openapi: 3.0.0
info:
x-logo:
url: getfile/przelewy24-logo_mini.png
altText: LogoP24
contact:
name: Przelewy24 Support
url: https://www.przelewy24.pl/support
title: Ekspres Przelewy24 REST API Documentation Additional API functionality Card API API
version: 1.0.6
description: "\n\n\n# Ekspres Przelewy24\n\nPrzelewy24 provides an authorisation and clearing system and provides payment services as a Domestic Payment Institution. <br><br/>\n<b><b>Ekspres-Przelewy24</b> service allows to quickly and effortlessly send money between accounts from different banks.</b><br/><br/>\nBelow documentation describes the process of information exchange in the course of ordering a transfer via Ekspres Przelewy24 with the use of REST API.<br/><br/>\nIn order to be able to access Ekspres API Przelewy24, first you need to [create an account](https://ekspres.przelewy24.pl/kontakt/index) in Ekspres P24 Administration Panel.\n<br/>\n# Basic notions\nThe following notions will be used for describing the operation of Ekspres Przelewy24:<br/><br/> **WWW system** – access to Ekspres Przelewy24 in the WWW version through the following websites:<ul>\n <li>[https://ekspres.przelewy24.pl](https://ekspres.przelewy24.pl) – production version,</li>\n <li>[https://testekspres.przelewy24.pl](https://testekspres.przelewy24.pl) – sandbox version.</li></ul>\n**API** – access to Ekspres Przelewy24 via REST API. <br/> **Partner** – a person / entity owning the system and submitting transfer orders to Ekspres.<br/> **Client** – a person using Ekspres services (payer or recipient of payment from Ekspres).\n\n# Modes and transfer processing\nEkspres Przelewy24 offers 3 modes of transfer processing:<ul> <li><b>Wallet</b> - transfers are processed using the funds previously paid into the wallet,</li> <li><b>P24</b> i <b>P24mobile</b> - transfers are processed only after the client has made the payment in [przelewy24.pl](https://www.przelewy24.pl),</li> Each of these modes allows the client to monitor the progress of the transfer by providing them with a dedicated URL address (available upon transfer registration).\n\n## Transfer processing in Wallet\n<b>Wallet</b> is characterized by quick processing of transfers to the client. Thanks to the funds accrued in the wallet, it is possible to effect immediate processing of a transfer registered by the Partner.<br/><br/>\n\n<img src=\"getfile/eng_wallet.png\" alt=\"Transfer w trybie Wallet\" class=\"center smallImg\">\n\n\n## Transfer processing in P24 and P24mobile\n<b>P24</b> and <b>P24mobile</b> processes payments based on the funds paid in by the Client through [przelewy24.pl](https://www.przelewy24.pl). Using this mode, the partner registers the transfer in API and, subsequently, sends a payment link to the client (alternatively, the payment link may also be sent automatically via email). Once the transaction is paid by the client in [przelewy24.pl](https://www.przelewy24.pl), the transfer registered by the partner is sent for processing.<br/><br/>\n<b>NOTE: P24mobile is analogous to P24 in that it is designed to operate with a mobile library.</b><br/><br/>\n\n<img src=\"getfile/eng_p24_p24mobile.png\" alt=\"Transfer w trybie P24 i P24mobile\" class=\"center smallImg\">\n\n\n# Codes of responses and erros\n## HTTP response codes\nEkspres Przelewy24 REST API uses response codes in HTTP headers to communicate the result of a query, potential problems and errors. <br/><br/> An inventory of possible response codes and their meanings are explained in the appropriate subchapters describing the specific methods.<br/><br/> <b>Always take note of the response code in order to react adequately to potential problems idempotent replies, etc.</b><br/><br/>\n<b>Possible response codes for all methods:</b>\n\n | Kod | Opis | Znaczenie |\n |--------------|:--------------|:------------|\n | 401 | Authorization Required | No access, check the key and the password, check if the key and the password are active and valid for this method. The code is also used to signal temporary failures. |\n | 403 | Forbidden | No access to a given method. The API key and the password are correct. Contact our staff in order to get access. |\n | 404 | Not Found | Method not found, check the URL address called. |\n | 405 | Method Not Allowed | The method used exists, but under a different http call. Check the calls for this method (GET/POST/etc.).