1. Home
2. Soluzioni di integrazione
3. Integrazioni
4. DirectLink

1. Introduction

Worldline DirectLink allows you to set up a server-to-server integration with our platform. The customer remains on a page of your own that will securely send the payment data to our servers.

You can also use DirectLink for maintenance of transactions, whether they were initiated in DirectLink or in e.g. Pagina di pagamento ospitata mode.

The graph above shows a transaction flow with DirectLink integration.

Using DirectLink, there is no contact between our system and the merchant's (your) customer. Your system transmits all the information required to make the payment directly to our system in an HTTPS POST request. Our system requests the financial transaction (synchronously or asynchronously) to the relevant acquirer and returns the response to your server in XML format. Your programme reads the response and resumes its processing. You are therefore responsible for collecting and storing your customer's confidential payment details and must guarantee the confidentiality and security of these details by means of encrypted web communication and server security. In order to store personal and card data, you need to be PCI compliant.

2. General procedures and security settings

The following general procedures and security controls are valid for all DirectLink requests: new order requests, maintenance requests and direct queries.

The graph above shows a step-by-step transaction flow with DirectLink integration.

2.1 API user

An API (Application Program Interface) user is needed to make DirectLink requests.

In general it's a user specifically designed to be used by an application to make automatic requests to the payment platform.

You can create an API user in your Worldline account via "Configuration" > "Users". Select "New user" and fill the required fields.

To make the new user an API user, make sure to enable the "Special user for API (no access to admin.)" box.

Even though various user profiles are available for an API user, we strongly recommend you to configure this user with the "Admin" profile. If you want to limit the rights for maintenance of transactions (refunds, cancellations etc.), you can still change the user profile to e.g. "Encoder". If you are not sure, we recommend you to choose the "Admin" profile, otherwise go to User profiles (User Manager) for more information. The password for an API user does not have to be changed regularly. This is more convenient when the password has to be hard-coded into your application. However, we recommend you to change the password from time to time. For more information about User types and how to change the API user's password, go to User types (User Manager).

2.2 Request form

For new order requests, maintenance requests and direct queries, you must send requests with certain parameters to specific URLs. The new order/maintenance/query parameters must be sent in a POST request as follows:

PSPID=value1&USERID=value2&PSWD=value3&…

The type/subtype indicating the Media Type in the Content-Type entity-header field in the POST request needs to be "application/x-www-form-urlencoded".

DirectLink works in “one request-one reply” mode; each payment is processed individually. Our system handles individual transaction requests via DirectLink and can work synchronously (where this option is technically supported), i.e. we wait for the bank’s reply before returning an XML response to the request.

2.3 Security

When we receive a request on our servers, we check the level of encryption and the IP address which the request was sent from.

2.3.1 Encryption

DirectLink is built on a robust, secure communication protocol. The API is a set of instructions submitted with standard HTTPS POST requests. We only allow the merchant to connect to us in secure HTTPS mode.
There is no need for a client TLS certificate.

2.3.2 SHA signature

The SHA signature is based on the principle of your (the merchant’s) server generating a unique character string for each order, hashed with the SHA-1, SHA-256 or SHA-512 algorithms. The result of this hash is then sent to us in your order request. Our system reconstructs this signature to check the integrity of the order data sent to us in the request.

Go to SHA-IN Signature (Worldline Pagina di pagamento ospitata documentation) - the principle is the same in Pagina di pagamento ospitata and DirectLink mode.

For DirectLink, the SHA-IN passphrase needs to be configured in the "Checks for DirectLink" section of the "Data and origin verification" tab in your Technical information page.

2.3.3 IP address

For each request, our system checks the IP address from which the request originates to ensure the requests are being sent from your (the merchant’s) server. In the IP address field in the "Checks for DirectLink" section of the "Data and origin verification" tab in your account's Technical Information page, you must enter the IP address(es) or IP address range(s) of the servers that send your requests.

If the originating IP address has not been declared in the given IP address field, you will receive the error message “unknown order/1/i/”. The IP address the request was sent from will also be displayed in the error message.

2.4 Response parsing

We will return an XML response to your request. Please ensure that your systems parse this XML response as tolerantly as possible to avoid issues in the future, e.g. avoid case-sensitive attribute names, do not prescribe a specific order for the attributes returned in responses, ensure that new attributes in the response will not cause issues, etc.

