Deposit Creation Endpoint
Hybrid Deposit Creation
POST
https://api-stg.directa24.com/api_curl/apd/create
The Hybrid API creates a URL to redirect the customers to our Hosted Checkout where they need to fill in the required details before proceeding with the payment
Headers
Name | Type | Description |
---|---|---|
Content-Type | string |
|
Request Body
Name | Type | Description |
---|---|---|
x_login | string | Your D24 DEPOSITS API Key, found on the Merchant Panel by going to Settings -> API Access -> Deposit Credentials |
x_trans_key | string | Your D24 DEPOSITS API Passphrase, found on the Merchant Panel by going to Settings -> API Access -> Deposit Credentials |
x_invoice | string | Unique identification for the transaction in your end |
x_iduser | string | Unique user ID in your side |
x_amount | number | Deposit amount |
x_country | string | Deposit country code ISO 3166-1 alpha-2 |
control | string | Deposit control string encoded using HMAC-SHA-256 (RFC 2104). Used to verify request integrity |
x_currency | string | Deposit currency in ISO 4217. If not sent, USD will be assumed |
x_bank | string | Payment method code. If not sent the customer will be able to select on on our Hosted Checkout |
cpf | string | Customer national document ID |
x_name | string | Customer full name (name and last name) |
x_email | string | Customer valid email address |
type | string | The format of the response: XML or JSON. If none is specified, XML will be assumed |
x_logo | string | URL pointing to your logo to show on our Hosted Checkout |
x_return | string | URL where you would like to redirect the customers once they finish the deposits. It has to be a valid URL over HTTPS |
x_confirm | string | URL used to receive notifications. Should be provided if the confirmation URL needs to be different from the one registered in your panel settings. It has to be a valid URL over HTTPS |
x_description | string | Description of the product/service offered |
All the requests must be in x-www-form-urlencoded format and contain the following header:
Content-Type: application/x-www-form-urlencoded
Example Request
Request fields description
Field | Mandatory | Format | Description |
---|---|---|---|
| Yes | string (max length: 32) | Your D24 DEPOSITS API Key, found on the Merchant Panel by going to Settings -> API Access -> Deposit Credentials -> API Key |
| Yes | string (max length: 32) | Your D24 DEPOSITS API Passphrase, found on the Merchant Panel by going to Settings -> API Access -> Deposit Credentials -> API Passphrase |
| Yes | string (max length: 125) | Unique identification for the deposit transaction in your side. It will also be used to retrieve the status of the transaction |
| Yes | number (max digits: 125) | Unique customer ID in your side |
| Yes | decimal (up to 10 digits with up to 4 decimals) | Deposit amount in the currency specified with the field |
| Yes | string (max length: 2) | Customer’s country ISO 3166-1 alpha-2 code. Click here to see country codes |
| Yes | string (max length: 32) | Control string encoded using HMAC-SHA-256 (RFC 2104) to ensure request´s integrity. Click here for instructions |
| No | string (max length: 3) | Currency in which the amount will be specified. Click here to see the available currencies per country |
| No | string (max length: 3) | Payment method code (see Payment Methods). To check the available Payment Methods for your account, you can use the get_banks_by_country API |
| No | String (max digits: 30) | Customer personal identification number. Click here to see the validations |
| No | string (max length: 50) | Customer full name (name and last name) |
| No | string (max length: 100) | Customer valid email address. Click here to see email validations |
| No | string (max length: 20) | The format of the response: XML or JSON. If none is specified XML will be assumed. |
| No | string (URL) (max length: 200) | Your company´s logo to show in our check-in page |
| No | string (URL) (max length: 200) | URL where you would like to redirect the customers once they finish the deposits. It has to be a valid URL over HTTPS (I.e.: https://www.d24.com). See Return URL |
| No | string (URL) (max length: 200) | URL specified where we will send the deposit notifications. It has to be a valid URL over HTTPS (I.e.: https://www.d24.com/notify). See Notifications |
| No | string (max length: 200) | Description of the transaction |
Optional fields
When you use the Hybrid API, you can opt for sending only the mandatory fields. However, when the customers gets into our Hosted Checkout, we will ask them to input the missing information. If you send the x_cpf
, x_name
, and x_email
fields, the information will be automatically populated onto the Checkout page and therefore, the customers wont have to manually insert it nor will be able to modify it. This is extremely useful when you already have that details on your database.