|\n | 415 | Unsupported Media Type | The „Content-Type” value used is not allowed or a required header is missing. Inventory of allowed values available at <a href=\"#section/General-structures-of-queries-and-responses/General-query-format\"><b>General query format</b></a>. |\n | 500 | Internal Server Error | Server error, if the error recurs, contact our staff and provide the whole query processed, as well as your API key. |\n | 503 | Service Unavailable | Service temporarily unavailable due to a failure or planned upgrade. |\n\n\n## Error codes\nError codes appear in the output object of a query that ended with an error and, if it’s possible, indicate its cause. This allows to precisely establish the cause of the error and triggers an automatic reaction / error notification. <br/><br/>\nError codes are divided into the following groups:<ul> <li><b>1xxx</b> – input parameter validation error (the query contains an error),</li> <li><b>2xxx, 3xxx</b> – transfer registration error (the query is correct, but the transfer cannot be processed, e.g. due to insufficient funds),</b> <li><b>9xxx</b> – external services error (API failure caused by unavailability of a related service necessary to process the transfer, e.g. currency exchange),</li> <li><b>10000</b> – internal error (failure of Ekspres Przelewy24 REST API).</li></ul>\n<b>NOTE! When implementing API error service, in order to identify the error, rely solely on the codes, as the “description” parameter may change and constitutes additional information only!</b><br/><br/>\nThe table below presents error codes <b>input parameter validation:</b>\n\n | Error code | Description |\n |--------------|:--------------|\n | 1001 | The value of parameter <b>parameter_name</b> contains illicict characters |\n | 1002 | Parameter <b>parameter_name</b> value must not be empty |\n | 1003 | Passwords are not identical |\n | 1004 | The password must consist of at least 8 characters and contain small and capital letters and digits |\n | 1005 | Incorrect email address |\n | 1006 | Incorrect postal code |\n | 1007 | Incorrect country code |\n | 1008 | Incorrect amount |\n | 1009 | The <b>parameter</b> value submitted is not a correct integer |\n | 1010 | Incorrect currency |\n | 1011 | Incorrect account number |\n | 1012 | Incorrect URL address |\n | 1013 | Transaction type not serviced |\n | 1014 | Incorrect field value |\n | 1015 | Current transfer status prevents this operation, or incorrect transfer object |\n | 1016 | Incorrect date format / incorrect date |\n | 1017 | Incorrect query signature |\n | 1018 | Parameter value too long |\n | 1019 | IBAN number submitted has been blocked |\n\n<br/>The table below presents <b>transfer registration error codes:</b>\n\n | Error code | Description |\n |--------------|:--------------|\n | 2001\t| Bank unavailable |\n | 2002 |\tInsufficient funds in wallet |\n | 2003\t| Limit for a single transfer has been exceeded |\n | 2004\t|\tDaily limit on the amount of transfers paid has been exceeded |\n | 2005\t| Transfer ID not recognised |\n | 2006\t| Refund amount provided exceeds the transfer value available |\n | 2007\t| Access denied |\n | 2008\t| Incorrect transfer ID |\n | 2009\t| Transfer limit exceeded |\n | 2010\t| Transfer already returned in P24 mode |\n | 3000\t| Incorrect ID query |\n | 3001\t| Unknown sessionId in P24 mode |\n\n<br/>The table below presents <b>error codes for external services:</b>\n\n | Error code | Description |\n |--------------|:--------------|\n | 9001 |\tTransfer processing error. Contact the customer service department and provide the query ID |\n | 9002 |\tCurrency exchange error. Please, try again |\n\n<br/>The table below presents the <b>remaining error codes:</b>\n\n | Error code | Description |\n |--------------|:--------------|\n | 10000 |\tInternal error. Please, contact the customer service department and provide the query ID |\n\n\n\n# General structures of queries and responses\n## General query format\n\n API queries may be processed using any library that allows HTTPS protocol-based communication. Allowed Content-Type values:<ul>\n <li><b>application/json</b> – queries sent in JSON format,</li>\n <li><b>application/x-www-form-urlencoded</b> – queries sent as POST (urlencoded).</li></ul>\n\n <b>Required coding to UTF-8.