdce-0fe43ae39195",
    "errorStatus": "SYSTEM_ERROR",
    "message": "Internal exception occurred.",
    "data": {
        "error": [
            {
                "source": "SYSTEM",
                "reasonCode": "SYSTEM_ERROR",
                "errorDetailCode": null,
                "description": "Internal exception occurred."
            }
        ]
    }
}

```

### Response fields

### Examples

# Authentication

Every single method should contains Authorization and Mobile-Product headers.

![threeDsMode = FRICTIONLESS](https://bookstack.verestro.dev/images/frictionless.png)

![threeDsMode =
THREE_DS_METHOD](https://bookstack.verestro.dev/images/threeDsMethod.png)

![threeDsMode = CHALLENGE](https://bookstack.verestro.dev/images/challange.png)

## Init Authentication

The authentication stage flow is indicated by the following field: threeDsMode

Method allows us to do initialize authentication using ThreeDs 2.0 protocol.

After this method you have 3 options:

- **FRICTIONLESS** - In response: authenticationStatus, transactionXId, cavv, eci and **threeDsMode = FRICTIONLESS** are present. This response denotes that authentication was finished.
- **ThreeDsMethod flow** - In response: threeDsMethodData and **threeDsMode = THREE\_DS\_METHOD** are present. This response denotes that you should perform ThreeDs method flow. After executing ThreeDs method flow, make a request for the method: [Continue Authentication](#continue-authentication)
- **CHALLENGE** - In response: acsUrl, creq, challengeHtmlFormBase64 and **threeDsMode = CHALLENGE** are present. This response denotes that you should perform challenge. After executing challenge, make a request for the method: [Finalize Authentication](#finalize-authentication)

### Request

Base request:

```
POST /mobile-api/authentication/v2/init HTTP/1.1
Content-Type: application/json;charset=UTF-8
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjUzNGJhIiwiZXhwIjoxNjUxNzU2Njk4fQ.tBs5Os24ux-zmYNGYx5MCRAIYOg4Wtnu51NGs39doZ0
Product-Name: TestProduct
Content-Length: 639
Host: localhost:8080

{
  "authenticationId" : "authenticationId",
  "amount" : 1000,
  "currency" : "PLN",
  "cardId" : "219708",
  "browserDetails" : {
    "browserIp" : "281.123.0.1",
    "language" : "PL",
    "javaEnabled" : "true",
    "jsEnabled" : "true",
    "screenColorDepth" : "32",
    "screenHeight" : "1500",
    "screenWidth" : "1500",
    "timezoneOffset" : "+60",
    "userAgent" : "Mozzila",
    "acceptHeader" : "*"
  },
  "requestChallengeIndicator" : "NO_PREFERENCE",
  "threeDsMethodNotificationUrl" : "https://webhook.verestro.com",
  "challengeNotificationUrl" : "https://notification.verestro.com",
  "authenticationType" : "PAYMENT"
}
```

Encrypted request:

```
POST /mobile-api/authentication/v2/init HTTP/1.1
Content-Type: application/x-jwe-encryption-body+json;charset=UTF-8
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjUzNGJhIiwiZXhwIjoxNjUxNzU2Njk4fQ.tBs5Os24ux-zmYNGYx5MCRAIYOg4Wtnu51NGs39doZ0
Product-Name: TestProduct
Content-Length: 101
Host: localhost:8080

