CyberSource SCMP API Payment Tokenization User Guide

Title Page
Payment Tokenization
Using the SCMP API
January 2016
CyberSource Corporation HQ | P.O. Box 8999 | San Francisco, CA 94128-8999 | Phone: 800-530-9095
CyberSource Contact Information
For general information about our company, products, and services, go to
http://www.cybersource.com.
For sales questions about any CyberSource Service, email [email protected] or
call 650-432-7350 or 888-330-2300 (toll free in the United States).
For support information about any CyberSource Service, visit the Support Center at
http://www.cybersource.com/support.
Copyright
© 2016 CyberSource Corporation. All rights reserved. CyberSource Corporation ("CyberSource") furnishes this
document and the software described in this document under the applicable agreement between the reader of
this document ("You") and CyberSource ("Agreement"). You may use this document and/or software only in
accordance with the terms of the Agreement. Except as expressly set forth in the Agreement, the information
contained in this document is subject to change without notice and therefore should not be interpreted in any way
as a guarantee or warranty by CyberSource. CyberSource assumes no responsibility or liability for any errors
that may appear in this document. The copyrighted software that accompanies this document is licensed to You
for use only in strict accordance with the Agreement. You should read the Agreement carefully before using the
software. Except as permitted by the Agreement, You may not reproduce any part of this document, store this
document in a retrieval system, or transmit this document, in any form or by any means, electronic, mechanical,
recording, or otherwise, without the prior written consent of CyberSource.
Restricted Rights Legends
For Government or defense agencies. Use, duplication, or disclosure by the Government or defense agencies
is subject to restrictions as set forth the Rights in Technical Data and Computer Software clause at DFARS
252.227-7013 and in similar clauses in the FAR and NASA FAR Supplement.
For civilian agencies. Use, reproduction, or disclosure is subject to restrictions set forth in subparagraphs (a)
through (d) of the Commercial Computer Software Restricted Rights clause at 52.227-19 and the limitations set
forth in CyberSource Corporation's standard commercial agreement for this software. Unpublished rights
reserved under the copyright laws of the United States.
Trademarks
CyberSource, The Power of Payment, CyberSource Payment Manager, CyberSource Risk Manager,
CyberSource Decision Manager, CyberSource Connect, Authorize.Net, and eCheck.net are trademarks and/or
service marks of CyberSource Corporation. All other brands and product names are trademarks or registered
trademarks of their respective owners.
2
CONTENTS
Contents
Recent Revisions to This Document
About This Guide
8
Audience and Purpose
8
Conventions 8
Note, Important, and Warning Statements
Text and Command Conventions 9
Related Documents
Customer Support
Chapter 1
Introduction
6
8
9
10
11
Terminology 11
Payment Tokenization 11
Payment Network Token 11
Profile ID 12
On-Demand Customer Profile
Secure Acceptance 13
Payment Token 13
12
Supported Processors and Payment Methods
Types of Authorizations
13
16
Authorization Consents 17
Authorization for Electronic Checks 17
Authorization for PINless Debits 17
Reporting 18
Subscription Detail Report
18
Transaction Endpoints 18
Test Card Numbers 19
Payment Tokenization Using the SCMP API | January 2016
3
Contents
Chapter 2
Requesting Payment Tokenization Services
20
Relaxed Requirements for Address Data and Expiration Date
20
Validating a Customer Profile 22
Charging a Setup Fee 22
Automatically Preauthorizing an Account 22
Manually Preauthorizing a Customer Profile 24
PINless Debit Validation 25
Creating an On-Demand Customer Profile
Credit Card without a Setup Fee 25
Credit Card with a Setup Fee 26
Including the Payment Network Token
eCheck 29
PINless Debit 30
25
27
Updating a Customer Profile 31
Updating Card Account Number 31
Removing Card Expiration Dates 32
Replacing Card Information With a Payment Network Token
Updating Payment Network Token Information 33
Replacing a Payment Network Token With Card Information
Changing the Payment Method of a Customer Profile
Requesting an On-Demand Transaction
Deleting a Customer Profile
Chapter 3
Additional Features
Optional Data Storage
34
35
36
Converting a Transaction to a Customer Profile
Retrieving a Customer Profile
32
37
38
38
39
39
Visa Bill Payment Program
Customer Profile Sharing
40
40
Account Updater 41
Account Updater Profile Update Report 42
Records in the Account Updater Profile Update Report
Header Records 43
Details Records 43
Footer Records 44
Payment Tokenization Using the SCMP API | January 2016
43
4
Contents
Appendix A API Fields
Data Types
46
46
Request Fields
Reply Fields
62
Reply Flags
71
47
AVS and CVN Codes 72
International AVS Codes 72
U.S. Domestic AVS Codes 73
CVN Codes
Appendix B Examples
74
76
Creating a Customer Profile 76
Credit Card without a Setup Fee 76
Credit Card with a 5.00 Setup Fee 77
eCheck 78
PINless 79
Updating a Customer Profile 80
Updating Card Account Number 80
Removing Card Expiration Dates 80
Retrieving a Customer Profile
Deleting a Customer Profile
81
82
Payment Tokenization Using the SCMP API | January 2016
5
REVISIONS
Recent Revisions to This
Document
Release
Changes
January 2016

Added the “Relaxed Requirements for Address Data and Expiration
Date”. See page 20.

Added the “Removing Card Expiration Dates” section. See page 32.

Added the “Removing Card Expiration Dates” example. See page 80.

Amex Direct no longer supports 0.00 preauthorizations.
September 2015
Added the “Transaction Endpoints” section. See page 18.
May 2015

Updated “Related Documents” section. See page 9.

Added the “Including the Payment Network Token” section. See page 27.

Added the “Replacing Card Information With a Payment Network Token”
section. See page 32.

Added the “Updating Payment Network Token Information” section. See
page 33.

Added the “Replacing a Payment Network Token With Card Information”
section. See page 34.

Added the following request fields (see page 47):
 cavv

e_commerce_indicator

payment_network_token_requestor_id

payment_network_token_transaction_type

ucaf_collection_indicator

xid
January 2015

Added a note to the “Manually Preauthorizing a Subscription” section.
See page 24.
December 2014

Updated the data type and length for a number of request fields. See
Table 8, page 47.

Added a number of authorization and capture reply fields. See Table 9,
page 62.

Updated the “Supported Processors and Payment Types” section. See
page 13.

Updated the “Requesting an On-Demand Transaction” section. See
page 36.

Updated the “Customer Subscription Sharing” section. See page 40.
August 2014
Payment Tokenization Using the SCMP API | January 2016
6
Recent Revisions to This Document
Payment Tokenization Using the SCMP API | January 2016
7
ABOUT GUIDE
About This Guide
Audience and Purpose
This guide is written for merchants who want to create customer payment profiles and
eliminate payment data from their network to ensure that customers’ sensitive personal
information is not compromised during a security breach. A customer’s sensitive
information is replaced with a unique identifier, known as a profile ID, which you store on
your network.
The purpose of this guide is to help you create, update, retrieve, and delete customer
profiles. It also describes how to process an on-demand transaction using a customer
profile.
Conventions
Note, Important, and Warning Statements
A Note contains helpful suggestions or references to material not contained in
the document.
Note
An Important statement contains information essential to successfully
completing a task or learning a concept.
Important
Warning
A Warning contains information or instructions, which, if not heeded, can result
in a security risk, irreversible loss of data, or significant cost in time or revenue
or both.
Payment Tokenization Using the SCMP API | January 2016
8
About This Guide
Text and Command Conventions
Convention
Usage
bold

Field and service names in text; for example:
Include the ics_pay_subscription_create field.

Items that you are instructed to act upon; for example:
Click Save.
monospace
Code examples and samples.
Related Documents
Refer to the Support Center for complete CyberSource technical documentation:
http://www.cybersource.com/support_center/support_documentation
Table 1
Related Documents
Subject
Description
Account Updater
Account Updater User Guide (PDF | HTML)—describes how to
automatically incorporate changes made to a customer’s
payment card data.
Business Center
Business Center Overview (PDF | HTML)—describes the
features and options available within the Business Center.
Credit Card
Credit Card Services Using the SCMP API (PDF | HTML)—
describes how to integrate credit card processing into your order
management system.
eCheck
Electronic Check Services Using the SCMP API (PDF |
HTML)—describes how to integrate eCheck processing into
your order management system.
Offline Transaction
Submission
Offline Transaction File Submission Implementation Guide (PDF
| HTML).
Payment Network
Tokenization
Payment Network Tokenization Using the SCMP API (PDF |
HTML)—describes how to add payment network tokenization to
an order management system that already uses CyberSource
credit card services.
PINless Debit
PINless Debit Card Services Using the SCMP API (PDF |
HTML)—describes how to integrate PINless debit processing
using the SCMP API into your order management system.
Recurring Billing
Recurring Billing Using the SCMP API (PDF | HTML)—
describes how to create customer subscriptions and process
installment or recurring payments.
Reporting
Reporting Developer Guide (PDF | HTML)—describes how to
view and configure Business Center reports.
Payment Tokenization Using the SCMP API | January 2016
9
About This Guide
Table 1
Related Documents (Continued)
Subject
Description
SCMP API

Getting Started with CyberSource Advanced for the SCMP
API (PDF | HTML)—describes how to get started using the
SCMP API.

SCMP API Documentation and Downloads page.
Secure Acceptance Silent
Order POST
Secure Acceptance Silent Order POST Development Guide
(PDF | HTML)—describes how to create a Secure Acceptance
profile and integrate seamlessly with Secure Acceptance Silent
Order POST.
Secure Acceptance Web
Mobile
Secure Acceptance Web/Mobile Configuration Guide (PDF |
HTML)—describes how to create a Secure Acceptance profile
and integrate seamlessly with Secure Acceptance Web/Mobile.
Customer Support
For support information about any CyberSource service, visit the Support Center:
http://www.cybersource.com/support
Payment Tokenization Using the SCMP API | January 2016
10
CHAPTER
Introduction
1
Terminology
Payment Tokenization
Tokenization is the process of replacing sensitive card information and billing information
with a unique identifier that cannot be reverse-engineered. The unique identifier is called a
profile ID, also known as a payment token (see page 12) which you store on your server.
Tokenization protects sensitive cardholder information in order to comply with industry
standards and government regulations and can prevent the theft of card information in
storage.
The payment tokenization solution is compatible with the Visa and MasterCard Account
Updater service. All payment information stored with CyberSource is automatically
updated by participating banks, thereby reducing payment failures. See the Account
Updater User Guide (PDF | HTML) for more information.
CyberSource payment tokenization and payment network tokenization are
different features:
Important

The CyberSource token (the profile ID) is created by CyberSource and
can be used only with CyberSource payment services.

The payment network token is created by a token service provider and
can be used throughout the financial network.
Payment Network Token
The payment network token is created by a token service provider and can be used
throughout the financial network. The payment network token replaces the primary
account number (PAN) that is stored in a customer profile. You can create a customer
profile and include the payment net token (see page 27), update the payment network
token details (see page 32), and replace a payment network token with updated card
details (see page 34).
Payment Tokenization Using the SCMP API | January 2016
11
Chapter 1
Introduction
Profile ID
Contact CyberSource Customer Support to have your account configured for a
16-digit profile ID, or to update from a 22-digit profile ID to a 16-digit profile ID.
Important
The profile ID, also known as the payment token, identifies the card and retrieves the
associated billing, shipping, and card information of a customer profile. No sensitive card
information is stored on your servers, reducing your PCI DSS obligations.
There are three types of profile IDs:

22 digit—the default profile ID.

16 digit—displays the last 4 digits of the primary account number (PAN) and passes
Luhn mod-10 checks. This profile ID is for card customer profiles.

16 digit—displays 99 as the two leading digits and passes Luhn mod-10 checks. If
your business rules prohibit using 99 as the leading digits, you must modify your
system to accept the other 16-digit profile ID.
On-Demand Customer Profile
For information about recurring and installment customer profiles, see
Recurring Billing Using the SCMP API (PDF | HTML).
Important
An on-demand customer profile contains specific information about a customer that you
store in the CyberSource database for future billing. After you create a customer profile,
the following tasks are available to you:

Update customer profile information (see page 31).

Change the payment method of a customer profile (see page 35).

Process an on-demand transaction using the customer profile details. You can
process an authorization, credit, PINless debit validate, PINless debit, eCheck credit,
and an eCheck debit (see page 37).

Retrieve customer profile information (see page 38).

Delete a customer profile (see page 38).

Share customer profiles (see page 40).
Payment Tokenization Using the SCMP API | January 2016
12
Chapter 1
Introduction
Secure Acceptance
Payment Token
If you are using Secure Acceptance to process transactions, the payment token is the
customer profile ID (see page 12). The payment token identifies the card and retrieves the
associated billing, shipping, and card information. For Secure Acceptance documentation,
see "Related Documents," page 9.
Supported Processors and
Payment Methods
Each customer profile has an associated payment method: card, eCheck, PINless debit,
or other.
Note
Important
Table 2
The other payment method enables you to store data securely in a customer
profile. This payment method is useful if you do not intend to use the customer
profile for payment transactions. You must use the CyberSource API services
to submit a customer profile request with the other payment method. See
"Optional Data Storage," page 39.
All the processors listed in the table below support automatic
preauthorizations and manual preauthorizations. Unless stated otherwise,
each processor in the table below supports 1.00 preauthorizations using all
credit card types.
Supported Processors and Payment Methods
Processor
Payment Method
AIBMS
Credit card.
American Express Brighton
Credit card.
Important Only American Express card types are supported.
Important Does not support automatic preauthorization
reversals.
American Express Direct
Debit card and pre-paid card—supports partial authorizations.
Important Only American Express card types are supported.
Asia-Mideast Processing
Credit card.
Barclays
Credit card—supports 0.00 preauthorizations for Visa and
MasterCard cards.
Payment Tokenization Using the SCMP API | January 2016
13
Chapter 1
Table 2
Introduction
Supported Processors and Payment Methods (Continued)
Processor
Payment Method
CCS (CAFIS)
Credit card.
Chase Paymentech Solutions

Credit card—supports 0.00 preauthorizations for Visa and
MasterCard cards.

