Shift4 3D Secure & Risk API
Cardholder authentication and fraud controls for the Shift4 Payment API — 3D Secure (3DS) authentication flows plus risk scoring and rule evaluation.
OpenAPI Specification
openapi: 3.1.0
info:
version: 1.7.57
title: Shift4 Payment API
contact:
url: https://www.shift4.com/contact-us/
servers:
- url: https://api.shift4test.com/api/rest/v1
description: Host Direct Test URL
- url: https://api.shift4api.net/api/rest/v1
description: Host Direct Production URL
components:
securitySchemes:
AccessToken:
type: apiKey
name: AccessToken
in: header
description: >
A security credential used to authenticate API requests and all
[i4Go®](https://s4-myportal.s3.amazonaws.com/downloads/documentation/i4go/i4go%20technical%20reference%20guide.pdf)
authorizeClient/preauthorizeClient requests. An Access Token is the
alias for the merchant account and interface being used.
Example:
```
AccessToken: EA79FB05-3AA7-4500-AF9A-73F986FF2C1D
```
HMAC-SHA256:
type: http
scheme: hmac-sha256
description: >
Authentication using HMAC-256 signatures as the authorization scheme.
Sent in the `Authorization` header in the following format:
`Authorization`: **HMAC-SHA256**
`Credential`={value}&`Signature`={value}
| Argument | Description |
|---------------|--------------------------------------------------|
| HMAC-SHA256 | Authorization scheme. |
| Credential | The ID of the key used to compute the signature. |
| Signature | base64 encoded HMACSHA256 value. |
Example:
```
Authorization: HMAC-SHA256 Credential=AESKEY1&Signature=8SFtIc6zQlswxAZqDKXL+BpRmlDvIWyjOwU8wdl0zK4=
```
parameters:
InterfaceVersion:
required: true
name: InterfaceVersion
in: header
schema:
type: string
maxLength: 11
example: '2.1'
description: >
Refers to the version of the program or application that is sending
requests to Shift4. The following special characters are not
allowed: $ % : ^ - ~ < > , ? “ ” ‘ ’ { } [ ] \ + =
InterfaceName:
required: true
name: InterfaceName
in: header
schema:
type: string
maxLength: 25
example: ForwardPOS
description: >
Refers to the name of the program or application that is sending
requests to Shift4. This should be the name of the program that you
purchased or created. The following special characters are not
allowed: $ % : ^ - ~ ` < > , ? “ ” ‘ ’ { } [ ] \ + =
CompanyName:
required: true
name: CompanyName
in: header
schema:
type: string
maxLength: 26
example: PAWS
description: >
Refers to the vendor or partner that designed and certified the
interface. The information you use in this field should match what
Shift4 has on file or what was agreed upon in your Integration Plan. The
following special characters are not allowed: $ % : ^ - ~ `
< > , ? “ ” ‘ ’ { } [ ] \ + =
AccessToken:
required: true
name: AccessToken
in: header
schema:
type: string
format: uuid
maxLength: 52
example: EA79FB05-3AA7-4500-AF9A-73F986FF2C1D
description: >
A security credential used to authenticate API requests and all
[i4Go®](https://s4-myportal.s3.amazonaws.com/downloads/documentation/i4go/i4go%20technical%20reference%20guide.pdf)
authorizeClient/preauthorizeClient requests. An Access Token is the
alias for the merchant account and interface being used. The Access
Token is required in all requests except an [Access Token
Exchange](/apis/payments-platform-rest/openapi/credentials/accesstokenexchange)
request, which generates an Access Token using an `authToken` and
`clientGuid`.
Invoice:
required: true
name: Invoice
in: header
schema:
$ref: '#/components/schemas/TransactionInvoice'
ApiOptions:
required: false
name: ApiOptions
in: header
schema:
type: string
maxLength: 255
example: ALLOWPARTIALAUTH,RETURNEXPDATE
description: >
API Options modify the request being made. Multiple API Options can be
sent in a comma separated list with no spaces. See the [API
Options](/guides/appendices/api-options.md) section for more
information.
ReceiptColumns:
required: false
name: ReceiptColumns
in: header
schema:
type: integer
example: 40
maxLength: 48
description: >
Send this field if you want Shift4 to format the receipt text instead of
returning individual fields. The value sent will correlate to the column
width of the formatted receipt that we return. (This also allows the
receipt text to wrap to fit the paper size of the printed receipt.) See
the [Printing Receipts](/guides/core-concepts/printing-receipts) section
of this document for more information on formatted receipts.
