Integration
Credit Card
Direct Debit
Bluecode
eps
giropay
iDEAL
Maestro
PayPal
Payment Page
Tools
Error codes
Result codes
Test data
giropay can only process EURO payments.
Important information
During the coming months, we will be gradually ending our support for the existing giropay API (see legacy giropay documentation). After that, the ONLY valid API will be the one documented here. While planning your transition, please take into consideration our migration guide on our giropay overview web site. There you will also find a comparison of the old and new API.
API change
The following change is being made to the API in the following days:
The parameter merchantReconciliationReferenceNumber is replaced by merchantOrderReferenceNumber, which will continue to be optional but allows only 20 characters. Please also have a look a the allowed characters that are specified below.
Here you will find the test data both for the so-called giropay OLD (the previous giropay way via your online banking), as well as giropay NEW (the formerly used way of Paydirekt requiring a user name and a password).
Which of the two ways (OLD and/or NEW) will be available to you when testing, depends on your contract. Please contact your sales representative should you not be presented with the expected variant. Please also bear in mind that you may be presented with either of the two variants iniaitally, depending on what might be stored in your browser from previous selections. So you may return to the selection of the NEW or OLD variant by using the left arrows available in the giropay user interface (please don't confuse with the browser back button!).
Please use the login data provided below (please do not change the password within the interface as it is shared with other testers, and also remember that your test transactions will be visible to other people using the same account):
Form field | Input value |
---|---|
Username | Giropay_test |
Password | 8x5hHDs+98Q2W |
TAN (should one be requested at some point) | 123456 |
Please make sure to only use the following giropay test bank for your tests!
Form field | Input value |
---|---|
Bank | giropay Testbank |
IBAN | DE48499999601234567890 |
VR-NetKey / Alias | (any value) |
PIN | 1234 |
TAN‑Verfahren auswählen (only for amounts >= 20,00, see below) | “Smart-TAN plus optisch / USB” or “Smart-TAN photo” |
TAN | 123456 |
Special amounts
The behaviour of the transaction may be controlled through the checkout sum (magic numbers), see the table below. For the integration of giropay in a shop o an authority office, the main takeaway of this list is that the amounts specified in the table below trigger a special behaviour of the simulation and therefore might produce unexpected results when not taken into account.
Amount | Reaction |
---|---|
2,00 EUR | For PSD2 payments, the payment is immediately rejected by the PSD2 Bank with the status REJECTED. |
20,00 EUR | Up to this amount, no TAN authentication is expected; for exactly 20 euros, the selection of TAN procedures is also displayed (without having to enter a TAN) |
20,02 EUR | For PSD2 payments with TAN authentication, the photo TAN procedure as well as two unsupported TAN procedures are used. For the user, this Magic Number should behave in the same way as €21.00. When selecting the TAN procedure, it is then specified that no TAN entry is necessary (EXEMPTED) |
21,00 EUR | For PSD2 payments with TAN authentication, only Photo-TAN procedures are used |
21,01 EUR | For PSD2 payments with TAN authentication, the photo TAN procedure as well as two unsupported TAN procedures are used. For the user, this Magic Number should behave in the same way as €21.00. |
22,00 EUR | For PSD2 payments with TAN authentication, only push TAN procedures are used |
22,01 EUR | For PSD2 payments with TAN authentication, the push TAN procedure and two unsupported TAN procedures are used. For the user, this Magic Number should behave in the same way as €22.00. |
23,00 EUR | For PSD2 payments with TAN authentication, only Flicker TAN procedures are used |
