[УКР](https://hackmd.io/jxzgAy4nSt-Q-6chgRCZdQ) | ENG
:arrow_left: [Guide](https://hackmd.io/QA2NYRliRLGviJl5P4-ZCw)

# [10102/101023/101025] Card-Wallet

*What is "Server-Server card payment" and how the sender is authenticated, see in the section "[Server-Server Card Payment](https://hackmd.io/83UDlVHPRf2CxEBCi6ECBg)".*

## Usage

|OperationType |Usage |
|:----:|----|
|`10102`| Debit funds from the card and credit to the Merchant's Wallet. Make a refund for request [10102] using request [[30201]](https://hackmd.io/VUh6hQpySFOsJV9yOzzgow).|
|`101023`| Debit funds from the card (ecom) and credit to the Merchants' Wallets, specified in the `MIDs` structure (see description below). Make a refund for request [101023] using request [[302013]](https://hackmd.io/VUh6hQpySFOsJV9yOzzgow).|
|`101025`| Debit funds from the card (c2a) and credit to the Merchants' Wallets, specified in the `MIDs` structure (see description below). Make a refund for request [101023] using request [[302015]](https://hackmd.io/VUh6hQpySFOsJV9yOzzgow).|

## Request

*See the description of the "Partner", "KeyAES" and "Sign" attributes in the section "[General API Integration Information](https://hackmd.io/ijxPm0xtTpycgTjuU_NHQQ)".*

### Data Structure

The Data structure for this operation is formed from the following parameters:

:::info
<details>
<summary>Data structure formation (examples are below)</summary>
<br>

**Funds flow scheme:** "Sender Card" -> Recipient Wallet" -> "Wallet".
~~~
{
"GoogleToken/AppleToken": "",
"Currency": "",
"Purpose": "",
"site": "",
"Order": "",
"Wallet": {
"ID": "",
"UserName": ""
},
"TransferC2W": {
"Sum": ,
"SenderCard": {
"PAN": "",
"ExpMon": "",
"ExpYear": "",
"CVV": "",
"Cryptogram": "",
"Gateway": "",
"eciIndicator": ""
},
"RecipientWallet": {
"ID": "",
"UserName": ""
},
"SuccessCallback": "",
"FailedCallback": "",
"CallbackURL": ""
},
"MIDs": [
{
"MID": ,
"Sum": ,
"PaymentInfo": [
{
"Caption": "",
"Value": ""
}
],
"Account": "",
"EDRPOU": "",
"MFO": "",
"Name": ""
}
],
"RecipientCard": {
"PAN": ""
},
"SenderPerson": {
"FirstName": "",
"LastName": "",
"MiddleName": "",
"Phone": "",
"Email": "",
"INN": "",
"Passport": "",
"BirthDate": "",
"Address": "",
"City": "",
"CountryCode": "",
"PostCode": "",
"State": ""
},
"RecipientPerson": {
"FirstName": "",
"LastName": "",
"MiddleName": "",
"INN": "",
"Passport": "",
"BirthDate": "",
"Address": "",
"City": "",
"CountryCode": "",
"PostCode": "",
"State": ""
},
"Transaction": {
"TransactionID": "",
"TerminalID": "",
"DateTime": ""
},
"BrowserData": {
"device": {
"channel": ""
},
"browserIP": "",
"browserTZ": ,
"browserLanguage": "",
"browserUserAgent": "",
"browserColorDepth": ,
"browserJavaEnabled": ,
"browserScreenWidth": ,
"browserScreenHeight": ,
"fraudhuntFingerprint": ""
}
}
~~~
</details>
:::

|Parameter|Required|Type|Description|Example|
|:----:|:----:|:----:|----|:----:|
|`GoogleToken` / `AppleToken`|No|String|Sender card token, transmitted when paying with the "Google/Apple Pay" method. |`24iOiJFQ3YyI-UwMDNk9In0...`|
| `Currency` | Yes - paying in a currency different from UAH | String | Currency debit code is an abbreviated currency designation described in the standard [ISO 4217](https://en.wikipedia.org/wiki/ISO_4217#Non_ISO_4217_currencies) (“GBP”, “USD”, etc.). |`USD`|
|`Purpose`|No|String|Payment purpose.|`Payment Order No.333`|
|`site`|No| String | Site name from which the payment is made. |`https://www.xpay.com.ua/`|
| `Order` | No | String | Order number. |`1234A`|
|`Wallet`^1^|No|Structure|Structure transmits wallet data of the final recipient (merchant) of funds in the Operator system.|See example below.|
|`TransferC2W`^2^|Yes|Structure|Structure transmits operation data.|See example below.|
| `MIDs`^4^ | No - for [10102]; Yes - for **[101023/101025]** | Array | Array is used to split the accepted payment in favor of the merchants. | See example below.|
|`RecipientCard`^6^|Сonditionally mandatory (determined at the integration stage)|Structure|Structure transmits recipient's bank card data.|See example below.|
|`SenderPerson`^7^|Сonditionally mandatory (determined at the integration stage)|Structure|Structure transmits sender's personal data.|See example below.|
|`RecipientPerson`^8^|Сonditionally mandatory (determined at the integration stage)|Structure|Structure transmits recipient's personal data.|See example below.|
|`BrowserData`|No|Structure|Structure transmits browser data for *3DSecure 2.0*. See section ["BrowserData structure"](https://hackmd.io/83UDlVHPRf2CxEBCi6ECBg#%E2%80%9CBrowserData%E2%80%9D-structure).|See example in section ["BrowserData structure"](https://hackmd.io/83UDlVHPRf2CxEBCi6ECBg#%E2%80%9CBrowserData%E2%80%9D-structure).|
|`Transaction`|Yes|Structure|Structure transmits transaction data. See section "[Transaction Structure](https://hackmd.io/ijxPm0xtTpycgTjuU_NHQQ?view#2-Data)".|See example below.|

