Version 28.2 by Kristian Lingsom on 2017/10/17 08:33
Hide last authors
Kristian Lingsom 4.1 1 (% class="WordSection1" %)
2 (((
Kristian Lingsom 19.1 3 = Overview =
Kristian Lingsom 5.2 4
5 The purpose of the H2H PayEx link is to enable authorization and settlement of card transactions, where PayEx is end host for that card, or just an PSP. The third party host acts as a gateway in between payment terminals and PayEx.
6
7
8 [[image:pos server.png]]
9
10
11
Kristian Lingsom 4.1 12
Kristian Lingsom 19.1 13 The third party host can be a single or dual host system.
14 PayEx has a fully redundant system, with an active/active configuration.
15 The third party host(s) connect to PayEx loadbalanser
16
17
Kristian Lingsom 20.1 18 == Supported massage types ==
Kristian Lingsom 19.1 19
Kristian Lingsom 4.1 20
Kristian Lingsom 21.1 21 |=Message Type|=Reference
Kristian Lingsom 23.1 22 |1100/1110|[[AUTHORISATION REQUEST>>doc:AUTHORISATION REQUEST 1100/1110]]
Kristian Lingsom 23.2 23 |1200/1210|[[FINANCIAL TRANSACTION REQUEST>>doc:.FINANCIAL TRANSACTION REQUEST 1200/1210.WebHome]]
24 |1220/1221/1230|[[FINANCIAL TRANSACTION ADVICE>>doc:FINANCIAL TRANSACTION ADVICE 1220/1221/1230]]
25 |1420/1421/1430|[[REVERSAL ADVICE>>doc:REVERSAL ADVICE 1420/1421/1430]]
26 |1820/1830|[[NETWORK MANAGEMENT>>doc:.NETWORK MANAGEMENT 1820/1830.WebHome]]
Kristian Lingsom 4.1 27
Kristian Lingsom 23.3 28 * Message types not included in the table above are not supported. E-g reconciliation is not supported
29 Only the Financial transaction advice (1220), Reversal Advice (1420) use repeat messages. Repeats are to be sent according to xxxxxxx rules
30 * Advice can be declined by PayEx for technical reasons. In this case the third party host need to retry the advice until manual intervention or the advice has been accepted. It’s expected that the third party implement a retry delay (to-be-defined). After 6 retry attemps have failed manual intervention by third party and PayEx support must be initiated.
Kristian Lingsom 4.1 31
Kristian Lingsom 19.1 32 == Message layout ==
33
Kristian Lingsom 16.1 34 This section covers message types and fields supported by PayEx
Kristian Lingsom 4.1 35
Kristian Lingsom 17.2 36
Kristian Lingsom 16.1 37 |=Presence|=Title|=Description
38 |C|Conditional|The data element’s presence depends on specific circumstances, witch are described either directly or by reference in the message content table.
39 |CE|Conditional echo|The response message must have the same data element if the data element was present in the original message
40 |M|Mandatory|Data element must be present in the specified message
41 |ME|Mandatory echo|The response message must have the same data element and value as sent in the original message request or advice message
42 |O|Optional|The data element may or may not be present in the message
Kristian Lingsom 17.2 43 )))
Kristian Lingsom 4.1 44
Kristian Lingsom 17.2 45 Optional fields may always be present in requests, even when not needed. In such case, they will be ignored. Requests received missing a mandatory field will be 904 - Format Error.
46
47 The third party host must ignore unknown fields included in the response messages.
48
49 When no usage notes are given in the field description, the field should be used as described in IFSF [1].
50
51 The “Format”-column can contain following info:
52
53 * LL: Variable length field, max 99 bytes as data. The field contains 2 bytes holding the length of the data. Example: 303101 a one byte field with LL = 3031 and the data is 01.
54 * LLL: Variable length field, max 999 bytes as data. The field contains 3 bytes holding the length of the data. Example: 30303101 a one byte field with LLL = 303031 and the data is 01.
55 * Date/time field formats, YYMMDDhhmmss (or variations), where:
56 ** YY : Last 2 digits of the year, 00 through 99
57 ** MM: Month, 01 through 12.