23,01 EUR | For PSD2 payments with TAN authentication, the Flicker TAN procedure and two unsupported TAN procedures are used. For the user, this Magic Number should behave in the same way as €23.00. |
23,45 EUR | With PSD2 payment with TAN authentication, there will be no automatic status change for push, photo and flicker TAN. The SCA status and the transaction status must be set manually in the test portal via paymentId. |
403,01 EUR | When starting a PSD2 TAN authentication at a Volksbank, simulates a 403 (forbidden) with the reason SERVICE_BLOCKED as the answer. |
403,03 EUR | Simulates a 403 (forbidden) with the reason EXPIRED as the answer to a PSD2 status query at a Volksbank. |
403,04 EUR | When sending a PSD2 TAN to a Volksbank, simulates a 403 (forbidden) with the reason SERVICE_BLOCKED as the answer. |
403,05 EUR | When selecting a PSD2-TAN authentication method at a Volksbank, simulates a 403 (forbidden) with the reason SERVICE_BLOCKED as the answer. |
403,13 EUR | Simulates a 403 (forbidden) with the reason BLOCKED as the answer to a PSD2 status query at a Volksbank. |
405,02 EUR | Simulates a 405 (method not allowed) as a response when deleting PSD2. |
408,04 EUR | Simulates a long response time (for a timeout) with PSD2 TAN authentication. |
422,00 EUR | Simulates a 422 (not processable) as a response to a PSD2 payment. |
422,01 EUR | Simulates a 422 (not processable) as a response for PSD2 authentication. |
503,00 EUR | Simulates a 503 (not available) as a response for a PSD2 payment. |
503,01 EUR | Simulates a 503 (not available) as a response for PSD2 authentication. |
A reservation is to be used when the actual fulfillment of an order takes place at a later time, but the order amount for the presented card (for credit card transactions) or the given account information (for Paydirekt payments and others) needs to be authorized beforehand at the time of the order. Once the reservation period has expired, the reservation is either booked or voided.
Use sale when the business case is complete, e.g. a shopping cart was offered, ordered and delivered to the customer. The customer's payment method is debited with the amount of the sale.
As shown in the workflow there are different API calls during a giropay transaction.
The initialization of a giropay can be processed in different ways. This will be distinguished just by the project id.
Towards a successful initialization you receive a reference number and an redirect link. The redirect link leads to the online banking account of the buyer's bank. He has to be redirected to his bank. This can be achieved by a HTTP-Redirect-Header, HTML page with an corresponding Meta-Tag or JavaScript redirect.
URL: https://payment.girosolution.de/girocheckout/api/v2/transaction/start
provided by: GiroCheckout
called by: Merchant
Name | Mandatory | Type | Description |
---|---|---|---|
merchantId | yes | Integer | merchant ID of a giropay project |
projectId | yes | integer | project ID of a giropay project |
merchantTxId | yes | String(255) | unique transaction id of the merchant. Allowed characters: any letters (incl. language-specific special characters such as German Umlauts), 0-9, symbols & = + , : ; . _ ! ? # / |
amount | yes | Integer | if a decimal currency is used, the amount has to be in the smallest unit of value, eg. Cent, Penny |
currency | yes | String(3) | currency EUR = Euro |
purpose | yes | String(27) | purpose field, characters must comply with the SEPA character set (see SEPA-compliant characters) |
type | Optional | String(4) | Transaction type (see Transaction types) SALE = Sale is booked immediately (default) AUTH = Reservation of the amount |
shoppingCartType | Optional | String(19) | Type of the shopping cart. The following values are allowed: PHYSICAL = All goods in the cart are of a physical nature, DIGITAL = All goods in the cart are of a digital nature (require no shipping), MIXED = The cart contains both physical and digital goods (this is the default value should the parameter not be given), ANONYMOUS_DONATION = This is an anonymous donation and not a commercial transaction (no address data necessary), AUTHORITIES_PAYMENT = This is a payment for local authorities (no address data necessary). |
