Edenred Direct Payment Services

1. Generalities

In Luxembourg, a user can spend the exact amount requested without any limitation (apart from the balance available on his account), i.e. balance can’t be negative.

These regulations are handled on the Edenred side.

Please note that all amounts in our API are given in cents 9€ = 900

2. User Security Tokens

Please refer to this section for more details about security tokens.

2.1. Login Process

1) To test the API in sandbox, you can get an authorization_code by clicking on the link bellow:

https://sso.sbx.edenred.io/connect/authorize?response_type=code&client_id=0204fc7ab8e4437a891cb07584e240b5&scope=openid%20edg-xp-mealdelivery-api%20offline_access&redirect_uri=http://nowhere.edenred.net/oauth/callback&state=abc123&nonce=456azerty&acr_values=tenant:lu-ben-uat&ui_locales=en

Example of account that can be used to test the API:

Account: test.lux@edenred.com
Password: Secret123
Masked PAN: 4546

2) After login, you'll be redirected to a url like :

http://nowhere.edenred.net/oauth/callback?code={authorization_code}&...

3) Copy the authorization_code and use the request "Get access_token from authorization_code" in the following collection of API calls:

Please note that an authorization_code is burned every time you try to use it. If your API call fails, you must get a new authorization_code.

2.2. Logout Process

Logout the Edenred account from your platform. All tokens are then invalid

GET /connect/endsession?id_token_hint=<idToken>=<postLogoutRedirectUri> HTTP/1.1
Host: {{authentication-URL}}

Where

'authentication-URL' = sso.sbx.edenred.io

And idToken is retrieved from the refreshing token response

And postLogoutRedirectUri is a callback URL whitelisted on our side (to be provided in the configuration request)

eg: postLogoutRedirectUri = http://nowhere.edenred.net/oauth/callback

3. Direct Payment API

3.1. Postman Collection

If you use the postman collection, the access_token will automatically be placed in your HTTP Authorization header.

The postman configuration available here is set in auto-clearing mode.

Notes: You can request an access to our UAT environment in manual-clearing mode if you choose to implement the payment with Edenred this way.

3.2. User Balance

Get Balances

Gets the available user balance for the wallet enabled.

The Authorization header is mandatory for this request.

Request:

GET /v2/users/{username}/balances HTTP/1.1
Host: directpayment.stg.eu.edenred.io
 Authorization: Bearer {token}
 X-Client-Id: {payment-clientId}
 X-Client-Secret: {payment-clientSecret}

Response:

{
    "meta": {
        "status": "succeeded",
        "messages": []
    },
    "data": [
        {
            "available_amount": 4758,
            "currency": "EUR"
        }
    ]
}

Estimate Charge

Check if an amount can be spent and answer the possible amount that can be spent. If the requested amount is above the available balance, the service will provide the available amount in the response.

The Authorization header is mandatory for this request.

Request:

 POST /v2/users/{username}/actions/estimate-charge HTTP/1.1
 Host: directpayment.stg.eu.edenred.io
  Authorization: Bearer {token}
 X-Client-Id: {payment-clientId}
 X-Client-Secret: {payment-clientSecret}
 Content-Type: application/json
 {
   "amount": 2300
 }

Response:

{
    "meta": {
        "status": "succeeded",
        "messages": []
    },
    "data": {
        "available_amount": 2300,
        "currency": "EUR"
    }
}

Capture Mode: Auto

Step 1: Auto Capture a payment

An authorization with auto capture can be requested with an amount in cents of Euros (10€ = 1000).

The authorization header should be set for this operation.

The field tstamp MUST be set in order to manage idempotency

Request:

 POST /v2/transactions HTTP/1.1
 Host: directpayment.stg.eu.edenred.io
 Authorization: Bearer {token}
 X-Client-Id: {payment-clientId}
 X-Client-Secret: {payment-clientSecret}
 Content-Type: application/json

{
  "mid": "{{mid}}",
  "order_ref": "Test-01",
  "amount": 1,
  "capture_mode": "auto",
  "security_level": "standard",
  "currency": "EUR",
  "tstamp": "2022-01-10T10:31:09Z"
}

Response:

{
    "meta": {
        "status": "succeeded",
        "messages": []
    },
    "data": {
        "order_ref": "Test-01",
        "mid": "428618",
        "authorization_id": "MTY0MTgxMDY2OTQyODYxODYzMDEwMz-652612",
        "authorized_amount": 1,
        "capture_id": "MTY0MTgxMDY2OTQyODYxODYzMDEwMz-652612",
        "captured_amount": 1,
        "status": "captured"
    }
}

Step 2: Refund a captured payment

Once captured, a transaction can't be cancelled but have to be refunded.

The authorization_id provided during the payment process must be provided in this request.

The authorization header should not be set for this operation.

The field tstamp MUST be set in order to manage idempotency

Refund Request:

 POST /v2/transactions/{authorization_id}/actions/refund HTTP/1.1
 Host: directpayment.stg.eu.edenred.io
 X-Client-Id: {payment-clientId}
 X-Client-Secret: {payment-clientSecret}
 Content-Type: application/json
 {
   "amount": 1,
   "currency": "EUR",
   "tstamp": "2022-01-10T10:31:09Z"
 }

Refund Response:

{
    "meta": {
        "status": "succeeded",
        "messages": []
    },
    "data": {
        "mid": "428618",
        "refund_id": "MTY0MTgxMjQwNzQyODYxODYzMDEwMz",
        "refunded_amount": 1,
        "status": "refunded"
    }
}

4. Error Codes