{
  "value" : "eyJ0eXAiONFIiwiZWDTSIsImlhdCI6MTYRjwJTAHd1iw.WqJ1NtTDapO40RPA.ub5wVd2yaaCX-PdjWq..."
}
```

### Request headers

<table id="bkmrk-request-body-with-he-12"><caption>Request body with header: *X-Encryption-Public-Key*</caption><colgroup><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col></colgroup><tbody><tr class="odd"><td>**Type**

</td><td>**Value**

</td><td>**Constraints**

</td><td>**Description**

</td></tr><tr class="even"><td>Authorization

</td><td>Mobile bG9naW46YWNrbWU=

</td><td>Required

</td><td>Device token with "Mobile " prefix

</td></tr><tr class="odd"><td>Product-Name

</td><td>TestProduct

</td><td>Required

</td><td>Application product name

</td></tr><tr class="even"><td>Content-Type

</td><td>application/x-jwe-encryption-body+json

</td><td>Optional

</td><td>Header must be present if the request body is encrypted using the JWE standard.

</td></tr><tr class="odd"><td>X-Encryption-Public-Key

</td><td>  
</td><td>Optional

</td><td>Header must be present if the response body is to be encrypted using the JWE standard. Public key must be encoded Base64.

</td></tr></tbody></table>

### Request fields

Base request:

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-constraint-6" style="width: 100%;"><thead><tr><th class="tableblock halign-left valign-top" style="width: 19.3997%;">Path</th><th class="tableblock halign-left valign-top" style="width: 9.15411%;">Type</th><th class="tableblock halign-left valign-top" style="width: 14.2151%;">Constraints</th><th class="tableblock halign-left valign-top" style="width: 57.2311%;">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">authenticationId

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">Unique authentication identifier per Product

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">amount

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">Number

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">Authentication amount

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">currency

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">Authentication currency (for example "PLN", "USD")

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">cardId

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">Wallet cardId belongs to sender account

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">browserDetails

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">Object

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">  
</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">browserDetails.browserIp

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Optional

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">Address IP of the order of authentication

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">browserDetails.language

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">This field contains the cardholder’s browser language as defined in IETF BCP 47

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">browserDetails.javaEnabled

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">This field contains a value representing the ability of the cardholder’s browser to execute Java.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">browserDetails.jsEnabled

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">This field contains a value representing the ability of the cardholder’s browser to execute JavaScript

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">browserDetails.screenColorDepth

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">This field contains a value representing the bit depth of the color palette, in bits per pixel, for displaying images. Obtained from Cardholder browser using the screen.colorDepth property. Values accepted:

**1** = 1 bit,

**4** = 4 bits,

**8** = 8 bits,

**15** = 15 bits,

**16** = 16 bits,

**24** = 24 bits,

**32** = 32 bits,

**48** = 48 bits

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">browserDetails.screenHeight

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required, Must match pattern: "^\[0-9\]{1,6}$"

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">This field contains the total height of the cardholder’s screen in pixels

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">browserDetails.screenWidth

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required, Must match pattern: "^\[0-9\]{1,6}$"

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">This field contains the total width of the cardholder’s screen in pixels

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">browserDetails.timezoneOffset

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required, Must match pattern: "^\[+-\]?\[0-9\]{1,4}$"

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">This field contains the difference between UTC time and the cardholder’s browser local time in minutes

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">browserDetails.userAgent

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">This field contains the exact content of the HTTP User-Agent header.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">browserDetails.acceptHeader

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">This field contains the exact content of the HTTP accept header as sent to the merchant from the cardholder’s user agent. This field is required only if the cardholder’s user agent supplied a value. e.g Accept: application/json

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">requestChallengeIndicator

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">Indicates whether a challenge is requested for this transaction. For authenticationType QUASI\_CASH, PAYMENT possible values are: **NO\_PREFERENCE**, **CHALLENGE\_NOT\_REQUESTED**, **CHALLENGE\_REQUESTED\_MANDATE**, **CHALLENGE\_PREFER\_BY\_REQUESTOR\_3DS**

For authenticationType ADD\_CARD, VERIFY\_CARDHOLDER, INSTALLMENT\_PAYMENT, COF\_INITIAL, RECURRING\_INITIAL possible values are: **CHALLENGE\_REQUESTED\_MANDATE**, **CHALLENGE\_PREFER\_BY\_REQUESTOR\_3DS**

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">threeDsMethodNotificationUrl

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">This field specifies the URL to which the ACS will post threeDsMethodData when the hidden iframe post form from browse

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">challengeNotificationUrl

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">This property specifies the URL to which the final challenge response is POSTed.

</td></tr><tr><td class="tableblock halign-left valign-top" style="width: 19.3997%;">authenticationType

</td><td class="tableblock halign-left valign-top" style="width: 9.15411%;">String

</td><td class="tableblock halign-left valign-top" style="width: 14.2151%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 57.2311%;">Authentication Type configuration prepared for specific type. Possible values are:

Non payment authentication - Identity verification and account confirmation: **ADD\_CARD**, **VERIFY\_CARDHOLDER**

Payment authentication - Cardholder authentication during an e-commerce transaction: **QUASI\_CASH**, **PAYMENT**, **COF\_INITIAL**, **INSTALLMENT\_PAYMENT**, **RECURRING\_INITIAL**

3DS Requestor Initiated (only for protocolVersion 2.2.0) - Confirmation of account information and Cardholder authentication with no direct Cardholder present. For example, a subscription-based e-commerce merchant confirming that an account is still valid: **MOTO**, **RECURRING\_SUBSEQUENT**

</td></tr></tbody></table>

Encrypted request:

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-constraint-7" style="width: 100%;"><thead><tr><th class="tableblock halign-left valign-top" style="width: 9.14343%;">Path</th><th class="tableblock halign-left valign-top" style="width: 7.0494%;">Type</th><th class="tableblock halign-left valign-top" style="width: 12.979%;">Constraints</th><th class="tableblock halign-left valign-top" style="width: 70.8282%;">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top" style="width: 9.14343%;">value

</td><td class="tableblock halign-left valign-top" style="width: 7.0494%;">String

</td><td class="tableblock halign-left valign-top" style="width: 12.979%;">Required

</td><td class="tableblock halign-left valign-top" style="width: 70.8282%;">The field contains encrypted JSON using the JWT standard. JSON is the same as the request body from the section: **BASE\_REQUEST**.

</td></tr></tbody></table>

### Response

**threeDsMode = FRICTIONLESS.**

