1 About eps

1.1 General information about eps

In Austria, the 1cs Online Payment System supports online money transfer with the Austrian Electronic Payment Standard (EPS). EPS is an established system for e-commerce payments in Austria offering a payment guarantee to the merchant. The customer can use the familiar and trusted online banking of its own credit institution, just the same as with online banking.

Logo

InfoType
In Austria, the online bank transfer with eps is very widespread in E-commerce and thus an interesting addition to the payment mix. Additionally, the merchant gets a payment guarantee.Payments by Online Bank Transfer

Further information can be found on the webpage of eps / STUZZA (www.stuzza.at).

1.2 Process flow chart

 

eps process flow

2 1cs Online Payment System interface

2.1 Definitions

2.1.1 Data formats

FormatDescription
aalphabetical
asalphabetical with special characters
nnumeric
analphanumeric
ansalphanumeric with special characters
nsnumeric with special characters
boolboolean expression (true or false)
3fixed length with 3 digits/characters
..3variable length with maximum 3 digits/characters
enumenumeration of allowed values
dttmISODateTime (YYYY-MM-DDThh:mm:ss)

2.1.2 Abbreviations

AbbreviationDescriptionComment
CNDcondition 
MmandatoryIf a parameter is mandatory, then it must be present
OoptionalIf a parameter is optional, then it can be present, but it is not required
CconditionalIf a parameter is conditional, then there is a conditional rule which specifies whether it is mandatory or optional

Notice: Please note that the names of parameters can be returned in upper or lower case.

2.2 Calling the eps interface

The eps connection with a 1cs Online Payment System form can be either direct or via PPRO, where the interface form and process are largely identical. With the PPRO connection there are a few added parameters which are explained separately in the table. Subsequent credits and batch transfer credits can only be made with the PPRO connection.

To make a payment in Austria with eps online transfer via a 1cs Online Payment System form, please use the following URL:

https://www.computop-paygate.com/eps.aspx

Notice: For security reasons, the 1cs Online Payment System rejects all payment requests with formatting errors. Therefore please use the correct data type for each parameter.

Notice: An eps connection via iFrame is not possible due to eps regulations and will be prevented technically.

The following table describes the encrypted payment request parameters:

ParameterFormatCNDDescription
MerchantIDans..30MMerchantID, assigned by First Cash Solution. Additionally, this parameter must be passed in plain language too.
TransIDans..64MTransactionID which should be unique for each payment
RefNrns..30MUnique reference number Only ASCII characters are allowed. Special characters such as (“umlauts”, …) are not permitted and may have to be replaced by ASCII characters (e.g. ü → ue, é → e, …).
Amountn..10MAmount in the smallest currency unit (e.g. EUR Cent) Please contact the helpdesk, if you want to capture amounts < 100 (smallest currency unit).
Currencya3MCurrency, three digits DIN / ISO 4217 Only EUR is permissible. Here is an overview: Currency table
OptionDateans10C
Desired payment execution date in the format YYYY-MM-DD
OrderDescans..768MIntended use on statement of account (max 35 digits)
OrderDesc2ans..384CNumber and description of purchased products, individual prices, comma-separated list, no special characters allowed
AccOwnerans..50OName of account holder
IBANans..34OIternational Bank Account Number for SEPA
BICans..11OBank Identifier Code for SEPA
MACan64MHash Message Authentication Code (HMAC) with SHA-256 algorithm. Details can be found here: HMAC Authentication (Request) HMAC Authentication (Notify)
UserDataans..1024OIf specified at request, the 1cs Online Payment System forwards the parameter with the payment result to the shop
URLSuccessans..256MComplete URL which calls up the 1cs Online Payment System if payment has been successful. The URL may be called up only via port 443 This URL may not contain parameters: In order to exchange values between the 1cs Online Payment System and shop, please use the parameter UserData. General notes: We recommend using the parameter “response=encrypt” to receive an encrypted response from 1cs Online Payment system However, fraudster may just copy the encrypted DATA-element which are sent to URLFailure and send the DATA to URLSuccess. Therefore ensure to check the “code”-value which indicates success/failure of the action. Only a result of “code=00000000” should be considered successful.
URLFailureans..256MComplete URL which calls up the 1cs Online Payment System if payment has been unsuccessful. The URL may be called up only via port 443 This URL may not contain parameters: In order to exchange values between the 1cs Online Payment System and shop, please use the parameter UserData. General notes: We recommend using the parameter “response=encrypt” to receive an encrypted response from 1cs Online Payment system
However, fraudster may just copy the encrypted DATA-element which are sent to URLFailure and send the DATA to URLSuccess. Therefore ensure to check the “code”-value which indicates success/failure of the action. Only a result of “code=00000000” should be considered successful.
Responsea7OStatus response sent by the 1cs Online Payment System to URLSuccess and URLFailure, should be encrypted. For this purpose, transmit Response=encrypt parameter.
URLNotifyans..256OComplete URL which the 1cs Online Payment System calls up in order to notify the shop about the payment result. The URL may be called up only via port 443 It may not contain parameters: Use the UserData parameter instead. General notes: We recommend using the parameter “response=encrypt” to receive an encrypted response from 1cs Online Payment system
However, fraudster may just copy the encrypted DATA-element which are sent to URLFailure and send the DATA to URLSuccess. Therefore ensure to check the “code”-value which indicates success/failure of the action. Only a result of “code=00000000” should be considered successful.
ReqIDans..32OTo avoid double payments, enter an alphanumeric value which identifies your transaction and may be assigned only once. If the transaction is submitted again with the same ReqID, the 1cs Online Payment System will not carry out the payment, but will just return the status of the original transaction. Please note that the 1cs Online Payment system must have a completed transaction status for the first initial action. Submissions with identical ReqID on an open status will be processed regularly. Please note that a ReqID is only valid for 12 months, after which it will be deleted from the 1cs Online Payment system.
Plainans..50OA single value to be set by the merchant to return some information unencrypted in response/notify, e.g. the MID.  “Plain”-parameter is part of encrypted “Data” in 1cs Online Payment System and therefore protected against manipulation.
Customans..1024O“Custom”-parameter is added to the request data before encryption and is part of encrypted “Data” in 1cs Online Payment System request. By this they are protected against manipulation by a consumer.  The Custom-value is added to the 1cs Online Payment System response in plain text and the “|” is replaced by a “&”. By this you can put a single value into Custom-parameter and get multiple key-value-pairs back in response for your own purpose.