3. Request a new order

3.1 Request URL

• The request URL in the TEST environment is https://ogone.test.v-psp.com/ncol/test/orderdirect.asp.
• The request URL in the PRODUCTION environment is https://secure.ogone.com/ncol/prod/orderdirect.asp.

Change "test" to "prod" Replace “test” with “prod” in the request URL when you switch to your production account. If you forget to change the request URL, once you start in production with real orders, your transactions will be sent to the test environment and will not be processed by the acquirers/banks.

3.2 Request parameters

The following table contains the request parameters for sending a new order request:

Field	Description
PSPID	Your affiliation name in our system. Format: AN, 30 Mandatory
ORDERID	Your unique order number (merchant reference). Format: AN, 40 Mandatory
USERID	Name of your application (API) user. Please refer to the User Manager documentation for information on how to create an API user. Format: AN, 20 (min 2) Mandatory
PSWD	Password of the API user (USERID). Format: AN Mandatory
AMOUNT	Amount to be paid, MULTIPLIED BY 100 as the format of the amount must not contain any decimals or other separators. Format: N, 15 Mandatory
CURRENCY	ISO alpha order currency code, for example: EUR, USD, GBP, CHF, etc. Format: AN, 3 Mandatory
CARDNO	Card/account number. Format: AN, 21 Mandatory
ED	Expiry date. Format: MM/YY or //YY Mandatory
COM	Order description. Format: AN, 100 Optional
CN	Customer name. Format: AN, 35 Mandatory
EMAIL	Customer’s email address. If you are requesting 3DSv2.1,  please ensure that the format of the email is valid, otherwise the authentication process will fall back to 3DS 1.0 Format: AN, 50 Optional
SHASIGN	Signature (hashed string) to authenticate the data (see SHA-IN Signature). Format: AN, 128 Mandatory
CVC	Card Verification Code. Depending on the card brand, the verification code will be a 3- or 4-digit code on the front or rear of the card, an issue number, a start date or a date of birth. Format: N, 5 Mandatory
ECOM_PAYMENT_ CARD_VERIFICATION	Alternative to CVC: date of birth / issue number / etc. (depending on country/bank) Format: N, 5 Optional
OWNERADDRESS	Customer’s street name and number. Format: AN, 50 Optional
OWNERZIP	Customer’s postcode. Format: AN, 10 Optional
OWNERTOWN	Customer’s town/city name. Format: AN, 40 Optional
OWNERCTY	Customer’s country, e.g. BE, NL, FR, etc. Format: AN, 2 Optional
OWNERTELNO	Customer’s telephone number. Format: AN, 30 Optional
OPERATION	Defines the type of requested transaction. You can configure a default operation (payment procedure) in the "Global transaction parameters" tab, "Default operation code" section of the Technical Information page. When you send an operation value in the request, this will overwrite the default value. Possible values: RES: request for authorization SAL: request for direct sale RFD: refund, not linked to a previous payment, so not a maintenance operation on an existing transaction (you can not use this operation without specific permission from your acquirer). Optional: PAU: Request for pre-authorization: In agreement with your acquirer you can use this operation code to temporarily reserve funds on a customer's card. This is a common practice in the travel and rental industry. PAU/pre-authorization can currently only be used on MasterCard and Visa transactions and is supported by selected acquirers. This operation code cannot be set as the default in your Worldline account. Should you use PAU on transactions via acquirers or with card brands that don't support pre-authorization, these transactions will not be blocked but processed as normal (RES) authorizations. Format: A, 3 Mandatory
WITHROOT	Adds a root element to our XML response. Possible values: ‘Y’ or empty. Format: Y or <empty> Optional
REMOTE_ADDR	Customer's IP address (for Fraud Detection Module only). If a country check does not need to be performed on the IP address, send 'NONE'. Format: AN Optional
RTIMEOUT	Request timeout for the transaction (in seconds, value between 30 and 90) Important: The value you set here must be smaller than the time out value in your system (!) Format: N, 2 Optional
ECI	Electronic Commerce Indicator. You can configure a default ECI value in your account's Technical information page, "Global transaction parameters" tab, "Default ECI value" section. When you send an ECI value in the request, this will override the default ECI value. Possible (numeric) values: 0 - Swiped 1 - Manually keyed (MOTO) (card not present) 2 - Recurring (from MOTO) 3 - Instalment payments 4 - Manually keyed, card present 7 - E-commerce with SSL encryption 9 - Recurring (from e-commerce) Format: N, 2 Optional

     





If you process recurring payments, you need to add Credentials-on-file (COF) parameters to your request.