58 ** DD: Day, 01 through 31
59 ** hh: Hour, 00 through 23
60 ** mm: Minutes, 00 through 59
61 ** ss: Seconds, 00 through 59
62
63 The “Type”-column can contain:
64
65 * a : Alphabetic character [a..z,A..Z]
66 * n : Numeric BCD-digit. [0..9]
67 * ans: alphabetic, numeric and special characters
68 * an : alphabetic and numeric.
69 * s : Special characters.
70 * b : Binary
71 * p: pad character, space
72 * x: “C” for credit, “D” for debit and shall always be associated with a numerical amount data element.
73
74 The “Size”-column can contain:
75
76 * Variable length fields have a size that looks like “..nn”, where nn is the maximum number of characters or bytes.
77 * A fixed length field has “n” as size content, with n the number of characters or bytes.
78
79 All fixed length “n” data elements are assumed to be right justified with leading zeroes. All other fixed length data elements are left justified with trailing spaces. In all “b” data elements, blocks of 8 bits are assumed to be left justified with trailing zeroes.
80
81
Kristian Lingsom 24.2 82 == Message protocol ==
Kristian Lingsom 17.2 83
Kristian Lingsom 24.2 84 All messages are transferred using TCP/IP sockets.
85
86 The message will be encapsulated in a transmission frame as follows:
87
88 * The first 4 digits contain the length of the message in ASCII (decimal value, most significant digit first). The length field includes all bytes from the first byte of the message ID up to the last byte of the last field.
89 * This 4-digit length field is immediately followed by the message ID, also in ASCII (decimal value, most significant digit first).
90 * An 8 byte message bitmap, which is a binary field (so not ASCII encoded).
91 * Message fields, which could be ASCII or binary encoded. The fields with format ‘n, ns, an, ans, anp or x’ are ASCII encoded, while the fields with format ‘b’ are binary encoded. The following conventions shall be applied to all data elements:
92 ** All fixed length numeric data element values shall be right justified with leading zeroes.
93 ** All fixed length data elements with alphabetic or special characters shall be left justified with trailing blanks.
94 ** All fixed length binary data elements shall be right justified with leading zeroes.
95 ** The position of a character or a bit in a data element shall be counted from the left beginning with one (1).(See also section 5.1 Attribute specification in [01])
96 ** No trailer is included.
97
98 Example: An imaginary message which consists only of a message ID “0300” and an empty bitmap (all zeros) will be transmitted as follows:
Kristian Lingsom 17.2 99
Kristian Lingsom 24.2 100
Kristian Lingsom 24.3 101 |=Length|=(((
102 Message ID
103 )))|=Bitmap
Kristian Lingsom 24.2 104 |=0x30 0x30 0x31 0x32|=0x30 0x33 0x30 0x30|=0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
105
Kristian Lingsom 24.3 106 Example: An 1820 message, without MAC, will be transmitted as follows: Message bytes (hex):
107 303035303138323002300101000000003039313031353238343133383239313030393039313031353238343138333130353130303331
108
109
110 |=Field|=Format|=Encoding|=Data|=Parsed
111 |Message Length|n|ASCII|30303530|0050
112 |Massage ID|n|ASCII|31383230|1820
113 |Bitmat|b|Binary|0230010100000000|
114 |7 - Date/Time|n|ASCII|30393130313532383431|0910152841
115 |11 - STAN|n|ASCII|333832393130|382910
116 |12 - Date/Time|n|ASCII|303930393130313532383431|090910152841
117 |24 - Function code|n|ASCII|383331|831
118 |32 - Acquiring institution identification code|n|ASCII|TODO eksempel|TODO eksempel
119
120 The PayEx response timeout is set to XX seconds. If after xx+1 seconds, no response has been received, the third party host needs to take the appropriate action based on the message type. (E.g. send a reversal)
121
122 The third party host has the possibility to perform offline stand-in, thought this needs to be agreed with the indididual card issuers. Otherwise the station might not be reimbursed.
123
124
Kristian Lingsom 25.1 125 == PIN Validation ==
126
127 PayEx perform online PIN validation on paye,ent cards where PayEx is the acquirer, on all other cartds PIN is validated by the third party acuirer. PayEx will not interpret P-22 Point-Of-Service code to determine if it needs to validate PIN or not on PayEx fuel cards, but 3rd patry aquirers might so it's good practice to use P-22 correctly.
