Payment Protocols > XML Hosted 3D Secure Protocol > Payment outcome notification

Payment outcome notification

If credit card details are entered correctly by the cardholder, payment is processed and the Merchant receives a notification about the payment outcome. The notification is made through HTTP posts in NVP (NameValue Pair) format on the url specified in the responseToMerchantUrl parameter.

The securityToken is, among the various passed-in-post parameters, a security quantity generated by the payment Gateway and notified to the Merchant both upon initialisation response, and upon outcome notification; for security purposes, it is recommended to make sure that the value of the securityToken received corresponds with anything received during initialisation.

In order to redirect the web session of the cardholder to a new page containing the transaction outcome, the Merchant must reply to the notification message which was newly received with the url of its outcome page containing the 'paymentid' as parameter. This url may be enriched with parameters to be able to display the outcome correctly.
The response to the notification should be in "Plain text" format.

PAY ATTENTION: the response must not contain HTML code.

Upon notice of a hosted payment to the merchant URL response, once the connection has started, our services wait for 20 seconds to receive the final URL for the redirection. At the end of the timeout, the socket is closed.

In case the response URLs a self-signed certificate or issued by a secondary CA, you need to contact the support service.

Should the notification of the url for holder redirection fail (unavailability of the responseToMerchantUrl page, invalid content of the responseToMerchantUrl page, response timeout or the certificate is not recognized) the cardholder will be redirected to the recoveryUrl page, which is notified by the Merchant through the appropriate parameter of the Initialisation message. If the recoveryUrl parameter was not filled in in, the cardholder will be redirected to a courtesy page.

By the detail page of the transaction, from the Back-Office portal, you can see errors with notification of its causal.

Example of payment outcome message

Approved authorisation

authorizationcode=85963&cardcountry=ITALY&cardexpirydate=0115&cardtype=VISA&customfield=somecustom field&maskedpan=483054******1294&merchantorderid=TRCK0001&paymentid=123456789012345678&response code=000&result=APPROVED&rrn=123456789012&securitytoken=80957febda6a467c82d34da0e0673a6e &threedsecure=S

Payment cancelled by cardholder

paymentid=882244493221440719,result=CANCELED,threedsecure=N

Parameters of HTTP message for the card payment outcome notification

NAME

DESCRIPTION

FORMAT

paymentid	Unique identifier of the order generated by the Gateway that corresponds to the same field received in response during the Initialisation phase	AN Max. length: 18
result	Transaction outcome: APPROVED = transaction authorised NOT APPROVED = transaction rejected CAPTURED = transaction captured CANCELED = the cardholder cancelled the transaction NOT AUTHENTICATED = authentication failed SOFT DECLINE = transaction not permitted by the card issuer, retry payment UNEXPECTED ERROR = generic system error SYSTEM UNAVAILABLE = system unavailable momentarily The response will just contain paymentid, result and threedsecure parameters.	AN Max. length: 20
responsecode	Response code (e.g. '000' if the transaction is authorised, in all other cases the transaction is rejected)	N Max. length: 3
authorizationcode	Authorisation code, which is entered only if the transaction has been authorised	AN Max. length: 6
merchantorderid	Transaction Reference sent to the merchant in Initialisation phase (can contain only letters and numbers and must be absolutely unique)	AN Max. length: 18
threedsecure	Transaction security level: S = Full Secure transaction H = Half Secure transaction N = Not Secure transaction	AN Max. length: 1
rrn	Unique transaction reference generated by the Authorisation System (to be used in case of explicit posting via file)	AN Max. length: 12
maskedpan	Used credit card's masked PAN (in the format 123456******7890)	AN Max. length: 19
cardtype	Circuit and type of credit card used (upon request) Amex Diners Maestro Mastercard Moneta Visa BAPAYPAL PAYPAL	AN Max. length: 10
cardcountry	Nationality of the used credit card	AN Max. length: 255
cardexpirydate	Expiration date of the used credit card (in the format mmaa)	N Max. length: 4
customfield	Custom field sent to the merchant in Initialisation phase	AN Max. length: 255
securitytoken	Security token	AN Max. length: 32
schematid	Alphanumeric circuit Tid (sent only for MIT recurring payments).	AN Max. length: 15
walletid	Card token (sent for tokenization only).	N Max. length: 18

Parameters of HTTP message for the MyBank payment outcome notification

MyBank protocol, defined by the EBA consortium, provides that the response to the Merchant will be sent only after the Payer (Account Holder) has returned from the bank page he chose to make the transfer. In cases where the Payer does not return from the Bank's own page and then terminates the payment process as by protocol, the gateway offers the possibility, through the inquiry tool, to know at any time the status of the transaction. MyBank integration is subject to certification and therefore adheres to the EBA consortium protocol.

