Edenred Direct Payment Services

1. Generalities

In Turkey, with the Ticket Restaurant Card, a user can spend the amount requested in the limit of the balance available on his account (i.e. balance can’t be negative) and with some daily limitations (to be detailed)

Please note that all amounts in our API are given in cents (example: 100₺ = 10000).

The regulation(s) are handled on the Edenred side.

2. User Security Tokens

Please refer to this section for more details about security tokens.

2.1. Login Process

1) To test the API in sandbox, you can get an authorization_code by following the authentication flow of the user, clicking on the link bellow:

https://sso.sbx.edenred.io/connect/authorize?response_type=code&client_id=989acfb423ba4f9f944f1819da89abe7&scope=openid%20edg-xp-mealdelivery-api%20offline_access&redirect_uri=http://nowhere.edenred.com/callback&state=abc123&nonce=456azerty&acr_values=tenant:tr-ben&ui_locales=tr

Example of account that can be used to test the flow:

  Username: edps@edps.com
  Password: 258067
  OTP: 123456

Login Page

At this step, provide the username and password of the user's account

Verify OTP code

At this step, enter the OTP

2) After login, you'll be redirected to a url like:

http://nowhere.edenred.net/oauth/callback?code={authorization_code}&...

3) Copy the authorization_code and paste it in the body of the request "Get Token by authorization_code" (in the "code" parameter) in the following collection of API calls :

Please note that an authorization_code is burned every time you try to use it. If your API call fails, you must get a new authorization_code by requesting the user to follow the authentication flow again.

2.2. Logout Process

Logout the Edenred account from your platform. All tokens are then invalid

GET /connect/endsession?id_token_hint=<idToken>=<postLogoutRedirectUri> HTTP/1.1
Host: {{authentication-URL}}

Where

'authentication-URL' = https://sso.sbx.edenred.io

And idToken is retrieved from the refreshing token response

And postLogoutRedirectUri is a callback URL whitelisted on our side (to be provided in the configuration request)

eg: postLogoutRedirectUri = http://nowhere.edenred.net/oauth/callback

3. Direct Payment API

If you use the postman collection, the access_token will automatically be placed in your HTTP. The postman configuration available here is set in auto-clearing mode. Manual clearing mode is not supported.

Token Management:

Users Management:

Transaction Management:

• Capture Mode auto:

3.1. Get Balances

Use the Get balances to get all the available user vouchers including the full sum of their values.

The Authorization header is mandatory for this request.

Please keep in mind that for {{username}} parameter, you need to retrieve the information provided in the id_token via an introspection (the data to retrieve is an ID which corresponds to an encrypted token).

Request:

 GET /v2/users/{{username}}/balances HTTP/1.1
 Host: directpayment.stg.eu.edenred.io
 Authorization: Bearer {{token}}
 X-Client-Id: {{payment-clientId}}
 X-Client-Secret: {{payment-clientSecret}}

Response:

{
  "meta": {
    "status": "succeeded",
    "messages": []
  },
  "data": {
    "available_amount": 46969,
    "product_class": "ETR",
    "currency": "TRY"
  }
}

3.2. Estimate Charge

Check if an amount can be spent and answer the possible amount that can be spent. If the requested amount is above the available balance, the service will provide the available amount in the response.

The Authorization header is mandatory for this request.

Request:

 POST /v2/users/{{username}}/actions/estimate-charge HTTP/1.1
 Host: directpayment.stg.eu.edenred.io
 Authorization: Bearer {{token}}
 Content-Type: application/json
 X-Client-Id: {{payment-clientId}}
 X-Client-Secret: {{payment-clientSecret}}

Response:

{
    "meta": {
        "status": "succeeded",
        "messages": []
    },
    "data": {
        "available_amount": 2300,
        "currency": "TRY"
    }
}

3.3. Authorize a payment

A transaction can only be processed via auto-capture mode (authorization and capture are done in the same call)

The amount must be provided in cents.

The authorization header is mandatory for this operation.

Please be advised that the order_ref field should be incremented with every request and it should contain only numbers and should be inferior to 2 147 483 647, not characters. The tstamp should be the current date and current hour of the request. (YYYY-MM-DD and hh:mm should be the same as the Turkish one, so in GMT+3).

The extra_field is composed of BatchNo|ServiceId|TerminalNo|TransactionSource|Hash.

Request:

 POST /v2/transactions HTTP/1.1
 Host: directpayment.stg.eu.edenred.io
 Authorization: Bearer {token}
 X-Client-Id: {{payment-clientId}}
 X-Client-Secret: {{payment-clientSecret}}
 Content-Type: application/json

{
    "mid": "17",
    "amount": 1,
    "security_level": "standard",
    "capture_mode": "auto",
    "order_ref": "1229192039",
    "tstamp": "2021-03-12T15:30:54Z",
    "currency": "TRY",
    "extra_field": "1000|300051|17|WCE6nGxCKdxtCR(|af8f3b39552a6eed90fe0e6a824fe48acd4d4f6cc559c117af64b4e8443394d4"
}

Response:

{
    "meta": {
        "status": "succeeded"
    },
    "data": {
        "mid": "17",
        "status": "captured",
        "authorization_id": "1229192039",
        "authorized_amount": 1,
        "capture_id": "1229192039",
        "captured_amount": 1
    }
}

3.3. Refund a transaction

This process is not supported on the local back-end

Mapped status codes