128
129 Fields required for PIN validation are:
130
131 * P-48-14 – PIN encryption Methodology
132 * P-52 – PIN data
133 * P-53 – Security related information
134
Kristian Lingsom 26.1 135 == Message field details ==
136
137
138 **P-2 PAN**
139
140 Personal Account Number, identifies the card.Only mandatory for Manual PAN transactions (replacement for Track2Data P35)
141
142 **P-3 PROCESSING CODE**
143
144 Code used to describe the effect of a transaction on the customer account and the accounts affected. Fixed 00000000 : Goods and services
145
146 **P-4 AMOUNT, TRANSACTION**
147
148 The amount is a numeric value, expressed without a decimal separator. Where a minor unit of currency applies, the relevant minor unit data element indicates the number of decimal places in the relevant amount. Example : 1 kr = 100
149
150 **P-7 DATE AND TIME, TRANSMISSION**
151
152 Date and time of message transmission from the third party host.
153
154 **P-11 SYSTEM TRACE AUDIT NUMBER**
155
156 Number assigned by the third party host to assist in identifying a transaction uniquely. Range 000001 till 999999. Every message must have a new STAN, repeats use the same STAN as the original message.
157 **P-12 DATE AND TIME, LOCAL TRANSACTION**
158
159 Date and time of the transaction when performed on the POS.
160
161 **P-14 DATE EXPIRY**
162
163 Month and year of card expiry. Only mandatory for a manual PAN transaction
164
165 **P-22 POINT OF SERVICE DATA CODE**
166
167 A series of codes intended to identify terminal capability, terminal environment and presentation security data.
168
169 |=Point of service date code|=Description
170 |POS 1: Card data input capabilities|2: magnetic stripe read A: RFID
171 B: Magnetic stripe reader and key entry
172 C: Magnetic stripe reader, ICC and key entry
173 D: Magnetic stripe reader and ICC
174 |Pos 2: Cardholder authentication capability|1: PIN
175 Y: Signature,plaintext/enciphered PIN offline and ‘no cvm’ capable, enciphered pin online
176 |Pos 3: Card capture capability|0:None
177 T: None and SDA/DDA/CDA capable
178 |Pos 4: Operating environment|(((
179 1: On premises of card acceptor, attended
180 2: On premises of card acceptor, unattended
181 )))
182 |Pos 5: Cardholder present|0: Cardholder present
183 |Pos 6: Card present|1: Card present
Kristian Lingsom 27.1 184 |Pos 7: Card data input mode|2: Magnetic stripe read
Kristian Lingsom 26.1 185 3: Bar code
186 5: ICC
187 6: Key entered A: RFID
188 D: Magnetic stripe read following failed chip card read
189 |Pos 8: Cardholder authentication method|0: Not authenticated
190 1: PIN
191 5: Manual signature verification
192 |Pos 9: Cardholder authentication entity|0: Not authenticated
193 1: ICC
194 2: Card acceptor device 3: Authorizing Agent
195 |Pos 10: Card data output capability|1: None
196 3: ICC
197 |Pos 11: Terminal output capability|2: Printing
198 4: Printing and display
199 |Pos 12: PIN capture capability|C: Twelve characters
200
201 **P-24 FUNCTION CODE**
202
203 |=Function code|=Description
204 |101|Original authorization, amount estimated used in 1100
205 |200|Original financial request/advice Used in 1200/1220/1221
206 |201|Previously approved authorisation, amount the same Used in 1220/1221
207 |202|Previously approved authorisation, amount differs Used in 1220/1221
208 |400|Full reversal Used in 1420/1421
209 |831|Echo test Used in 1820
210
211 **P-25 MESSAGE REASON CODE**
212
213 |=reason code |=Description
214 |1003|Card issuer unabailable
215 |1004|Terminal processed
216 |1508|On-line forced by terminal
217 |4000|Customer cancellation
218 |4020|Invalid response, no action taken
219 |4021|Timeout waiting for response
220 |4351|Cancellation - unmatched signature
221
222 **P-30 ORIGINAL AMOUNT**
223
224 The original amount data element is a constructed element of two parts with a total of 24 positions:
225 a) Original amount transaction, n 12;
226 b) Original amount reconciliation, n 12.