Check out our Alias Manager guide to learn everything about COF-transaction processing.


The list of possible parameters to send can be longer for merchants who have activated certain options/functionalities in their accounts. Please refer to the respective option documentation for more information on extra parameters linked to the option.

The following request parameters are mandatory in new orders:

• PSPID and USERID
• PSWD
• ORDERID
• AMOUNT (x 100)
• CURRENCY
• CARDNO
• ED
• CVC
• OPERATION

Complying with your customer’s choice of brand for co-badged cards In some cases, a credit card of an international scheme (ie Visa / MasterCard) is also issued for a second, local payment method. Such credit cards are called co-badged cards.  If you offer local payment methods on top of the international schemes, you need to offer your customers to choose between the brands a co-badged card is issued for. To do so, make sure that You have the local payment available in your Back Office in Configuration > Payment methods. If you offer Visa / MasterCard via French acquirer, we have added Card Bancaire (CB) already for you. Our customer care team is happy to assist you for adding more payment methods Your customers can choose between the brands in your web shop and that the payment form hosted on your side is adapted accordingly. Use parameters PM / BRAND to indicate your customer’s choice (You can find a list of all available values for these parameters in the Back Office).

3.3 Test page

Our test page to send order requests in DirectLink can be found here: https://ogone.test.v-psp.com/ncol/test/testodl.asp.

3.4 Excluding specific payment methods

If there are payment methods you don't want a customer to be able to pay with, you can use a parameter to do so.
This is particularly useful for sub-brands, when you want to accept a brand (e.g. MasterCard) but not one of its sub-brands (e.g. Maestro).

The parameter is the following:

Field	Usage
EXCLPMLIST	List of payment methods and/or credit card brands that should NOT be used. Values must be separated by a “;” (semicolon).

If a customer tries paying with a card linked to a payment method and/or (sub)brand thT you've excluded BY using the EXCLPMLIST parameter, the error message “Card number incorrect or incompatible” will be returned with the NCERRORPLUS return field.

3.5 Order request using 3-D Secure

Our system supports the usage of 3-D Secure with DirectLink.

Important If you wish to use 3-D Secure with DirectLink, you need to have the D3D option activated in your account. Some acquiring banks require the use of 3-D Secure. Please check with your acquirer if this is the case for you.

3.6 Split credit/debit cards

The functionality to split VISA and MasterCard into a debit and a credit payment method allows you to offer them to your customers as two different payment methods (e.g. VISA Debit and VISA Credit), or you can decide only to accept one of both split brands.

To use the split of credit and debit cards via DirectLink, you need to include the CREDITDEBIT parameter in the fields that you send to the orderdirect.asp page (and therefore also include in the SHA-IN calculation!).

Field	Format
CREDITDEBIT	"C": credit card "D": debit card

Related error: When the buyer selects the debit card method but next enters a credit card number, an error code will be returned: ‘Wrong brand/Payment method was chosen’.

If the payment is successfully processed with the CREDITDEBIT parameter, the same parameter will also be returned in the XML response, and/or can be requested with a Direct Query. However, whereas the submitted values are C or D, the return values are "CREDIT" or "DEBIT".

You will also find these return values in transaction overview via "View transactions" and "Financial history", and in reports you may download afterwards.

Configuration in your account The "split" functionality can also be activated and configured per payment method, in your Worldline account. Go to Split Credit/Debit Cards for more information.

3.7 Processing transactions with stored credentials

Check out our Alias Manager guide to learn everything about COF-transaction processing.

