Shift4 Credentials API

openapi: 3.2.0
info:
  version: 1.7.57
  title: Shift4 Payment Credentials API
  contact:
    url: https://www.shift4.com/contact-us/
servers:
- url: https://api.shift4test.com/api/rest/v1
  description: Host Direct Test URL
- url: https://api.shift4api.net/api/rest/v1
  description: Host Direct Production URL
tags:
- name: Credentials
paths:
  /credentials/accesstoken:
    servers:
    - url: https://api.shift4test.com/api/rest/v1
      description: Host Direct Test URL
    - url: https://api.shift4api.net/api/rest/v1
      description: Host Direct Production URL
    - url: https://192.168.1.10:277/api/rest/v1
      description: Locally Installed UTG URL
    - url: https://192.168.1.20:8085/api/rest/v1
      description: Commerce Engine For On Premise URL
    - url: https://api.shift4test.com/api/rest/v1
      description: Commerce Engine For Cloud Test URL
    - url: https://api.shift4api.net/api/rest/v1
      description: Commerce Engine For Cloud Production URL
    post:
      tags:
      - Credentials
      summary: Access Token Exchange
      operationId: accesstokenexchange
      security:
      - {}
      description: 'This function is used to request exchanging a Client GUID and Auth Token for an Access Token.


        **Integration Methods:**

        - Host Direct

        - Locally Installed UTG

        - Commerce Engine For On Premise

        - Commerce Engine For Cloud


        See the [Integration Methods](/guides/quickstart#integration-methods) and [URLs Section](/guides/quickstart#urls) sections of the Development Quick Start guide for details regarding each processing option.

        '
      parameters:
      - $ref: '#/components/parameters/InterfaceVersion'
      - $ref: '#/components/parameters/InterfaceName'
      - $ref: '#/components/parameters/CompanyName'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              required:
              - dateTime
              - credential
              properties:
                dateTime:
                  $ref: '#/components/schemas/DateTime'
                credential:
                  $ref: '#/components/schemas/Credential'
      responses:
        '200':
          description: AccessToken request was processed
          content:
            application/json:
              schema:
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        dateTime:
                          $ref: '#/components/schemas/DateTime'
                        credential:
                          type: object
                          properties:
                            accessToken:
                              $ref: '#/components/schemas/CredentialAccessToken'
                        server:
                          $ref: '#/components/schemas/Server'
        '400':
          description: Error
          content:
            application/json:
              schema:
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        error:
                          $ref: '#/components/schemas/Error'
                        server:
                          $ref: '#/components/schemas/Server'
              examples:
                Error:
                  $ref: '#/components/examples/AuthTokenNotValidError'
        '504':
          $ref: '#/components/responses/TimeoutResponse'
components:
  schemas:
    Error:
      type: object
      properties:
        code:
          $ref: '#/components/schemas/ErrorCode'
        severity:
          $ref: '#/components/schemas/ErrorSeverity'
        shortText:
          $ref: '#/components/schemas/ErrorShortText'
        longText:
          $ref: '#/components/schemas/ErrorLongText'
        primaryCode:
          $ref: '#/components/schemas/ErrorPrimaryCode'
        secondaryCode:
          $ref: '#/components/schemas/ErrorSecondaryCode'
    CredentialClientGuid:
      type: string
      format: uuid
      maxLength: 51
      example: A3B18F21-AD17-8416-0626C4C9F1CA86A7
      writeOnly: true
      description: 'The Client GUID is a unique identifier that is used to identify an interface across all of the merchant accounts that use it. The same Client GUID can be used for all versions of the same interface. If a completely new interface is certified, then you will receive a new Client GUID, which must be hard coded into the application and must not be a configurable field. The Client GUID is required when making an [Access Token Exchange](/apis/payments-platform-rest/openapi/credentials/accesstokenexchange). For detailed information about the Client GUID, please see [Authentication](/guides/quickstart#access-token-exchange).


        **Requirement: The Client GUID supplied by your API Analyst must be hard coded into your application because it will permanently identify your interface across all merchant accounts.**

        '
    ServerName:
      type: string
      maxLength: 50
      example: TM01CE
      description: 'The name of the server that processed the request.

        '
    CredentialApiSerialNumber:
      type: string
      maxLength: 10
      example: '266'
      readOnly: true
      description: 'The serial number for the merchant account. This field is only used for backwards compatibility with older interfaces and has been replaced by the Access Token.

        '
    ErrorSeverity:
      type: string
      enum:
      - Info
      - Error
      - Alert
      readOnly: true
      example: Info
      description: 'Severity level of the error.


        | Severity | Description                                                       |

        | -------- | ----------------------------------------------------------------  |

        | Info     | Action not required - Data input/formatting is incorrect          |

        | Error    | Action may be required - Communication, timeout or network issue  |

        | Alert    | Action required - System issue                                    |

        '
    DateTime:
      type: string
      format: ISO 8601
      example: '2024-05-21T09:18:23.283-07:00'
      description: 'The date and time in ISO 8601 format including the timezone offset (yyyy-mm-ddThh:mm:ss.nnn+hh:mm).