shippingAddresseFirstName | (see descr.) | String(100) | First name of the shipping address. Mandatory for shopping cart types PHYSICAL, DIGITAL and MIXED, optional for ANONYMOUS_DONATION and AUTHORITIES_PAYMENT. Permitted characters: All letters (UTF-8, also foreign), 0-9, the symbols .-!#$%&'*+/=?^_’`´{|}~"(),:;<>@[] , and blanks as well as line breaks. |
shippingAddresseLastName | (see descr.) | String(100) | Last name of the shipping address. Mandatory for shopping cart types PHYSICAL, DIGITAL and MIXED, optional for ANONYMOUS_DONATION and AUTHORITIES_PAYMENT. Permitted characters, see shippingAddresseFirstName. |
shippingCompany | Optional | String(100) | Company name of shipping address. Permitted characters, see shippingAddresseFirstName. |
shippingAdditionalAddressInformation | Optional | String(100) | Additional (street) information of shipping address. Permitted characters, see shippingAddresseFirstName. |
shippingStreet | Optional | String(100) | Street of the shipping address. Permitted characters, see shippingAddresseFirstName. |
shippingStreetNumber | Optional | String(10) | House number of the shipping address. Permitted characters, see shippingAddresseFirstName. |
shippingZipCode | (see descr.) | String(10) | Postcode of shipping address. Mandatory for shopping cart types PHYSICAL and MIXED, optional for DIGITAL, ANONYMOUS_DONATION and AUTHORITIES_PAYMENT. Permitted characters, see shippingAddresseFirstName. |
shippingCity | (see descr.) | String(100) | City of shipping address. Mandatory for shopping cart types PHYSICAL and MIXED, optional for DIGITAL, ANONYMOUS_DONATION and AUTHORITIES_PAYMENT. Permitted characters, see shippingAddresseFirstName. |
shippingCountry | (see descr.) | String(2) | 2-letter country code (ISO 3166-1). Mandatory for shopping cart types PPHYSICAL and MIXED, optional for DIGITAL, ANONYMOUS_DONATION and AUTHORITIES_PAYMENT. |
shippingEmail | (see descr.) | String(255) | Email address of the buyer. Mandatory for shopping cart type DIGITAL, optional for all others. |
merchantOrderReferenceNumber | Optional | String(20) | Additional information for the payment reconciliation that is shown in the purpose on bank statements (only for type=SALE). Characters must comply with the SEPA character set (see SEPA-compliant characters). |
cart | Optional | JSON String | All products in the shopping cart in the following format (see below): Description of cart field. |
deliveryType | Optional | String(12) | The destination of a shipment. The default value is STANDARD. Possible values: STANDARD: The goods are delivered to an ordinary postal address. PACKSTATION: The goods are delivered to a self-service parcel terminal. STORE_PICKUP: The goods are collected from the store. |
urlRedirect | yes | String(2048) | URL, where the buyer has to be sent after payment |
urlNotify | yes | String(2048) | URL, where the notification has to be sent after payment |
kassenzeichen | optional | String(255) | Optional field that allows passing an additional reference/identifier for the transaction. This value is displayed inside GiroCockpit as part of the transaction details (and soon export) and a search for it is also supported there. Characters must comply with the UTF-8 character set. |
giropayCustomerId | optional | String(20) | Customer number, max. length: 20 |
hash | yes | String(32) | HMAC MD5 hash (see hash generation) |
curl -d "merchantId=1234567" \ -d "projectId=1234" \ -d "merchantTxId=1234567890" \ -d "amount=100" \ -d "currency=EUR" \ -d "purpose=Beispieltransaktion" \ -d "shoppingCartType=DIGITAL" \ -d "shippingAddresseFirstName=Max" \ -d "shippingAddresseLastName=Mustermann" \ -d "shippingEmail=mmuster@example.com" \ -d "urlRedirect=http://www.ihre-domein.de/girocheckout/redirect" \ -d "urlNotify=http://www.ihre-domein.de/girocheckout/notify" \ -d "hash=2017e2f4d694e24a3396d83a20b3828b" \ https://payment.girosolution.de/girocheckout/api/v2/transaction/start
The reply includes a JSON encoded string. The field rc contains the response code. If it is 0 the transaction was successfully initialised. The response also includes a transaction id and a redirect URL to the online banking account of the buyer's bank.