Your logo (x_logo
) can be defined by default in the Merchant Panel by submitting one into Settings -> Company -> "Merchant Payment Page Logo". Otherwise, you can replace it on each request by sending a URL with your logo in the field x_logo
.
Both the Return URL (x_return
) and the Confirmation URL (x_confirm
) are defined by default in your Merchant Panel by going to Settings -> API Access. These parameters can be over-ridden at any time using the x_return
and x_confirm
parameters in the deposit request.
Control String for the Hybrid API requests
The Control field is a mandatory field used to ensure request integrity. It should be created using HMAC-SHA-256 (RFC 2104) encoding and must include ONLY the following fields:
x_invoice
x_amount
x_iduser
secretKey - your D24 DEPOSITS API Signature, found on the Merchant Panel by going to Settings -> API Access -> Deposit Credentials -> API Signature
The Control String for the Hybrid API must be in Upper Case and must include all the above mentioned fields. Each field should be converted to UTF-8 before actually hashing it to prevent Invalid Control Hash error when sending characters with different encodings. Please check the Examples in the different languages on how to properly calculate the Control String.
Example Response
Check Status
Once you redirect your customers to our Hosted Checkout page, they will complete all the details and click on Confirm details. If everything is OK, the transaction will remain in Pending status until we detect the customers payment. Once detected, the transaction will be changed to Completed state or if the user never pays it will expire and be updated to Cancelled state.
As soon as the user comes back to your Return URL, a POST request will come along with it with the details of the request as shown in the code snippet "Example: POST to the Return URL" below.
Control String for the POST to the Return URL
The x_control field we sent in the notification, is used to ensure request integrity. It should be created using HMAC-SHA-256 (RFC 2104) encoding and must include ONLY the following fields:
x_login - your D24 DEPOSITS API Key, found on the Merchant Panel by going to Settings API Access -> Deposit Credentials -> API Key
x_result
x_amount
x_invoice
secretKey - your D24 DEPOSITS API Signature, found on the Merchant Panel by going to Settings -> API Access -> Deposit Credentials -> API Signature
The Control String for the POST of the Return URL Hybrid API must be in Upper Case and must include all the above mentioned fields. Each field should be converted to UTF-8 before actually hashing it to prevent Invalid Control Hash error when sending characters with different encodings. Please check the Examples in the different languages on how to properly calculate the Control String.
Webpaystatus API
Example: webpaystatus API´s response in Pending status
If the user fails to be redirected to your return_url
, you wont be notified about the transaction in Pending state until it changes to either "Completed" or "Cancelled". Therefore, after some minutes (recommended 5 minutes) of the requests being created, you can opt to use the Deposit Status API to check whether the transaction was created and left Pending on our end. That would happen only if the customer finished the flow on the Hosted Checkout page and was redirected to the Payment Method page to deposit.
If the transaction was created, when you check its status with the Deposit Status API, you will receive a response with "result": "7" along with other details about the transaction. Result 7 means "Transaction Pending, awaiting customer's deposit". If the transaction was never created, be it because the user inserted incorrect data or they have never completed the flow, when you use the Deposit Status API you will receive a response with "result": "6" meaning "Transaction not found on the system". Feel free to check its status again after some more time in case the user is delayed.
Click here for all the results code meanings.
Notifications
Transaction completed
Transaction expired
If the transaction was successfully created, you will receive a notification in the URL specified in the x_confirm
field every time it changes its status. result
9 in case the payment was completed. At that moment, you can release the funds to the customer in your website as the payment has been detected and the funds are now in your account. A result
8 in case the payment wasn't completed before it reached its expiration time.
Click here for all the result codes meanings.
Last updated