</b><br/>\n\n Sample PHP code with the use of cURL\n ```php\n <?php\n $process = curl_init('https://endpoint/ekspres/v1/balance');\n // Content-Type header required\n curl_setopt(\n $process,\n CURLOPT_HTTPHEADER,\n array('Content-Type: application/json')\n );\n // Basic Auth authentication\n curl_setopt($process, CURLOPT_USERPWD, 'api-key' . \":\" . 'api-pass');\n curl_setopt($process, CURLOPT_RETURNTRANSFER, true);\n $return = json_decode(curl_exec($process));\n echo json_encode($return, JSON_PRETTY_PRINT) . \"n\";\n curl_close($process);\n ```\n\n## General response format\nA correct method call in Ekspres Przelewy24 REST API will generate a response in the form of a JSON object, in the format dependent on the method called.<br/> <p style=\"border:1.5px; border-style:dashed; border-color:#FF0000; padding: 1em;\"> <b>NOTE!</b><br/><br/> All the responses returned by API are <b>UTF-8-coded JSON objects without “slash” sign filters and unicode characters!</b><br/><br/> All the responses are returned using the following method:<br/> json_encode($response, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES)<br/><br/> For more information see [PHP documentation](https://www.php.net/manual/en/json.constants.php). </p><br/>\nIn the case of some errors, e.g. internal error 500 or authorisation error 401, the same http code will be returned without additional information in the body. These are the cases when the system does not have any more information on the error or does not want to make it available (for instance, due to lack of authorisation). <br/><br/>\n\n When most errors are generated, GeneralErrorObject is returned (in addition to the relevant http code) with additional details:<br/>\n\n <b>GeneralErrorObject:</b>\n\n | Field name | Type | Description |\n |--------------|:--------------:|:------------|\n | code | int | General <a href=\"#section/Codes-of-responses-and-erros/Error-codes\"><b>error code</b></a> |\n | description | string | Error details |\n\n <p style=\"color:darkblue; font-size:17px\"><b>Przykład odpowiedzi z obiektem GeneralErrorObject:</b></p>\n\n ```html\n HTTP/1.1 400 Bad Request\n Content-Type: application/json\n\n {\n „error”: {\n „code”: 1011,\n „description”: „Given IBAN value ”iban” is not valid”\n }\n }\n ```\n\n\n# Environments\n## Production environment\nEvery request is differentiated by its own unique request URL. This way Ekspres P24 knows which API-function you want to access. Combined with the base URL for either the production- or test-environment, you will get the complete API-URL.\n\nBase URL production system:<br/> https://secure.przelewy24.pl/express/v1\n\n## Test environment\nDuring implementation of the mechanisms in merchant’s system, it is recommended to use test environment. Test environment allows to reproduce system functionalities without making actual payments. <br><br>\nTest environment endpoint:<br> https://sandbox.przelewy24.pl/express/v1 <br><br>\n**<u>The test version does not effect transfers and requires separate login keys.</u>**\n\n# IP server addresses\nWe recommend script protection against suspicious calls using address filtering for incoming connections. IP server ranges for the P24 servers: <br><br> <font class = \"right\"><b>5.252.202.255 , 5.252.202.254</b></font><br> <font class = \"right\"><b>20.215.81.124</b></font><br> <font class = \"right\"><b>193.178.213.0/24</b></font><br> <font class = \"right\"><b>91.220.177.0/24</b></font><br> <font class = \"right\"><b>20.215.183.48/28</b></font><br> <font class = \"right\"><b>134.112.88.8/29</b></font><br>\n\n\n# API Access\nAuthentication is effected with the Basic Auth mechanism, which uses a REST API key (as a login) and the password assigned to it. Generating the API key is possible upon logging on to one’s account in the <a href=\"#section/Basic-notions\"><b>WWW System</b></a> (left-hand menu, tab “API Users” -> “REST User List”). A single user may possess a few API access keys.\n# Authentication\n<!-- Redoc-Inject: <security-definitions> -->\n"
servers:
- url: https://sandbox.przelewy24.pl
description: Sandbox server (uses test data)
- url: https://secure.przelewy24.pl
description: Production server (uses live data)
tags:
- name: Card API
paths:
/api/v1/card/info/{orderId}:
get:
tags:
- Card API
summary: Card info
parameters:
- name: orderId
in: path
description: An unique order ID.