227 Absence of data shall be indicated by zeroes. These parts shall be used when attempting to perform a partial approval and shall contain the original amounts.
228
229 **P-32 ACQUIRING INSTITUTION IDENTIFICATION CODE**
230
231 ISO 3166 - numeric country code of country where the POS transaction took place.
232
Kristian Lingsom 28.1 233 ISO numeric country code
234 578 - Norway
235 208 - Sweden
236 ??? - Danmark
237 ??? - Finland
Kristian Lingsom 26.1 238
239 **P-33 FORWARDING INSTITUTION IDENTIFICATION CODE**
240
241 10 digit code identifying the 3rd patry host. Each 3rd party integrated with PayEx will be assigned a unique code that they are to use in all messages where P-33 is specified.
242
243
244 **P-35 TRACK 2 DATA**
245
246 The information encoded on track 2 of the magnetic stripe as defined in ISO7813, excluding beginning and ending sentinels and longitudinal redundancy check characters as defined therein.
247
248 Example: 123456789012345=00112233
249
250
251 **P-38 APPROVAL CODE**
252
253 Code assigned by the authorising institution indicating approval.
254
255
256 **P-39 ACTION CODE**
257
Kristian Lingsom 27.1 258 See action code page for codes that can be returned by PayEx.
259
260
261 **P-41 Card acceptor terminal identification**
262 Needs to be unique per POS terminal at the merchant site. For Inndoor terminals use the range 1-99 and for outdoor terminals 100-199. PayEx needs to be informed of how many terminals that are installed at the merchant site.
263
264 **P-42 Card acceptor identification code**
265
266 8 digit unique ID provided by PayEx for each merchant.
267
268 **P-43 Card acceptor name/location**
269
270 The name and location of the card acceptor.
271
272 **P-48 MESSAGE CONTROL DATA ELEMENTS**
273 Used for the control of messages between the POS and the FEP. These are present in field 48 as a variable content data element. It uses a standard bit map to identify the specific data elements present in field 48. The format is LLLVAR with a maximum length of 999. The 8 byte bit map is the first item (element 48-0) in the data element.
274
275 P-48-4 BATCH/SEQUENCE NUMBER
276
277 This field identifies the transactions associated with a particular settlement period. This number starts at one and increments with each Reconciliation.
278
279 P-48-8 CUSTOMER DATA
280
281 The customer data is any data entered by the customer or cashier as required by the authorizer to complete the transaction. Transactions requiring customer data may be related to fleet fuelling, cheque authorizations or any other type of retail store management functions. Up to sixteen separate entries are supported. Each entry consists of two elements, the type of customer data entered and the variable length value of the entered data. Successive entries are separated by a back-slash (\). (Note: the LVAR method is not used for these entries.) The entire data element has a maximum length of 250 bytes and is parsed as an LLLVAR field.
282
283 |=Element|=Name|=Attribute|=Description
284 |48-8-1|Number of customer data fields|n2|Count of customer data entries to follow.Note: this value must be from 1 to 16.
285 |48-8-2|Type of customer data|an 1|Identifies the type of customer data entered. (see P48-8-2)
286 |48-8-3|Value of customer data|ans...99|Data entered by customer orcashier.
287
Kristian Lingsom 28.1 288 **P-48-8-2 TYPE OF CUSTOMER DATA**
Kristian Lingsom 27.1 289
Kristian Lingsom 28.1 290 1 - Vehicle Number
291 3 - Driver ID
292 4 - Mileage
293 5 - Driver license number
294 B - Unit number/fleet ID
295 D - Customer verification code
296 G - Alphanumeric entered data
Kristian Lingsom 27.1 297
298
Kristian Lingsom 28.1 299 The information encoded on track 2 of the magnetic stripe as defined in ISO7813, excluding beginning and ending sentinels and longitudinal redundancy check characters.**P-48-9 TRACK II OF VEHICLE CARD**
Kristian Lingsom 27.1 300
301 **P-48-14 PIN ENCRYPTION METHODOLOGY**
302
303 Fixed value ‘33’: ZKA MS/SK PAC H2H
304 When P-52 is present, this field must also be present. When field P-52 is NOT present, field 48-14 should also NOT be present.