```
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "authenticationId": "authenticationId",
    "authenticationStatus": "Y",
    "transactionXId": "9742432a-dfdc-41ca-9ae9-b6595de65f1d",
    "cavv": "jEu04WZns7pbARAApU4qgNdJTag",
    "eci": "02",
    "threeDsMode": "FRICTIONLESS"
}

```

**threeDsMode = THREE\_DS\_METHOD.**

```
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "authenticationId": "authenticationId",
    "threeDsMethodData": "eyJ0aHJlZURWZpY2F0aW9uVVJMIjoiaHR0cHM6Ly93ZWJob29rLnNpdGUvc3MiLCJ0aHJlZURTU2VydmVyVHJhbnNJRCI6IjNmYWYwZjFZi1iYjQyLThkN2RhM2M0NjY5OSJ9",
    "threeDsMethodUrl": "https://threeDsMethodUrl-test.verestro.com/acs-mock",
    "threeDsMode": "THREE_DS_METHOD"
}

```

**threeDsMode = CHALLENGE.**

```
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "authenticationId": "authenticationId",
    "acsUrl": "https://acs-url.verestro.com/mock-acs",
    "creq": "eyJjYXJkQXV0aGVudGljYNmODlhLTk2MjQtNGQ1OS04NzZmLTNkMWViYTcyNzM3NiIsIm5vdGlmaWNhdGlvblVybvd2ViaG9vay5zaXRlLzE5ODI3MWMyLTljYWYtNGEyMy05ZGJiLWRlZTc3ODExMDdlOSIsInRocmVlRFNTZXJ2ZXJUcmFuc0lEIjoiM2ZhZjBmMWQtM2YxNy00MTJmLWJiNDItOGQ3ZGEzYzQ2Njk5IiwibWVzc2FnZVZlcnNpb24iOiIyLjEuMCJ9",
    "challengeHtmlFormBase64": "PGh0bWw+PFNDUklQVCBMQU5mF2YXNjcmlwdCI+ZnVuY3Rpb24gT25Mb2FkRXZlbW1lbnQuZG93bmxvYWRGb3JtLnN1Ym1pdCgpOyB9PC9TQ1JJUFQ+PGJvZHkgT25Mb2FkmVudCgpOyI+PGZvcm0gbmFtZT0iZG93bmxvYWRGb3JtIiBhY3Rpb249Imh0dHBzOi8vbXBpLXN0YWdpbmcuZmVuaWdlLnBsL21vY2stYWNzIiBtZXRob2Q9IlBPU1QiPjxJTlBVVCB0eXBlPSJoaWRkZW4iXEiIHZhbHVlPSJleUpqWVhKa1FYVjBhR1Z1ZEdsallYUnBiMjVKWkNJNkltRmpZbU5tT0RsaExUazJNalF0TkdRMU9TMDROelptTFROa01XVmlZVGN5TnpNM05pSXNJbTV2ZEdsbWFXTmhkR2x2YmxWeWJDSTZJbWgwZEhCek9pOHZkMlZpYUc5dmF5NXphWFJsTHpFNU9ESTNNV015TFRsallXWXROR0V5TXkwNVpHSmlMV1JsWlRjM09ERXhNRGRsT1NJc0luUm9jbVZsUkZOVFpYSjJaWEpVY21GdWMwbEVJam9pTTJaaFpqQm1NV1F0TTJZeE55MDBNVEptTFdKaU5ESXRPR1EzWkdFell6UTJOams1SWl3aWJXVnpjMkZuWlZabGNuTnBiMjRpT2lJeUxqRXVNQ0o5Ij48SU5QVVQgdHlwZT0iaGlkZGVuIiBuYW1lPSJ0aHJlZURTU2Vzc2lvbkRhdGEiIHZhbHVlPSJZV05pWTJZNE9XRXRPVFl5TkMwMFpEVTVMVGczTm1ZdE0yUXhaV0poTnpJM016YzIiPjwvZm9ybT48L2JvZHk+PC9odG1sPg==",
    "threeDsSessionData": "YWNiY2Y4OWEtONC00ZDU5LTg3NmYtM2QxZWJhNzI3Mzc2",
    "threeDsMode": "CHALLENGE"
}

```

### Response fields

<table id="bkmrk-base-response-fields"><caption>Base response fields</caption><colgroup><col style="width: 33%;"></col><col style="width: 33%;"></col><col style="width: 33%;"></col></colgroup><tbody><tr class="odd"><td>**Path**

</td><td>**Type**

</td><td>**Description**

</td></tr><tr class="even"><td>authenticationId

</td><td>String

</td><td>Unique authentication identifier

</td></tr><tr class="odd"><td>threeDsMethodData

</td><td>String

</td><td>Encoded data used for request to ACS

</td></tr><tr class="even"><td>threeDsMethodUrl

</td><td>String

</td><td>ACS endpoint for hidden request. If endpoint is not present then request is not required.

</td></tr><tr class="odd"><td>authenticationStatus

</td><td>String

</td><td>Indicates whether a transaction qualifies as an authenticated transaction or account verification. Possible values are:

**Y** - Authentication/account verification successful

**N** - Not authenticated/account not verified; transaction denied

**U** - Authentication/account verification could not be performed; technical or other problem as indicated in ARes or RReq

**A** - Attempts processing performed; not authenticated/verified, but a proof of attempted authentication/verification is provided

**C** - Challenge required; additional authentication is required using the CReq/CRes

**R** - Authentication/account verification rejected; issuer is rejecting authentication/verification and request that authorization not be attempted

**D** - Challenge required; decoupled authentication confirmed

**I** - Informational only; ThreeDs Requestor challenge preference acknowledged

The CRes message can contain only a value of Y or N. Values of D and I are only applicable for ThreeDs version 2.2.0.