4. Order response

Our server returns an XML response to a request:

Example of an XML response to an order request <?xml version=”1.0”?> <ncresponse orderID=”99999” PAYID=”1111111” NCSTATUS=”0” NCERROR=”” NCERRORPLUS=”” ACCEPTANCE=”12345” STATUS=”5” ECI=”7” amount="125" currency="EUR" PM="CreditCard" BRAND="VISA"/>

The following table contains a list of the ncresponse tag attributes:

Field	Description
ACCEPTANCE	Acceptance code returned by acquirer.
amount	Order amount (not multiplied by 100).
BRAND	Card brand or similar information for other payment methods.
currency	Order currency.
ECI	Electronic Commerce Indicator.
NCERROR	Error code.
NCERRORPLUS	Explanation of the error code.
NCSTATUS	First digit of NCERROR.
orderID	Your order reference.
PAYID	Payment reference in our system.
PM	Payment method.
STATUS	Transaction status. (Possible statuses)

The attribute list may be longer for merchants who have activated certain options (e.g. the Fraud Detection) in their accounts. Please refer to the respective option documentation for further information about additional response attributes linked to the option.

4.1 Duplicate request

If you request processing for an already existing (and correctly processed) orderID, our XML response will contain the PAYID corresponding to the existing orderID, the ACCEPTANCE given by the acquirer in the previous processing, STATUS “0” and NCERROR “50001113”.

5. Direct Maintenance

A direct maintenance request from your application allows you to:

• Perform a data capture (payment) of an authorised order automatically (as opposed to manually in the back office);
• Cancel an authorisation of an order;
• Renew an authorisation of an order;
• Refund a paid order.

Data captures, authorisation cancellations and authorisation renewals are specifically for merchants who have configured their account/requests to perform the authorisation and the data capture in two steps.

5.1 Maintenance request

5.1.1 Request URL

• The request URL in the TEST environment is https://ogone.test.v-psp.com/ncol/test/maintenancedirect.asp.
• The request URL in the PRODUCTION environment is https://secure.ogone.com/ncol/prod/maintenancedirect.asp.

Change "test" to "prod" Replace “test” with “prod” in the request URL when you switch to your production account. If you forget to change the request URL, once you start working with real orders, your maintenance transactions will be sent to the test environment and will not be sent to the acquirers/banks.

5.1.2 Request parameters

The following table contains the mandatory request parameters for performing a maintenance operation:

Field	Description
AMOUNT	Order amount multiplied by 100. This is only required when the amount of the maintenance differs from the amount of the original authorisation. However, we recommend its use in all cases. Our system will check that the maintenance transaction amount is not higher than the authorisation/payment amount.
OPERATION	Possible values: REN: renewal of authorisation, if the original authorisation is no longer valid. DEL: delete authorisation, leaving the transaction open for further potential maintenance operations. DES: delete authorisation, closing the transaction after this operation. SAL: partial data capture (payment), leaving the transaction open for another potential data capture. SAS: (last) partial or full data capture (payment), closing the transaction (for further data captures) after this data capture. RFD: partial refund (on a paid order), leaving the transaction open for another potential refund. RFS: (last) partial or full refund (on a paid order), closing the transaction after this refund. Please note that with DEL and DES that not all acquirers support the deletion of an authorisation. If your acquirer does not support DEL/DES, we will nevertheless simulate the deletion of the authorisation in the back office.
ORDERID	You can send the PAYID or the orderID to identify the original order. We recommend the use of the PAYID.
PAYID
PSPID	Your account's PSPID
PSWD	Password of your API-user
SHASIGN	Signature (hashed string) to authenticate the data (see SHA-IN-signature)
USERID	Your API-user

5.2 Maintenance response

Our server returns an XML response to the maintenance request:

Example of an XML response to a direct maintenance request <?xml version=”1.0”?> <ncresponse orderID=”99999” PAYID=”1111111” PAYIDSUB=”3” NCSTATUS=”0” NCERROR=”” NCERRORPLUS=”” ACCEPTANCE=”12345” STATUS="91" amount="125" currency="EUR"/>

The following table contains a list of the ncresponse tag attributes:

Field	Description
ACCEPTANCE	Acceptance code returned by acquirer
AMOUNT	Order amount (not multiplied by 100)
CURRENCY	Order currency
NCERROR	Error code
NCERRORPLUS	Explanation of the error code
NCSTATUS	First digit of NCERROR
ORDERID	Your order reference
PAYID	Payment reference in our system
PAYIDSUB	The history level ID of the maintenance operation on the PAYID
STATUS	Transaction status (Possible statuses)

The standard ncresponse tag attributes are the same as those for the XML reply to a new order, except for the extra attribute PAYIDSUB.