Debit card and pre-paid card—supports partial
authorizations for Visa, MasterCard, American Express,
Discover, and Diners Club cards.

Electronic check.

Visa Bill Payments—see page 40.
Citibank
Credit card—supports 0.00 preauthorizations for Visa and
MasterCard cards.
CyberSource ACH Service
Electronic check.
CyberSource through VisaNet

Credit card—supports 0.00 preauthorizations for Visa and
MasterCard cards.

Credit card—supports 1.00 preauthorizations for American
Express, Discover, Diners Club, and JCB card types.

Debit card and pre-paid card—supports partial
authorizations for Visa, MasterCard, American Express,
Diners Club, JCB, and Discover cards.

Credit card—supports 0.00 preauthorizations for Visa and
MasterCard cards.

Debit card and pre-paid card—supports partial
authorizations for Visa, MasterCard, American Express, and
Discover cards.

Visa Bill Payments—see page 40.

Credit card—supports 0.00 preauthorizations for Visa and
MasterCard cards.

Debit card and pre-paid card—supports partial
authorizations for Visa, MasterCard, American Express,
Discover, Diners Club, and JCB (US Domestic) cards.

Visa Bill Payments—see page 40.

Credit card—supports 0.00 preauthorizations for Visa and
MasterCard cards.

Debit card and pre-paid card—supports partial
authorizations for Visa, MasterCard, American Express,
Discover, Diners Club, and JCB (US Domestic) cards.

Visa Bill Payments—see page 40.

Credit card—supports 0.00 preauthorizations for Visa and
MasterCard cards.

Debit card and pre-paid card—supports partial
authorizations for Visa, MasterCard, American Express,
Discover, and JCB (US Domestic) cards.
FDC Compass
FDC Nashville Global
FDMS Nashville
FDMS South
Payment Tokenization Using the SCMP API | January 2016
14
Chapter 1
Table 2
Introduction
Supported Processors and Payment Methods (Continued)
Processor
Payment Method
Global Collect
Credit card.
GPN

Credit card—supports 0.00 preauthorizations for Visa and
MasterCard cards.

Debit card and pre-paid card—supports partial
authorizations for Visa, MasterCard, American Express,
Discover, Diners Club, and JCB cards.

PINless debit.

Visa Bill Payments—see page 40.
HSBC
Credit card—supports 0.00 preauthorizations for Visa and
MasterCard cards.
Important Does not support automatic preauthorization
reversals.
Litle

Credit card—supports 0.00 preauthorizations for American
Express, Diners Club, Discover, JCB, MasterCard, and Visa
cards.

Debit card and pre-paid card—supports partial
authorizations for Visa, MasterCard, American Express,
Discover, Diners Club, and JCB cards.
LloydsTSB Cardnet
Credit card.
Moneris
Credit card—supports 0.00 preauthorizations for Visa and
MasterCard cards.
OmniPay-Ireland

Credit card—supports 0.00 preauthorizations using Visa
and MasterCard cards.

Visa Bill Payments—see page 40.

Credit card—supports 0.00 preauthorizations for Visa and
MasterCard cards.

Electronic check.
RBS WorldPay Atlanta
Streamline
Credit card—supports 0.00 preauthorizations for Visa and
MasterCard cards.
TeleCheck
Electronic check—supports 1.00 preauthorizations.
TSYS Acquiring Solutions

Credit card—supports 0.00 preauthorizations using Visa,
MasterCard, American Express, and Discover cards.

Debit card and pre-paid card—supports partial
authorizations for Visa, MasterCard, American Express,
Discover, Diners Club, and JCB cards.

Visa Bill Payments—see page 40.
Important Does not support automatic preauthorization
reversals.
Payment Tokenization Using the SCMP API | January 2016
15
Chapter 1
Introduction
Types of Authorizations
Table 3
Types of Authorizations
Authorization
Description
Automatic Preauthorization
Automatically preauthorize a credit card when you create a
customer profile, or automatically preauthorize a bank
account when you create a customer profile with new
eCheck information. See "Validating a Customer Profile,"
page 22.
Depending on the payment method and if your account is
configured for Decision Manager, CyberSource
automatically runs several fraud checks during a
preauthorization: AVS and CVN checks for cards, and
Decision Manager for cards and eChecks.
Note Partial authorizations for prepaid cards and debit
cards cannot be performed for automatic
preauthorizations.
Important Contact your merchant account provider to
determine whether you will be charged a fee for a
preauthorization.
Manual Preauthorization
Manually preauthorize a customer’s account for a nominal
or zero amount when you create a customer profile. This
feature is available only with the CyberSource API. See
"Validating a Customer Profile," page 22.
Important Contact your merchant account provider to
determine whether you will be charged a fee for a
preauthorization.
Automatic Preauthorization
Reversal
If your processor supports full authorization reversal, you
can contact CyberSource Customer Support to
automatically reverse preauthorizations when you create a
customer profile. CyberSource does not charge you for
reversing automatic preauthorizations. If you cannot create
a customer profile for any reason, or if the preauthorization
amount is 0.00, CyberSource does not reverse the
automatic preauthorization.
Important TSYS Acquiring Solutions, American Express
Brighton, and HSBC do not support automatic
preauthorization reversals.
Partial Authorization
Payment Tokenization Using the SCMP API | January 2016
When the balance on a debit card or prepaid card is lower
than the requested authorization amount, the issuing bank
can approve a partial amount.
16
Chapter 1
Introduction
Authorization Consents
Authorization for Electronic Checks
To support customer profiles that use electronic checks, you must display a separate
consent agreement accepted by the customer before you create the customer profile. The
authorization statement must:

Be readily identifiable as an authorization.

Clearly and conspicuously state its terms including the transaction amount and the
effective date of the transfer.

Include the routing number and bank account number to be debited.

Specify the frequency of the debits and the period of time during which the customer’s
payment authorization is granted.

Include instructions for revoking the authorization.
Authorization for PINless Debits
You must have a consent statement displayed on your web site or read to the customer
over the phone and accepted by the customer before you create a customer profile for
PINless debits. The authorization statement must:

Be readily identifiable as an authorization.

Clearly and conspicuously state its terms including the transaction amount and the
effective date of the transfer.

Include the account number to be debited.

Clearly indicate that the authorization is for a one-time purchase.

Include instructions for revoking the authorization.
Payment Tokenization Using the SCMP API | January 2016
17
Chapter 1
Introduction
Reporting
Subscription Detail Report
The Subscription Detail report provides detailed information about on-demand customer
profiles and their transactions.
The Subscription Detail Report is available in XML and CSV formats. You can view the
report on the Business Center, or you can use a client API to programmatically download
the report.
For a detailed description of the Subscription Detail Report, and for details about
downloading the report, see the Reporting Developer Guide (PDF | HTML).
Transaction Endpoints
Contact CyberSource Customer Support to configure your account for
Payment Tokenization.
Important
For live transactions, send requests to the production server:
http://ics2a.ic3.com
For test transactions, send requests to the test server:
http://ics2testa.ic3.com
When you use the test server, the payment method you are testing determines whether
you use test card numbers (see page 19) or test account numbers. Search for and view
your test subscriptions in the test version of the Business Center:
https://ebctest.cybersource.com
When you use the production server, the payment method you are testing determines
whether you use real card numbers or real account numbers. Create customer
subscriptions that use small amounts, such as 1.50. Search for and view your live
customer subscriptions in the production version of the Business Center:
https://ebc.cybersource.com
Payment Tokenization Using the SCMP API | January 2016
18
Chapter 1
Introduction
Test Card Numbers
You may use the following test credit card numbers for transactions:
Credit Card Type
Test Account Number
Visa
4111111111111111
MasterCard
5555555555554444
American Express
378282246310005
Discover
6011111111111117
JCB
3566111111111113
Diners Club
38000000000006
Maestro International (16 digits)
6000340000009859
Maestro Domestic (16 digits)
6759180000005546
Payment Tokenization Using the SCMP API | January 2016
19
CHAPTER
Requesting Payment
Tokenization Services
2
Contact CyberSource Customer Support to configure your account for
Payment Tokenization.
Important
Relaxed Requirements for
Address Data and Expiration Date
Services:

Authorization

On-Demand credit
Processors:

American Express Direct

Chase Paymentech Solutions

CyberSource through VisaNet

FDC Compass

FDC Nashville Global

FDMS South

Global Collect

GPN
To enable relaxed requirements for address data and expiration date, contact
CyberSource Customer Support to have your account configured for this feature.
Historically, this data was mandated by CyberSource. With the advent of digital payments
and an increasingly global e-commerce environment, CyberSource decided to relax the
requirements for address data and expiration date.
Payment Tokenization Using the SCMP API | January 2016
20
Chapter 2
Requesting Payment Tokenization Services
Relaxed requirements for address data make the following fields optional when creating
customer profiles:

bill_address1

bill_city

bill_country

bill_state

bill_zip: if you include this field in your request, you must also include bill_country.

customer_email

customer_firstname

customer_lastname
Relaxed requirements for expiration date make the following fields optional when updating
customer profiles:

customer_cc_expmo: if you include this field in your request, you must also include
customer_cc_expyr.

customer_cc_expyr: if you include this field in your request, you must also include
customer_cc_expmo.
Important
When relaxed requirements for address data and expiration date are enabled
for your CyberSource account, and your service request does not include one
or more of the fields in the preceding list, you increase the risk of declined
transactions and fraud depending on your location, your processor, and the
cardholder's issuing bank.
It is your responsibility to determine whether a field is required for the
transaction you are requesting. For example, effective October 2014, an
issuing bank can decline an authorization request for a recurring transaction
with a Visa Europe card if the expiration date is incorrect, invalid, or missing. If
you do not provide the correct expiration date for a recurring transaction the
authorization request may be declined.
Payment Tokenization Using the SCMP API | January 2016
21
Chapter 2
Requesting Payment Tokenization Services
Validating a Customer Profile
PINess debits cannot be preauthorized. You must validate the card before you
create the customer profile. See "PINless Debit Validation," page 25.
Important
Three validation methods are available to you to validate a card or eCheck customer
profile before you create it: charging a setup fee, automatically preauthorizing an account,
or manually preauthorizing an account.
Charging a Setup Fee
This fee can be charged only for card and eCheck payments. It is a one-time optional fee
that you can charge only when you are creating a customer profile. Include the setup fee
in the grand_total_amount field. See "Credit Card with a Setup Fee," page 26.
Important
CyberSource recommends that you do not enable partial authorizations for
authorizing a setup fee. If the issuing bank approves a partial amount for the
setup fee, the customer profile is not created.
Automatically Preauthorizing an Account
Only card payments and eCheck payments can be preauthorized, and CyberSource does
not charge you for this feature. Before the customer profile is created, CyberSource
authorizes a small amount against the payment method entered for the customer profile.
Each payment processor supports different preauthorization amounts, see "Payment
Tokenization," page 11.
If your account is configured for automatic preauthorizations, CyberSource automatically
runs several fraud checks during a preauthorization depending on the payment method for
the new customer profile:

AVS checks—credit card only

CVN checks—credit card only

Decision Manager—credit card and electronic checks
Payment Tokenization Using the SCMP API | January 2016
22
Chapter 2
Requesting Payment Tokenization Services
If your payment processor supports full authorization reversals you can contact
CyberSource Customer Support to automatically reverse preauthorizations. When you
create a customer profile with automatic preauthorizations and automatic preauthorization
reversals enabled, the order of services is:
1
Credit card authorization service for the preauthorization.
2
Subscription create service—only if the authorization is successful.
3
Full authorization reversal service—only if the authorization is successful and the
preauthorization amount is not 0.00.
To enable automatic preauthorizations:
Step 1
Log in to the Business Center:

Live Transactions: https://ebc.cybersource.com

Test Transactions: https://ebctest.cybersource.com
Step 2
In the left navigation pane, choose Payment Tokenization > Settings.
Step 3
Check Perform an automatic preauthorization before creating profile.
Step 4
Click Submit Changes.
To disable automatic preauthorizations:
Step 1
Request the ics_pay_subscription_create service. See "Creating an On-Demand
Customer Profile," page 25.
Step 2
In the ics_pay_subscription_create request, set the recurring_disable_auto_auth
field to Y.
Payment Tokenization Using the SCMP API | January 2016
23
Chapter 2
Requesting Payment Tokenization Services
Manually Preauthorizing a Customer Profile
This feature is available only for card payments and eCheck payments. You can manually
preauthorize a customer profile when you create a customer profile.
Important
If your processor supports full authorization reversals, and if you charged
more than 0.00 for the preauthorization, CyberSource recommends that you
subsequently request a full authorization reversal. See "Supported
Processors and Payment Methods," page 13.
To manually preauthorize a card customer profile:
Step 1
Request the ics_pay_subscription_create service. See "Credit Card without a Setup
Fee," page 25.
Step 2
Include the following fields:

ics_applications—set to ics_auth.

grand_total_amount—set to 0.00 or a small amount.
For all card type transactions on Atos and for MasterCard and American
Express transactions on FDC Nashville Global, include the following fields:
Note

e_commerce_indicator=recurring

auth_first_recurring_payment=Y

customer_cc_cv_number
See Credit Card Services Using the SCMP API (PDF | HTML) for detailed
descriptions of the above request fields.
To manually preauthorize an eCheck customer profile:
Step 1
Request the ics_pay_subscription_create service. See "eCheck," page 29.
Step 2
Include the following fields:

ics_applications—set to ics_ecp_debit.

