Payment Page Authorization

If you want to collect card data through a payment page, send an authorization request and then, once you've checked your inventory, send a follow-up capture request, here's what you need to do.

First, send a payment page request where, inside the doDeal command, mpiValidation is set to Verify:

<ashrait>
      <request>
          <version>2000</version>
          <language>ENG</language>
          <command>doDeal</command>
          <doDeal>
              <terminalNumber>{terminalNumber}</terminalNumber>
              <cardNo>CGMPI</cardNo>
              <total>{totalAmount}</total>
              <transactionType>Debit</transactionType>
              <creditType>RegularCredit</creditType>
              <currency>ILS</currency>
              <transactionCode>Internet</transactionCode>
              <validation>TxnSetup</validation>
              <mid>{mid}</mid>
              <uniqueid>{uniqueId}</uniqueid>
              <mpiValidation>Verify</mpiValidation>
              <successUrl>{successUrl}</successUrl>
              <errorUrl>{errorUrl}</errorUrl>
          </doDeal>
      </request>
  </ashrait>

Extract and handle the returned payment page URL as usual.

When Hyp performs a payment completion redirect, save the values of the following URL parameters:

1. cardToken

2. cardExp

3. cgUid

Take any steps you need before you're ready to charge the customer. Normally, credit card providers allow up to 5 days between authorization and capture requests, although you may want to check the exact limit with your credit card provider.

When you're ready, perform a capture request. This is a standard Hyp API request with the doDeal command payload in the int_in parameter:

<ashrait>
  <request>
      <version>2000</version>
      <language>ENG</language>
      <command>doDeal</command>
      <doDeal>
          <terminalNumber>{terminalNumber}</terminalNumber>
          <cardId>{cardToken}</cardId>
          <cardExpiration>{cardExp}</cardExpiration>
          <total>{total}</total>
          <transactionType>Debit</transactionType>
          <creditType>RegularCredit</creditType>
          <currency>ILS</currency>
          <transactionCode>Phone</transactionCode>
          <validation>AutoComm</validation>
          <cgUid>{cgUid}</cgUid>
      </doDeal>
</request>
</ashrait>

Variable parameters of the doDeal command in a capture request are:

• terminalNumber: a unique number assigned to you as a merchant during registration.

• cardId: the card token that Hyp returned as the cardToken URL parameter in the payment completion redirect following the authorization request.

• cardExpiration: the card expiration date that Hyp returned as the cardExp URL parameter in the payment completion redirect.

• cgUid: the ID that Hyp returned as the cgUid URL parameter in the payment completion redirect.

• total: the total amount to charge, which can be equal to or less than the authorized amount.

Here's a sample response for a successful capture request:

Show response

<?xml version='1.0'?>
<ashrait>
    <response>
        <command>doDeal</command>
        <dateTime>2025-08-19 20:29</dateTime>
        <requestId/>
        <tranId>119565716</tranId>
        <result>000</result>
        <message>Permitted transaction</message>
        <userMessage>Permitted transaction</userMessage>
        <additionalInfo>Host Result Local 00-SUCCESS</additionalInfo>
        <version>2000</version>
        <language>Eng</language>
        <doDeal>
            <status>000</status>
            <statusText>Permitted transaction</statusText>
            <extendedStatus/>
            <extendedStatusText/>
            <extendedUserMessage/>
            <terminalNumber>0882819014</terminalNumber>
            <cardId>1092880571131111</cardId>
            <cardBin>411111</cardBin>
            <cardMask>411111******1111</cardMask>
            <cardLength>16</cardLength>
            <cardNo>xxxxxxxxxxxx1111</cardNo>
            <cardName/>
            <cardExpiration>0328</cardExpiration>
            <cardType code="99">Foreign</cardType>
            <extendedCardType code="0">Credit</extendedCardType>
            <blockedCard/>
            <lifeStyle/>
            <customCardType/>
            <creditCompany code="0">Foreign</creditCompany>
            <cardBrand code="2">Visa</cardBrand>
            <cardAcquirer code="6">Alphacard</cardAcquirer>
            <serviceCode/>
            <transactionType code="01">RegularDebit</transactionType>
            <creditType code="1">RegularCredit</creditType>
            <currency code="1">ILS</currency>
            <baseCurrency/>
            <baseAmount/>
            <transactionCode code="52">Internet</transactionCode>
            <total>11400</total>
            <firstPayment/>
            <periodicalPayment/>
            <numberOfPayments/>
            <clubId/>
            <validation code="4">AutoComm</validation>
            <idStatus code=""/>
            <cvvStatus code=""/>
            <authSource code="3">VoiceMail</authSource>
            <authNumber>7420996</authNumber>
            <fileNumber>63</fileNumber>
            <slaveTerminalNumber>086</slaveTerminalNumber>
            <slaveTerminalSequence>451</slaveTerminalSequence>
            <eci>7</eci>
            <clientIp>84.50.146.252</clientIp>
            <email/>
            <cavv code=""/>
            <user/>
            <addonData/>
            <supplierNumber>300012</supplierNumber>
            <id/>
            <shiftId1/>
            <shiftId2/>
            <shiftId3/>
            <shiftTxnDate/>
            <cgUid>119565594</cgUid>
            <cardHash/>
            <acquirerData>
                <gateway>AshraitEmv</gateway>
                <acquirerResponseId>478808928365</acquirerResponseId>
                <mcc>4121</mcc>
                <acquirerTranType>01</acquirerTranType>
                <acquirerTranCode>52</acquirerTranCode>
            </acquirerData>
            <ashraitEmvData>
                <orgUid>25081920121808828195988</orgUid>
                <orgAuthCodeCreditCompany>1</orgAuthCodeCreditCompany>
                <orgAuthCodeAcquirer>0</orgAuthCodeAcquirer>
                <orgAuthNo>7420996</orgAuthNo>
                <orgAmount>11400</orgAmount>
                <orgTranDate>0819</orgTranDate>
                <orgCvvFlag>1</orgCvvFlag>
                <orgTranTime>201218</orgTranTime>
                <authCodeCreditCompany code="7">CreditCompanyPreAuthorized</authCodeCreditCompany>
                <uid>25081920121808828195988</uid>
                <idFlag>0</idFlag>
                <manufId>CGD</manufId>
                <catLevel>0</catLevel>
                <cvvFlag>0</cvvFlag>
                <manufUse>001101</manufUse>
                <ashVersion>x</ashVersion>
                <ashTermType>0</ashTermType>
                <deviceStatus>1111000000</deviceStatus>
                <authCodeAcquirer code="0">NoAuthNumber</authCodeAcquirer>
                <isDoReverseDeal>0</isDoReverseDeal>
                <mti>100</mti>
            </ashraitEmvData>
            <extendedTranCode/>
            <sendNotification/>
        </doDeal>
    </response>
</ashrait>