5.3 Duplicate request

If maintenance is requested twice for the same order, the second request will theoretically be declined with an error “50001127” (This order is not authorised), because the initial successful transaction will have changed the order status.

6. Direct Query

A direct query request from your application allows you to query the status of an order automatically (as opposed to manually in the back office). You can only query one payment at a time, and you will only receive a limited amount of information about the order.

If you need more details about the order, you can look up the transaction in the back office or perform a manual or automatic file download (see Consult your transactions and Batch).

6.1 Query request

6.1.1 Request URL

• The request URL in the TEST environment is https://ogone.test.v-psp.com/ncol/test/querydirect.asp
• The request URL in the PRODUCTION environment is https://secure.ogone.com/ncol/prod/querydirect.asp

Change "test" to "prod" Replace “test” with “prod” in the request URL when you switch to your production account.

6.1.2 Request parameters

The following table contains the mandatory request parameters to perform a direct query:

Field	Description
ORDERID	You can send the PAYID or the ORDERID to identify the original order. We recommend the use of the PAYID.
PAYID
PAYIDSUB	You can indicate the history level ID if you use the PAYID to identify the original order (optional).
PSPID	Your account's PSPID
PSWD	Password of your API-user
USERID	Your API-user

6.1.3 Test page

You can test direct query requests here: https://ogone.test.v-psp.com/ncol/test/testdq.asp.

6.2 Query response

Our server returns an XML response to the request:

Example of an XML response to a direct query <?xml version=”1.0”?> <ncresponse orderID=”99999” PAYID=”1111111” PAYIDSUB=”3” NCSTATUS=”0” NCERROR=”” NCERRORPLUS=”” ACCEPTANCE=”12345” STATUS="9" ECI=”7” amount="125" currency="EUR" PM="CreditCard" BRAND="VISA" CARDNO="XXXXXXXXXXXX1111" IP="212.33.102.55"/>

The following table contains a list of the ncresponse tag attributes:

Field	Usage
ACCEPTANCE	Acceptance code returned by acquirer
amount	Order amount (not multiplied by 100)
BRAND	Card brand or similar information for other payment methods
CARDNO	The masked credit card number
currency	Order currency
ECI	Electronic Commerce Indicator
IP	Customer’s IP address, as detected by our system in a 3-tier integration, or sent to us by the merchant in a 2-tier integration
NCERROR	Error code
NCERRORPLUS	Explanation of the error code
NCSTATUS	First digit of NCERROR
orderID	Your order reference
PAYID	Payment reference in our system
PAYIDSUB	The history level ID of the maintenance operation on the PAYID
PM	Payment method
STATUS	Transaction status

The standard ncresponse tag attributes are identical to those for the XML reply to a new order, except for the additional attributes PAYIDSUB, CARDNO and IP.

The attribute list may be longer for merchants who have activated certain options (e.g. the Fraud Detection) in their accounts. Please refer to the respective option documentation for more information on extra response attributes linked to the option.

6.2.1 Transactions processed with Pagina di pagamento ospitata (hosted payment page)

If the transaction whose status you want to check was processed with Pagina di pagamento ospitata (hosted payment page), you may also receive the following additional attributes (providing you sent these fields with the original Pagina di pagamento ospitata transaction).

Field	Description
complus*	A value you wanted to have returned
(paramplus content)*	The parameters and their values you wanted to have returned

*Please check the Variable feedback parameters (Pagina di pagamento ospitata documentation).

Example of an XML response to a direct query for an Pagina di pagamento ospitata transaction <ncresponse orderID=”99999” PAYID=”1111111” PAYIDSUB=”3” NCSTATUS=”0” NCERROR=”” NCERRORPLUS=”” ACCEPTANCE=”12345” STATUS="9" amount="125" currency="EUR" PM="CreditCard" BRAND="VISA" CARDNO="XXXXXXXXXXXX1111" IP="212.33.102.55" COMPLUS="123456789123456789123456789" SessionID="126548354" ShopperID="73541312"/>

6.3 Possible response statuses

The STATUS field will contain the status of the transaction (see Possible statuses).

