Edenred Direct Payment Services

Generalities

In Brazil, a user can spend the exact amount requested, with limitations.

These regulations are handled on the Edenred side. Please note that all amounts in our API are given in centavos (example: 9BRL = 900).

Ticket Restaurant local regulation

In Brazil, for the Ticket Restaurant product, a user can :

• Perform a transaction up to 500 BRL (which meaning that a transaction of 501 BRL will be declined). Note that the amount of the transaction can't be below 0,01cts
• Perform 5 transactions per day (which mean that the 6th transaction request of the day will be declined)

Note that all those checks are performed by the local authorization platform itself. Error code related to those limits are described in the specification of the transaction processing.

Ticket Alimentaçao local regulation (for grocery players)

In Brazil, for the Ticket Alimentaçao product, a user can :

• Perform a transaction up to 2000 BRL (which meaning that a transaction of 2001 BRL will be declined). Note that the amount of the transaction can't be below 0,25cts
• Perform 5 transactions per day (which meaning that the 6th transaction request of the day will be declined)

Note that all those checks are performed by the local authorization platform itself.

User Security Tokens

Please refer to this section for more details about security tokens.

1) To test the API in sandbox, you can get an authorization_code by clicking on the link bellow:

https://sso.sbx.edenred.io/connect/authorize?response_type=code&client_id=8085b1d4894e4e0ebbbd2bfe32e903d4&scope=openid%20edg-xp-mealdelivery-api%20offline_access&redirect_uri=http://nowhere.edenred.net/oauth/callback&state=abc123&nonce=456azerty&acr_values=tenant:br-ben&ui_locales=en

Example of account that can be used to test the API:

 Username: StgEdps@Ticket.com.br
 Password: Stg@2023
 CVV: 046 (for card ending with ******6111)

Login Page

Card selector

Confirm CVV code from the back of the card

Accept Agreement

2) After login, you'll be redirected to a url like :

http://nowhere.edenred.net/?code={authorization_code}&...

3) Copy the authorization_code and use the request "Get access_token from authorization_code" in the following collection of API calls : postman collection

Please note that an authorization_code is burned every time you try to use it. If your API call fails, you must get a new authorization_code.

Logout

Logout the Edenred account from your platform. All tokens are then invalid

GET /connect/endsession?id_token_hint=<idToken>=<postLogoutRedirectUri> HTTP/1.1
Host: {{authentication-URL}}

Where

'authentication-URL' = sso.sbx.edenred.io

And idToken is retrieved from the refreshing token response

And postLogoutRedirectUri is a callback URL whitelisted on our side (to be provided in the configuration request)

eg: postLogoutRedirectUri = [http://nowhere.edenred.net/(http://nowhere.edenred.net/)

Direct Payment API

III. Direct Payment API

If you use the postman collection, the access_token will automatically be placed in your HTTP Authorization header.

Token Management:

Users Management:

Transaction Management

• Capture Mode auto:

• Capture Mode Manual:

a- Authorize > Cancel

b- Authorize > Capture > Refund

The postman configuration available here is set in auto-clearing mode => cancel and capture routes are not available.

You can request an access to our UAT environment in manual-clearing mode if you choose to implement the payment with Edenred this way.

Get Balance

Get the balance which is available on the user's account.

The authorization header is mandatory for this request.

Request:

 GET /v2/users/{username} HTTP/1.1
 Host: directpayment.stg.eu.edenred.io
 Authorization: Bearer {token}
 X-Client-Id: {payment-clientId}
 X-Client-Secret: {payment-clientSecret}

Response:

 {
  "meta": {
     "status": "succeeded",
     "messages": []
   },
  "data": {
     "available_amount": 12000,
     "currency": "BRL"
   }
 }

Estimate Charge

Check if an amount can be spent and answer the possible amount that can be spent. If the requested amount is above the available balance, the service will provide the available amount in the response.

The authorization header is mandatory for this request.

Request:

 POST /v2/users/{username}/actions/estimate-charge HTTP/1.1
 Host: directpayment.stg.eu.edenred.io
 Authorization: Bearer {token}
 X-Client-Id: {payment-clientId}
 X-Client-Secret: {payment-clientSecret}
 Content-Type: application/json
 {
   "amount": 1900
 }

Response:

 {
   "meta": {
      "status": "succeeded",
      "messages": []
    },
   "data": {
      "available_amount": 1500,
      "currency": "BRL"
    }
 }

Capture Mode - Auto

Step 1: Auto Capture a transaction

An auto capture can only be requested with an amount in cents of BRL.

The authorization header should be set for this operation.

In this mode, we can perform only the below operations:

All transactions requests must be sent with the following information to identify the merchant in the transaction : the "MID" and the corresponding "CNPJ". A check is performed during the authorization to validate that the MID belongs to the CNPJ (if not, the authorization will be declined with the reason "400 - The Merchant is invalid").

CNPJ must be provided in the body of the transaction request in the field "extra_field"

CNPJ must contain 14 digits (if CNPJ inferior to 14 digits, it must be fulfilled with “0” on the left). CNPJ must contain only numbers, no special caracters allowed such as “/” “.” or “-“

The idempotency/duplicate check is applied based on the "username / amount / MID / Date" check. Timestamp is not mandatory to trigger the idempotency/duplicate check on the Brazilian authorization platform.

