1. Merchant should gather required data from customer from the merchant site such as customer information, Amount and Order Details.
2. MPAP has the capability to show list of available methods in the system. However, Merchant can choose specific methods to process the transaction.
3. Merchant should provide Merchant Id
4. Use trusted IPs

To authenticate REST/JSON payment requests, MPAP uses the industry-standard HTTP Basic Authentication method wherein the assigned unique id and password which are respectively specified in the service id and key or password parameters inside the request along with the signature.

The signature is assigned as the value of the signature parameter inside requests and responses as follows:

1. Concatenate all parameter values in a single string.
2. Use hyphen (-) in place of any empty values.
3. Calculate HMAC-SHA256 code for the string by using the secret key provided.
4. Convert the result to lower case.

1. Request for payment with all the required parameters is sent with the required parameters.
2. All customer data should be collected by the Merchant.
3. The Customer is redirected to a payment page.
4. The Customer to confirm the information obtained or enter additional information as required.
5. The Customer will receive an information regarding the status of the transaction.
6. The Customer will return to the merchant page.

Note:

1. The callback with payment result should be sent to the URL specified in the callback_url parameter only when payment reaches one of the final payment statuses (status = paid/fail).
2. To check the payment status, a status request is issued (Command=status in the request URL). The payment status should be provided by the payment ID on Processing side (operation_id in the payment request parameters).

• The base endpoint is: https://icoredev.tech:8835/
• All endpoints return either a JSON object or array.
• Data is returned in ascending order. Oldest first, newest last.
• All time and timestamp related fields are in milliseconds.

Method: POST

Content-Type: application/json

URL: {domain}/pay

{
“service_id”: “”,
“passwork”: “”,
“amount”: “30000”,
“currency”: “PHP”,
“operation_id”: “DEVTESTING001”,
“payment_id”: “DEVTESTING001”,
“by_method”: “bank-qr”,
“callback_url”: “http://your.site/callback”,
“return_url”: ” http://your.site/return_url”,
“signature”: “”,

“customer”: {
“account_number”: “1234567890”,
“name”: “Juan Dela Cruz”,
“email”: “juan.dela_cruz@gmail.com”,
“address”: “Manila, PH”,
“remark”: “This is a Testing.”
},

“merchant”: {
“name”: “icore”
}
}

{
“external_id”: “NDXD643288631283”,
“operation_id”: “DEVTESTING001”,
“redirect_url”: “https://payment.site/1L9PJTl”,

“operation”: {
“status”: “awaiting_redirect”,
“error_code”: null,
“error_message”: “”,
“provider_error_message”: “”
},
“request”: {
“status”: “success”,
“error_code”: 0,
“error_message”: “”
},

“signature”: “25fa1067a70247887c8d058af2078749d69820232397c189ad6d1ef6fd134ea0”
}

Method: POST

Content-Type: application/json

URL: {domain}/status