ecp_payment_mode—set to 1.
Payment Tokenization Using the SCMP API | January 2016
24
Chapter 2
Requesting Payment Tokenization Services
PINless Debit Validation
PINless debits cannot be preauthorized. Instead, you must validate the card before you
create the customer profile.
To validate a PINless debit card you must request the ics_pinless_debit_validate
service before requesting the ics_pay_subscription_create service.
For detailed information about requesting the ics_pinless_debit_validate service, see
the PINless Debit Card Services Using the SCMP API (PDF | HTML).
Creating an On-Demand Customer
Profile
Credit Card without a Setup Fee
You must validate the customer account before the customer profile is created.
See "Validating a Customer Profile," page 22.
Important
To create a customer a profile without a setup fee:
Step 1
Set the ics_applications field to ics_pay_subscription_create.
Step 2
Include the following fields in the request:

customer_firstname

customer_lastname

bill_city

bill_country

customer_email

bill_zip

bill_state

bill_address1

customer_cc_number

card_type

customer_cc_expmo

customer_cc_expyr

merchant_id
Payment Tokenization Using the SCMP API | January 2016
25
Chapter 2

merchant_ref_number

currency

recurring_frequency—set to on-demand.
Requesting Payment Tokenization Services
See "API Fields," page 46, for detailed descriptions of the request and reply fields. See
"Examples," page 76, for a request and reply example.
Credit Card with a Setup Fee
You must validate the customer account before the customer profile is created.
See "Validating a Customer Profile," page 22.
Important
To create a customer a profile with a 5.00 setup fee:
Step 1
Set the ics_applications service field to ics_auth,ics_pay_subscription_create,ics_
bill. Authorizes the setup fee amount and captures the setup fee.
Step 2
Include the following fields in the request:

grand_total_amount—setup fee amount.

customer_firstname

customer_lastname

bill_city

bill_country

customer_email

bill_zip

bill_state

bill_address1

customer_cc_number

card_type

customer_cc_expmo

customer_cc_expyr

merchant_id

merchant_ref_number

currency

recurring_frequency—set to on-demand.
Payment Tokenization Using the SCMP API | January 2016
26
Chapter 2
Requesting Payment Tokenization Services
See "API Fields," page 46, for detailed descriptions of the request and reply fields. See
"Examples," page 76, for a request and reply example.
Including the Payment Network Token
Important
You can request an authorization before requesting a subscription create. For
the authorization request details, see Payment Network Tokenization Using the
SCMP API (HTML | PDF).
To create a customer profile including the payment network token:
Step 1
Set the ics_applications field to ics_auth,ics_pay_subscription_create.
Step 2
For Visa cards include the following fields:

e_commerce_indicator=vbv.

cavv—populate with the cryptogram value.

xid—populate with the cryptogram value.

card_type=001.
For MasterCard cards include the following fields:

e_commerce_indicator=spa.

cavv—populate with the cryptogram value.

ucaf_collection_indicator=2.

card_type=002.
For American Express cards include the following fields:
Step 3

e_commerce_indicator=aesk.

cavv—populate with block A of the cryptogram value.

xid—populate with block B of the cryptogram value.

card_type=003.
Include the following fields in the request:

customer_firstname

customer_lastname

bill_city

bill_country

customer_email

bill_zip

bill_state
Payment Tokenization Using the SCMP API | January 2016
27
Chapter 2
Requesting Payment Tokenization Services

bill_address1

customer_cc_number—populate with the network token value obtained from your
payment network token provider.

customer_cc_expmo—populate with the network token expiration month obtained
your payment network token provider.

customer_cc_expyr—populate with the network token expiration year obtained your
payment network token provider.

payment_network_token_transaction_type—set to 1.

payment_network_token_requestor_id—this field is supported only for CyberSource
through VisaNet.

merchant_id

merchant_ref_number

currency

recurring_frequency—set to on-demand.
See "API Fields," page 46, for detailed descriptions of the request and reply fields. See
"Examples," page 76, for a request and reply example.
Payment Tokenization Using the SCMP API | January 2016
28
Chapter 2
Requesting Payment Tokenization Services
eCheck
You must validate the customer account before the customer profile is created.
See "Validating a Customer Profile," page 22.
Important
To create an eCheck customer a profile:
Step 1
Set the ics_applications service field to ics_pay_subscription_create.
Step 2
Include the following fields in the request:

subscription_payment_method—set to check.

customer_firstname

customer_lastname

bill_city

bill_country

customer_email

bill_zip

bill_state

bill_address1

customer_phone—contact your payment processor representative to learn whether
this field is required or optional.

merchant_id

merchant_ref_number

currency

recurring_frequency—set to on-demand.

date_of_birth

driver_license_no—contact your TeleCheck representative to learn whether this field
is required or optional.

driver_license_state—contact your TeleCheck representative to learn whether this
field is required or optional.

bill_company_tax_id—contact your TeleCheck representative to learn whether this
field is required or optional.

ecp_account_no

ecp_account_type

ecp_rdfi

ecp_sec_code—required field if your processor is TeleCheck.—this field is required if
your processor is TeleCheck.

ecp_check_no—contact your payment processor representative to learn whether this
field is required or optional.
Payment Tokenization Using the SCMP API | January 2016
29
Chapter 2
Requesting Payment Tokenization Services
See "API Fields," page 46,for detailed descriptions of the request and reply fields. See
"Examples," page 76, for a request and reply example.
PINless Debit
You must validate the customer account before the customer profile is created.
See "PINless Debit Validation," page 25.
Important
To create a PINless debit customer profile:
Step 1
Set the ics_applications service field to ics_pay_subscription_create.
Step 2
Include the following fields in the request:

subscription_payment_method—set to pinless debit.

customer_firstname

customer_lastname

bill_city

bill_country

customer_email

bill_zip

bill_state

bill_address1

customer_cc_number

customer_cc_expmo

customer_cc_expyr

merchant_id

merchant_ref_number

currency

recurring_frequency—set to on-demand.
See "API Fields," page 46, for detailed descriptions of the request and reply fields. See
"Examples," page 76, for a request and reply example.
Payment Tokenization Using the SCMP API | January 2016
30
Chapter 2
Requesting Payment Tokenization Services
Updating a Customer Profile
Important
You can update all fields except the recurring_frequency field. If your account
is configured to use a 16-digit format-preserving profile ID (see page 12), and
you update the card number, you receive a new profile ID if the last four digits
of the new card number are different from the previous card number. The status
of the previous profile ID changes to superseded. You cannot update, delete, or
cancel a customer profile that has a status of superseded.
Updating Card Account Number
To update a customer’s card account number:
Step 1
Set the ics_applications service field to ics_pay_subscription_update.
Step 2
Include the following fields in the request:

customer_cc_number.

card_type

customer_cc_expmo—This field is optional if your CyberSource account is configured
for relaxed requirements for address data and expiration date. See "Relaxed
Requirements for Address Data and Expiration Date," page 20.

customer_cc_expyr—This field is optional if your CyberSource account is configured
for relaxed requirements for address data and expiration date. See "Relaxed
Requirements for Address Data and Expiration Date," page 20.

merchant_id

merchant_ref_number

subscription_id
Note
When you update the card number for a customer profile, CyberSource
recommends that you validate the customer profile. See "Validating a
Customer Profile," page 22. New billing and shipping information can be
included in the request.
See "API Fields," page 46, for detailed descriptions of the request and reply fields. See
"Examples," page 76, for a request and reply example.
Payment Tokenization Using the SCMP API | January 2016
31
Chapter 2
Requesting Payment Tokenization Services
Removing Card Expiration Dates
To remove a customer’s card expiration dates:
Step 1
Set the ics_applications service field to ics_pay_subscription_update.
Step 2
Include the following fields in the request:

customer_cc_expmo—include an empty value in this field.

customer_cc_expyr—include an empty value in this field.

merchant_id

merchant_ref_number

subscription_id
See "API Fields," page 46, for detailed descriptions of the request and reply fields. See
page 80 for a request and reply example.
Replacing Card Information With a Payment
Network Token
You can replace the customer’s card information, which is stored in the customer profile,
with a payment network token. For more information about payment network tokens, see
page 11.
Note
Updated billing and shipping information can also be included in the request.
To remove a value that is stored in the customer profile, include the relevant
API field in the request but do not include a value for the field.
To replace a customer’s card information with a payment network
token:
Step 1
Set the ics_applications service field to ics_pay_subscription_update.
Step 2
Include the following fields in the request:

customer_cc_number—populate with the network token value obtained from your
payment network token provider

card_type—must be 001, 002, or 003.

customer_cc_expmo—populate with the network token expiration month obtained
from your payment network token provider.

customer_cc_expyr—populate with the network token expiration year obtained from
your payment network token provider.
Payment Tokenization Using the SCMP API | January 2016
32
Chapter 2
Requesting Payment Tokenization Services

payment_network_token_transaction_type—set to 1.

payment_network_token_requestor_id—this field is supported only for CyberSource
through VisaNet.

merchant_id

merchant_ref_number

subscription_id
See "API Fields," page 46, for detailed descriptions of the request and reply fields. See
"Examples," page 76, for a request and reply example.
Updating Payment Network Token Information
You can update the payment network token information that is stored in the customer
profile. For more information about payment network tokens, see page 11.
Note
Updated billing and shipping information can also be included in the request.
To remove a value that is stored in the customer profile, include the relevant
API field in the request but do not include a value for the field.
To update a customer’s payment network token:
Step 1
Set the ics_applications service field to ics_pay_subscription_update.
Step 2
Include the following fields in the request:

customer_cc_number—populate with the network token value obtained from your
payment network token provider.

card_type—must be 001, 002, or 003.

customer_cc_expmo—populate with the network token expiration month obtained
from your payment network token provider.

customer_cc_expyr—populate with the network token expiration year obtained from
your payment network token provider.

payment_network_token_transaction_type—set to 1.

payment_network_token_requestor_id—this field is supported only for CyberSource
through VisaNet.

merchant_id

merchant_ref_number

subscription_id
Payment Tokenization Using the SCMP API | January 2016
33
Chapter 2
Requesting Payment Tokenization Services
See "API Fields," page 46, for detailed descriptions of the request and reply fields. See
"Examples," page 76, for a request and reply example.
Replacing a Payment Network Token With
Card Information
You can replace the customer’s payment network token, which is stored in the customer
profile, with the customer’s card information instead. For more information about payment
network tokens, see page 11.
Note
Updated billing and shipping information can also be included in the request.
To remove a value that is in against the customer profile, include the relevant
API field in the request but do not include a value for the field.
To update a customer’s payment network token to card information:
Step 1
Set the ics_applications service field to ics_pay_subscription_update.
Step 2
Include the following fields in the request:

customer_cc_number

card_type

customer_cc_expmo

customer_cc_expyr

payment_network_token_transaction_type—include an empty value in this field.

payment_network_token_requestor_id—include an empty value in this field.

merchant_id

merchant_ref_number

subscription_id
See "API Fields," page 46, for detailed descriptions of the request and reply fields. See
"Examples," page 76, for a request and reply example.
Payment Tokenization Using the SCMP API | January 2016
34
Chapter 2
Requesting Payment Tokenization Services
Changing the Payment Method of
a Customer Profile
Important
Note
You must validate the customer account before the customer profile is created.
See "Validating a Customer Profile," page 22. When you create a customer
profile from an existing transaction, the account is already validated.
You cannot change the payment method to or from the Other payment method.
The Other payment method enables you to store data securely in a customer
profile. This payment method is useful if you do not intend to use the customer
profile for payment transactions. See "Optional Data Storage," page 39.
To change the payment method of a customer profile:
Step 1
Set the ics_applications service field to ics_pay_subscription_update.
Step 2
Include the following fields in the request:

subscription_payment_method—change to card (see page 25), check (see page 29),
or pinless debit (see page 30).

merchant_id

merchant_ref_number

subscription_id
See "API Fields," page 46, for detailed descriptions of the request and reply fields. See
"Examples," page 76, for a request and reply example.
Payment Tokenization Using the SCMP API | January 2016
35
Chapter 2
Requesting Payment Tokenization Services
Requesting an On-Demand
Transaction
An on-demand transaction is a real-time transaction using the details stored in a customer
profile. The on-demand transactions that you can request are:

Credit cards—authorization, sale (an authorization and a capture combined), and
credit.

Electronic checks—debit and credit.

