In this section, you'll find everything you need to manage the various entry points your application will receive during and after an Axepta BNP Paribas Online payment.

You'll learn:

• Which URLs to transmit when creating a payment,
• The order in which they are called,
• How to interpret the returned information,
• How to verify the actual status of a transaction,
• How to manage webhooks

1. Provide URLs : return, cancel, webhook

When initializing the payment, you must provide a URLs object:

2. Return URL & Cancel URL

One of these two URLs (return or cancel) will be called at the end of transaction processing to:

• Redirect the customer to the merchant's site at the end of the transaction
• Inform the merchant of the transaction status: whether it was validated or not
• Return the unique transaction identifier payId generated by Axepta Online to the merchant's back office

When either of these URLs is called, Axepta BNP Paribas Online automatically adds the parameter: PayId=<paymentId generated by Axepta> - see Integration recommendation

What to Do When You Receive This Call?

When one of these URLs is called:

1. Retrieve the PayId parameter.

2. Call the API to get the actual transaction status: GET /payments/getByPayId/{payId} - Retrieve payment details by Payment ID

3. Update your order based on the status and responseCode.

Important Fields in the API Response

• Amount: value, capturedValue, refundedValue
• Identifiers: payId, transId, xId, refNr
• Status: status = AUTHORIZED, CAPTURED, FAILED, etc.
• Result:
  • responseCode = "00000000" if successful
  • responseDescription = text message

Example Response

3. Webhook

The Webhook notification is the only reliable way to be informed of transaction completion. It is essential for the merchant site to process requests received at the Webhook URL.

This notification is sent even if the customer:

• Closes their browser,
• Loses connection,
• Doesn't return to your site.

When is it sent?

At the end of each asynchronous payment processing.

What you need to do

1. Read the JSON payload
2. Identify the transaction via payId or transId
3. Update your system
4. Respond with a 200 OK status code

Structure du webhook

Champs fournis

• merchantId
• payId
• transId
• xId
• refNr
• status (AUTHORIZED, FAILED, etc.)
• responseCode / responseDescription
• amount
• paymentMethods
• creationDate (UTC)
• channel (ECOM, MOTO, Pay By Link…)

Exemple

Sécurité et Vérification

Afin de garantir l'authenticité des données du webhook, elle sont signées avec un HMAC-SHA256.

La signature est portée par 3 header http dans le message webhook.

Signature headers

Génération de la signature (Axepta BNP-Paribas Online)

signed_payload = timestamp + "." + raw_json_body
signature = HMAC_SHA256(secret, signed_payload)

• secret – HMAC key
• La signature générée est encodé 'hex' et le header est valorisé comme suit:

X-Paygate-Signature: v1=<hex-hmac>

Vérification de la signature (Commerçant)

Pour vérifier l'authenticité des données du message webhook:

1. Extraire les données portées par les headers HTTP:

   • X-Paygate-Timestamp
   • X-Paygate-Signature
2. Prendre les données brutes de la payoad Json (les données binaire reçues)

3. Calculer le HMAC avec les données extraites

4. signed_payload = timestamp + "." + raw_body
   expected_signature = HMAC_SHA256(secret, signed_payload)
   

5. Comparer la signature calculée avec celle reçue en utilisant une méthode "constant-time"
6. Valider le webhook si
   1. Les signatures sont identiques
   2. le Timestamp est compris dans les ±5 minutes par rapport à votre horloge locale.

Recommandations d’intégration