required: true
schema:
type: integer
format: int64
description: The method generates information about specific payment card based on previous payment. Including reference number to charge card without CVV authorisation.
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/cardinfores'
'400':
description: Wrong input data
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorCodeResponse'
'403':
description: Not authorized
content:
application/json:
schema:
$ref: '#/components/schemas/UnauthorizedResponse'
'404':
description: Transaction not exists
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorCodeResponse'
security:
- basicAuth: []
/api/v1/card/chargeWith3ds:
post:
tags:
- Card API
summary: Charge card with 3DS
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CardChargeRequestBody'
description: The method allows to charge a card based on the reference number.
responses:
'200':
description: The charge card command has been accepted - notification will be send on success.
content:
application/json:
schema:
$ref: '#/components/schemas/ChargeCard3dsSuccessResponse'
'201':
description: The card payment requires 3DS redirection
content:
application/json:
schema:
$ref: '#/components/schemas/ChargeCard3dsSuccessResponse'
'400':
description: Invalid input data
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidInputData'
'401':
description: Not authorized
content:
application/json:
schema:
$ref: '#/components/schemas/UnauthorizedResponse'
security:
- basicAuth: []
/api/v1/card/charge:
post:
tags:
- Card API
summary: Charge card
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CardChargeRequestBody'
description: The method allows to charge a card based on the reference number.
responses:
'200':
description: The charge card command has been accepted - notification will be send on success.
content:
application/json:
schema:
$ref: '#/components/schemas/ChargeCardSuccessResponse'
'400':
description: Invalid input data
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidInputData'
'401':
description: Not authorized
content:
application/json:
schema:
$ref: '#/components/schemas/UnauthorizedResponse'
security:
- basicAuth: []
/api/v1/card/pay:
post:
tags:
- Card API
summary: Card Payment
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CardRegisterRequestBody'
description: Method is used for charging customer's card. Method directly sends card details. To use the method, the merchant must have PCI DSS certificate.
responses:
'200':
description: The card payment has been succesed.
content:
application/json:
schema:
$ref: '#/components/schemas/CardPaySuccessResponse'
'201':
description: The card payment requires 3DS redirection.
content:
application/json:
schema:
$ref: '#/components/schemas/CardPayThreeDSecureResponse'
'400':
description: Invalid input data
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidInputData'
'401':
description: Not authorized
content:
application/json:
schema:
$ref: '#/components/schemas/UnauthorizedResponse'
'409':
description: Conflict
content:
application/json:
schema:
$ref: '#/components/schemas/CardPayResponse409'
security:
- basicAuth: []
/api/v1/transaction/reject:
put:
tags:
- Card API
summary: Reject transaction
description: Method allows to reject an authorised transaction.