^1^ **"Wallet"** Structure Parameters:

|Parameter|Required|Type|Description|Example|
|:----:|:----:|:----:|----|:----:|
|`ID`|Yes|String|Wallet іdentifier, that can be: </br> - phone number, </br> - email, </br> - unique client identifier in the Partner system, </br> - client card number.|`[e-mail]`|
|`UserName`|No|String|Wallet owner name.|`267608990`|

^2^ **"TransferC2W"** Structure Parameters:

|Parameter|Required|Type|Description|Example|
|:----:|:----:|:----:|----|:----:|
| `Sum` | Yes | Integer| Operation sum in kopecks. |1UAH=>`100`|
|`SenderCard`^3^|Yes|Structure|Structure transmits sender's bank card data.|See example below.|
|`RecipientWallet`|Yes|Structure|Structure transmits user wallet data in the Operator system. Parameters are similar to the structure "Wallet": `ID` and `UserName`.|See example below.|
| `SuccessCallback` | No | String | URL (server) is called for successful operation. See section ["Server-Server Card Payment"](https://hackmd.io/83UDlVHPRf2CxEBCi6ECBg). |`https://partner.host/cb_success`|
| `FailedCallback` | No | String | URL (server) is called for failed operation. See section ["Server-Server Card Payment"](https://hackmd.io/83UDlVHPRf2CxEBCi6ECBg). |`https://partner.host/cb_fail`|
| `CallbackURL` | No | String | URL, where client is redirected after completing the payment. See section ["Server-Server Card Payment"](https://hackmd.io/83UDlVHPRf2CxEBCi6ECBg). |`https://partner.host/resul_page`|

^3^ **"SenderCard"** Structure Parameters:

|Parameter|Required|Type|Description|Example|
|:----:|:----:|:----:|----|:----:|
| `PAN` | Yes | String[16] | Sender card PAN (bank card number). | `8888888888888888` |
|`ExpMon`|Yes|String[2]|Month of card validity. Parameter is aligned to 2 digits by the symbol "0".|`02`|
|`ExpYear`|Yes|String[2]|Last 2 digits of the card's expiration year. Parameter is aligned to 2 digits by the symbol "0".|`22`|
|`CVV`|No, if parameter `Cryptogram` is transmitted.|String[3]|CVV card code.|`356`|
|`Cryptogram`|No|String|Cryptogram of the decrypted "Google/Apple Pay" token. A cryptogram is a dynamic one-time code of each transaction accompanying the token. |`AFYjls2Of..XFAoABFA==`|
|`Gateway`|Yes, if parameter `Cryptogram` is transmitted.|String|Tokenization gateway for "Google/Apple Pay". Parameter is transmitted only when the card data was got as a result of data decryption.|`gpay` or `applepay`|
|`eciIndicator`|Yes, if parameter `Cryptogram` is transmitted.|String| [ECI indicator](https://developer.visa.com/request_response_codes#moto_eci_ind_codes), the value from the decrypted "Google/Apple Pay" cryptogram. |`7`|

^4^ **"MIDs"** array parameters:

|Parameter|Required|Type|Description|Example|
|:----:|:----:|:----:|----|:----:|
| `MID` |Yes| Integer | Merchant ID in the Operator system, to which wallet funds are credited. |`111`|
| `Sum` | Yes |Integer | Payment sum in kopecks. |1UAH=>`100`|
| `PaymentInfo`^5^ | No | Array | Parameter is used to display additional payment details on the payment page ("payment purpose"). | See example below.|
| `Account` |No| String | Recipient current account or IBAN (international bank account number). | `UA4830529900000 26008031203677`|
|`EDRPOU`|No|String | Recipient ["EDRPOU"](https://uk.wikipedia.org/wiki/%D0%9A%D0%BE%D0%B4_%D0%84%D0%94%D0%A0%D0%9F%D0%9E%D0%A3) code.|`3505506226` |
| `MFO` |No |String | Recipient "[Bank Sort Code](https://en.wikipedia.org/wiki/Sort_code). |`305299`|
| `Name` | No | String | Recipient name. |`Resource LLC`|