TokenValue:
name: Token
in: header
schema:
type: string
maxLength: 16
example: '8048471746471119'
description: This field is used to specify the token for the payment method.
ReversalReason:
name: ReversalReason
in: header
schema:
type: string
minLength: 2
maxLength: 2
enum:
- '01'
- '02'
- '03'
- '04'
- '05'
- '06'
- '07'
- '08'
- '09'
example: '01'
description: |
Specifies the reason for the reversal.
Value|Description
-----|-----------
01 | Timeout
02 | POS lost connection
03 | Merchant cancellation
04 | Customer cancellation
05 | EMV card removed prematurely
06 | EMV card declined issuer approval
07 | PIN PAD unavailable
08 | Chip error
09 | Suspected Fraud
CardNumber:
name: CardNumber
in: header
schema:
type: string
maxLength: 32
example: '4321000000001119'
description: >
The payment card number. This field will always be masked when returned
in a response.
P2PEData:
name: P2PEData
in: header
schema:
type: string
maxLength: 2048
description: The full output of a P2PE keypad/magnetic swipe reader (MSR).
P2PEFormat:
name: P2PEFormat
in: header
schema:
type: string
minLength: 2
maxLength: 2
enum:
- '01'
- '02'
- '03'
- '04'
- '05'
example: '01'
description: |
Classifies the type of payment device being used for P2PE.
Value|Description
-----|-----------
01 | IDTech Enhanced Encryption format, USB KB mode
02 | IDTech Enhanced Encryption format, USB HID mode
03 | Ingenico format
04 | VeriFone format
05 | Shift4 TDES DUKPT format
P2PEKsn:
name: P2PEKsn
in: header
schema:
type: string
maxLength: 20
example: '6299495001100E200041'
description: |
**Conditional: Required when `p2pe.format` == "05"**
The key serial number which was used to encrypt the P2PE data.
TokenSerialNumber:
name: SerialNumber
in: header
schema:
type: string
maxLength: 10
example: '266'
description: >
In requests that require the use of a shared card token that is held by
another merchant account, such as in TokenStore or TokenShare®, this
field is used to specify the serial number for the account where the
card token is stored.
TrackData:
name: TrackData
in: header
schema:
type: string
maxLength: 128
example: ;4321000000001119=2212201999999?
description: >
**Conditional: Send in the initial authorization/sale request when
processing a swiped MSR transaction. This field is not specified when
using True P2PE® (point-to-point encryption) or a UTG-controlled PIN
pad.**
Card swipe data exactly as read by an MSR.
ApiOptionsGetMerchant:
required: false
name: ApiOptions
in: header
schema:
type: string
maxLength: 255
example: RETURNPROCESSORS
description: >
API Options modify the request being made. Multiple API Options can be
sent in a comma separated list with no spaces. See the [API
Options](/guides/appendices/api-options.md) section for more
information.
Value | Description
-----------------|------------
RETURNPROCESSORS | Returns the processor information and card ranges the
merchant is configured for.
TerminalID:
required: true
name: TerminalId
in: header
schema:
type: string
maxLength: 32
example: '1742'
description: >
The API Terminal ID configured in UTG TuneUp must be specified in this
field.
TerminalIDDevicesInfo:
name: TerminalId
in: header
schema:
type: string
maxLength: 32
example: '1742'
description: >
**Conditional: Required for UTG, optional for Commerce Engine.**
The API Terminal ID assigned to the device.
For UTG it is configured in TuneUp and must be included in the request
For Commerce Engine it is defined in the Terminal Management System
(TMS) and is optional. If sent, it must match the value defined in the
TMS.
BusinessDateTotals:
required: true
name: BusinessDate
in: header
schema:
type: string
format: ISO 8601
minLength: 10
example: '2021-04-15T09:18:23.283-07:00'
description: The business date you want to obtain the totals report for.
Inclusive:
required: false
name: Inclusive
in: header
schema:
type: string
enum:
- 'Y'
- 'N'
description: >
Indicates whether or not you want the batch to include transactions for
every day leading up to the `BusinessDate`. If this parameter is not
sent, the assumed value will be 'Y'.