PINless debits—debit.
To request an on-demand sale transaction:
Step 1
Set the ics_applications service field to ics_auth,ics_bill.
Step 2
Include the following fields in the request:

merchant_id

merchant_ref_number

currency

grand_total_amount

subscription_id
See "API Fields," page 46, for detailed descriptions of the request and reply fields. See
"Examples," page 76, for a request and reply example.
To request an on-demand credit transaction:
Step 1
Set the ics_applications service field to ics_credit.
Step 2
Include the following fields in the request:

merchant_id

merchant_ref_number

currency

grand_total_amount

subscription_id
See "API Fields," page 46, for detailed descriptions of the request and reply fields.
Payment Tokenization Using the SCMP API | January 2016
36
Chapter 2
Requesting Payment Tokenization Services
Converting a Transaction to a
Customer Profile
Important
Note
Transaction information resides in the CyberSource database for 60 days
after the transaction is processed. When you create a customer profile from
an existing transaction, the account is already validated. You can charge a
setup fee. See "Charging a Setup Fee," page 22.
If you account is configured to use automatic preauthorizations, CyberSource
does not perform a preauthorization when you convert a transaction to a
customer profile.
To convert a transaction to a customer profile:
Step 1
Set the ics_applications field to ics_pay_subscription_create.
Step 2
Include the following fields in the request:

merchant_id

merchant_ref_number

recurring_frequency—set to on-demand.

payment_request_id—include the request ID value returned from the original
transaction request.
See "API Fields," page 46, for detailed descriptions of the request and reply fields. See
"Examples," page 76, for a request and reply example.
Payment Tokenization Using the SCMP API | January 2016
37
Chapter 2
Requesting Payment Tokenization Services
Retrieving a Customer Profile
To retrieve a customer profile:
Step 1
Set the ics_applications field to ics_pay_subscription_retrieve.
Step 2
Include the following fields in the request:

merchant_id

merchant_ref_number

subscription_id
See "API Fields," page 46,for detailed descriptions of the request and reply fields. See
"Examples," page 76, for a request and reply example.
Deleting a Customer Profile
Deleting a customer profile is permanent. When a profile is deleted, any
profiles it superseded are also deleted.
Important
To delete a customer profile:
Step 1
Set the ics_applications field to ics_pay_subscription_delete.
Step 2
Include the following fields in the request:

merchant_id

merchant_ref_number

subscription_id
See "API Fields," page 46, for detailed descriptions of the request and reply fields. See
"Examples," page 76, for a request and reply example.
Payment Tokenization Using the SCMP API | January 2016
38
CHAPTER
Additional Features
3
Optional Data Storage
Each payment method enables you to store data securely in a customer profile. If you are
using the Other payment method, you must use CyberSource API services to submit a
customer profile request. This payment method is useful if you do not intend to use the
customer profile for payment transactions.
You can include two types of data storage fields in a customer profile:

merchant_secure_data_1 to 4—CyberSource encrypts this data before storing it in
the database. The validation performed on these fields is a size check. Fields 1 to 3
are string (100) and the fourth field is string (2K). You can include any data in the
encrypted fields.

merchant_defined_data1 to 4—CyberSource does not encrypt these fields before
storing them in the database. Legal limitations exist on the type of data that you can
include in the unencrypted fields.
Warning
Note
Merchant-defined data fields are not intended to and MUST NOT be used
to capture personally identifying information. Accordingly, merchants are
prohibited from capturing, obtaining, and/or transmitting any personally
identifying information in or via the merchant-defined data fields.
Personally identifying information includes, but is not limited to, card
number, social security number, driver's license number, state-issued
identification number, passport number, and card verification numbers
(CVV, CVC2, CVV2, CID, CVN). In the event CyberSource discovers that a
merchant is capturing and/or transmitting personally identifying information
via the merchant-defined data fields, intentionally or not, CyberSource
WILL immediately suspend the merchant's account, which will result in a
rejection of any and all transaction requests submitted by the merchant
after the point of suspension.
When you create a customer profile based on an existing transaction, the
merchant-defined data fields are not transferred to the new customer
profile.
Payment Tokenization Using the SCMP API | January 2016
39
Chapter 3
Additional Features
Visa Bill Payment Program
This feature is a transaction indicator for specific authorization or credit requests that Visa
wants to differentiate from other types of purchases and credits. Customers can use their
Visa cards to pay bills, such as monthly utility bills. Visa requests that you flag the bill
payments and credits so that they can be easily identified.
When you create a customer profile using a Visa card, set the bill_payment field to Y.
This value is case sensitive.
When you process a one-time payment, set the bill_payment field to Y. This value is case
sensitive.
When you process a one-time credit, set the bill_payment field to Y. This value is case
sensitive.
For more information about the Visa Bill payment Program and the processors that
support it, see Credit Card Services Using the SCMP API (PDF | HTML).
Customer Profile Sharing
Contact CyberSource Customer Support to enable your account for profile
sharing.
Important
When you create a customer profile, your CyberSource merchant ID is associated with
that profile. You can share customer profiles among merchant IDs, and you can access
customer profiles that were created with other CyberSource merchant IDs.
You can:

Create a customer subscription by converting an existing transaction that was
processed with a CyberSource merchant ID other than your own.

Retrieve customer profile information—in your request include your merchant ID and
the profile ID of the customer profile (see page 38). If the customer profile is not
enabled for profile sharing, CyberSource returns the ESYSTEM reply flag (see
page 71).

Update customer profile information—in your request include your merchant ID and
the profile ID of the customer profile (see page 31). If the customer profile is not
enabled for profile sharing, CyberSource returns the ESYSTEM reply flag (see
page 71).
Payment Tokenization Using the SCMP API | January 2016
40
Chapter 3

Additional Features
Perform an on-demand transaction using the customer profile—in your request
include your merchant ID and the profile ID of the customer profile (see page 36). If
the customer profile is not enabled for profile sharing, CyberSource returns the
ESYSTEM reply flag (see page 71).
You cannot delete a customer profile that has a merchant ID other than your own.
Account Updater
You must comply with the Account Updater Terms of Use. See the Account
Updater User Guide (PDF | HTML).
Important
CyberSource Account Updater is integrated with the Recurring Billing functionality so that
your customer subscriptions can be kept up-to-date with the latest credit card data
changes. These changes can include a new expiration date, a new credit card number, or
a brand change such as a change from Visa to MasterCard.
You must enroll in the Visa Account Updater program and the MasterCard Automatic
Billing Updater program or both before you can use CyberSource Account Updater.
Contact your account representative to enroll in Account Updater. CyberSource will
submit enrollment forms on your behalf to both MasterCard and Visa. The enrollment
process can take up to 10 business days.
After your enrollment forms are processed, CyberSource:

Configures your account to automatically update your customer subscriptions with
updated credit card data.

Updates your customer subscriptions once per month.

Requests updates only for customer subscriptions with a status of active or on-hold.
Updates for customer subscriptions with a status of completed or cancelled cannot be
requested.
To have your customer subscriptions updated on a particular day of the month to coincide
with your billing cycle, contact Customer Support to make this request. It is best practice to
request updates for your customer subscriptions 3 to 5 days before your billing cycle
begins. You can choose any calendar day, 1 through 28.
Payment Tokenization Using the SCMP API | January 2016
41
Chapter 3
Additional Features
Account Updater Profile Update Report
From 24 to 48 hours after your scheduled customer subscription update, an Account
Updater Profile Update report is available for download. You can download the report from
the Business Center or through a query API with a client application.
To download the Profile Update report:
Step 1
In the left navigation panel, choose Reports > Report Search. The Report Search
window appears.
Step 2
From the Report drop-down list, choose All.
Step 3
From the Frequency drop-down list, choose Daily.
Step 4
Choose the day that your reports were processed.
Step 5
Click Submit. The report is listed in the Downloadable Reports table.
Step 6
Click the Download link next to the report name.
To connect to the report server, your client application must support HTTPS connections:

HTTP/1.0 or HTTP/1.1

TLS 1.2 or above
Your client application must use Basic Access Authentication to send the username and
password. Many HTTPS client libraries implement this authentication method. For more
information about Basic Access Authentication, see:
http://www.ietf.org/rfc/rfc2617.txt
To request a report, your client application must send an HTTP GET message to the
report server. Use this URL format for the request:
https://<server_name>/DownloadReport/YYYY/MM/DD/<merchant_ID>/<report_
name>.<report_format>
Table 4
Report URL Values
Variable
Description
<server_name>
Name of the server from which to download the report. Use one of these
values:

Test server: ebctest.cybersource.com/ebctest

Production server: ebc.cybersource.com/ebc
YYYY
Four-digit year.
MM
Two-digit month.
DD
Two-digit day.
<merchant_id>
CyberSource merchant ID.
Payment Tokenization Using the SCMP API | January 2016
42
Chapter 3
Table 4
Additional Features
Report URL Values (Continued)
Variable
Description
<report_name>
Name of the report to download:
<merchant_id>au.response.ss
<report_format>
Report format to download:
csv
Records in the Account Updater Profile
Update Report
Header Records
Table 5
Header Records
Order
Field Name
Description
Max. No. of
Characters
1
Record Identifier
Constant value indicating the record type.
Format: H
1
2
File Classification
Indicates file type.
Format: cybs.au.response.ss
30
3
Merchant ID
CyberSource Merchant ID.
Format: Alphanumeric
30
4
Batch ID
Unique identifier for the batch, generated by CyberSource.
Format: Numeric
30
Details Records
Table 6
Details Records
Order
Field Name
Description
Max. No. of
Characters
1
Record Identifier
Constant value indicating the record type.
Format: D
1
2
Account Updater
Request ID
Unique CyberSource identifier for the record.
Format: Numeric
30
3
Profile ID
The value that identifies the profile. CyberSource returned
this value when the profile was created.
Format: Numeric
16 or 22
Payment Tokenization Using the SCMP API | January 2016
43
Chapter 3
Table 6
Additional Features
Details Records (Continued)
Order
Field Name
Description
Max. No. of
Characters
4
New Card Number
New card number with 8 digits masked.
Format: Alphanumeric
19
If no new card number is available, this field is populated
with the current card number.
5
Response Code
Return code for the record.1
Customer profiles with a response code of ACL are moved
to a cancelled state.
Format: Alphabetic
3
6
Reason Code
Reason code for the record.1
Format: Numeric
3
7
Old Card Number
Old card number with 8 digits masked.
Format: Alphanumeric
19
8
Old Card Expiry Month
Expiration month of the old card.
Format: MM
2
9
Old Card Expiry Year
Expiration year of the old card.
Format: YY
2
10
New Card Expiry
Month
Expiration date of the new card.
Format: MM
2
11
New Card Expiry Year
Expiration year of the new card.
Format: YY
2
12
New Profile ID
The new value that identifies the customer profile. This
value supersedes the previous profile ID. CyberSource
returns this value when the profile is updated.
16
Format: Numeric
1
For more information, see the “Record Level Response Codes” and “Record Level Reason Codes” sections in the Account
Updater User Guide (PDF | HTML).
Footer Records
Table 7
Footer Records
Order
Field Name
Description
Max. No. of
Characters
1
Record Identifier
Constant value indicating the record type.
Format: F
1
2
Record Count
The number of detail records in the file.
Format: Numeric
—
Payment Tokenization Using the SCMP API | January 2016
44
Chapter 3
Table 7
Additional Features
Footer Records (Continued)
Order
Field Name
Description
Max. No. of
Characters
3
Response Code
Indicates the overall response.1
Format: Alphabetic
Possible values:
3
DEC: Declined
COM: Completed
4
Reason Code
Indicates the overall reason for the response code.1
Format: Numeric
3
1 For more information, see the “Record Level Response Codes” and “Record Level Reason Codes” sections in the Account
Updater User Guide (PDF | HTML).
Payment Tokenization Using the SCMP API | January 2016
45
APPENDIX
A
API Fields
The Payment Tokenization service names in the API field tables have been shortened:
Service name
Shortened Name
ics_pay_subscription_create
Create
ics_pay_subscription_delete
Delete
ics_pay_subscription_update
Update
ics_pay_subscription_retrieve
Retrieve
Data Types
Data Type
Description
Date and time
Format is YYYY-MM-DDThhmmssZ, where:

T separates the date and the time

Z indicates Coordinated Universal Time (UTC), which is also known as
Greenwich Mean Time
Example: 2012-08-11T224757Z equals 10:47:57 P.M. on August 11, 2012
Decimal
Number that includes a decimal point
Examples: 23.45, -0.1, 4.0, 90809.0468
Integer
Whole number {..., -3, -2, -1, 0, 1, 2, 3, ...}
Nonnegative integer
Whole number greater than or equal to zero {0, 1, 2, 3, ...}
Positive integer
Whole number greater than zero {1, 2, 3, ...}
String
Sequence of letters, numbers, spaces, and special characters
Payment Tokenization Using the SCMP API | January 2016
46
Appendix A
API Fields
Request Fields
Table 8
Request Fields
Field Name
Description
Used By &
Required (R)/
Optional (O)
Data Type
& Length
amount
Use this field with the offer0 field or use the
grand_total_amount field to specify the amount
for a setup fee or for a manual preauthorization.
These features are not available for all payment
methods. See "Charging a Setup Fee," page 22.
Create (see
description)
String (15)
First line of the billing address.
Create (R)1
bill_address1
Update (O)
Update (O)
CyberSource
through
VisaNet:
String (40)
Litle: String
(35)
Moneris:
String (50)
All other
processors:
String (60)
bill_address2
Second line of the billing address.
Create (O)
Update (O)
CyberSource
through
VisaNet:
String (40)
Litle: String
(35)
Moneris:
String (50)
All other
processors:
String (60)
bill_city
City of the billing address.
Create (R)1
String (50)
Update (O)
bill_company_tax_id
Tax identifier for the customer’s company.
Important Contact your TeleCheck
representative to find out whether this field is
required or optional.
bill_country
Country code for the shipping address. Use the
two-character ISO country codes.
Create (see
description)
Update (see
description)
Create (R)1
String with
numbers
only (9)
String (2)
Update (O)
1. This field is optional if your CyberSource account is configured for relaxed requirements for address data and expiration date.
See "Relaxed Requirements for Address Data and Expiration Date," page 20. Important It is your responsibility to determine
whether a field is required for the transaction you are requesting.
Payment Tokenization Using the SCMP API | January 2016
47
Appendix A
Table 8
API Fields
Request Fields (Continued)
Field Name
Description
Used By &
Required (R)/
Optional (O)
Data Type
& Length
bill_payment
Indicates that the payments for this customer
profile are for the Bill Payment program. See "Visa
Bill Payment Program," page 40.
Create (O)
String (1)
Update (O)
This feature applies to all transactions using this
customer profile.
Possible values:
bill_state
bill_zip

N (default): Not a Visa Bill Payment.