</td></tr><tr class="even"><td>transactionXId

</td><td>String

</td><td>This field indicates the transactionXid from recurring initial authentication.

</td></tr><tr class="odd"><td>cavv

</td><td>String

</td><td>This property is determined by the Access Control Server. This property will be valid if the TransactionStatus is "Y" or "A". The value may be used to provide proof of authentication.

</td></tr><tr class="even"><td>eci

</td><td>String

</td><td>This property is determined by the Access Control Server. This property contains the two digit Electronic Commerce Indicator (ECI) value, which is to be submitted in a credit card authorization message. This value indicates to the processor that the customer data in the authorization message has been authenticated. The data contained within this property is only valid if the TransactionStatus is "Y" or "A".

</td></tr><tr class="odd"><td>acsUrl

</td><td>String

</td><td>If challenge is required, data for building a form such as challengeHtmlFormBase64

</td></tr><tr class="even"><td>creq

</td><td>String

</td><td>If challenge is required, data for building a form such as challengeHtmlFormBase64

</td></tr><tr class="odd"><td>challengeHtmlFormBase64

</td><td>String

</td><td>This field is a BASE64 encrypted html source file containing the challenge 3-D Secure frame

</td></tr><tr class="even"><td>threeDsSessionData

</td><td>String

</td><td>ThreeDsSessionData value

</td></tr><tr class="odd"><td>threeDsMode

</td><td>String

</td><td>ThreeDs process mode which informs about. One of: \[FRICTIONLESS, THREE\_DS\_METHOD, CHALLENGE\]

**FRICTIONLESS** - this is where the authentication process was finished.

**THREE\_DS\_METHOD** - next step is to execute the ThreeDs method process. After it is done, we need to make a request to the method: [Continue Authentication](#continue-authentication)

**CHALLENGE** - next step is to execute the challenge process. After it is done, we need to make a request to the method: [Finalize Authentication](#finalize-authentication)

</td></tr></tbody></table>

### Errors

<table id="bkmrk-request-body-with-he-13"><caption>Request body with header: *X-Encryption-Public-Key*</caption><colgroup><col style="width: 33%;"></col><col style="width: 33%;"></col><col style="width: 33%;"></col></colgroup><tbody><tr class="odd"><td>**Http Status**

</td><td>**Error Status**

</td><td>**Description**

</td></tr><tr class="even"><td>400 - Bad Request

</td><td>PROCESS\_NOT\_ALLOWED

</td><td>Method not allowed - invoke calculate commission method is necessary first.

</td></tr><tr class="odd"><td>400 - Bad Request

</td><td>ERROR\_SENDER\_CARD\_NOT\_ACTIVE

</td><td>Sender card is not active

</td></tr></tbody></table>

## Continue Authentication

The authentication stage flow is indicated by the following field: threeDsMode

Method allows us to do continue authentication using ThreeDs 2.0 protocol. Use this method after perform process ThreeDsMethod. This step is optional in the authentication process. Required only if ThreeDsMethod case is present.

After this method you have 2 options:

- **FRICTIONLESS** - In response: authenticationStatus, transactionXId, cavv, eci and **threeDsMode = FRICTIONLESS** are present. This response denotes that authentication was finished.
- **CHALLENGE** - In response: acsUrl, creq, challengeHtmlFormBase64 and **threeDsMode = CHALLENGE** are present. This response denotes that you should perform challenge. After executing challenge, make a request for the method: [Finalize Authentication](#finalize-authentication)

### Request

Base request:

```
POST /mobile-api/authentication/v2/continue HTTP/1.1
Content-Type: application/json;charset=UTF-8
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjUzNGJhIiwiZXhwIjoxNjUxNzU2Njk4fQ.tBs5Os24ux-zmYNGYx5MCRAIYOg4Wtnu51NGs39doZ0
Product-Name: TestProduct
Content-Length: 82
Host: localhost:8080

{
  "authenticationId" : "authenticationId",
  "methodCompletionIndicator" : "Y"
}
```

Encrypted request:

```
POST /mobile-api/authentication/v2/continue HTTP/1.1
Content-Type: application/x-jwe-encryption-body+json;charset=UTF-8
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjUzNGJhIiwiZXhwIjoxNjUxNzU2Njk4fQ.tBs5Os24ux-zmYNGYx5MCRAIYOg4Wtnu51NGs39doZ0
Product-Name: TestProduct
Content-Length: 101
Host: localhost:8080

{
  "value" : "eyJ0eXAiONFIiwiZWDTSIsImlhdCI6MTYRjwJTAHd1iw.WqJ1NtTDapO40RPA.ub5wVd2yaaCX-PdjWq..."
}

```

### Request headers

<table id="bkmrk-request-body-with-he-14"><caption>Request body with header: *X-Encryption-Public-Key*</caption><colgroup><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col></colgroup><tbody><tr class="odd"><td>**Type**

</td><td>**Value**

</td><td>**Constraints**

</td><td>**Description**

</td></tr><tr class="even"><td>Authorization

</td><td>Mobile bG9naW46YWNrbWU=

</td><td>Required

</td><td>Device token with "Mobile " prefix

</td></tr><tr class="odd"><td>Product-Name

</td><td>TestProduct

</td><td>Required

</td><td>Application product name

</td></tr><tr class="even"><td>Content-Type

</td><td>application/x-jwe-encryption-body+json

</td><td>Optional

</td><td>Header must be present if the request body is encrypted using the JWE standard.

</td></tr><tr class="odd"><td>X-Encryption-Public-Key

</td><td>  
</td><td>Optional

</td><td>Header must be present if the response body is to be encrypted using the JWE standard. Public key must be encoded Base64.

</td></tr></tbody></table>

### Request fields

<table class="tableblock frame-all grid-all stretch" id="bkmrk-path-type-constraint-8"><thead><tr><th class="tableblock halign-left valign-top">Path</th><th class="tableblock halign-left valign-top">Type</th><th class="tableblock halign-left valign-top">Constraints</th><th class="tableblock halign-left valign-top">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top">authenticationId

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">Unique authentication identifier per Product

</td></tr><tr><td class="tableblock halign-left valign-top">methodCompletionIndicator

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">Possible values:

**Y** - if response from hidden form from Pre Authentication is under 10s,

**N** - if response from hidden form from Pre Authentication is over 10s,

**U** - if threeDsMethodUrl is empty

</td></tr></tbody></table>

### Response

**threeDsMode = FRICTIONLESS.**