PaymentLinksLimit:
name: Limit
in: header
schema:
type: number
maximum: 100
description: |
Maximum number of returned objects
PaymentLinksStartingAfterId:
name: StartingAfterId
in: header
schema:
type: string
description: >
Cursor used for pagination (getting the next page). For example, if you
make a list request and receive 10 objects, where the last object has
`id=some-example-id` - then you can make another request with
`startingAfterId=some-example-id` to get the next page of that list.
PaymentLinksEndingBeforeId:
name: EndingBeforeId
in: header
schema:
type: string
description: >
Cursor used for pagination (getting the previous page). For example, if
you make a list request and receive 10 objects, where the first object
has `id=some-example-id` - then you can make another request with
`endingBeforeId=some-example-id` to get the previous page of that list
PaymentLinksDateTimeAfter:
name: DatetimeAfter
in: header
schema:
type: string
format: ISO 8601
example: '2024-05-21T09:18:23.283-07:00'
description: |
Returns only records strictly after the specified timestamp
PaymentLinksDateTimeBefore:
name: DatetimeBefore
in: header
schema:
type: string
format: ISO 8601
example: '2024-05-21T09:18:23.283-07:00'
description: |
Returns only records strictly before the specified timestamp
PaymentLinksId:
name: PaymentLinkId
in: header
required: true
schema:
type: string
description: |
Used for selecting payment link by id
PaymentLinksIdOptional:
name: PaymentLinkId
in: header
schema:
type: string
description: |
Used for selecting payment link by id
CheckoutSessionsStatus:
name: Status
in: header
schema:
type: string
enum:
- active
- paid
- expired
- failed
description: >
Filter checkout sessions by their current status. When omitted, all
sessions are returned.
| Value |
Description
|
|-----------|------------------------------------------------------------------------------------------------|
| `active` | Session is open — payment not yet completed, not expired,
and within the allowed failure count |
| `paid` | Payment was completed
successfully
|
| `expired` | Session expired or was deleted without a successful
payment |
| `failed` | Payment was attempted but reached the maximum number of
failed attempts |
An invalid value returns HTTP 400 with error code
`invalid_header_format`.
CheckoutSessionsId:
name: CheckoutSessionId
in: header
required: true
schema:
type: string
description: |
Used for selecting checkout session by id
AuthorizationHMACSHA256:
name: Authorization
required: true
in: header
schema:
type: string
example: >-
Authorization: HMAC-SHA256
Credential=AESKEY1&Signature=8SFtIc6zQlswxAZqDKXL+BpRmlDvIWyjOwU8wdl0zK4=
description: |
HMAC-SHA256 signature
Shift4AppId:
name: Shift4AppId
in: header
schema:
type: string
example: Commerce Engine
description: |
Shift4 application identifier
Shift4AppVersion:
name: Shift4AppVersion
in: header
schema:
type: string
example: 2.4.0
description: |
Shift4 application version number
MagicCubeDeviceId:
required: true
name: deviceId
in: path
schema:
type: string
example: GOiQMwBhSQ8THouJ
description: |
MagicCube Device Id
IdempotencyId:
required: true
name: IdempotencyId
in: header
schema:
type: string
format: uuid
description: >
Unique identifier for the request. Each request must contain a unique
`requestId` value.
Any reattempts due to timeout or error scenarios should include the
same `requestId` as the original request to ensure idempotence.
MID:
required: true
name: mid
in: query
schema:
type: string
maxLength: 10
example: 123456
description: |
The Shift4 MID number
SourceIP:
name: sourceIp
in: query
schema:
type: string
example: 63.57.84.101
description: >
Public source IP Address where the request originates, not the IP
Address of the web server.
EmailAddress:
name: emailAddress
in: query
schema:
type: string
example: janedoe@email.com
description: |
Email address
EmailDomain:
name: emailDomain
in: query
schema:
type: string
example: gmail.com
description: |
Email domain
FullName:
name: fullName
in: query
schema:
type: string
example: John Smith
description: |
Full Name
Token:
name: token
in: query
schema:
type: string
example: '8058471748284111'
description: |
Token
schemas:
DateTime:
type: string
format: ISO 8601
example: '2024-05-21T09:18:23.283-07:00'
description: >
The date and time in ISO 8601 format including the timezone offset
(yyyy-mm-ddThh:mm:ss.nnn+hh:mm).