Y: Visa Bill Payment.
State or province in the billing address. Use the
two-character ISO state and province code.
Create (See
description)1
Important Required when the billing country is
the U.S. or Canada; otherwise, optional.
Update (O)
Postal code for the billing address. The postal
code must consist of 5 to 9 digits.
Create (R)1
If the billing country is the U.S., the 9-digit postal
code must follow this format:
[5 digits][dash][4 digits]
Example: 12345-6789
If the billing country is Canada, the 6-digit postal
code must follow this format:
[alpha][numeric][alpha][space]
[numeric][alpha][numeric]
Example: A1B 2C3
Update (O)
String (2)
CyberSource
through
VisaNet:
String (9)
All other
processors:
String (10)
1. This field is optional if your CyberSource account is configured for relaxed requirements for address data and expiration date.
See "Relaxed Requirements for Address Data and Expiration Date," page 20. Important It is your responsibility to determine
whether a field is required for the transaction you are requesting.
Payment Tokenization Using the SCMP API | January 2016
48
Appendix A
Table 8
API Fields
Request Fields (Continued)
Field Name
Description
Used By &
Required (R)/
Optional (O)
Data Type
& Length
card_type
Type of card to authorize. Possible values:
Create (R for
card payments)
String (3)
cavv

001: Visa

002: MasterCard, Eurocard—European
regional brand of MasterCard.

003: American Express

004: Discover

005: Diners Club

006: Carte Blanche

007: JCB

014: EnRoute

021: JAL

024: Maestro (UK Domestic)

031: Delta—Use this value only for Global
Collect. For other processors, use 001 for all
Visa card types.

033: Visa Electron

034: Dankort

036: Carte Bleu

037: Carta Si

042: Maestro (International)

043: GE Money UK card—before setting up
your system to work with GE Money UK cards,
contact the CyberSource UK Customer Support
group.
Visa
Cryptogram for payment network tokenization
transactions. The value for this field must be 28character base64 or 40-character hex binary. All
cryptograms use one of these formats.
American Express
Block A of the cryptogram for payment network
tokenization transactions. The value for this field
must be 28-character base64 or 40-character hex
binary. All cryptograms use one of these formats.
Update (O)
Create (Rrequired for
payment network
token
transactions with
Visa and
American
Express)
String (40)
1. This field is optional if your CyberSource account is configured for relaxed requirements for address data and expiration date.
See "Relaxed Requirements for Address Data and Expiration Date," page 20. Important It is your responsibility to determine
whether a field is required for the transaction you are requesting.
Payment Tokenization Using the SCMP API | January 2016
49
Appendix A
Table 8
API Fields
Request Fields (Continued)
Field Name
Description
Used By &
Required (R)/
Optional (O)
Data Type
& Length
comments
Optional comments you have for the customer
profile.
Create (O)
String (255)
Update (O)
Warning Do not use this field to store sensitive
customer information.
company_name
Name of the customer’s company.
Create (O)
CyberSource through VisaNet
Update (O)
String (60)
Credit card networks cannot process transactions
that contain non-ASCII characters. CyberSource
through VisaNet accepts and stores non-ASCII
characters correctly and displays them correctly in
reports. However, the limitations of the credit card
networks prevent CyberSource through VisaNet
from transmitting non-ASCII characters to the
credit card networks. Therefore, CyberSource
through VisaNet replaces non-ASCII characters
with meaningless ASCII characters for
transmission to the credit card networks.
currency
Currency used by the customer.
Create (R)
String (3)
Update (O)
customer_account_id
Your identifier for the customer.
Create (O)
String (100)
Update (O)
customer_cc_cv_
indicator
Indicates whether a card verification number was
included in the request. Possible values:

0 (default): CVN service not requested. This
default is used if you do not include customer_
cc_cv_number in the request.

1 (default): CVN service requested and
supported. This default is used if you include
customer_cc_cv_number in the request.

2: CVN on credit card is illegible.

9: CVN was not imprinted on credit card.
Create (O)
Integer (1)
1. This field is optional if your CyberSource account is configured for relaxed requirements for address data and expiration date.
See "Relaxed Requirements for Address Data and Expiration Date," page 20. Important It is your responsibility to determine
whether a field is required for the transaction you are requesting.
Payment Tokenization Using the SCMP API | January 2016
50
Appendix A
Table 8
API Fields
Request Fields (Continued)
Field Name
Description
Used By &
Required (R)/
Optional (O)
Data Type
& Length
customer_cc_cv_
number
Card verification number. Include this field only if
you are using automatic preauthorization and
want to run the CVN check. See "Validating a
Customer Profile," page 22.
Create (O)
Integer (4)
Create (R for
card payments)
String (2)
Do not include this field if you are creating a
customer profile that uses Global Collect.
customer_cc_expmo
Expiration month.
Format: MM
Update1
customer_cc_expyr
Expiration year.
Format: YYYY
FDC Nashville Global and FDMS South
Create (R for
card payments)
Update1
You can send in 2 digits or 4 digits. When you
send in 2 digits, they must be the last 2 digits of
the year.
FDC
Nashville
Global and
FDMS
South: String
(See
description)
All other
processors:
String (4)
customer_cc_issue_
number
customer_cc_number
Indicates how many times a Maestro (UK
Domestic) card has been issued to the account
holder. The card might or might not have an issue
number; the field is required if the card has an
issue number. The number can consist of one or
two digits, and the first digit might be a zero.
Include exactly what is printed on the card—a
value of 2 is different than a value of 02. Do not
include the field, even with a blank value, if the
card is not a Maestro (UK Domestic) card.
Create (see
description)
Card account number.
Create (R for
card payments)
String (5)
Update (O)
Integer (20)
Update (O)
customer_cc_startmo
Month of the start of the Maestro (UK Domestic)
card validity period. The card might or might not
have a start date printed on it; the field is required
if the card has a start date. Do not include the
field, even with a blank value, if the card is not a
Maestro (UK Domestic) card.
Create (see
description)
Integer (2)
Update (O)
Format: MM
Possible values: 01 through 12
1. This field is optional if your CyberSource account is configured for relaxed requirements for address data and expiration date.
See "Relaxed Requirements for Address Data and Expiration Date," page 20. Important It is your responsibility to determine
whether a field is required for the transaction you are requesting.
Payment Tokenization Using the SCMP API | January 2016
51
Appendix A
Table 8
API Fields
Request Fields (Continued)
Field Name
Description
Used By &
Required (R)/
Optional (O)
Data Type
& Length
customer_cc_startyr
Year of the start of the Maestro (UK Domestic)
card validity period. The card might or might not
have a start date printed on it; the field is required
if the card has a start date. Do not include the
field, even with a blank value, if the card is not a
Maestro (UK Domestic) card.
Create (see
description)
Integer (4)
Update (O)
Format: YYYY
customer_email
Customer email address.
Create (R)1
String (255)
Update (O)
customer_firstname
Customer first name.
Create (R)1
String (60)
Update (O)
customer_lastname
Customer last name.
Create (R)1
String (60)
Update (O)
customer_phone
date_of_birth
Customer phone number. When you create a
customer profile, the requirements depend on the
payment method:

Credit cards—optional.

Electronic checks—contact your payment
processor representative to find out if this field
is required or optional.

PINless debits—optional.
Create (see
description)
String (15)
Update (see
description)
Customer date of birth.
Create (O)
Format: YYYY-MM-DD or YYYYMMDD
Update (O)
String (10)
1. This field is optional if your CyberSource account is configured for relaxed requirements for address data and expiration date.
See "Relaxed Requirements for Address Data and Expiration Date," page 20. Important It is your responsibility to determine
whether a field is required for the transaction you are requesting.
Payment Tokenization Using the SCMP API | January 2016
52
Appendix A
Table 8
API Fields
Request Fields (Continued)
Field Name
Description
Used By &
Required (R)/
Optional (O)
Data Type
& Length
decision_manager_
enabled
Indicates whether to use Decision Manager for a
customer profile.
Create (O)
String (5)
Create (O)
String (255)
Create (see
description)
String (30)
Use this field only if you are using Decision
Manager and your system is configured to use
automatic preauthorizations. See "Automatically
Preauthorizing an Account," page 22.
If your account is enabled for Decision Manager,
Decision Manager is used on the preauthorization
that occurs before the customer profile is created.
You can use this field to turn off Decision Manager
for the preauthorization for this specific customer
profile. Possible values:

false: do not use Decision Manager for this
customer profile.

true (default): use Decision Manager for this
customer profile.
For more information about Decision Manager,
see the Decision Manager Developer Guide Using
the SCMP API (PDF | HTML)
decline_avs_flags
List of AVS codes that cause the customer profile
creation request to be declined for AVS reasons.
Use a space to separate the codes in the list. Use
this field only if you are using automatic
preauthorization. See "AVS and CVN Codes,"
page 72.
Important You must include the value N in the
list if you want to receive declines for the AVS
code N.
driver_license_no
Customer driver’s license number.
Important Contact your TeleCheck
representative to learn whether this field is
required or optional.
driver_license_state
State or province in which the customer’s
driver’s license was issued. Use the two-character
ISO state and province code.
Important Contact your TeleCheck
Update (see
description)
Create (see
description)
String (2)
Update (see
description)
representative to learn whether this field is
required or optional.
1. This field is optional if your CyberSource account is configured for relaxed requirements for address data and expiration date.
See "Relaxed Requirements for Address Data and Expiration Date," page 20. Important It is your responsibility to determine
whether a field is required for the transaction you are requesting.
Payment Tokenization Using the SCMP API | January 2016
53
Appendix A
Table 8
API Fields
Request Fields (Continued)
Field Name
Description
Used By &
Required (R)/
Optional (O)
Data Type
& Length
e_commerce_indicator
In-App Transactions
Type of payer authentication fields that are being
used for the payment network tokenization
transaction. Possible values:
Create (Rrequired for
payment network
token
transaction)
String (13)
Create (R for
eCheck
payments)
Integer (17)
ecp_account_no

aesk: American Express SafeKey

spa: MasterCard SecureCode

vbv: Verified by Visa
Checking account number.
Update (O)
ecp_account_type
ecp_rdfi
Checking account type. Possible values:

C: checking

S: savings (USD only)

X: corporate checking (USD only)
Bank routing number. This value is also known as
the transit number.
Create (R for
eCheck
payments)
String (1)
Update (O)
Create (R for
eCheck
payments)
Integer (9)
Update (O)
1. This field is optional if your CyberSource account is configured for relaxed requirements for address data and expiration date.
See "Relaxed Requirements for Address Data and Expiration Date," page 20. Important It is your responsibility to determine
whether a field is required for the transaction you are requesting.
Payment Tokenization Using the SCMP API | January 2016
54
Appendix A
Table 8
API Fields
Request Fields (Continued)
Field Name
Description
Used By &
Required (R)/
Optional (O)
Data Type
& Length
ecp_sec_code
Important This field is required if your processor
is TeleCheck.
Create (R)
String (3)
Update (O)
Code that specifies the authorization method for
the transaction. Possible values:
grand_total_amount

CCD: corporate cash disbursement—charge or
credit against a business checking account.
You can use one-time or recurring CCD
transactions to transfer funds to or from a
corporate entity. A standing authorization is
required for recurring transactions.

PPD: prearranged payment and deposit
entry—charge or credit against a personal
checking or savings account. You can originate
a PPD entry only when the payment and
deposit terms between you and the customer
are prearranged. A written authorization from
the customer is required for one-time
transactions and a written standing
authorization is required for recurring
transactions.

TEL: telephone-initiated entry—one-time
charge against a personal checking or savings
account. You can originate a TEL entry only
when there is a business relationship between
you and the customer or when the customer
initiates a telephone call to you. For a TEL
entry, you must obtain a payment authorization
from the customer over the telephone. There is
no recurring billing option for TEL.

WEB: internet-initiated entry—charge against a
personal checking or savings account. You can
originate a one-time or recurring WEB entry
when the customer initiates the transaction
over the Internet. For a WEB entry, you must
obtain payment authorization from the
customer over the Internet.
Use this field or use the offer0 line item field with
the amount field to specify the amount for a setup
fee or for a manual preauthorization. These
features are not available for all payment
methods. See "Validating a Customer Profile,"
page 22.
Create (see
description)
Decimal (15)
Update (O)
1. This field is optional if your CyberSource account is configured for relaxed requirements for address data and expiration date.
See "Relaxed Requirements for Address Data and Expiration Date," page 20. Important It is your responsibility to determine
whether a field is required for the transaction you are requesting.
Payment Tokenization Using the SCMP API | January 2016
55
Appendix A
Table 8
API Fields
Request Fields (Continued)
Field Name
Description
Used By &
Required (R)/
Optional (O)
Data Type
& Length
ics_applications
Comma-separated list of CyberSource services to
process.
Required for all
services
String (255)
ignore_avs
Indicates whether CyberSource should ignore the
results of the AVS check and create the customer
profile even if the credit card does not pass the
AVS check. Use this field only if you are using
automatic preauthorization. See "Automatically
Preauthorizing an Account," page 22.
Create (O)
String (5)
Create (O)
String (1)
Possible values:

true: ignore the results of the AVS check and
create the customer profile.

false (default): if the AVS check fails, do not
create the customer profile.
When this value is true, the list in the decline_
avs_flags field is ignored.
ignore_card_expiration
Indicates whether to ignore a card expiration date
when creating a subscription.
Possible values:

N: do not ignore the card expiration date.

