Introduction Last update 2023-03-31

Parameters

Signature

All requests to the payment API must be signed using the merchant's secret key with the HMAC SHA256 algorithm. The signature should be calculated using the request payload, sorted in ascending order, and adding this result in a request header named X-Pg-Sig.

Get token

Response 200 OK - Content-Type: application/json

{
  "token": "dce5b070ba65626dccd4ad700fdf3c1d219105a1"
}
							

Create payment

Response 200 OK - Content-Type: application/json

{
  "data": {
    "service_id": "SERVICE_ID",
    "transaction_id": "b023a79c-222f-454f-9ce9-dcf9c5712f4c",
    "status": "created",
    "payment_method": "webpay",
    "amount": "3500.00",
    "currency": "CLP",
    "payment_method_url": "https://gateway.payretailers.cl/pay-direct/b023a79c-222f-454f-9ce9-dcf9c5712f4c",
    "custom": "Pago cuenta VIP",
    "customer": {
      "first_name": "Roberto",
      "last_name": "Fernandez",
      "email": "roberto@gmail.com",
      "phone": "",
      "personal_id": "",
      "country": "CL"
    },
    "redirect_urls": {
      "success_url": "http://www.mi-sitio.com/pago-ok",
      "cancel_url": "http://www.mi-sitio.com/pago-cancelado"
    }
  }
}

Get payment status

Response 200 OK - Content-Type: application/json

{
  "payment": {
    "service_id": "SERVICE_ID",
    "transaction_id": "b023a79c-222f-454f-9ce9-dcf9c5712f4c",
    "status": "completed",
    "payment_method": "webpay",
    "amount": "3500.00",
    "currency": "CLP",
    "created_at": "2021-01-02 23:11:00",
    "completed": "2021-01-02 23:13:00",
    "custom": "Pago cuenta VIP",
    "customer": {
      "first_name": "Roberto",
      "last_name": "Fernandez",
      "email": "roberto@gmail.com",
      "phone": "",
      "personal_id": "",
      "country": "CL"
    }
  }
}

Sign a request

To ensure the authenticity and data integrity of incoming requests, PayRetailers requires these requests to be signed. This signature is based on a computed Hash-based Message Authentication Code (HMAC) using the payload of a request, sorted in ascending order, and a secret key, known only to you and PayRetailers.

Before sending a request to PayRetailers, you must calculate the signature and add it in the X-Pg-Sig header. Upon receiving a request, PayRetailers calculates the same signature based on the received parameters and the stored secret key. By verifying that both signatures are the same, PayRetailers ensures that the request is not tampered with.

Enroll a card

It allows the registration of the customer's card for its later use in the commerce.

Response 200 OK - Content-Type: application/json

{
    "pg_token": "97462c4c-b807-4245-9716-d1b33acd2a5e",
    "redirect_url": "https://gatewayint.paygol.com/oneclick/session/97462c4c-b807-4245-9716-d1b33acd2a5e"
}
							

Confirm card enrollment

At the end of the registration process by the customer, he will be redirected to the URL provided by the merchant (pg_return_url) attaching the pg_token parameter. To complete the enrollment process, the merchant must make a confirmation call by sending the pg_serviceid and pg_token parameters.

Response 200 OK - Content-Type: application/json

{
    "pg_oneclick_card": "f81812f9-0e1b-4998-8dab-8c4084163eba",
    "pg_card_type": "visa",
    "pg_card_number": "XXXXXXXXXXXX9658"
}

Authorize a transaction

Once the enrollment is done, the merchant can use the pg_card parameter received in the enrollment to make transactions.

The payment process using a previously enrolled card is similar to the regular payment process used in an API integration, with the only difference that, for OneClick payments, the pg_oneclick_card parameter must also be sent.

Response 200 OK - Content-Type: application/json

{
  "data": {
    "amount": 5000,
    "currency": "CLP",
    "customer": {
      "first_name": "Roberto",
      "last_name": "Fernandez",
      "email": "user@site.cl",
      "country": "CL"
    },
    "payment_method": "oneclick",
    "status": "completed",
    "transaction_id": "2418fa18-3e38-4adf-9a4a-ba943956bd59",
  }
}

Delete an enrolled card

Allows the merchant to delete an enrolled card.

Response 200 OK - Content-Type: application/json

{
    "status": "OK"
}

List enrolled cards

Get the enrolled cards for a customer.

Response 200 OK - Content-Type: application/json

{
    "status": "OK"
}

Confirmation

If your notification script executes very complex logic or makes calls to the network, it is possible that the waiting time will expire before PayRetailers receives the reception confirmation. Ideally, your code that handles receiving notifications (acknowledging with 2xx status code) is independent of any other logic.

Handling duplicate notifications

Notification endpoints can sometimes receive the same notification more than once. This is why we recommend that you avoid duplicate notification receipts by making your event processing idempotent.

Notifications

{
    "country": "CL",
    "completed_at": "2020-11-26T16:22:32-03:00",
    "currency": "CLP",
    "created_at": "2020-11-26T16:19:27-03:00",
    "custom": "Pago cuenta VIP",
    "method": "webpay",
    "price": "7500.00",
    "service_id": "SERVICE_ID",
    "status": "completed",
    "transaction_id": "ZISS-A7Q8-RE2Z-S73W",
}
	

Internacional

Argentina

Brasil

Chile

Colombia

México

Perú