Must be sent as the local date/time of the merchant. For example, a
request processed at a merchant in the Pacific time zone at 9:18am on
April 15th 2021 would be sent as 2021-04-15T09:18:23.283-07:00
CredentialAccessToken:
type: string
format: uuid
maxLength: 52
example: EA79FB05-3AA7-4500-AF9A-73F986FF2C1D
readOnly: true
description: >
A security credential used to authenticate API requests and all
[i4Go®](https://s4-myportal.s3.amazonaws.com/downloads/documentation/i4go/i4go%20technical%20reference%20guide.pdf)
authorizeClient/preauthorizeClient requests. An Access Token is the
alias for the merchant account and interface being used. The Access
Token is required in all requests except an [Access Token
Exchange](/apis/payments-platform-rest/openapi/credentials/accesstokenexchange)
request, which generates an Access Token using an `authToken` and
`clientGuid`.
CredentialAuthToken:
type: string
format: uuid
maxLength: 51
example: 3504489F-A774-88E0-80114FBBC925E207
writeOnly: true
description: >
A unique encrypted identifier that refers to a specific merchant
account. It is required when making an [Access Token
Exchange](/apis/payments-platform-rest/openapi/credentials/accesstokenexchange)
request. For detailed information about the AuthToken, please see
[Authentication](/guides/quickstart#access-token-exchange)
CredentialClientGuid:
type: string
format: uuid
maxLength: 51
example: A3B18F21-AD17-8416-0626C4C9F1CA86A7
writeOnly: true
description: >
The Client GUID is a unique identifier that is used to identify an
interface across all of the merchant accounts that use it. The same
Client GUID can be used for all versions of the same interface. If a
completely new interface is certified, then you will receive a new
Client GUID, which must be hard coded into the application and must not
be a configurable field. The Client GUID is required when making an
[Access Token
Exchange](/apis/payments-platform-rest/openapi/credentials/accesstokenexchange).
For detailed information about the Client GUID, please see
[Authentication](/guides/quickstart#access-token-exchange).
**Requirement: The Client GUID supplied by your API Analyst must be hard
coded into your application because it will permanently identify your
interface across all merchant accounts.**
CredentialApiSerialNumber:
type: string
maxLength: 10
example: '266'
readOnly: true
description: >
The serial number for the merchant account. This field is only used for
backwards compatibility with older interfaces and has been replaced by
the Access Token.
CredentialApiPassword:
type: string
maxLength: 32
example: 9YCR23G7%BY#9+
readOnly: true
description: >
A credential used to authenticate the API Serial Number when processing
a request. This field is only used for backwards compatibility with
older interfaces and has been replaced by the Access Token.
Credential:
type: object
required:
- authToken
- clientGuid
properties:
accessToken:
$ref: '#/components/schemas/CredentialAccessToken'
authToken:
$ref: '#/components/schemas/CredentialAuthToken'
clientGuid:
$ref: '#/components/schemas/CredentialClientGuid'
apiSerialNumber:
$ref: '#/components/schemas/CredentialApiSerialNumber'
apiPassword:
$ref: '#/components/schemas/CredentialApiPassword'
ServerName:
type: string
maxLength: 50
example: TM01CE
description: |
The name of the server that processed the request.
Server:
type: object
readOnly: true
properties:
name:
$ref: '#/components/schemas/ServerName'
ErrorCode:
type: integer
maxLength: 5
readOnly: true
example: 64100
description: >
Code indicating the type of error that occurred. Refer to the [Error
Codes](/guides/appendices/error-codes) section of this document for more
details.
**Note: This is currently only supported for European merchant
processing.**
ErrorSeverity:
type: string
enum:
- Info
- Error
- Alert
readOnly: true
example: Info
description: >
Severity level of the error.
| Severity |
Description |
| -------- |
---------------------------------------------------------------- |
| Info | Action not required - Data input/formatting is
incorrect |
| Error | Action may be required - Communication, timeout or network
issue |
| Alert | Action required - System
issue |
ErrorShortText:
type: string
maxLength: 16
readOnly: true
example: NOT IN CARDRANGE
description: >
Abbreviated error message that is always returned if an error condition
exists
ErrorLongText:
type: string
maxLength: 255
readOnly: true
example: Card type not recognized
description: |
Extended error message that is returned if an error condition exists.