^5^ **"PaymentInfo"** Array Parameters:

|Parameter|Required|Type|Description|Example|
|:----:|:----:|:----:|----|:----:|
| `Caption` |Yes| String | Description of additional information. |`Purpose`|
| `Value` |Yes| String | Additional Information. |`Contract Repayment No. 3642989012-5 from 04/03/2021 Pupkina Valeriya Serhiivna`|

^6^ **"RecipientCard"** Structure Parameters:

|Parameter|Required|Type|Description|Example|
|:----:|:----:|:----:|----|:----:|
| `PAN` | Yes | String[16] | Recipient card PAN (bank card number). | `8888888888888888` |

^7^ **"SenderPerson"** Structure Parameters:

|Parameter|Required|Type|Description|Example|
|:----:|:----:|:----:|----|:----:|
| `FirstName` | No | String | Sender name. |`Oleg`|
| `MiddleName` | No | String | Sender middle name. |`Mykhaylovich`|
| `LastName` | No | String | Sender last name. |`Podilskyi`|
| `Phone` | No | String | Sender phone number in the format: "380xxxxxxxxxxxx". |`380679335544`|
| `Email` | No | String | Sender email. |`[e-mail]`|
| `INN` | No | String | Sender registration number of taxpayer's account card. |`1234567891`|
| `Passport` | No | String | Sender passport number (and series, if available) of a citizen of Ukraine or foreign passport number, if the client is a non-resident. |`AN 123456`|
| `BirthDate` | No | String | Sender birth date. |`10.01.1993`|
| `Address`* | No | String | Sender billing address. |`456 Main Street`|
| `City`* | No | String | Sender city. |`San Diego`|
| `CountryCode`* | No | String | Sender country code (ISO CODES), according to table "[Country Codes](https://countrycode.org/)". |`US`|
| `PostCode`* | No | String | Sender index. |`92126`|
| `State`* | No | String | Sender state. |`California (CA)`|

^8^ **"RecipientPerson"** Structure Parameters:

|Parameter|Required|Type|Description|Example|
|:----:|:----:|:----:|----|:----:|
| `FirstName` | No | String | Recipient name. |`Andrew`|
| `MiddleName` | No | String | Recipient middle name. |`Valeriiovich`|
| `LastName` | No | String | Recipient last name. |`Mazur`|
| `INN` | No | String | Recipient registration number of taxpayer's account card. |`1234567891`|
| `Passport` | No | String | Recipient passport number (and series, if available) of a citizen of Ukraine or foreign passport number, if the client is a non-resident. |`AN 123456`|
| `BirthDate` | No | String | Recipient birth date. |`10.01.1993`|
| `Address`* | No | String | Recipient billing address. |`pl. Bankowy 3/5`|
| `City`* | No | String | Recipient city. |`Warszawa`|
| `CountryCode`* | No | String | Recipient country code (ISO CODES), according to table "[Country Codes](https://countrycode.org/)". |`PL`|
| `PostCode`* | No | String | Recipient index. |`00-950`|
| `State`* | No | String | Recipient state. |-|

:::warning
*Parameters are transmitted only using a sender/recipient card not issued by the Bank of Ukraine.
:::

:::success
<details>
<summary>Example of "Data" structure</summary>
<br>

~~~md
{
"GoogleToken/AppleToken": "24iOiJFQ3YyI-UwMDNk9In0...",
"Currency": "USD",
"Purpose": "Payment Order No.333",
"site": "https://www.xpay.com.ua/",
"Order": "1234А",
"Wallet": {
"ID": "[e-mail]",
"UserName": "267608990"
},
"TransferC2W": {
"Sum": 52500,
"SenderCard": {
"PAN": "0000000000000000",
"ExpMon": "11",
"ExpYear": "22"
},
"RecipientWallet": {
"ID": "[e-mail]",
"UserName": "267608990"
},
"CallbackURL": "https://cpay.unitpay.org/process/index/gateId/16/actionId/267608990/lang/uk/h/e09755bb8352f62b7cc0defb574e5b78a2a3db49cdece328a8e9d2861c46dd9ada04e10df873b63f2277cb988 755d562",
"FailedCallback": "https://core.paysoft.solutions/api/merchant/result/21?PaysystemId=35&actionId=267608990",
"SuccessCallback": "https://core.paysoft.solutions/api/merchant/result/21?PaysystemId=35&actionId=267608990"
},
"MIDs": [
{
"MID": 111,
"Sum": 100,
"PaymentInfo": [
{
"Caption": "Purpose",
"Value": "Contract Repayment No.3642989012-5 dated 04/03/2021 Pupkina Valeriya Serhiivna"
}
],
"Account": "UA483052990000000008031203000",
"EDRPOU": "3505501111",
"MFO": "123456"
},
{
"MID": 112,
"Sum": 200,
"PaymentInfo": [
{
"Caption": "Purpose",
"Value": "Contract Repayment No.3642989012-5 dated 04/03/2021 Pupkina Valeriya Serhiivna"
}
],
"Account": "UA483052990000000008031203000",
"EDRPOU": "3505501111",
"MFO": "123456"
}
],
"Transaction": {
"DateTime": "20220504 08:14:07",
"TerminalID": "802",
"TransactionID": "267608990"
}
}
~~~
</details>
:::