name | mandatory | type | description |
---|---|---|---|
rc | yes | Integer | response code |
msg | yes | String(255) | additional information about the response code |
reference | optional | String(36) | unique GiroCheckout transaction ID |
redirect | optional | String(2048) | redirect URL to the buyer's online banking account |
HEADER parameter | |||
hash | yes | String(32) | HMAC MD5 hash of the full JSON string. (see api call reply) |
hash : f56b5f91094cd22ace93b76ef250aa62
{"reference":"9ce6c641-4082-4f75-ae54-333309febcc5","redirect":"https://giropay.starfinanz.de/ftg/a/go/07i2j1k00pp0u109biywcswh;jsessionid=B1D575F122ED8D4B4B4EB0F83E85897F","rc":"0","msg":""}
hash : baf3c9b7217f362c29dd5cf6f098320c
{"reference":null,"redirect":null,"rc":5033,"msg":"Währung ungütig"}
In SEPA payments, according to Annex 3 of this document, only characters of the limited SWIFT Latin characters set are allowed:
JSON array with item objects:
Name | Mandatory | Type | Description |
---|---|---|---|
name | Yes | String(100) | Article name |
ean | Optional | String(100) | International artical number (EAN or GTIN) |
quantity | Yes | Integer | Article quantity (integer) |
grossAmount | Optional | Integer | Gross amount of the article (price of each unit, if more than one), Bruttobetrag des Artikels, for currencies that use decimals, specify amount in the smallest unit, e.g. Cent, Penny |
[ { "name" : "Bobbycar", "ean" : "800001303", "quantity" : 3, "grossAmount" : 2599 }, { "name" : "Helm", "quantity" : 1, "grossAmount" : 1853 } ]
The result of a initialised transaction will be submitted to the prior in the urlNotify parameter specified URL. This notification should be used to update the payment status in the merchant's system.
The result of a giropay payment is contained in the field gcResultPayment.
At the end of the payment process on giriopay-side, an automatic redirect back to the shop is done after 5 seconds.
URL: notifyUrl of the prior init transaction call
provided by: merchant
called by: GiroCheckout
name | mandatory | type | description | ||
---|---|---|---|---|---|
giropay | giropay-ID | giropay+giropay-ID | |||
gcReference | yes | yes | yes | String(36) | unique GiroCheckout transaction ID |
gcMerchantTxId | yes | yes | yes | String(255) | merchant transaction ID |
gcBackendTxId | yes | yes | yes | String(36) | payment processor transaction ID |
gcAmount | yes | yes | Integer | if a decimal currency is used, the amount has to be in the smallest unit of value, eg. cent, penny | |
gcCurrency | yes | yes | String(3) | currency | |
gcResultPayment | yes | yes | Integer/String(1) | String “0” or numeric payment result code | |
gcHash | yes | yes | yes | String(32) | HMAC MD5 hash (see hash generation) |
As a reply to the GET request, one of the following HTTP status codes is expected.
HTTP status code | description |
---|---|
200 (OK) | The notification was processed correctly. |
400 (Bad Request) | The merchant did not process the notification and does not wish to be notified again. |
all others | The notification is repeated no more than 10 times every 30 minutes until the merchant returns the status code 200 or 400. |
After completing the payment, the customer may return to the merchant through a link. After 5 seconds, there is an automatic redirect.
URL: redirectUrl of the prior init transaction call
Provided by: merchant
Called by: GiroCheckout
name | mandatory | type | description | ||
---|---|---|---|---|---|
giropay | giropay-ID | giropay+giropay-ID | |||
gcReference | yes | yes | yes | String(36) | unique GiroCheckout transaction ID |
gcMerchantTxId | yes | yes | yes | String(255) | merchant transaction ID |
gcBackendTxId | yes | yes | yes | String(36) | payment processor transaction ID |
gcAmount | yes | yes | Integer | if a decimal currency is used, the amount has to be in the smallest unit of value, eg. cent, penny | |
gcCurrency | yes | yes | String(3) | currency | |
gcResultPayment | yes | yes | Integer/String(1) | String “0” or numeric payment result code | |
gcHash | yes | yes | yes | String(32) | HMAC MD5 hash (see hash generation) |
This service allows the retrieval of the information associated to the sender of a completed transaction. As a response to the given reference number, the account holder, IBAN and BIC of the customer are returned. This information may be used for a refund to the original payer.