ErrorPrimaryCode:
type: integer
maxLength: 4
readOnly: true
example: 9842
description: >
Code indicating the type of error that occurred. Refer to the [Error
Codes](/guides/appendices/error-codes) section of this document for more
details.
ErrorSecondaryCode:
type: integer
maxLength: 4
readOnly: true
example: 0
description: >
This code supplements the code specified in the `error.primaryCode`
field to provide additional information about the error that occurred.
Error:
type: object
properties:
code:
$ref: '#/components/schemas/ErrorCode'
severity:
$ref: '#/components/schemas/ErrorSeverity'
shortText:
$ref: '#/components/schemas/ErrorShortText'
longText:
$ref: '#/components/schemas/ErrorLongText'
primaryCode:
$ref: '#/components/schemas/ErrorPrimaryCode'
secondaryCode:
$ref: '#/components/schemas/ErrorSecondaryCode'
LighthouseDataResponse:
type: string
example: >-
eyJwYXltZW50SWQiOiI4NWM0MWNhNy01NzVjLTQzNGUtODIyZi0xYzZlOTE0ZDAzODYiLCJyZW1haW5pbmdBbW91bnQiOjB9
description: >
Base64 encoded JSON formatted data that will be returned from Lighthouse
to be passed back to SkyTab. This data will contain variable
information.
AmountTotal:
type: number
maxLength: 14
example: 160
description: >
The amount being charged for a particular transaction. If other amount
fields are sent, they must be included in the total amount. Amount
cannot be zero.
AmountTax:
type: number
maxLength: 14
example: 15
description: >
The amount of sales tax charged for a transaction. The tax amount is
used by businesses to track tax expenses for accounting purposes.
Identifying the tax amount also helps consumers understand the total
amount that they were billed. This field is part of Level 2 card data.
AmountTaxIndicator:
type: string
maxLength: 1
enum:
- 'Y'
- 'N'
example: 'Y'
description: |
Value|Description
-----|-----------
Y | Tax is included
N | Tax is not included
AmountCashback:
type: number
maxLength: 14
example: 20
description: >
Specifies the cashback amount in a transaction. When using a
UTG-controlled PIN pad with the ALLOWCASHBACK API Option, this field
will return the cashback amount requested by the consumer. The interface
can also send the desired cashback amount in a request by adding it to
the `amount.total` and including it in the `amount.cashback` field. This
will bypass prompting the consumer for a cashback amount.
IIASAmount:
type: number
maxLength: 14
example: 34
description: |
The subtotal for this type of healthcare expenses.
IIASType:
type: string
minLength: 2
maxLength: 2
example: 4T
enum:
- 4O
- 4S
- 4T
- 4U
- 4V
- 4W
- 4X
description: >
This code classifies eligible healthcare expenses.
Value|Description
-----|-----------
4O | Cash Disbursement (Discover Only) – Amount of Cash Back Being
Requested
4S | Healthcare (Visa/MC Only) – Qualified Medical Expenses or
Over-the-Counter
4T | Transit (Visa Only) – Transit Fare Media (e.g., Commuter and
Parking Passes, Mass Transit Vouchers, and Tickets)
4U | RX (Visa/MC Only)
4V | Vision (Visa Only)
4W | Clinical (Visa Only)
4X | Dental (Visa Only)
IIASAmounts:
type: object
properties:
amount:
$ref: '#/components/schemas/IIASAmount'
type:
$ref: '#/components/schemas/IIASType'
IIASAmountsArray:
type: array
writeOnly: true
items:
$ref: '#/components/schemas/IIASAmounts'
example:
- type: 4S
amount: 75
- type: 4W
amount: 25
description: >
**Conditional: Send in the request if processing for a health care
merchant.**
For Vision related charges you must send only `iiasAmounts.type = 4V`
and the corresponding `iiasAmounts.amount` value.
For all other charges, the first entry in the array should have an
amount representing the total of all healthcare costs, and
`iiasAmounts.type = 4S`. Any subsequent entries should contain the
subtotal for each of the other expense types involved in this
transaction.
AmountTip:
type: number
maxLength: 14
example: 20
description: |
**Conditional: Send in the request if a tip is included.**
The tip amount of the transaction.