Only the following status is specifically related to the query itself:

Status	NCERROR	NCSTATUS	Description
88			The query on querydirect.asp failed

6.4 Direct Query as fallback

The response times for a DirectLink transaction request are generally a few seconds; however, some acquirers may have longer response times.

If you haven't received a response from our system after 30 seconds, you can send a request to querydirect.asp, asking for the status of your most recent transaction sent to orderdirect.asp. If you receive an immediate reply containing a non-final status for the transaction, there might be issues on the acquirer's end.

If you haven't received an answer to this direct query request after 10 seconds, there might be issues on our end. You can repeat this request to querydirect.asp every 30 seconds until you see you receive a response within 10 seconds.

Note This check system will only be able to pinpoint issues at our end if there is also a check at your end to verify that requests are leaving your servers correctly. An issue at our end will not always necessarily be caused by downtime, but could also be as a result of slow response times due to database issues for example. Please use these checks judiciously to avoid bombarding our servers with requests, otherwise we might have to restrict your access to the querydirect.asp page.

Important To protect our system from unnecessary overloads, we prohibit system-up checks which involve sending fake transactions or systematic queries, as well as systematic queries to obtain transaction feedback for each transaction.

7. Data Controller privacy policy request

Based on GDPR article 12, 13 & 14, a Data Controller has the obligation to inform its end-customers about the future processing of their personal data. Such information should be made specific based on the type of personal data to be filled-in for a specific transaction (e.g.: selected payment method, controller/processor, acquirer, fraud). The result should be available and visible at the moment of the data collection and the cardholder should be offered with a printable and downloadable version of it.

7.1 Query request

7.1.1 Request URL

• The request URL in the TEST environment is https://secure.ogone.com/ncol/test/privacy-policy.asp

Change "test" to "prod"

7.1.2 Request-parameters

The following table contains the mandatory request parameters to be sent to your customer regarding the usage of their privacy information:

Field	Format	Description
USERID	String	Your API-user
PSWD	String	Your API-user password
PSPID	String	Your account’s PSPID
BRAND	String (e.g. Visa)	Optional: Payment method brand You can send this field multiple times to get the result of several brands at once. • Sending no brand is the same as sending all your active brands. • Empty/wrong formatted brands are ignored.
LANGUAGE	ISO 639-1: Two-letter codes (e.g. FR)	Optional: The language in which you want to retrieve the text. If not provided, the text will be returned into the merchant configured language.

7.1.3 Test-page

You can test direct query requests here: https://secure.ogone.com/ncol/test/privacy-policy.asp

7.2 Query response

The following is a list of XML elements and the returned XML responses examples for different outcomes.

Name	Format	Description
Response	Complex	Root node, always present
Response.Status	String, possible values : Success, SuccessWithWarnings, Error	Always present
Response.Body	Complex	Present only when Response.Status = Success or SuccessWithWarnings
Response.Body.Html	String / html	Empty if Response.Status = SuccessWithWarnings & Response.Warnings.Warning.Code = NoContent
Response.Errors	Complex	Present only when Response.Status = Error
Response.Errors.Error	Complex	Can occur multiple times inside an <Errors> node
Response.Warnings	Complex	Present only when Response.Status = SuccessWithWarnings or Error
Response.Warnings.Warning	Complex	Occurs multiple times inside a <Warnings> node
Response.Errors.Error.Code Response.Warnings.Warning.Code	String, possible values : •Inside an <Error> node : Unauthorized, InternalServerError •Inside a <Warning> node : NoContent	Always present in an <Error> or <Warning> node
Response.Errors.Error.Message Response.Warnings.Warning.Message	String	Optional

If you face Response.Status=Error, please refer to the Response.Errors.Error to fix it.
The following are two successful examples:

1. Example of an XML response for success with warnings. This example displays if no privacy information needs to be disclosed to the customer.
   <Response>
<Status>SuccessWithWarnings</Status>
<Warnings>
<Warning>
<Code>NoContent</Code>
</Warning>
</Warnings>
<Body>
<Html/>
</Body>
</Response>
   
   
2. Example of an XML response for success with content. The example shows a 2 section display
   <?xml version="1.0" encoding="utf-8"?>
<Response>
<Status>Success</Status>
<Body>
<Html><![CDATA[<ul><li><h2>Title 1</h2><p>Content 1</p></li><li><h2>Title 2 (VISA, American Express)</h2><p>Content 2</p></li></ul>]]></Html>
</Body>
</Response>

8. Payment method exceptions

For certain payment methods, the parameter values differ from the standard credit card values.