## Response

*See the general information on the response structure formation in the section "[General API Integration Information](https://hackmd.io/ijxPm0xtTpycgTjuU_NHQQ?view#Response-Structure)"*.

### Response Examples

:::success
<details>
<summary>Request successfully accepted and needs "3DS" verification</summary>
<br>

~~~md
{
"Code": 102,
"Message": "need3ds",
"Data": {
"OperationID": 111,
"3dsHtml": "<html page in base64 encoding>",
"OperationStatus": 2
},
"KeyAES": "",
"Sign": ""
}
~~~
</details>
:::

:::success
<details>
<summary>Request successfully accepted and needs "OTP" verification</summary>
<br>

~~~md
{
"Code": 102,
"Message": "needOTP",
"Data": {
"OperationID": 111,
"otpJson": "<JSON structure as string>",
"OperationStatus": 3
},
"KeyAES": "",
"Sign": ""
}
~~~
</details>
:::

:::success
<details>
<summary>Operation Successfully Completed</summary>
<br>

~~~md
{
"Code": 200,
"Message": "done",
"Data": {
"OperationID": 555,
"OperationStatus": 10
},
"KeyAES": "",
"Sign": ""
}
~~~
</details>
:::

:::success
<details>
<summary>Operation Failed</summary>
<br>

~~~md
{
"Code": 200,
"Message": "done",
"Data": {
"OperationID": 111,
"OperationStatus": 21,
"Reason": 3
},
"KeyAES": "",
"Sign": ""
}
~~~
</details>
:::

## Related Requests

[[10101] Card-Card](https://hackmd.io/VYlXRMiWRkimK0sxlTZ2BA)
[[10103] Card-IBAN of Individual](https://hackmd.io/9c9kaHeMTH-LiGf_mVWwpg)
[[101031] Card-IBAN of Legal Entity](https://hackmd.io/XQDv9qmoRiqFzfzcD0H1uA)
[[10150/10051] Card-Phone-Card](https://hackmd.io/ES9hW5BlS6CozQAmULgnRw)

**Token Payment**
[[104021] Card Payment by Token](https://hackmd.io/I4FJ0d0eStuvfqG2YmS8IQ)
[[1040217] Bulk Card Payment by Token](https://hackmd.io/6h9zyYaBTwOLzzP8XJDrfg)
[[104121] Auto Debit by Token. MO/TO Operations](https://hackmd.io/X4ImobdtSJ-Hy1qM-p7PWA)

**Get Card Data**
[[20400/20410] Get Card Data by Phone Number](https://hackmd.io/Xd9OZWXARcSZRTCsu-1jrw)
[[20404] Get Card Data by Token](https://hackmd.io/PSdh1ldNSmmJMR4OIhM_-Q)

**Get Transaction Data**
[[20003] Get Operation Status](https://hackmd.io/_eAjmoG-QPWoWWmsLOGf1g)
[[20009] Get Limit for Operation [10101]](https://hackmd.io/rQ7epWnbQmG9kM0rFjUfhA)
[[20110] Get Card Data](https://hackmd.io/WruG7PGDRsuF0gL0Wl21bA)

**Refunds**
[[30201/302013/302015] Cancel/Refund Payment for Operations [10102/101023/101025]](https://hackmd.io/VUh6hQpySFOsJV9yOzzgow)

## Reference Materials

General parameters of the XPAY system are given in the section ["Reference Materials"](https://hackmd.io/16yLv895Qo-FWTvrWWQwbg):  operation types, payment types, response codes, operation status, reasons of operation rejection, etc.

:arrow_left: [Guide](https://hackmd.io/QA2NYRliRLGviJl5P4-ZCw)
:arrow_left: [General API Integration Information](https://hackmd.io/ijxPm0xtTpycgTjuU_NHQQ)

<details>
<summary>XPAY Support</summary>
</br>

Phone: [phone]
Email: [e-mail]
Telegram: @xpaysupportbot
</details>