NAME

DESCRIPTION

FORMAT

paymentid	Unique identifier of the Gateway authorization request	AN Max. length: 18
result	Transaction outcome: AUTHORISED = credit transfer authorised by the payer's Bank ERROR = credit transfer not completed because it was denied by the payer's Bank AUTHORISINGPARTYABORTED = credit transfers aborted by the payer (after acces to the portal of the Bank) CANCELED* = payment abandoned or cancelled by the payer (before access to the portal of the Bank). The response will just contain paymentid and result parameters. TIMEOUT = payment not confirmed within the established limit (usually 15 minutes) PENDING = payment in waiting for the Bank to receive the outcome	AN Max. length: 32
description	Payment description	AN Max. length: 255
authorizationcode	End-to-end payment ID	AN Max. length: 35
merchantorderid	Transaction Reference sent to the merchant in Initialisation phase (can contain only letters and numbers and must be absolutely unique)	AN Max. length: 18
mybankid	Unique identifier of the payment released by myBank's circuit	N Max. length: 35
customfield	Custom field sent to the merchant in Initialisation phase	AN Max. length: 255
securitytoken	Security token	AN Max. length: 32

MyBank transactions automatic update

All MyBank payments assume PENDING status (on Nexi systems) waiting for the Bank to receive the outcome of the credit transfer. The payer has 15 minutes, from the beginning of the transaction, to confirm the credit transfer. Beyond this limit, the payment status will be set to TIMEOUT by the Bank.

Be set to TIMEOUT by the Bank. If the credit transfer is authorised (AUTHORISED) or denied (ERROR) by the Bank or cancelled (AUTHORISINGPARTYABORTED) by the payer on the homebanking page, the status will be updated accordingly.

When the payer does not reach or does not return from the page of the Bank, the status will remain PENDING on Nexi systems, but Merchant will not receive any notification. An automatic batch updates every 8 minutes, questioning MyBank services, the status of any pending payments. Update the status of pending payments is possible at any time through the service inquirymybank.

*Payment may assume the CANCELED status in the following scenarios:

Whether associating a final status to a payment is not possible (batch update, the Merchant will not receive any notification)
Whether the payer should leave the session before choosing the Bank (batch update, the Merchant will not receive any notification)
Whether the payer should click "Cancel Transaction" from the choose Bank page (The Merchant will receive appropriate notification)

Parameters of HTTP message for the PayPal payment outcome notification

NAME

DESCRIPTION

FORMAT

paymentid	Unique identifier of the Gateway authorization request	AN Max. length: 18
result	Transaction outcome:: APPROVED = transaction authorised CAPTURED = transaction confirmed PENDING = transaction suspended pending verification	AN Max. length: 20
responsecode	Response code (e.g. '000' if the transaction is authorised, in all other cases the transaction is rejected)	N Max. length: 3
merchantorderid	Transaction Reference sent to the merchant in Initialisation phase (can contain only letters and numbers and must be absolutely unique)	AN Max. length: 18
cardtype	Circuit and type of credit card used (upon request) Amex Diners Maestro Mastercard Moneta Visa BAPAYPAL PAYPAL	AN Max. length: 10
securitytoken	Security token	AN Max. length: 32

package sample;

// XML Hosted 3D Secure Protocol - Payment outcome notification

import java.util.HashMap;
import java.util.Map;

public class Notify {

private final String RESULT_PAGE_URL = GlobalVariables.MERCHANT_DOMAIN + "result.jsp?";
	private final Map<String, String[]> parameters;

public Notify(Map<String, String[]> parameters) {
		this.parameters = parameters;
	}

public String getResultPage() {
		String paymentId = parameters.get("paymentid")[0];

Map<String, String> results = new HashMap<String, String>();
		for (String key : parameters.keySet()) {
			results.put(key, parameters.get(key)[0]);
		}

GlobalVariables.payment_results.put(paymentId, results);
		return RESULT_PAGE_URL + String.format("paymentid=%s", paymentId);
	}
	// paymentid: parameters["paymentid"],
	// result: parameters["result"],
	// authorizationcode: parameters["authorizationcode"],
	// rrn: parameters["rrn"],
	// merchantorderid: parameters["merchantorderid"],
	// responsecode: parameters["responsecode"],
	// threedsecure: parameters["threedsecure"],
	// maskedPan: parameters["maskedpan"],
	// cardcountry: parameters["cardcountry"],
	// customfield: parameters["customfield"],
	// securityToken: parameters["securitytoken"]

}

using System;
using System.Collections.Generic;
//using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;

// XML Hosted 3D Secure Protocol - Payment outcome notification

namespace AspNetAntiguaHosted
{
    public partial class Notify : System.Web.UI.Page
    {
        private const string cardHolderRedirectUrl = GlobalVariables.MERCHANT_DOMAIN + "result.aspx";
        private System.Collections.Specialized.NameValueCollection parameters;
        //private Dictionary<string, string[]>  parameters;

protected void Page_Load(object sender, EventArgs e)
        {
            this.parameters = Request.Params;

//string id = Request["paymentid"];
            //string result = Request["result"];
            //string authorizationcode = Request["authorizationcode"];
            //string rrn = Request["rrn"];
            //string merchantorderid = Request["merchantorderid"];
            //string responsecode = Request["responsecode"];
            //string securitytoken = Request["securitytoken"];
            //string threedsecure = Request["threedsecure"];
            //string maskedpan = Request["maskedpan"];
            //string cardcountry = Request["cardcountry"];
            //string customfield = Request["customfield"];

Response.Write(string.Format("{0}?result={1}&paymentid={2}", cardHolderRedirectUrl, parameters.Get("result"), parameters.Get("paymentid")));
            
        }
    }
}

COPY CODE

TEST AREA