Y: ignore the card expiration date.
Note If this field is set to Y, the recurring_
disable_auto_auth field must also be set to Y.
1. This field is optional if your CyberSource account is configured for relaxed requirements for address data and expiration date.
See "Relaxed Requirements for Address Data and Expiration Date," page 20. Important It is your responsibility to determine
whether a field is required for the transaction you are requesting.
Payment Tokenization Using the SCMP API | January 2016
56
Appendix A
Table 8
API Fields
Request Fields (Continued)
Field Name
Description
Used By &
Required (R)/
Optional (O)
Data Type
& Length
merchant_defined_
data1
Four fields that you can use to store information.
These values are displayed on the Subscription
Transaction Details page on the Business Center.
See "Optional Data Storage," page 39.
Create (O)
String (64)
merchant_defined_
data2
merchant_defined_
data3
merchant_defined_
data4
Update (O)
Warning Merchant-defined data fields are not
intended to and MUST NOT be used to capture
personally identifying information. Accordingly,
merchants are prohibited from capturing,
obtaining, and/or transmitting any personally
identifying information in or via the merchantdefined data fields. Personally identifying
information includes, but is not limited to, card
number, bank account number, social security
number, driver's license number, state-issued
identification number, passport number, and card
verification numbers (CVV, CVC2, CVV2, CID,
CVN). In the event CyberSource discovers that a
merchant is capturing and/or transmitting
personally identifying information via the
merchant-defined data fields, whether or not
intentionally, CyberSource WILL immediately
suspend the merchant's account, which will result
in a rejection of any and all transaction requests
submitted by the merchant after the point of
suspension.
Note If you are creating a customer profile based
on an existing transaction, the merchant-defined
data fields do not get transferred to the new
customer profile.
merchant_id
Your CyberSource merchant ID.
Required for all
services
String (30)
merchant_ref_number
Merchant-generated order reference or tracking
number.
Required for all
services
Asia, Middle
East, and
Africa
Gateway:
String (40)
Atos: String
(32)
All other
processors:
String (50)
1. This field is optional if your CyberSource account is configured for relaxed requirements for address data and expiration date.
See "Relaxed Requirements for Address Data and Expiration Date," page 20. Important It is your responsibility to determine
whether a field is required for the transaction you are requesting.
Payment Tokenization Using the SCMP API | January 2016
57
Appendix A
Table 8
API Fields
Request Fields (Continued)
Field Name
Description
Used By &
Required (R)/
Optional (O)
Data Type
& Length
merchant_secure_data1
Storage fields for any type of data. The only
validation performed on these fields is a size
check. The data is encrypted before it is stored in
the database. See "Optional Data Storage,"
page 39.
Create (O)
String (100)
Storage field for any type of data. The only
validation performed on this field is a size check.
The data is encrypted before it is stored in the
database. See "Optional Data Storage," page 39.
Create (O)
merchant_secure_data2
merchant_secure_data3
merchant_secure_data4
Update (O)
String (2K)
Update (O)
Note The maximum number of characters
allowed is 2071.
offer0
payment_network_
token_requestor_id
Use the offer0 line item with the amount field or
use grand_total_amount to specify the amount
for a setup fee or for a manual preauthorization.
These features are not available for all payment
methods. See "Validating a Customer Profile,"
page 22.
Create (see
description)
String (50)
Value that identifies your business and indicates
that the cardholder’s account number is
tokenized. This value is assigned by the token
service provider and is unique within the token
service provider’s database. See "Including the
Payment Network Token," page 27.
Create (O)
Integer (11)
Create (Rrequired for
payment network
token
transaction)
String (1)
Update (O)
Note This field is supported only for
CyberSource through VisaNet and FDC Nashville
Global.
payment_network_
token_transaction_type
Type of transaction that provided the token data.
This value does not specify the token service
provider; it specifies the entity that provided you
with information about the token. See "Including
the Payment Network Token," page 27.
Value:
1: In-app transaction. An application on the
customer’s mobile device provided the token data
for an e-commerce transaction.
1. This field is optional if your CyberSource account is configured for relaxed requirements for address data and expiration date.
See "Relaxed Requirements for Address Data and Expiration Date," page 20. Important It is your responsibility to determine
whether a field is required for the transaction you are requesting.
Payment Tokenization Using the SCMP API | January 2016
58
Appendix A
Table 8
API Fields
Request Fields (Continued)
Field Name
Description
Used By &
Required (R)/
Optional (O)
Data Type
& Length
payment_request_id
The request_id value returned from a previous
request for an authorization transaction. This
value links the previous request to the current
follow-on request.
Create (see
description)
String (26)
Create (see
description)
String (256)
Create (O)
String (1)
Create (R)
String (20)
String (15)
Important This field is required when you
convert an existing authorization to a customer
profile.
payment_request_
token
The request_token value returned from a
previous request for a credit card authorization.
This value links the previous request to the
current follow-on request. This field is an encoded
string that does not contain any confidential
information, such as account numbers or card
verification numbers. The string can contain up to
256 characters.
You must include this field or order_request_
token when converting an existing authorization
to a customer profile.
recurring_disable_auto
auth
Indicates whether to turn off the preauthorization
check when creating this customer profile. See
"Validating a Customer Profile," page 22.
Possible values:
recurring_frequency

N: no, go ahead and perform the
preauthorization for this customer profile.

Y: yes, turn off the preauthorization check for
this customer profile.
Frequency of payments for the customer profile.
Possible value:

on-demand: No payment schedule.
recurring_payment_
amount
Amount of the customer profile payments. This
value can be 0.
Create (O)
ship_to_address1
First line of the shipping address.
Create (O)
Update (O)
String (60)
Update (O)
ship_to_address2
Second line of the shipping address.
Create (O)
String (60)
Update (O)
ship_to_city
City of the shipping address.
Create (O)
String (50)
Update (O)
1. This field is optional if your CyberSource account is configured for relaxed requirements for address data and expiration date.
See "Relaxed Requirements for Address Data and Expiration Date," page 20. Important It is your responsibility to determine
whether a field is required for the transaction you are requesting.
Payment Tokenization Using the SCMP API | January 2016
59
Appendix A
Table 8
API Fields
Request Fields (Continued)
Field Name
Description
Used By &
Required (R)/
Optional (O)
Data Type
& Length
ship_to_company_
name
Name of the company receiving the product.
Create (O)
String (60)
ship_to_country
Country code for the shipping address. Use the
two-character ISO country codes.
Create (O)
String (2)
First name of the person receiving the product.
Create (O)
ship_to_firstname
Update (O)
String (60)
Update (O)
ship_to_lastname
Last name of the person receiving the product.
Create (O)
String (60)
Update (O)
ship_to_phone
Phone number for the shipping address.
Create (O)
String (15)
Update (O)
ship_to_state
ship_to_zip
State or province in the billing address. Use the
two-character ISO state and province code.
Create (O)
Postal code for the shipping address. The postal
code must consist of 5 to 9 digits.
Create (O)
String (2)
Update (O)
String (10)
Update (O)
If the billing country is the U.S., the 9-digit postal
code must follow this format:
[5 digits][dash][4 digits]
Example: 12345-6789
If the billing country is Canada, the 6-digit postal
code must follow this format:
[alpha][numeric][alpha][space]
[numeric][alpha][numeric]
Example: A1B 2C3
If the postal code for the shipping address is not
included in the request message, CyberSource
uses the postal code for the billing address. If the
postal code for the billing address is not included
in the request message, the postal code for the
shipping address is required.
subscription_id
Value that identifies the customer profile for which
the service is being requested. This value is sent
to you when the customer profile is created. See
"Profile ID," page 12.
Update (R)
String (26)
Retrieve (R)
1. This field is optional if your CyberSource account is configured for relaxed requirements for address data and expiration date.
See "Relaxed Requirements for Address Data and Expiration Date," page 20. Important It is your responsibility to determine
whether a field is required for the transaction you are requesting.
Payment Tokenization Using the SCMP API | January 2016
60
Appendix A
Table 8
API Fields
Request Fields (Continued)
Field Name
Description
Used By &
Required (R)/
Optional (O)
Data Type
& Length
subscription_payment_
method
Method of payment. See "Supported Processors
and Payment Methods," page 13. Possible
values:
Create (see
description)
String (20)

credit card (default when creating a customer
profile)

check

other

pinless debit
Update (O)
Create: this field is required when you create a
customer profile with a payment method other
than credit card.
subscription_title
Name or title of the customer profile.
Create (O)
String (60)
Update (O)
timeout
Number of seconds the system waits before
returning a timeout error. The default is 110
seconds.
Optional for all
services
Positive
integer (3)
ucaf_collection_
indicator
Required field for payment network tokenization
transactions with MasterCard. Set the value for
this field to 2.
Create (Rrequired for
payment network
token
transactions with
MasterCard)
String with
numbers
only (1)
xid
Visa
Cryptogram for payment network tokenization
transactions. The value for this field must be 28character base64 or 40-character hex binary. All
cryptograms use one of these formats.
Create (Rrequired for
payment network
token
transactions with
Visa and
American
Express)
String (40)
American Express
Block B of the cryptogram for payment network
tokenization transactions. The value for this field
must be 28-character base64 or 40-character hex
binary. All cryptograms use one of these formats.
1. This field is optional if your CyberSource account is configured for relaxed requirements for address data and expiration date.
See "Relaxed Requirements for Address Data and Expiration Date," page 20. Important It is your responsibility to determine
whether a field is required for the transaction you are requesting.
Payment Tokenization Using the SCMP API | January 2016
61
Appendix A
API Fields
Reply Fields
Table 9
Reply Fields
Field Name
Description
Returned By
Data Type
& Length
auth_rcode
Indicates whether the authorization was
successful. Possible values:
Create
Integer (1)

-1: An error occurred.

0: The request was declined.

1: The request was successful.
auth_rflag
One-word description of the result of the
authorization request. See "Reply Flags,"
page 71.
Create
String (50)
auth_rmsg
Message that explains the reply flag auth_
rflag. Do not display this message to the
customer, and do not use this field to write an
error handler.
Create
String (255)
auth_auth_amount
Amount that was authorized.
Create
Decimal (15)
auth_auth_avs
AVS result code. See page 72.
Create
String (1)
auth_auth_code
Authorization code. Returned only if the
processor returns this value.
Create
String (7)
Create
Integer (1)
See “Encoded Account Numbers” and “Zero
Amount Authorizations” in Credit Card
Services Using the SCMP API (PDF | HTML).
bill_rcode
Indicates whether the capture was successful.
Possible values:

-1: An error occurred.

0: The request was declined.

1: The request was successful.
bill_rflag
One-word description of the result of the
capture request. See "Reply Flags," page 71.
Create
String (50)
bill_rmsg
Message that explains the reply flag bill_rflag.
Do not display this message to the customer,
and do not use this field to write an error
handler.
Create
String (255)
bill_bill_amount
Amount that was captured.
Create
Decimal (15)
Payment Tokenization Using the SCMP API | January 2016
62
Appendix A
Table 9
API Fields
Reply Fields (Continued)
Field Name
Description
Returned By
Data Type
& Length
client_lib_version
Information about the client library used to
request the transaction.
All services
String (50)
ics_rcode
One-digit code that indicates whether the
entire request was successful. Possible
values:
All services
Integer (1)

-1: an error occurred

0: the request was declined

1: the request was successful
ics_rflag
One-word description of the result of the entire
request. See "Reply Flags," page 71.
All services
String (50)
ics_rmsg
Message that explains the reply flag ics_rflag.
Do not display this message to the customer,
and do not use this field to write an error
handler.
All services
String (255)
merchant_ref_number
Order reference or tracking number that you
provided in the request.
All services
String (50)
pay_subscription_
create_rcode
One-digit code that indicates whether the
specific service request was successful.
Possible values:
Create
Integer (1)

-1: an error occurred

0: the request was declined

1: the request was successful
pay_subscription_
create_rflag
One-word description of the result of the
specific service request. See "Reply Flags,"
page 71.
Create
String (50)
pay_subscription_
create_rmsg
Message that explains the reply flag pay_
subscription_create_rflag. Do not display
this message to the customer, and do not use
this field to write an error handler.
Create
String (255)
pay_subscription_
create_subscription_id
Identifier for the customer profile.
Create
String (26)
pay_subscription_
delete_rcode
One-digit code that indicates whether the
specific service request was successful.
Possible values:
Delete
Integer (1)
Delete
String (50)
pay_subscription_
delete_rflag

-1: an error occurred

0: the request was declined

1: the request was successful
One-word description of the result of the
specific service request. See "Reply Flags,"
page 71.
Payment Tokenization Using the SCMP API | January 2016
63
Appendix A
Table 9
API Fields
Reply Fields (Continued)
Field Name
Description
Returned By
Data Type
& Length
pay_subscription_
delete_rmsg
Message that explains the reply flag pay_
subscription_delete_rflag field. Do not
display this message to the customer, and do
not use this field to write an error handler.
Delete
String (255)
pay_subscription_
delete_subscription_id
Identifier for the customer profile.
Delete
String (26)
pay_subscription_
retrieve_merchant_
defined_data1
Four fields for storing information. To
understand the kinds of data storage fields see
"Optional Data Storage," page 39.
Retrieve
String (64)
Data that was encrypted. CyberSource
decrypts the data before returning it. To
understand the different kinds of data storage
fields see "Optional Data Storage," page 39.
Retrieve
String (100)
pay_subscription_
retrieve_merchant_
secure_data4
Data that was encrypted. CyberSource
decrypts the data before returning it. See
"Optional Data Storage," page 39.
Retrieve
String (2K)
pay_subscription_
retrieve_bill_address1
First line of the billing address.
Retrieve
String (60)
pay_subscription_
retrieve_bill_address2
Second line of the billing address.
Retrieve
String (60)
pay_subscription_
retrieve_bill_city
City of the customer address.
Retrieve
String (50)
pay_subscription_
retrieve_bill_company_
tax_id
Company’s tax identifier.
Retrieve
String with
numbers only
(9)
pay_subscription_
retrieve_bill_country
Country code for the billing address. Use the
two-character ISO codes.
Retrieve
String (2)
pay_subscription_
retrieve_merchant_
defined_data2
pay_subscription_
retrieve_merchant_
defined_data3
pay_subscription_
retrieve_merchant_
defined_data4
pay_subscription_
retrieve_merchant_
secure_data1
pay_subscription_
retrieve_merchant_
secure_data2
pay_subscription_
retrieve_merchant_
secure_data3
Payment Tokenization Using the SCMP API | January 2016
64
Appendix A
Table 9
API Fields
Reply Fields (Continued)
Field Name
Description
Returned By
Data Type
& Length
pay_subscription_
retrieve_bill_payment
Indicates whether the payments for this
customer profile are for the Visa Bill Payment
program. Possible values:
Retrieve
String (1)

N (default): not a Visa Bill Payment.