```
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "authenticationId": "authenticationId",
    "authenticationStatus": "Y",
    "transactionXId": "9742432a-dfdc-41ca-9ae9-b6595de65f1d",
    "cavv": "jEu04WZns7pbARAApU4qgNdJTag",
    "eci": "02",
    "threeDsMode": "FRICTIONLESS"
}

```

**threeDsMode = CHALLENGE.**

```
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY

{
    "authenticationId": "authenticationId",
    "acsUrl": "https://acs-url.verestro.com/mock-acs",
    "creq": "eyJjYXJkQXV0aGVudGljYNmODlhLTk2MjQtNGQ1OS04NzZmLTNkMWViYTcyNzM3NiIsIm5vdGlmaWNhdGlvblVybvd2ViaG9vay5zaXRlLzE5ODI3MWMyLTljYWYtNGEyMy05ZGJiLWRlZTc3ODExMDdlOSIsInRocmVlRFNTZXJ2ZXJUcmFuc0lEIjoiM2ZhZjBmMWQtM2YxNy00MTJmLWJiNDItOGQ3ZGEzYzQ2Njk5IiwibWVzc2FnZVZlcnNpb24iOiIyLjEuMCJ9",
    "challengeHtmlFormBase64": "PGh0bWw+PFNDUklQVCBMQU5mF2YXNjcmlwdCI+ZnVuY3Rpb24gT25Mb2FkRXZlbW1lbnQuZG93bmxvYWRGb3JtLnN1Ym1pdCgpOyB9PC9TQ1JJUFQ+PGJvZHkgT25Mb2FkmVudCgpOyI+PGZvcm0gbmFtZT0iZG93bmxvYWRGb3JtIiBhY3Rpb249Imh0dHBzOi8vbXBpLXN0YWdpbmcuZmVuaWdlLnBsL21vY2stYWNzIiBtZXRob2Q9IlBPU1QiPjxJTlBVVCB0eXBlPSJoaWRkZW4iXEiIHZhbHVlPSJleUpqWVhKa1FYVjBhR1Z1ZEdsallYUnBiMjVKWkNJNkltRmpZbU5tT0RsaExUazJNalF0TkdRMU9TMDROelptTFROa01XVmlZVGN5TnpNM05pSXNJbTV2ZEdsbWFXTmhkR2x2YmxWeWJDSTZJbWgwZEhCek9pOHZkMlZpYUc5dmF5NXphWFJsTHpFNU9ESTNNV015TFRsallXWXROR0V5TXkwNVpHSmlMV1JsWlRjM09ERXhNRGRsT1NJc0luUm9jbVZsUkZOVFpYSjJaWEpVY21GdWMwbEVJam9pTTJaaFpqQm1NV1F0TTJZeE55MDBNVEptTFdKaU5ESXRPR1EzWkdFell6UTJOams1SWl3aWJXVnpjMkZuWlZabGNuTnBiMjRpT2lJeUxqRXVNQ0o5Ij48SU5QVVQgdHlwZT0iaGlkZGVuIiBuYW1lPSJ0aHJlZURTU2Vzc2lvbkRhdGEiIHZhbHVlPSJZV05pWTJZNE9XRXRPVFl5TkMwMFpEVTVMVGczTm1ZdE0yUXhaV0poTnpJM016YzIiPjwvZm9ybT48L2JvZHk+PC9odG1sPg==",
    "threeDsSessionData": "YWNiY2Y4OWEtONC00ZDU5LTg3NmYtM2QxZWJhNzI3Mzc2",
    "threeDsMode": "CHALLENGE"
}

```

### Response fields

<table id="bkmrk-base-response-fields-0"><caption>Base response fields</caption><colgroup><col style="width: 33%;"></col><col style="width: 33%;"></col><col style="width: 33%;"></col></colgroup><tbody><tr class="odd"><td>**Path**

</td><td>**Type**

</td><td>**Description**

</td></tr><tr class="even"><td>authenticationId

</td><td>String

</td><td>Unique authentication identifier

</td></tr><tr class="odd"><td>authenticationStatus

</td><td>String

</td><td>Indicates whether a transaction qualifies as an authenticated transaction or account verification. Possible values are:

**Y** - Authentication/account verification successful

**N** - Not authenticated/account not verified; transaction denied

**U** - Authentication/account verification could not be performed; technical or other problem as indicated in ARes or RReq

**A** - Attempts processing performed; not authenticated/verified, but a proof of attempted authentication/verification is provided

**C** - Challenge required; additional authentication is required using the CReq/CRes

**R** - Authentication/account verification rejected; issuer is rejecting authentication/verification and request that authorization not be attempted

**D** - Challenge required; decoupled authentication confirmed

**I** - Informational only; ThreeDs Requestor challenge preference acknowledged

The CRes message can contain only a value of Y or N. Values of D and I are only applicable for ThreeDs version 2.2.0.

</td></tr><tr class="even"><td>transactionXId

</td><td>String

</td><td>This field indicates the transactionXid from recurring initial authentication.

</td></tr><tr class="odd"><td>cavv

</td><td>String

</td><td>This property is determined by the Access Control Server. This property will be valid if the TransactionStatus is "Y" or "A". The value may be used to provide proof of authentication.

</td></tr><tr class="even"><td>eci

</td><td>String

</td><td>This property is determined by the Access Control Server. This property contains the two digit Electronic Commerce Indicator (ECI) value, which is to be submitted in a credit card authorization message. This value indicates to the processor that the customer data in the authorization message has been authenticated. The data contained within this property is only valid if the TransactionStatus is "Y" or "A".

</td></tr><tr class="odd"><td>acsUrl

</td><td>String

</td><td>If challenge is required, data for building a form such as challengeHtmlFormBase64

</td></tr><tr class="even"><td>creq

</td><td>String

</td><td>If challenge is required, data for building a form such as challengeHtmlFormBase64

</td></tr><tr class="odd"><td>challengeHtmlFormBase64

</td><td>String

</td><td>This field is a BASE64 encrypted html source file containing the challenge 3-D Secure frame

</td></tr><tr class="even"><td>threeDsSessionData

</td><td>String

</td><td>ThreeDsSessionData value

</td></tr><tr class="odd"><td>threeDsMode

</td><td>String

</td><td>ThreeDs process mode which informs about. One of: \[FRICTIONLESS, CHALLENGE\]

**FRICTIONLESS** - this is where the authentication process was finished.

**CHALLENGE** - next step is to execute the challenge process. After it is done, we need to make a request to the method: [Finalize Authentication](#finalize-authentication)

</td></tr></tbody></table>

## Finalize Authentication

**Request body with header: *X-Encryption-Public-Key*.**

Method allows us to do finalize authentication using ThreeDs 2.0 protocol.

### Request

Base request:

```
POST /mobile-api/authentication/v2/finalize HTTP/1.1
Content-Type: application/json;charset=UTF-8
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjUzNGJhIiwiZXhwIjoxNjUxNzU2Njk4fQ.tBs5Os24ux-zmYNGYx5MCRAIYOg4Wtnu51NGs39doZ0
Product-Name: TestProduct
Content-Length: 45
Host: localhost:8080

{
  "authenticationId" : "authenticationId"
}
```

Encrypted request:

```
POST /mobile-api/authentication/v2/finalize HTTP/1.1
Content-Type: application/x-jwe-encryption-body+json;charset=UTF-8
Authorization: Mobile eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJiNjUzNGJhIiwiZXhwIjoxNjUxNzU2Njk4fQ.tBs5Os24ux-zmYNGYx5MCRAIYOg4Wtnu51NGs39doZ0
Product-Name: TestProduct
Content-Length: 101
Host: localhost:8080

{
  "value" : "eyJ0eXAiONFIiwiZWDTSIsImlhdCI6MTYRjwJTAHd1iw.WqJ1NtTDapO40RPA.ub5wVd2yaaCX-PdjWq..."
}
```

### Request headers

<table id="bkmrk-request-body-with-he-16"><caption>Request body with header: *X-Encryption-Public-Key*</caption><colgroup><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col><col style="width: 25%;"></col></colgroup><tbody><tr class="odd"><td>**Type**

</td><td>**Value**

</td><td>**Constraints**

</td><td>**Description**

</td></tr><tr class="even"><td>Authorization

</td><td>Mobile bG9naW46YWNrbWU=

</td><td>Required

</td><td>Device token with "Mobile " prefix

</td></tr><tr class="odd"><td>Product-Name

</td><td>TestProduct

</td><td>Required

</td><td>Application product name

</td></tr><tr class="even"><td>Content-Type

</td><td>application/x-jwe-encryption-body+json

</td><td>Optional

</td><td>Header must be present if the request body is encrypted using the JWE standard.

</td></tr><tr class="odd"><td>X-Encryption-Public-Key

</td><td>  
</td><td>Optional

</td><td>Header must be present if the response body is to be encrypted using the JWE standard. Public key must be encoded Base64.

</td></tr></tbody></table>

### Request fields

Base request:

<div class="openblock primary" id="bkmrk-path-type-constraint-9"><div class="content"><table class="tableblock frame-all grid-all stretch"><thead><tr><th class="tableblock halign-left valign-top">Path</th><th class="tableblock halign-left valign-top">Type</th><th class="tableblock halign-left valign-top">Constraints</th><th class="tableblock halign-left valign-top">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top">authenticationId

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">Unique authentication identifier per Product

</td></tr></tbody></table>

</div></div><div class="openblock secondary" id="bkmrk-encrypted-request%3A-t"><div class="title">Encrypted request:</div><div class="content"><table class="tableblock frame-all grid-all stretch" style="width: 100%;"><caption class="title">Table 44. Encrypted request fields with header: Content-Type: application/x-jwe-encryption-body+json</caption><colgroup><col style="width: 10.378%;"></col><col style="width: 8.90506%;"></col><col style="width: 10.754%;"></col><col style="width: 69.9629%;"></col></colgroup><thead><tr><th class="tableblock halign-left valign-top">Path</th><th class="tableblock halign-left valign-top">Type</th><th class="tableblock halign-left valign-top">Constraints</th><th class="tableblock halign-left valign-top">Description</th></tr></thead><tbody><tr><td class="tableblock halign-left valign-top">value

</td><td class="tableblock halign-left valign-top">String

</td><td class="tableblock halign-left valign-top">Required

</td><td class="tableblock halign-left valign-top">The field contains encrypted JSON using the JWT standard. JSON is the same as the request body from the section: **BASE\_REQUEST**.

</td></tr></tbody></table>

</div></div>### Response

Base response:

```
HTTP/1.1 200 OK
Content-Type: application/json
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Length: 196

{
  "authenticationId" : "authenticationId",
  "authenticationStatus" : "Y",
  "transactionXId" : "9742432a-dfdc-41ca-9ae9-b6595de65f1d",
  "cavv" : "jEu04WZns7pbARAApU4qgNdJTag",
  "eci" : "02"
}
```

### Response fields

<table id="bkmrk-base-response-fields-1"><caption>Base response fields</caption><colgroup><col style="width: 33%;"></col><col style="width: 33%;"></col><col style="width: 33%;"></col></colgroup><tbody><tr class="odd"><td>**Path**

</td><td>**Type**

</td><td>**Description**

</td></tr><tr class="even"><td>authenticationId

</td><td>String

</td><td>Unique authentication identifier

</td></tr><tr class="odd"><td>authenticationStatus

</td><td>String

</td><td>Indicates whether a transaction qualifies as an authenticated transaction or account verification. Possible values are:

**Y** - Authentication/account verification successful

**N** - Not authenticated/account not verified; transaction denied

**U** - Authentication/account verification could not be performed; technical or other problem as indicated in ARes or RReq

**A** - Attempts processing performed; not authenticated/verified, but a proof of attempted authentication/verification is provided

**C** - Challenge required; additional authentication is required using the CReq/CRes

**R** - Authentication/account verification rejected; issuer is rejecting authentication/verification and request that authorization not be attempted

**D** - Challenge required; decoupled authentication confirmed

**I** - Informational only; ThreeDs Requestor challenge preference acknowledged

The CRes message can contain only a value of Y or N. Values of D and I are only applicable for ThreeDs version 2.2.0.

</td></tr><tr class="even"><td>transactionXId

</td><td>String

</td><td>This field indicates the transactionXid from recurring initial authentication.

</td></tr><tr class="odd"><td>cavv

</td><td>String

</td><td>This property is determined by the Access Control Server. This property will be valid if the TransactionStatus is "Y" or "A". The value may be used to provide proof of authentication.

</td></tr><tr class="even"><td>eci

</td><td>String

</td><td>This property is determined by the Access Control Server. This property contains the two digit Electronic Commerce Indicator (ECI) value, which is to be submitted in a credit card authorization message. This value indicates to the processor that the customer data in the authorization message has been authenticated. The data contained within this property is only valid if the TransactionStatus is "Y" or "A".

</td></tr></tbody></table>