URL: https://payment.girosolution.de/girocheckout/api/v2/giropay/senderinfo
Provided by: GiroCheckout
Called by: Merchant
Name | Mandatory | Type | Description |
---|---|---|---|
merchantId | Yes | Integer | merchant ID of a giropay project |
projectId | Yes | Integer | project ID of a giropay project |
reference | Yes | String(36) | GiroCheckout transaction ID |
hash | Yes | String(32) | HMAC MD5 hash of the full JSON string. (see api call reply) |
curl -d "merchantId=1234567" \ -d "projectId=1234" \ -d "reference=9ce6c641-4082-4f75-ae54-333309febcc5" \ -d "hash=246d1fa2ed97ecff895de974c560f9ec" \ https://payment.girosolution.de/girocheckout/api/v2/giropay/senderinfo
The response is a JSON object. The rc field returns an error code. If rc = 0 is returned, the corresponding fields contain the sender information.
Name | Mandatory | Type | Description |
---|---|---|---|
rc | yes | Integer | response code |
msg | yes | String(255) | Additional information about the response code in case of error |
accountholder | Optional | String(255) | Account holder of the sender account |
iban | Optional | String(36) | IBAN of the sender account |
bic | Optional | String(11) | BIC of the sender account |
HEADER parameter | |||
hash | yes | String(32) | HMAC MD5 hash of the full JSON string. (see api call reply) |
hash : cde71b6b98e8dae709fdc1e17aef885f
{"accountholder":"Max Mustermann","iban":"DE87123456781234567890","bic":"TESTDETT421","rc":0,"msg":""}
hash : f1d186103b8c4cb59c54ae7b987a9d4c
{"accountholder":null,"iban":null,"bic":null,"rc":5034,"msg":"Transaktion nicht vorhanden"}
These transactions refer to a previous transaction. They are based on a server-to-server communication and require no customer intervention (in terms of data entry).
Provided by: GiroCheckout
Called by: Merchant
When booking, the customer account is debited with an amount and the merchant account is credited. This model is based on the assumption that the associated business case has been completed, e.g. a shopping cart was offered, ordered and delivered to the customer.
A refund is to be used when a previous payment is to be returned fully or partially to the customer.
CAPTURE URL: https://payment.girosolution.de/girocheckout/api/v2/transaction/capture
REFUND URL: https://payment.girosolution.de/girocheckout/api/v2/transaction/refund
Name | Mandatory | Type | Description | |
---|---|---|---|---|
CAPTURE | REFUND | |||
merchantId | Yes | Yes | Integer | Merchant ID of a giropay project |
projectId | Yes | Yes | Integer | Project ID of a giropay project |
merchantTxId | Yes | Yes | String(255) | Unique merchant transaction ID. Allowed characters: any letters (incl. language-specific special characters such as German Umlauts), 0-9, symbols & = + , : ; . _ ! ? # / |
amount | Yes | Yes | Integer | Full or partial amount. For currencies that use decimals, specify amount in the smallest unit, e.g. Cent, Penny |
currency | Yes | Yes | String(3) | Transaction currency, see ISO 4217. EUR = Euro |
purpose | Yes | Yes | String(27) | Transaction purpose. This information is displayed on the accounting reports. |
reference | Yes | Yes | String(36) | GiroCheckout transaction ID of the underlying AUTH transaction. |
merchantReconciliationReferenceNumber | Optional | Optional | String(30) | Additional information for the payment reconciliation that is shown in the purpose on bank statements. |
final | Optional | Boolean | CAPTURE ONLY. Last CAPTURE for a reservation. After this, no further CAPTURE may be done on the referenced reservation. | |
kassenzeichen | Optional | String(255) | CAPTURE ONLY. Optional field that allows passing an additional reference/identifier for the transaction. This value is displayed inside GiroCockpit as part of the transaction details (and soon export) and a search for it is also supported there. | |
hash | Yes | Yes | String(32) | HMAC MD5 hash of all the values in the call. See Generate hash |
curl -d "merchantId=1234567" \ -d "projectId=1234" \ -d "merchantTxId=1234567890" \ -d "amount=10000" \ -d "currency=EUR" \ -d "purpose=Beispiel-Capture" \ -d "reference=dd724940-5e86-4072-8442-2c2ba2aebc79" \ -d "final=true" \ -d "hash=e4e57b71b094d7fa197374f4fbdd4ca9" \ https://payment.girosolution.de/girocheckout/api/v2/transaction/capture
The response is a JSON object. The field resultPayment returns an error code. If resultPayment = 4000 is returned, the transaction was carried out successfully. You receive a transaction number in the reply.