8.1 Direct Debits

8.1.1 Direct Debits AT

The following table contains the specific parameter values allowing the transmission of Direct Debit AT transactions via DirectLink.

Field	Description	Format/Value
CARDNO	Bank account number	AN, 21 Format: XXXXXXXXXXXBLZYYYYY XXXXXXXXXXX: account number, numeric, 11 digits. YYYYY: Bank code (Bankleitzahl), 5 digits.
CN	Bank account holder’s name	AN, 35
ED	Expiry date	„99/99“ oder „9999“
OPERATION	Operation code (Action to be performed)	A, 3 Possible values: RES: authorisation SAL/SAS: debit money from the bank account RFD/RFS: refund money (*)
OWNERADDRESS	Address of the account holder	AN, 50
OWNERTOWN	City/town of the account holder	AN, 40
OWNERZIP	Postal code of the account holder	AN, 10
PM	Payment method	AN, 25 “Direct Debits AT”

_{(*If the Refund option is available and active, and DTAUS Refunds is available)}

8.1.2 Direct Debits DE (ELV)

8.1.3 Direct Debits NL

The following table contains the specific parameter values allowing the transmission of Direct Debits NL transactions via DirectLink.

Field	Description	Format/Value
CARDNO	Bank account number	Regular Dutch account number: max. 10 alphanumeric characters (if less, left pad with zeros). OR IBAN account number: max. 35 alphanumeric characters (SEPA)
CN	Bank account holder’s name	AN, 35
ED	Expiry date	„99/99“ oder „9999“
OPERATION	Operation code (Action to be performed)	A, 3 Possible values: SAL or SAS: debit money from the bank account RFD or RFS: credit money to the bank account (refund)
OWNERTOWN	City of the bank account holder	AN, 40
PM	Payment method	AN, 25 “Direct Debits NL”
Only relevant for SEPA (*) transactions:
BIC	Bank Identifier Code	AN, 11
MANDATEID	Unique mandate reference. Note: If not provided, the ORDERID will be used.	AN, 35 No spaces; cannot start or end with a forward slash "/", or contain two consecutive slashes.
SEQUENCETYPE	The Direct Debit transaction type Note: If not provided, the transactions will be considered as a “one-off” and value "OOFF" will be used.	Possible values to indicate the Direct Debit transaction type (AN, 4): "FRST": First collection of a series of Direct Debit instructions "RCUR": Direct Debit instructions where the debtor's authorisation is used for regular Direct Debit transactions initiated by the creditor "FNAL": Final collection of a series of Direct Debit instructions (afterwards same MandateID can't be used anymore) "OOFF": Direct Debit instruction where the debtor's authorisation is used to initiate one single Direct Debit transaction
SIGNDATE	Date mandate was signed by the buyer. Note: If not provided, the transaction date will be used.	YYYYMMDD

_{(*SEPA: Single Euro Payments Area)}

Note: These fields can be returned in the DirectLink XML-response and need to be included in the SHA-IN (and optionally SHA-OUT) calculation.

8.2 Payment methods with only maintenance via DirectLink

For certain payment methods (excluding credit cards), you cannot send new transactions via DirectLink, but you can send certain maintenance operations via DirectLink. This is the case for PostFinance Card, PostFinance E-finance, PayPal Express Checkout and TUNZ.

When sending maintenance operations, the PM, BRAND, CARDNO and ED fields are not required, so no specific values need to be sent for these payment methods.

9. Pagamento sicuro con 3-D Secure

Per informazioni generali su 3-D Secure v2, consulta la nostra guida a PSD2.

Scopri qui come attivare 3-D Secure in modo sicuro nel processo di pagamento.