305
306 The value supported by PayEx is ‘33’ and refers to 3DES ZKA UKPT. Other values are not supported.
307
308 The first digit (3) refers to key management type ‘ZKA UKPT’ and the second digit (3) refers to the cryptographic algorithm ‘3DES with double length key’. A double length key means 2X56 bits effective key length.
309
310
311 **P-48-32 VAT PERCENTAGES**
312
313 List of VAT codes accompanied with their corresponding VAT percentage.
314
315 The purpose of this field is to link the VAT codes as used in field P-63 Product data, P-63-8 tax code, to actual VAT percentages. As the incoming link can be multi-country, and PayEx does not have product codes per VAT rate, the VAT rates need to be provided in every transaction.
316
317 Individual items are separated with a backslash character.
318 Only VAT codes used in the product data (P-63) need to be described in this array. Others will be ignored.
319
320
321 **P-48-37 VEHICLE IDENTIFICATION ENTRY MODE**
322 Only present when a vehicle number is available (P48-8). Defines how the vehicle number was entered:
323
324 0 - Manual entry
325 1- On the Card
326 2 - Automatic Licence Plate Recognition
327
328 **P-48-38 PUMP LINKED INDICATOR**
329
Kristian Lingsom 28.1 330 Indicating whether the fuel pump reading is is linked to the payment terminal:
Kristian Lingsom 27.1 331 0 – Unspecified
332 1 – Pump-linked
333 2 – Pump not linked
334
335
336 **P-48-39 DELIVERY NOTE NUMBER**
337 Number allocated by the terminal given to the customer as printed on the ticket.
338
339 **P-49 CURRENCY CODE , TRANSACTION**
340 All transactions are in local currency, as defined during system installation. Actual value is as defined by ISO 4217.
341
342 **P-52 PIN DATA**
343 ISO 9564-1 format 0 PIN block encrypted with ZKA MK/SK PAC.
Kristian Lingsom 28.1 344
345
346 **P-53 SECURITY RELATED CONTROL INFORMATION**
347
348 |=Element|=Name|=Format|=Attribute|=Description
349 |53| |n|2|LLVAS lenght field
350 |53-1|Master key generation number|n|1|Identifies the master key generation
351 |53-2|Key version of master key|n|1|Identifes the key version
352 |53-3|MAC random value|b|16|ZKA MAC random valuse
353 |53-4|PAC random value|b|16|ZKA PAC random valuse. Zero filled if no PIN block in the message
354
355 PayEx defines the value of 53-1 and 53-2. Note that a set of different values are defined for both TEST and LIVE, and is unique for every third party (host).
356
357 For optimal security it is a good practice to use different random values for the MAC and PAC. However the security impact of having the same random number for PAC and MAC is very limited. Especially because in the MK/SK security scheme an XOR of the Master key with a fixed Control Mask is done, where the Control Mask value is different for PIN and MAC. So even if the MAC session key would be compromised the PIN session key still cannot be determined even when the same random number is used.
358
359 Important is to assure that different random numbers are used for every transaction.
360
361
Kristian Lingsom 28.2 362 **P-56 ORIGINAL DATA ELEMENTS**
363
364 Data elements of original transaction which contains the original “message identifier”, original “STAN” and original “date and time – local transaction”. This must be present if the message is preceded by an 1100 Authorisation Request, it can be omitted if the message is as a result of a store and forward transaction.
365 In Payment advice : Link to previous Authorisation dialog
366 In reversal advice : Link to previous Authorisation request or previous Payment request being reversed.
Kristian Lingsom 28.1 367
Kristian Lingsom 28.2 368
369 **P-62 PRODUCT SETS AND MESSAGE DATA**
370
371 This field contains allowed product sets and message data.
372
373 |=Number|=Name|=Format|=Attribute|=Description
374 |62| |n|3|LLLVAR length field. Sets the length of P-62 data
375 |62-1|Allowed products|ans|...99|LLVAR field, contains the products that are allowed
376 |62-2|Device text|n|1|For what device 62-3 is to be sent to
377 |62-3|Massage text|ans|...999|LLLVAR field. Display text
378
379 All subfields must be present when bit 62 is set. Field 62 shall not be sent if none of the three subfields need to be sent. If one of the subfields needs to be sent, all three subfields shall be sent.
380