Request:

 POST /v2/transactions HTTP/1.1
 Host: directpayment.stg.eu.edenred.io
 Authorization: Bearer {token}
 X-Client-Id: {payment-clientId}
 X-Client-Secret: {payment-clientSecret}
 Content-Type: application/json
 {
  "order_ref": "order-002",
  "mid": "20290",
  "extra_field"= "15596390000181",
  "amount": 1,
  "capture_mode": "auto",
  "security_mode": "standard",
  "currency": "BRL",
  "tstamp": "2019-05-23T14:02:50Z",
 }

Response:

{
   "meta": {
        "status": "succeeded",
        "messages": []
    }
    "data": {
        "order_ref": "order-002",
        "mid": "20290",
        "authorization_id": "455211",
        "authorized_amount": 1,
        "capture_id": "455211",
        "capture_amount": 1,
        "status": "captured"
    }
}

Step 2: Refund a captured transaction

Once captured, a transaction can be refunded.

The authorization_id provided during the payment process must be provided in this request.

the exact "capture_amount" must be provided in the amount field. No partial refund supported

The authorization header is not for this operation. The authorization_id is used by the platform to retrieve the existing authorization and process the enrichment of the request with the information of this transaction.

Refund Request:

 POST /v2/transactions/{authorization_id}/actions/refund HTTP/1.1
 Host: directpayment.stg.eu.edenred.io
 X-Client-Id: {payment-clientId}
 X-Client-Secret: {payment-clientSecret}
 Content-Type: application/json
 {
   "amount": 1,
   "currency": "BRL",
   "tstamp": "2019-05-23T14:02:50Z"
 }

Refund Response:

 {
   "meta": {
     "status": "succeeded",
     "messages": []
   },
   "data": {
      "refund_id": "786653",
      "refunded_amount": 1,
      "status": "refunded"
    }
 }

Capture Mode - Manual

In this mode, we can perform the below operations:

Step 1: Autorize a transaction

An authorization is requested with an amount in cents of Euros (19€ = 1900 in the request).

The authorization header should be set for this operation.

The field tstamp MUST be set in order to manage idempotency

Request:

 POST /v2/transactions HTTP/1.1
 Host: directpayment.stg.eu.edenred.io
 Authorization: Bearer {token}
 X-Client-Id: {payment-clientId}
 X-Client-Secret: {payment-clientSecret}
 Content-Type: application/json
 {
    "mid": "{{mid}}",
    "order_ref": "89364043",
    "security_level": "standard",
    "amount": 100,
    "capture_mode": "manual",
    "tstamp": "{{tstamp}}"
 }

Response:

{
    "meta": {
        "status": "succeeded",
        "messages": []
    },
    "data": {
        "order_ref": "89364043",
        "mid": "5423945122",
        "authorization_id": "f4416a5e-f7bc-4dbb-9032-ed683ee775f6",
        "authorized_amount": 100,
        "status": "authorized"
    }
}

###

Step 2.1: Cancel an authorized transaction

An authorized payment can be cancelled or captured.

Cancel and capture are for the full amount authorized

The field tstamp MUST be set in order to manage idempotency

Cancel Request:

 POST /v2/transactions/{authorization_id}/actions/cancel HTTP/1.1
 Host: directpayment.stg.eu.edenred.io
 X-Client-Id: {payment-clientId}
 X-Client-Secret: {payment-clientSecret}
 Content-Type: application/json
 {
   "amount": 100,
   "tstamp": "2019-05-21T12:10:12Z"
 }

Cancel Response:

{
    "meta": {
        "status": "succeeded",
        "messages": []
    },
    "data": {
        "mid": "5423945122",
        "cancel_id": "1c38564c-9986-4e69-b5e0-9c36c37f7cb8",
        "cancelled_amount": 100,
        "status": "cancelled"
    }
}

Step 2.2: Capture an authorized transaction

An authorized payment can be cancelled or captured.

Cancel and capture are for the full amount authorized

The field tstamp MUST be set in order to manage idempotency

Capture Request:

 POST /v2/transactions/{authorization_id}/actions/capture HTTP/1.1
 Host: directpayment.stg.eu.edenred.io
 X-Client-Id: {payment-clientId}
 X-Client-Secret: {payment-clientSecret}
 Content-Type: application/json
 {
   "amount": 100,
   "tstamp": "2019-05-21T12:15:29Z"
 }

Capture Response:

{
    "meta": {
        "status": "succeeded",
        "messages": []
    },
    "data": {
        "mid": "5423945122",
        "capture_id": "1c5743c-9986-4e69-b5e0-9c36c37f7cb8",
        "captured_amount": 100,
        "status": "captured"
    }
}

Step 3: Refund a captured transaction

Once captured, a transaction can't be cancelled but have to be refunded.

The capture_mode is mandatory in the case of dual messaging (Authorize and Capture) and must be set to "manual".

The refund can only be performed for the full amount that has been captured

The field tstamp MUST be set in order to manage idempotency

Refund Request:

 POST /v2/transactions/{authorization_id}/actions/refund HTTP/1.1
 Host: directpayment.stg.eu.edenred.io
 X-Client-Id: {payment-clientId}
 X-Client-Secret: {payment-clientSecret}
 Content-Type: application/json
 {
    "amount": 100,
    "capture_mode": "manual",
    "tstamp": "2019-05-21T12:17:53Z"
 }

Refund Response:

{
    "meta": {
        "status": "succeeded",
        "messages": []
    },
    "data": {
        "mid": "5423945122",
        "refund_id": "314f8e0f-6952-4695-91a7-4f0c11f83da6",
        "refunded_amount": 100,
        "status": "refunded"
    }
}

Mapped status codes