Parameters for online transfers with eps

The following table gives the result parameters which the 1cs Online Payment System transmits to URLSuccess or URLFailure and URLNotify. If you have specified the Response=encrypt parameter, the following parameters are forwarded Blowfish encrypted to your system:

  • pls. be prepared to receive additional parameters at any time and do not check the order of parameters
  • the key (e.g. MerchantId, RefNr) should not be checked case-sentive
ParameterFormatCNDDescription
MIDans..30MMerchantID, assigned by 1cs Online Payment system
PayIDan32MID assigned by the 1cs Online Payment System for the payment, e.g. for referencing in batch files.
XIDan32MID for all single transactions (authorisation, capture, credit note) for one payment assigned by 1cs online payment system
TransIDans..64MTransactionID provided by you which should be unique for each payment
Statusa..50MOK, AUTHORIZED (URLSuccess) or FAILED (URLFailure).
Descriptionans..1024MFurther details in the event that payment is rejected. Please do not use the Description but the Code parameter for the transaction status analysis!
Coden8MError code according to the 1cs Online Payment System Response Codes Excel file
RefNrns..30OUnique reference number Only ASCII characters are allowed. Special characters such as (“umlauts”, …) are not permitted and may have to be replaced by ASCII characters (e.g. ü → ue, é → e, …).
UserDataans..1024OIf specified at request, the 1cs Online Payment System forwards the parameter with the payment result to the shop
MACan64MHash Message Authentication Code (HMAC) with SHA-256 algorithm. Details can be found here: HMAC Authentication (Request) HMAC Authentication (Notify)
AccOwnerans..50MName of account holder
IBANans..34OInternational Bank Account Number for SEPA
BICans..11OBank Identifier Code for SEPA
Plainans..50OA single value that can be set by you to return information unencrypted in the response or notify, e.g. the MID.

As the “Plain” parameter is part of the encrypted “Data” in 1cs Online Payment system, it is protected from manipulation.
Customans..1024OThe “Custom” parameter is appended to the call before encryption and is part of the encrypted “Data” in the 1cs online payment system call. This protects the value against manipulation.

The custom value is then appended in plain text to the  1cs online payment system response and “|” is replaced by “&”. This allows you to pass a custom value and get back several key-value pairs for your own use in the response. Custom=session=123|id=456 will change in the answer to Session=123&id=456

Result parameters for URLNotify, URLSuccess and URLFailure in case of eps