Response

Share Commerce will response different type of Pre-Auth transaction to Merchant with the status of transaction completion.

Merchant server shall examine field RespCode to determine the actual processing response of the request.

*Note, the PreAuth family actually uses TWO different response shapes, not one:

• Create (redirect) and Enquiry responses (Sections 1 and 2 below) include MaskedPAN, and their SCSign is a field embedded inside the response itself (query string or JSON body).
• Capture / Void / Capture-Void responses (Section 3 below) do NOT include MaskedPAN, and their SCSign is returned as an HTTP response header instead - never in the body.

Always check which endpoint you called before picking a field table.

1 & 2. Create (Redirect) and Enquiry Response

Legend:
M: Mandatory field.
O: Optional field. Value can be empty, but parameter must exist.

1. Sample of response (Redirect / Http GET)

    https://[MerchantRedirectUrl]?RespCode=00
        &RespDesc=Success
        &PaymentType=PREAUTH
        &MerchantID=MID0001
        &TxnRefNo=3262873184
        &CurrencyCode=MYR
        &TxnAmount=100.00
        &MerchantOrderNo=POST0001
        &MerchantOrderDesc=perfume
        &MerchantPaymentNo=AKSP172389123
        &MerchantRef1=mref1
        &MerchantRef2=mref2
        &MerchantRef3=mref3
        &CustReference=ctRefIC111
        &CustName=TomTom
        &CustEmail=tomt%40email.com
        &CustPhoneNo=01938668396
        &CustAddress1=add1
        &CustAddress2=add2
        &CustCountryCode=MY
        &CustAddressState=semenyih
        &CustAddressCity=selangor
        &CustPostcode=12345
        &PaymentMethod=CARD
        &MaskedPAN=545301XXXXXX1234
        &Versioning=2
        &TxnDateTime=2022-06-13%2015%3A49.12
        &SCSign=ec0a47f774a003842042d8be1a448ce58f026cdd6c9bb087960f400a7a65ff18

*Note, above is one line string url.

2. Sample of response (Http POST - used by Enquiry)

    {
        "RespCode": "00",
        "RespDesc": "Success",
        "PaymentType": "PREAUTH",
        "MerchantID": "MID0001",
        "TxnRefNo": "3262873184",
        "CurrencyCode": "MYR",
        "TxnAmount": 100.00,
        "MerchantOrderNo": "POST0001",
        "MerchantOderDesc": "Perfume",
        "MerchantPaymentNo": "AKSP172389123",
        "MerchantRef1": "mref1",
        "MerchantRef2": "mref2",
        "MerchantRef3": "mref3",
        "CustReference": "ctRefIC111",
        "CustName": "TomTom",
        "CustEmail": "tomt%40email.com",
        "CustPhoneNo": "01938668396",
        "CustAddress1": "add1",
        "CustAddress2": "add2",
        "CustCountryCode": "MY",
        "CustAddressState": "semenyih",
        "CustAddressCity": "selangor",
        "CustPostcode": "12345",
        "PaymentMethod": "CARD",
        "MaskedPAN": "545301XXXXXX1234",
        "Versioning": 2,
        "TxnDateTime": "2022-06-13 15:49.12",
        "SCSign": "ec0a47f774a003842042d8be1a448ce58f026cdd6c9bb087960f400a7a65ff18"
    }

*Note (Enquiry only): the response ALSO carries a second, independent SCSign as an HTTP response header - a hash of the entire JSON body above (including the SCSign field already inside it). This is in addition to, not instead of, the body's own SCSign field. Verify whichever one your integration actually reads.

SCSign Calculation (Http GET & POST, Sections 1 & 2)

SCSign generation will concat all the above Table Field's value (in sequence, excluding SCSign itself), with HMACSHA256.

1. Concat all the value (refer to Sample)

   String to sign :

   00SuccessPREAUTHMID000013262873184MYR101.50POST0001perfumeAKSP172389123mref1mref2mref3ctRefIC111TomTomtomt@email.com01938668396add1add2MYsemenyihselangor12345CARD545301XXXXXX123422022-06-13 15:49.12

2. Calculate with HMACSHA256

   Secret Key : mSuE3Ttn5B8vJhe5ncMutMLV

   SCSign : ec0a47f774a003842042d8be1a448ce58f026cdd6c9bb087960f400a7a65ff18

3. Capture / Void / Capture-Void Response

This is the shape returned by PreAuth > Capture / Sale, PreAuth > Void and Capture / Sale > Void. It does NOT include MaskedPAN, and SCSign is returned as an HTTP response header - it is never present in the JSON body.

3. Sample of response (Http POST - used by Capture / Void / Capture-Void)

    {
        "RespCode": "00",
        "RespMessage": "Success",
        "PaymentType": "PREAUTH",
        "MerchantID": "MID0001",
        "TxnRefNo": "3262873184",
        "CurrencyCode": "MYR",
        "TxnAmount": "100.00",
        "MerchantOrderNo": "POST0001",
        "MerchantOrderDesc": "Perfume",
        "MerchantPaymentNo": "AKSP172389123",
        "MerchantRef1": "mref1",
        "MerchantRef2": "mref2",
        "MerchantRef3": "mref3",
        "CustReference": "ctRefIC111",
        "CustName": "TomTom",
        "CustEmail": "[email protected]",
        "CustPhoneNo": "01938668396",
        "CustAddress1": "add1",
        "CustAddress2": "add2",
        "CustCountryCode": "MY",
        "CustAddressState": "semenyih",
        "CustAddressCity": "selangor",
        "CustPostcode": "12345",
        "PaymentMethod": "CARD",
        "Versioning": 2,
        "TxnDateTime": "2022-06-13 15:49.12"
    }

> **Response HTTP Header** : SCSign: 05401db0cb5848b8bf2cf0d66481a02a7585e36c081c47c4683ca63ed1e5f967

SCSign Calculation (Section 3)

Same convention as Sections 1 & 2 - concat all the above Table Field's value (in sequence), with HMACSHA256 - but the result is placed in the SCSign HTTP response header instead of the JSON body.

1. Concat all the value (refer to Sample)

   String to sign :

   00SuccessPREAUTHMID00013262873184MYR100.00POST0001PerfumeAKSP172389123mref1mref2mref3ctRefIC111TomTomtomt@email.com01938668396add1add2MYsemenyihselangor12345CARD22022-06-13 15:49.12

2. Calculate with HMACSHA256

   Secret Key : mSuE3Ttn5B8vJhe5ncMutMLV

   SCSign : 05401db0cb5848b8bf2cf0d66481a02a7585e36c081c47c4683ca63ed1e5f967