Name | Mandatory | Type | Description |
---|---|---|---|
reference | Yes | String(36) | GiroCheckout transaction ID |
merchantTxId | Yes | String(255) | Merchant transaction ID |
backendTxId | Yes | String(36) | Transaction ID of the payment provider |
amount | Yes | Integer | For currencies that use decimals, specify amount in the smallest unit, e.g. Cent, Penny |
currency | Yes | String(3) | Currency |
resultPayment | Yes | Integer | Payment result |
hash | Yes | String(32) | HMAC MD5 hash of all the values of the call. Siehe Generate hash |
hash : 36dc1f4622d0c1260fe5da76fe83fbd3
{"reference":"ehd82947-5e86-4072-8442-2c2ba2ae74a","referenceParent":null,"merchantTxId":"123456","backendTxId":"5720d913a1338","amount":"100","currency":"EUR","resultPayment":4000,"rc":0,"msg":""}
hash : c7dcb2d7d5e6719c6a51d81705bfc3af
{"reference":null,"rc":5030,"msg":"Betrag ungültig"}
Void is to be used when an already accepted transaction is not to be executed.
URL VOID: https://payment.girosolution.de/girocheckout/api/v2/transaction/void
Name | Mandatory | Type | Description |
---|---|---|---|
merchantId | Yes | Integer | Merchant ID of a giropay project |
projectId | Yes | Integer | Project ID of a giropay project |
merchantTxId | Yes | String(255) | Unique transaction ID of the merchant. Allowed characters: any letters (incl. language-specific special characters such as German Umlauts), 0-9, symbols & = + , : ; . _ ! ? # / |
reference | Yes | String(36) | GiroCheckout transaction ID that is to be voided |
hash | Yes | String(32) | HMAC MD5 hash on the complete JSON string. (see api call reply) |
curl -d "merchantId=1234567" \ -d "projectId=1234" \ -d "merchantTxId=1234567890" \ -d "reference=fb70602d-c137-4413-8432-7dcc69a9d891" \ -d "hash=edb7459114db25c2991d1783d4ab5388" \ https://payment.girosolution.de/girocheckout/api/v2/transaction/void
The reply is a JSON encoded string. The field rc contains the response code. If it is 0 the call was successful. The response includes a transaction number and other information.
Name | Mandatory | Type | Description |
---|---|---|---|
rc | yes | Integer | response code |
msg | yes | String(255) | Additional information about the response code |
reference | yes | String(36) | Unique GiroCheckout transaction ID |
referenceParent | yes | String(36) | GiroCheckout transaction ID of the original base transaction |
merchantTxId | yes | String(255) | Unique transaction id of the merchant |
backendTxId | yes | String(36) | Payment processor transaction ID |
amount | yes | Integer | Voided amount, if a decimal currency is used, the amount has to be in the smallest unit of value, e.g. Cent, Penny |
currency | yes | String(3) | Currency |
resultPayment | yes | Integer | Payment result codes |
HEADER parameter | |||
hash | yes | String(32) | HMAC MD5 hash on the complete JSON string. (see api call reply) |
{"reference":"ef27303f-87b3-465e-9c39-fabfb749d253","referenceParent":"5a101478-df14-4a79-86af-f743784c2c24","merchantTxId":"58e39be91fce8","backendTxId":"1226723_01","amount":"100","currency":"EUR","resultPayment":"4000","rc":0,"msg":""}
{"reference":null,"referenceParent":null,"merchantTxId":null,"backendTxId":null,"amount":null,"currency":null,"resultPayment":null,"rc":5200,"msg":"Transaktion nicht akzeptiert"}