Audi Virtual Payment Client Integration Manual 1
Table of Contents Table of Contents... 2 Introduction:... 3 Intended Audience:... 3 AVPC Payment Requests Processing... 3 AVPC required parameters... 3 AVPC Black-Listed Cards:... 4 AVPC Merchant Transaction Reference:... 4 AVPC Successful Transaction... 4 AVPC Bin Block... 4 AVPC Merchant Amount Limit... 4 AVPC Card Amount Limit... 4 AVPC Bin Amount Limit... 4 Step 1: Merchant Form Submission... 5 Step 2: Pre-Payment Process... 5 Step 3: Payment Process... 5 Step 4: Merchant Response Code... 6 Confidentiality... 7 References... 7 2
Introduction: The Audi Virtual Payment Client is a server component that communicates with Audi Payment Server using http protocol. Communication is secured through the exchange of a secret access code, shared between the Audi server and the host application, in addition to the SSL channel encryption. Audi Virtual Payment Client is an interface for merchants to connect to Audi card processing. The AVPC is a server interface there is no supplied client software. Intended Audience: This guide is aimed at Terminal Vendor application developers, or developers of host applications accepting Card-Present transactions, who wish to connect their application to the Audi server for Transaction Processing AVPC Payment Requests Processing Users checking out from merchant s website are redirected to AVPC where they submit their credit card information. AVPC will run the following validations Parameters acquired from the merchant against the merchant s access code Credit Card Number authenticity Date format Black listed cards Unique merchant transaction reference Merchant amount limit Card amount limit Allowed card bin number If all the required rules are met, then AVPC forwards the payment request to Audi Payment Server to acquire the response and relay it back to the merchant with the status of the transaction AVPC required parameters In order to function properly, AVPC needs to parse the following parameters from the querystring: Parameter Type Description accesscode The merchant s access code supplied by Audi Bank Merchant the Merchant ID supplied by Audi Bank Amount the amount of money to be processed via the current transaction merchtxnref A unique merchant transaction reference supplied by the merchant to identify his transaction in process orderinfo The order information field supplied by the merchant returnurl the URL to which AVPC will redirect when the transaction processing is complete vpc_securehash The MD5 result string of all parameters sorted and concatenated with the Secure Hash Secret 3
key AVPC Black-Listed Cards: The main purpose behind AVPC is to prevent any black listed MasterCard or VISA cards. AVPC acquires all information from the Merchant and asks the user for his credit card information, directly after the credit card number is validated against a database of black listed cards. AVPC will deny access to Audi Payment Server in case of faulty card, otherwise the payment procedure proceeds normally. AVPC Merchant Transaction Reference: The merchant transaction reference is kept in the database to validate multiple use of the same transaction reference. AVPC Card Attempts: AVPC records the number of unsuccessful payment attempts. Any card number hitting three failing attempts will be automatically blocked for 15 days. AVPC Successful Transaction When Audi Payment Server responds with a successful transaction, the credit card belonging to this transaction will be blocked for predefined number of days during which the user should use another credit card to pay. AVPC Bin Block A merchant will have the ability to define the allowed bin numbers upon which transactions can be processed. Allowed or disallowed groups of bin numbers can be composed of custom bin numbers or bin numbers related to a specific country. AVPC Merchant Amount Limit Each merchant has a limited total amount of transactions to be accepted for every defined number of days. AVPC Card Amount Limit Each merchant can have a limited transaction amount per credit card for a defined number of days. AVPC Bin Amount Limit Each Merchant can have a limited bin amount for a defined number of days. 4
Audi Virtual Payment Client Process Payment: Four steps are required in order to complete the payment process: Step 1: Merchant Form Submission After acquiring the parameters needed (parameter list described in AVPC required parameters), the merchant s AVPC will proceed in the following: 1. Run an encryption mechanism using the secure hash key shared with the merchant to compare it with the value of the field vpc_securehash passed. If this test is unsuccessful then the authentication fails and the user is redirected back to the merchant with a corresponding error code (error codes are listed in Step 4). 2. Check for the merchant transaction reference: if the ID has already been used the user is redirected to the merchant with a corresponding error code. 3. Check if the transaction s amount is valid in comparison with the merchant limit. If not valid the user is redirected to the merchant with a corresponding error code. Step 2: Pre-Payment Process AVPC goes through the following validation steps while processing the payment: Check if all the required fields are filled; if not, then the user is redirected to the merchant s page with M being the value of vpc_txnresponsecode indicating missing fields. Check if the credit card number is blocked. Check if the credit card number is still in process. This validation is done to check if a transaction upon a certain credit card was interrupted (for connectivity issues, user cancelling). If the validation is successful AVPC will temporary block the card until it grabs the response back from Audi Payment Server. Check if the amount is valid in comparison to the transaction limit and the bin limit. Step 3: Payment Process Upon receiving response from the payment server, AVPC will: Check the value of the vpc_securehash field after running its encryption mechanism. Remove the temporary block initiated in step 2. If the transaction is successful AVPC will block the card for 15 days. If the transaction is unsuccessful AVPC will record a failed transaction attempt. 5
Step 4: Merchant Response Code The merchant will receive the response from AVPC with the status of the transaction which can be recognized through the value of the field vpc_txnresponsecode. Each merchant will have to undergo the same encryption mechanism comparison to check for the validity of the URL. Below is a list of vpc_txnresponsecode values with their description. Code Description 0 Transaction Successful? Transaction status is unknown 1 Unknown Error 2 Bank Declined Transaction 3 No Reply from Bank 4 Expired Card 5 Insufficient funds 6 Error Communicating with Bank 7 Payment Server System Error 8 Transaction Type Not Supported 9 Bank declined transaction (Do not contact Bank) A Transaction Aborted C Transaction Cancelled D Deferred transaction has been received and is awaiting processing F 3D Secure Authentication failed I Card Security Code verification failed L Shopping Transaction Locked (Please try the transaction again later) N Cardholder is not enrolled in Authentication scheme P Transaction has been received by the Payment Adaptor and is being processed R Transaction was not processed - Reached limit of retry attempts allowed S Duplicate SessionID (OrderInfo) T Address Verification Failed U Card Security Code Failed V Address Verification and Card Security Code Failed Y Invalid URL B Transaction was not completed X Credit Card Blocked M Please enter all required fields J Transaction already in use. BL Card Bin Limit Reached 6
CL E G LM Q Z Card Limit Reached Invalid Credit Card Invalid Merchant Merchant Amount Limit Reached IP Blocked Bin Blocked Confidentiality For confidentiality purposes AVPC does not store, keep or save credit card information in its database. References To best view the integration of the merchant payment form you can find sample codes in VB.Net, C#.Net and PHP located under the folder \Integration\SampleCode\AVPC_SampleCode\. 7