AmountCheckTotal:
type: number
maxLength: 14
writeOnly: true
example: 200
description: >
Optional field specifying the total amount of the entire bill/invoice
that this transaction is part of. It can be larger than `amount.total`
in scenarios where the check is being split or if a portion of the check
was already paid in cash or another form of payment.
AmountObjectNoSurcharge:
type: object
description: >
Object containing information regarding the amount being requested. The
`total` field within the object is required and specifies the amount
being requested. All other fields are for informational purposes and
must also be included in the `total` field. For example, a purchase of
$100 with a $20 tip and $8 tax would be `128.00` in the `total` field,
`20.00` in the `tip` field and `8.00` in the `tax` field.
Note: For merchants that are configured to allow multiple currencies,
the amount fields can specify up to three decimal places. However, the
number of decimal places can not exceed the number allowed for the
specified currency. See the [Currency
Codes](/guides/appendices/currency-codes) section for details.
required:
- total
- tax
properties:
total:
$ref: '#/components/schemas/AmountTotal'
tax:
$ref: '#/components/schemas/AmountTax'
taxIndicator:
$ref: '#/components/schemas/AmountTaxIndicator'
cashback:
$ref: '#/components/schemas/AmountCashback'
iiasAmounts:
$ref: '#/components/schemas/IIASAmountsArray'
tip:
$ref: '#/components/schemas/AmountTip'
checkTotal:
$ref: '#/components/schemas/AmountCheckTotal'
ClerkNumericId:
type: integer
maxLength: 5
example: 1576
description: >
A number used to identify the point-of-sale (POS) or property management
system (PMS) clerk or user. The value cannot be 0. An interface must be
able to dynamically populate this field (not use a hardcoded value),
unless the interface will be used exclusively for e-commerce.
Clerk:
type: object
required:
- numericId
properties:
numericId:
$ref: '#/components/schemas/ClerkNumericId'
TransactionInvoice:
type: string
maxLength: 10
example: '0510093358'
description: >
10-digit invoice number assigned by the interface to identify a
transaction. An invoice number serves as a unique key that identifies a
transaction within a batch in Shift4's Gateway.
**Note: For US and Canadian processing: Although the invoice number is
sent as a JSON string it is a numeric value. No alpha characters are
allowed.**
**For processing outside of the US and Canada alpha characters are
allowed.**
TransactionNotes:
type: string
maxLength: 4096
example: Transaction notes are added here
description: >
A free-form notes field that supports the use of HTML tags. This can be
used for reference in [Lighthouse Transaction
Manager](https://ltm.shift4test.com/) and is not sent to the
authorization host. Escaped quotation marks should not be sent in the
Notes field.
TransactionBusinessDate:
type: string
format: ISO 8601
minLength: 10
example: '2021-04-15'
description: >
Desired business date of a transaction. Include when overriding the
existing business date of a transaction. The overriding date may be
earlier or later than the existing date. (yyyy-mm-dd)
AmexPropertyCode:
type: string
maxLength: 15
example: '21546782948'
description: >
The code that contains a Merchant-assigned store or location number (or
name) that uniquely identifies where the transaction took place.
TransactionAmex:
type: object
properties:
propertyCode:
$ref: '#/components/schemas/AmexPropertyCode'
AutoEstimatedDays:
type: integer
maxLength: 2
example: 5
description: |
Estimated contract length of car rental.
AutoCheckIn:
type: object
description: |
**Conditional: Utilize this object for Auto Rental transactions**
properties:
estimatedDays:
$ref: '#/components/schemas/AutoEstimatedDays'
AirlineCarrierCode:
type: string
maxLength: 4
example: '5472'
description: |
The code of the airline carrier issuing the ticket.
AirlineCarrierName:
type: string
maxLength: 19
example: American Airlines
description: |
The name of the airline carrier issuing the ticket.
AirlineConjunctionTicketIndicator:
type: string
maxLength: 1
enum:
- 'Y'
- 'N'
example: 'N'
description: >
Indicates whether the itinerary contains more than four segments of
travel.
Value | Description
-------|-------------------
Y | Yes
N | No
AirlineDocumentType:
type: string
maxLength: 2
enum:
# --- truncated at 32 KB (1417 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/shift4/refs/heads/main/openapi/shift4-payment-api.yml