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/TransactionRejectJsonRequestBodyV11'
description: null
required: true
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/TransactionReject200'
'400':
description: Invalid input data
content:
application/json:
schema:
$ref: '#/components/schemas/InvalidInputData'
'401':
description: Not authorized
content:
application/json:
schema:
$ref: '#/components/schemas/UnauthorizedResponse'
'500':
description: Undefined error
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorCodeResponse'
components:
schemas:
CardRegisterRequestBody:
type: object
properties:
transactionToken:
type: string
description: Token obtained during registration
cardNumber:
type: string
description: Card number
maxLength: 16
cardDate:
type: string
description: Card expiry date in format MMYYYY
cvv:
type: string
description: Card CVV
clientName:
type: string
description: First name and surname of cardholder
required:
- transactionToken
- cardNumber
- cardDate
- cvv
- clientName
CardPaySuccessResponse:
properties:
data:
properties:
orderId:
type: integer
format: int64
redirectUrl:
type: string
type: object
responseCode:
type: number
example: 0
InvalidInputData:
properties:
error:
type: string
default: Invalid input data
example: Invalid input data
code:
type: number
default: 400
example: 400
UnauthorizedResponse:
properties:
error:
type: string
default: Incorrect authentication
example: Incorrect authentication
code:
type: number
default: 401
example: 401
ChargeCardSuccessResponse:
properties:
data:
properties:
orderId:
type: integer
format: int64
description: Registered transaction ID
type: object
responseCode:
type: number
default: 0
example: 0
cardinfores:
properties:
data:
type: object
properties:
refId:
type: string
description: Unique card token (reference code)
bin:
type: integer
description: Card’s BIN number
mask:
type: string
description: Masked card number
cardType:
type: string
description: Card type (VISA, ECMC)
cardDate:
type: string
description: Expiry date in the following format MMYYYY
hash:
type: string
description: Unique card hash – unique for each card
responseCode:
type: number
default: 0
example: 0
TransactionReject200:
properties:
data:
properties:
status:
type: string
example: success
type: object
responseCode:
type: string
example: '0'
TransactionRejectJsonRequestBodyV11:
properties:
orderId:
type: integer
format: int64
description: Transaction ID assigned by Przelewy24
sessionId:
type: string
description: Unique ID from Partner’s system
sign:
type: string
description: <br>Checksum of parameters:<br> {<font color = "brown">"merchantId":</font>int,<font color = "brown">"orderId":</font>int,<font color = "brown">"sessionId":</font>"string",<font color = "brown">"crc":</font>"string"} <br><br>calculated with the use of sha384<br><br> <b><font color = "#DB2053">IMPORTANT!:</font></b><br> in case json_encode function is used, the following attributes should be added <br> "JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES"
ChargeCard3dsSuccessResponse:
properties:
data:
properties:
orderId:
type: integer
format: int64
redirectUrl:
type: string
type: object
responseCode:
type: number
example: 0
CardPayThreeDSecureResponse:
properties:
data:
properties:
orderId:
type: integer
format: int64
redirectUrl:
type: string
type: object
responseCode:
type: number
example: 0
ErrorCodeResponse:
properties:
error:
type: string
example: Undefined error
default: Undefined error
code:
type: integer
example: 500
default: 500
type: object
CardChargeRequestBody:
properties:
token:
type: string
description: Token registered by <a href="#tag/Transaction-service-API/paths/~1api~1v1~1transaction~1register/post"><b>transaction/register</b></a> method. Card reference number must be provided during transaction registration in <b>methodRefId</b> parameter.
CardPayResponse409:
properties:
error:
type: string
example: Unable to make payment.
code:
type: number
securitySchemes:
basicAuth:
description: This is the default authentication method. User login is API REST key the password assigned to it.
type: http
scheme: basic
x-tagGroups:
- name: Methods available in API
tags:
- Ekspres P24 API
- name: Sign parameter
tags:
- Calculation of sign parameter
- name: Transfer
tags:
- Notifications on transfer status
- Table of transfer statuses
- Transfer scenarios