Y: Visa Bill Payment.
See "Visa Bill Payment Program," page 40.
pay_subscription_
retrieve_bill_state
State or province of billing address. Use the
two-character ISO state and province codes.
Retrieve
String (2)
pay_subscription_
retrieve_bill_zip
Postal code in the billing address.
Retrieve
String (10)
pay_subscription_
retrieve_card_type
Card type.
Retrieve
String (3)
pay_subscription_
retrieve_comments
Comments that you included for the customer
profile.
Retrieve
String (255)
pay_subscription_
retrieve_company_
name
Name of the customer’s company.
Retrieve
String (40)
pay_subscription_
retrieve_currency
Currency used by the customer.
Retrieve
String (5)
pay_subscription_
retrieve_customer_
account_id
Your identifier for the customer.
Retrieve
String (50)
pay_subscription_
retrieve_customer_cc_
expmo
Expiration month for the card.
Retrieve
Integer (2)
pay_subscription_
retrieve_customer_cc_
expyr
Expiration year for the card.
Retrieve
Integer (4)
pay_subscription_
retrieve_customer_cc_
issue_number
Issue number for the Maestro (UK Domestic)
card.
Retrieve
String (5)
pay_subscription_
retrieve_customer_cc_
number
Card account number.
Retrieve
String (20)
pay_subscription_
retrieve_customer_cc_
startmo
Start month for the Maestro (UK Domestic)
card.
Retrieve
Integer (2)
pay_subscription_
retrieve_customer_cc_
startyr
Start year for the Maestro (UK Domestic) card.
Retrieve
Integer (4)
Format: MM
Format: YYYY
Format: MM
Format: YYYY
Payment Tokenization Using the SCMP API | January 2016
65
Appendix A
Table 9
API Fields
Reply Fields (Continued)
Field Name
Description
Returned By
Data Type
& Length
pay_subscription_
retrieve_customer_
email
Customer email address.
Retrieve
String (255)
pay_subscription_
retrieve_customer_
firstname
Customer first name.
Retrieve
String (60)
pay_subscription_
retrieve_customer_
lastname
Customer last name.
Retrieve
String (60)
pay_subscription_
retrieve_customer_
phone
Customer phone number.
Retrieve
String (20)
pay_subscription_
retrieve_date_of_birth
Date of birth of the customer.
Retrieve
String (10)
pay_subscription_
retrieve_driver_license_
no
Driver’s license number of the customer.
Retrieve
String (30)
pay_subscription_
retrieve_driver_license_
state
State or province where the customer’s
driver’s license was issued.
Retrieve
String (2)
pay_subscription_
retrieve_ecp_account_
no
Bank account number.
Retrieve
Integer (17)
pay_subscription_
retrieve_ecp_account_
type
Account type. Possible values:
Retrieve
String (1)
Format: YYYY-MM-DD or YYYYMMDD.

C: checking

S: savings (USD only)

X: corporate checking (USD only)
pay_subscription_
retrieve_ecp_
authenticate_id
Identification number returned when an
Authenticate request is processed and
returned in subsequent monetary transactions.
Retrieve
Numeric (32)
pay_subscription_
retrieve_ecp_rdfi
Bank routing number.
Retrieve
Integer (9)
Payment Tokenization Using the SCMP API | January 2016
66
Appendix A
Table 9
API Fields
Reply Fields (Continued)
Field Name
Description
Returned By
Data Type
& Length
pay_subscription_
retrieve_ecp_sec_code
Code that specifies the authorization method
for the transaction. Possible values:
Retrieve
String (3)

CCD: corporate cash disbursement—
charge or credit against a business
checking account. You can use one-time or
recurring CCD transactions to transfer
funds to or from a corporate entity. A
standing authorization is required for
recurring transactions.

PPD: prearranged payment and deposit
entry—charge or credit against a personal
checking or savings account. You can
originate a PPD entry only when the
payment and deposit terms between you
and the customer are prearranged. A
written authorization from the customer is
required for one-time transactions and a
written standing authorization is required for
recurring transactions.

TEL: telephone-initiated entry—one-time
charge against a personal checking or
savings account. You can originate a TEL
entry only when there is a business
relationship between you and the customer
or when the customer initiates a telephone
call to you. For a TEL entry, you must obtain
a payment authorization from the customer
over the telephone. There is no recurring
billing option for TEL.

WEB: internet-initiated entry—charge
against a personal checking or savings
account. You can originate a one-time or
recurring WEB entry when the customer
initiates the transaction over the Internet.
For a WEB entry, you must obtain payment
authorization from the customer over the
Internet.
pay_subscription_
retrieve_end_date
This field is not meaningful for customer
profiles.
Retrieve
String (8)
pay_subscription_
retrieve_frequency
Frequency of payments for the customer
profile. Possible value:
Retrieve
String (20)
Retrieve
String (50)

pay_subscription_
retrieve_merchant_ref_
number
on-demand: no payment schedule
Merchant-generated order reference or
tracking number.
Payment Tokenization Using the SCMP API | January 2016
67
Appendix A
Table 9
API Fields
Reply Fields (Continued)
Field Name
Description
Returned By
Data Type
& Length
pay_subscription_
retrieve_merchant_
secure_data4
Data that was encrypted. CyberSource
decrypts the data before returning it. To
understand the different kinds of data storage
fields, see "Optional Data Storage," page 39.
Retrieve
String (2048)
pay_subscription_
retrieve_owner_
merchant_id
CyberSource merchant ID that was used to
create the customer profile for which the
service was requested. This field is returned
only if you are using profile sharing and only if
you requested this service for a customer
profile that is created with a CyberSource
merchant ID for which sharing is enabled. See
"Customer Profile Sharing," page 40.
Retrieve
String (30)
pay_subscription_
retrieve_payments_left
This field is not meaningful for customer
profiles.
Retrieve
Integer (3)
pay_subscription_
retrieve_rcode
One-digit code that indicates whether the
specific service request is successful. Possible
values:
Retrieve
Integer (1)

-1: an error occurred

0: the request was declined

1: the request was successful
pay_subscription_
retrieve_recurring_
amount
The payment amount for the customer profile.
Retrieve
String (15)
pay_subscription_
retrieve_rflag
One-word description of the result of the
specific service request. See "Reply Flags,"
page 71.
Retrieve
String (50)
pay_subscription_
retrieve_rmsg
Message that explains the reply flag pay_
subscription_retrieve_rflag field. Do not
display this message to the customers and do
not use this field to write an error handler.
Retrieve
String (255)
pay_subscription_
retrieve_ship_to_
address1
First line of the shipping address.
Retrieve
String (60)
pay_subscription_
retrieve_ship_to_
address2
Second line of the shipping address.
Retrieve
String (60)
pay_subscription_
retrieve_ship_to_city
City of the shipping address.
Retrieve
String (50)
pay_subscription_
retrieve_ship_to_
company_name
Name of the company that is receiving the
product.
Retrieve
String (60)
Payment Tokenization Using the SCMP API | January 2016
68
Appendix A
Table 9
API Fields
Reply Fields (Continued)
Field Name
Description
Returned By
Data Type
& Length
pay_subscription_
retrieve_ship_to_
country
Country code for the shipping address. Use
the two-character ISO codes.
Retrieve
String (2)
pay_subscription_
retrieve_ship_to_
firstname
First name of the person receiving the product.
Retrieve
String (60)
pay_subscription_
retrieve_ship_to_
lastname
Last name of the person receiving the product.
Retrieve
String (60)
pay_subscription_
retrieve_ship_to_state
State or province of shipping address. Use the
two-character ISO state and province codes.
Retrieve
String (2)
pay_subscription_
retrieve_ship_to_zip
Postal code in the shipping address.
Retrieve
String (10)
pay_subscription_
retrieve_start_date
This field is not meaningful for customer
profiles.
Retrieve
String (8)
pay_subscription_
retrieve_status
Status of the customer profile. Possible values:
Retrieve
String (9)

Cancelled: the customer profile has been
cancelled.

Current: the customer profile is active.

Superseded: the subscription or customer
profile has been updated and a new
subscription ID has been assigned to it.
pay_subscription_
retrieve_subscription_
id
Profile ID.
Retrieve
String (26)
pay_subscription_
retrieve_subscription_id_
new
The new profile ID that supersedes the
previous profile ID for the customer profile.
Retrieve
String (16)
pay_subscription_
retrieve_title
Name or title for the customer profile.
Retrieve
String (60)
pay_subscription_
update_owner_
merchant_id
CyberSource merchant ID that is used to
create the customer profile for which the
service is requested. This field is returned only
if you are using profile sharing and only if you
requested this service for a customer profile
that is created with a CyberSource merchant
ID for which sharing is enabled. See
"Customer Profile Sharing," page 40.
Update
String (30)
Payment Tokenization Using the SCMP API | January 2016
69
Appendix A
Table 9
API Fields
Reply Fields (Continued)
Field Name
Description
Returned By
Data Type
& Length
pay_subscription_
update_rcode
One-digit code that indicates whether the
specific service request is successful. Possible
values:
Update
Integer (1)

-1: an error occurred

0: the request was declined

1: the request was successful
pay_subscription_
update_rflag
One-word description of the result of the
specific service request. See "Reply Flags,"
page 71.
Update
String (50)
pay_subscription_
update_rmsg
Message that explains the reply flag pay_
subscription_update_rflag. Do not display
this message to the customer, and do not use
this field to write an error handler.
Update
String (255)
pay_subscription_
update_subscription_id
Identifier for the customer profile.
Update
String (26)
pay_subscription_
update_subscription_id_
new
The new subscription ID that supersedes the
previous subscription ID for the customer
profile or subscription.
Update
String (16)
request_id
Identifier for the request.
All services
String (26)
request_token
Request token data created by CyberSource
for each reply. The field is an encoded string
that contains no confidential information, such
as an account or card verification number. The
string can contain a maximum of 256
characters.
All Services
String (256)
Payment Tokenization Using the SCMP API | January 2016
70
Appendix A
API Fields
Reply Flags
The following table describes the reply flags returned by the SCMP API for customer
profiles. For a discussion of reply codes, reply flags, and reply messages, see Getting
Started with CyberSource Advanced for the SCMP API (PDF | HTML).
Because CyberSource can add reply codes, reply flags, and reply messages at
any time, you need to:
Note
Table 10

Parse the reply data according to the names of the fields instead of their
order in the reply. For more information on parsing reply fields, see the
documentation for your client.

Program your error handler to use the reply flag value to determine the
result if it receives a reply code that it does not recognize.
Reply Flags
Reply Flag
Description
DAVSNO
The credit card was accepted by the bank but refused by
CyberSource because it did not pass the AVS check. AVS result is N.
DCALL
You must call the issuing bank to proceed with the transaction.
DCV
The credit card was accepted by the bank but refused by
CyberSource because it did not pass the CVN check. CVN result is N.
DCARDEXPIRED
CyberSource declined the request because the card has expired.
DCARDREFUSED
The bank declined the transaction, including for reasons such as
insufficient funds, which cannot be differentiated at authorization time
from other transactions.
DCHECKREFUSED
The processor declined the electronic check transaction.
DINVALIDCARD
The card number did not pass CyberSource basic checks.
DINVALIDDATA
Data provided is not consistent with the request. For example, the
customer profile has been superseded. See "Updating a Customer
Profile," page 31.
DMISSINGFIELD
The request is missing a required field.
ESYSTEM
System error. You must design your transaction management system
to include a way to correctly handle CyberSource system errors.
Depending on which payment processor is handling the transaction,
the error can indicate a valid CyberSource system error or a
processor rejection because of invalid data. In either case,
CyberSource recommends that you do not design your system to
endlessly retry sending a transaction in the case of a system error.
See the documentation for the CyberSource client you are using for
important information about how to handle system errors and retries.
ETIMEOUT
The request timed out.
Payment Tokenization Using the SCMP API | January 2016
71
Appendix A
Table 10
API Fields
Reply Flags (Continued)
Reply Flag
Description
SOK
Transaction was successful.
SPARTIALAPPROVAL
Your authorization request was partially approved. See "Validating a
Customer Profile," page 22.
AVS and CVN Codes
An issuing bank uses the AVS code to confirm that your customer is providing the correct
billing address. If the customer provides incorrect data, the transaction might be
fraudulent. The international and U.S. domestic Address Verification Service (AVS) codes
are the Visa standard AVS codes, except for codes 1 and 2, which are CyberSource AVS
codes. The standard AVS return codes for other types of credit cards (including American
Express cards) are mapped to the Visa standard codes.
Important
When you populate billing street address 1 and billing street address 2,
CyberSource through VisaNet concatenates the two values. If the
concatenated value exceeds 40 characters, CyberSource through VisaNet
truncates the value at 40 characters before sending it to Visa and the issuing
bank. Truncating this value affects AVS results and therefore might impact risk
decisions and chargebacks.
International AVS Codes
These codes are returned only for Visa cards issued outside the U.S.
Table 11
International AVS Codes
Code
Response
Description
B
Partial match
Street address matches, but postal code is not verified.
C
No match
Street address and postal code do not match.
D&M
Match
Street address and postal code match.
I
No match
Address is not verified.
P
Partial match
Postal code matches, but street address is not verified.
Payment Tokenization Using the SCMP API | January 2016
72
Appendix A
API Fields
U.S. Domestic AVS Codes
Table 12
Domestic AVS Codes
Code
Response
Description
A
Partial match
Street address matches, but 5-digit and 9-digit postal codes do
not match.
B
Partial match
Street address matches, but postal code is not verified.
C
No match
Street address and postal code do not match.
D&M
Match
Street address and postal code match.
E
Invalid
AVS data is invalid, or AVS is not allowed for this card type.
F
Partial match
Card member’s name does not match, but billing postal code
matches. Returned only for the American Express card type.
G
Not supported.
H
Partial match
Card member’s name does not match, but street address and
postal code match. Returned only for the American Express
card type.
I
No match
Address not verified.
J
Match
Card member’s name, billing address, and postal code match.
Shipping information verified and chargeback protection
guaranteed through the Fraud Protection Program. Returned
only if you are registered to use AAV+ with the American
Express Phoenix processor.
K
Partial match
Card member’s name matches, but billing address and billing
postal code do not match. Returned only for the American
Express card type.
L
Partial match
Card member’s name and billing postal code match, but billing
address does not match. Returned only for the American
Express card type.
M
Match
Street address and postal code match.
N
No match
One of the following:

Street address and postal code do not match.

Card member’s name, street address, and postal code do not
match. Returned only for the American Express card type.
O
Partial match
Card member’s name and billing address match, but billing
postal code does not match. Returned only for the American
Express card type.
P
Partial match
Postal code matches, but street address not verified.
Q
Match
Card member’s name, billing address, and postal code match.
Shipping information verified but chargeback protection not
guaranteed (Standard program). Returned only if you are
registered to use AAV+ with the American Express Phoenix
processor.
R
System unavailable
System unavailable.
Payment Tokenization Using the SCMP API | January 2016
73
Appendix A
Table 12
API Fields
Domestic AVS Codes (Continued)
Code
Response
Description
S
Not supported
U.S.-issuing bank does not support AVS.
T
Partial match
Card member’s name does not match, but street address
matches. Returned only for the American Express card type.
U
System unavailable
Address information unavailable for one of these reasons:

The U.S. bank does not support non-U.S. AVS.

The AVS in a U.S. bank is not functioning properly.
V
Match
Card member’s name, billing address, and billing postal code
match. Returned only for the American Express card type.
W
Partial match
Street address does not match, but 9-digit postal code matches.
X
Match
Street address and 9-digit postal code match.
Y
Match
Street address and 5-digit postal code match.
Z
Partial match
Street address does not match, but 5-digit postal code matches.
1
Not supported
AVS is not supported for this processor or card type.
2
Unrecognized
The processor returned an unrecognized value for the AVS
response.
3
Match
Address is confirmed. Returned only for PayPal Express
Checkout.
4
No match
Address is not confirmed. Returned only for PayPal Express
Checkout.
CVN Codes
Table 13
CVN Codes
Code
Description
D
The transaction was considered suspicious by the issuing bank.
I
The CVN failed the processor's data validation.
M
The CVN matched.
N
The CVN did not match.
P
The CVN was not processed by the processor for an unspecified reason.
S
The CVN is on the card but was not included in the request.
U
Card verification is not supported by the issuing bank.
X
Card verification is not supported by the card association.
1
Card verification is not supported for this processor or card type.
2
An unrecognized result code was returned by the processor for the card
verification response.
Payment Tokenization Using the SCMP API | January 2016
74
Appendix A
Table 13
API Fields
CVN Codes (Continued)
Code
Description
3
No result code was returned by the processor.
Payment Tokenization Using the SCMP API | January 2016
75
APPENDIX
Examples
B
Creating a Customer Profile
Credit Card without a Setup Fee
Example
Request: Credit Card Profile without a Setup Fee
customer_firstname=John
customer_lastname=Smith
bill_address1=1295 charleston rd
bill_city=Mountain View
bill_state=ca
bill_zip=94042
bill_country=us
[email protected]
currency=usd
customer_cc_number=4111111111111111
customer_cc_expmo=01
customer_cc_expyr=20
card_type=001
merchant_id=demomerchant
merchant_ref_number=TC54240-1
recurring_frequency=on-demand
ics_applications=ics_pay_subscription_create
Payment Tokenization Using the SCMP API | January 2016
76
Appendix B
Example
Examples
Reply: Credit Card Profile without a Setup Fee
ics_decision_reason_code=100
ics_rcode=1
ics_return_code=1000000
ics_rflag=SOK
ics_rmsg=Request was processed successfully.
merchant_ref_number=TC54240-1
pay_subscription_create_rcode=1
pay_subscription_create_rflag=SOK
pay_subscription_create_rmsg=Request was processed successfully.
pay_subscription_create_subscription_id=3829668893822130706689
pay_subscription_create_time=2013-10-28T132755Z
request_id=3829668893822130706689
Credit Card with a 5.00 Setup Fee
Example
Request: Credit Card Customer Profile with a 5.00 Setup Fee
customer_firstname=John
customer_lastname=Smith
bill_address1=1295 charleston rd
bill_city=Mountain View
bill_state=ca
bill_zip=94042
bill_country=us
[email protected]
currency=usd
customer_cc_number=4111111111111111
customer_cc_expmo=01
customer_cc_expyr=20
card_type=001
grand_total_amount=5.00
merchant_id=demomerchant
merchant_ref_number=TC54240-1
recurring_frequency=on-demand
ics_applications=ics_pay_subscription_create
Payment Tokenization Using the SCMP API | January 2016
77
Appendix B
Example
Examples
Reply: Credit Card Customer Profile with a Setup Fee
auth_rcode=1
auth_rflag=SOK
auth_rmsg=Request was processed successfully.
auth_auth_amount=5.00
auth_auth_avs=Y
auth_auth_code=123456
bill_rcode=1
bill_rflag=SOK
bill_rmsg=Request was processed successfully.
bill_bill_amount=5.00
ics_rcode=1
ics_return_code=1000000
ics_rflag=SOK
ics_rmsg=Request was processed successfully.
merchant_ref_number=TC54240-1
pay_subscription_create_rcode=1
pay_subscription_create_rflag=SOK
pay_subscription_create_rmsg=Request was processed successfully.
pay_subscription_create_subscription_id=3829668893822130706689
pay_subscription_create_time=2013-10-28T132755Z
request_id=3829668893822130706689
eCheck
Example
Request: eCheck Customer Profile
ics_applications=ics_pay_subscription_create
subscription_payment_method=check
bill_address1=1295 charleston rd
bill_city=Mountain View
bill_country=us
bill_state=ca
bill_zip=94042
card_type=001
currency=usd
customer_cc_expmo=01
customer_cc_expyr=20
customer_cc_number=4111111111111111
[email protected]
customer_firstname=John
customer_lastname=Smith
customer_phone=1234567890
ecp_account_no=12345678
ecp_account_type=c
ecp_rdfi=112200439
ecp_sec_code=web
merchant_id=demomerchant
merchant_ref_number=TC54240-4
recurring_frequency=on-demand
Payment Tokenization Using the SCMP API | January 2016
78
Appendix B
Example
Examples
Reply: eCheck Customer Profile
ics_rcode=1
ics_rflag=SOK
ics_rmsg=Request was processed successfully.
merchant_ref_number=TC54240-4
pay_subscription_create_rcode=1
pay_subscription_create_rflag=SOK
pay_subscription_create_rmsg=Request was processed successfully. pay_
subscription_create_subscription_id=3829672273012130706689
pay_subscription_create_time=2013-10-28T133333Z
request_id=3829672273312130706689
PINless
Example
Request: PINless Customer Profile
bill_address1=1295 charleston rd
bill_city=Mountain
View bill_country=us
bill_state=ca
bill_zip=94042
card_type=001
currency=usd
customer_cc_expmo=01
customer_cc_expyr=20
customer_cc_number=4111111111111111
[email protected]
customer_firstname=John
customer_lastname=Smith
ics_applications=ics_pay_subscription_create
merchant_id=demomerchant
merchant_ref_number=TC54240-2
recurring_frequency=on-demand
subscription_payment_method=pinless debit
Example
Reply: PINless Customer Profile
ics_rcode=1
ics_rflag=SOK ics_rmsg=Request was processed successfully.
merchant_ref_number=TC54240-2
pay_subscription_create_rcode=1
pay_subscription_create_rflag=SOK
pay_subscription_create_rmsg=Request was processed successfully.
pay_subscription_create_subscription_id=9990000092087479
pay_subscription_create_time=2013-10-28T133732Z
request_id=3829674669492130706689
Payment Tokenization Using the SCMP API | January 2016
79
Appendix B
Examples
Updating a Customer Profile
Updating Card Account Number
Example
Request: Updating a Card Account Number
merchant_id=demomerchant
merchant_ref_number=TC54240-1
customer_cc_number=4111111111111111
customer_cc_expmo=01
customer_cc_expyr=20
card_type=001
subscription_id=3829680248342130706689
ics_applications=ics_pay_subscrition_update
Example
Reply: Updating a Card Account Number
ics_rcode=1
ics_rflag=SOK
ics_rmsg=Request was processed successfully.
merchant_ref_number=TC54314-10up
pay_subscription_update_owner_merchant_id=demomerchant
pay_subscription_update_rcode=1
pay_subscription_update_rflag=SOK
pay_subscription_update_rmsg=Request was processed successfully.
pay_subscription_update_subscription_id=3829680248342130706689
pay_subscription_update_time=2013-10-28T134651Z
request_id=3829680259022130706689
Removing Card Expiration Dates
Example
Request: Removing Card Expiration Dates
merchant_id=demomerchant
merchant_ref_number=TC54240-1
customer_cc_expmo=
customer_cc_expyr=
subscription_id=3829680248342130706689
ics_applications=ics_pay_subscrition_update
Payment Tokenization Using the SCMP API | January 2016
80
Appendix B
Examples
Reply: Removing Card Expiration Dates
ics_rcode=1
ics_rflag=SOK
ics_rmsg=Request was processed successfully.
merchant_ref_number=TC54314-10up
pay_subscription_update_owner_merchant_id=demomerchant
pay_subscription_update_rcode=1
pay_subscription_update_rflag=SOK
pay_subscription_update_rmsg=Request was processed successfully.
pay_subscription_update_subscription_id=3829680248342130706689
pay_subscription_update_time=2013-10-28T134651Z
request_id=3829680259022130706689
Retrieving a Customer Profile
Example
Request: Retrieving a Customer Profile
merchant_id=demomerchant
merchant_ref_number=TC54313-5
subscription_id=3829684519002130706689
ics_applications=ics_pay_subscription_retrieve
Payment Tokenization Using the SCMP API | January 2016
81
Appendix B
Example
Examples
Reply: Retrieving a Customer Profile
ics_rcode=1
ics_rflag=SOK
ics_rmsg=Request was processed successfully.
merchant_ref_number=TC54313-5
pay_subscription_retrieve_approval_required=false
pay_subscription_retrieve_automatic_renew=false
pay_subscription_retrieve_bill_address1=1295 Charleston Road
pay_subscription_retrieve_bill_city=Mountain View
pay_subscription_retrieve_bill_country=US
pay_subscription_retrieve_bill_payment=N
pay_subscription_retrieve_bill_state=CA
pay_subscription_retrieve_bill_zip=94042
pay_subscription_retrieve_currency=USD
pay_subscription_retrieve_customer_cc_number=4111111111111111
[email protected]
pay_subscription_retrieve_customer_firstname=JOHN
pay_subscription_retrieve_customer_lastname=DOE
pay_subscription_retrieve_customer_phone=6504322000
pay_subscription_retrieve_frequency=on-demand
pay_subscription_retrieve_owner_merchant_id=demomerchant
pay_subscription_retrieve_payment_method=credit card
pay_subscription_retrieve_rcode=1
pay_subscription_retrieve_ship_to_address1=1295 Ship To Street
pay_subscription_retrieve_ship_to_address2=High Street
pay_subscription_retrieve_ship_to_city=San Francisco
pay_subscription_retrieve_ship_to_country=US
pay_subscription_retrieve_ship_to_firstname=JOHN
pay_subscription_retrieve_ship_to_lastname=DOE
pay_subscription_retrieve_ship_to_state=CA
pay_subscription_retrieve_ship_to_zip=94042-1234
pay_subscription_retrieve_status=CURRENT
pay_subscription_retrieve_subscription_id=3829684519002130706689
request_id=3829684529252130706689
Deleting a Customer Profile
Example
Request: Deleting a Customer Profile
merchant_id=demomerchant
merchant_ref_number=TC54300-5
subscription_id=3829688163002130706689
ics_applications=ics_pay_subscription_delete
Payment Tokenization Using the SCMP API | January 2016
82
Appendix B
Example
Examples
Reply: Deleting a Customer Profile
ics_rcode=1
ics_rflag=SOK
ics_rmsg=Request was processed successfully.
merchant_ref_number=TC54300-5
pay_subscription_delete_rcode=1
pay_subscription_delete_rflag=SOK
pay_subscription_delete_rmsg=Request was processed successfully.
pay_subscription_delete_subscription_id=3829688163002130706689
request_id=3829688182452130706689
Payment Tokenization Using the SCMP API | January 2016
83
">