        Must be sent as the local date/time of the merchant. For example, a request processed at a merchant in the Pacific time zone at 9:18am on April 15th 2021 would be sent as 2021-04-15T09:18:23.283-07:00

        '
    Credential:
      type: object
      required:
      - authToken
      - clientGuid
      properties:
        accessToken:
          $ref: '#/components/schemas/CredentialAccessToken'
        authToken:
          $ref: '#/components/schemas/CredentialAuthToken'
        clientGuid:
          $ref: '#/components/schemas/CredentialClientGuid'
        apiSerialNumber:
          $ref: '#/components/schemas/CredentialApiSerialNumber'
        apiPassword:
          $ref: '#/components/schemas/CredentialApiPassword'
    ErrorLongText:
      type: string
      maxLength: 255
      readOnly: true
      example: Card type not recognized
      description: 'Extended error message that is returned if an error condition exists.

        '
    ErrorShortText:
      type: string
      maxLength: 16
      readOnly: true
      example: NOT IN CARDRANGE
      description: 'Abbreviated error message that is always returned if an error condition exists

        '
    LighthouseDataResponse:
      type: string
      example: eyJwYXltZW50SWQiOiI4NWM0MWNhNy01NzVjLTQzNGUtODIyZi0xYzZlOTE0ZDAzODYiLCJyZW1haW5pbmdBbW91bnQiOjB9
      description: 'Base64 encoded JSON formatted data that will be returned from Lighthouse to be passed back to SkyTab. This data will contain variable information.

        '
    ErrorPrimaryCode:
      type: integer
      maxLength: 4
      readOnly: true
      example: 9842
      description: 'Code indicating the type of error that occurred. Refer to the [Error Codes](/guides/appendices/error-codes) section of this document for more details.

        '
    CredentialAccessToken:
      type: string
      format: uuid
      maxLength: 52
      example: EA79FB05-3AA7-4500-AF9A-73F986FF2C1D
      readOnly: true
      description: 'A security credential used to authenticate API requests and all [i4Go®](https://s4-myportal.s3.amazonaws.com/downloads/documentation/i4go/i4go%20technical%20reference%20guide.pdf) authorizeClient/preauthorizeClient requests. An Access Token is the alias for the merchant account and interface being used. The Access Token is required in all requests except an [Access Token Exchange](/apis/payments-platform-rest/openapi/credentials/accesstokenexchange) request, which generates an Access Token using an `authToken` and `clientGuid`.

        '
    ErrorCode:
      type: integer
      maxLength: 5
      readOnly: true
      example: 64100
      description: 'Code indicating the type of error that occurred. Refer to the [Error Codes](/guides/appendices/error-codes) section of this document for more details.


        **Note: This is currently only supported for European merchant processing.**

        '
    CredentialApiPassword:
      type: string
      maxLength: 32
      example: 9YCR23G7%BY#9+
      readOnly: true
      description: 'A credential used to authenticate the API Serial Number when processing a request. This field is only used for backwards compatibility with older interfaces and has been replaced by the Access Token.

        '
    CredentialAuthToken:
      type: string
      format: uuid
      maxLength: 51
      example: 3504489F-A774-88E0-80114FBBC925E207
      writeOnly: true
      description: 'A unique encrypted identifier that refers to a specific merchant account. It is required when making an [Access Token Exchange](/apis/payments-platform-rest/openapi/credentials/accesstokenexchange) request. For detailed information about the AuthToken, please see [Authentication](/guides/quickstart#access-token-exchange)

        '
    ErrorSecondaryCode:
      type: integer
      maxLength: 4
      readOnly: true
      example: 0
      description: 'This code supplements the code specified in the `error.primaryCode` field to provide additional information about the error that occurred.

        '
    Server:
      type: object
      readOnly: true
      properties:
        name:
          $ref: '#/components/schemas/ServerName'
  parameters:
    CompanyName:
      required: true
      name: CompanyName
      in: header
      schema:
        type: string
        maxLength: 26
        example: PAWS
      description: 'Refers to the vendor or partner that designed and certified the interface. The information you use in this field should match what Shift4 has on file or what was agreed upon in your Integration Plan. The following special characters are not allowed&colon;  $ % &colon; ^ - ~ ` < > , ? “ ” ‘ ’ { } [ ] \ + =

        '
    InterfaceVersion:
      required: true
      name: InterfaceVersion
      in: header
      schema:
        type: string
        maxLength: 11
        example: '2.1'
      description: 'Refers to the version of the program or application that is sending requests to Shift4. The following special characters are not allowed&colon;  $ % &colon; ^ - ~ < > , ? “ ” ‘ ’ { } [ ] \ + =

        '
    InterfaceName:
      required: true
      name: InterfaceName
      in: header
      schema:
        type: string
        maxLength: 25
        example: ForwardPOS
      description: 'Refers to the name of the program or application that is sending requests to Shift4. This should be the name of the program that you purchased or created. The following special characters are not allowed&colon;  $ % &colon; ^ - ~ ` < > , ? “ ” ‘ ’ { } [ ] \ + =

        '
  examples:
    AuthTokenNotValidError:
      summary: AuthToken Not Valid
      value:
        result:
        - error:
            primaryCode: 9862
            secondaryCode: 0
            shortText: AuthToken
            longText: AuthToken not valid ENGINE01CE
          server:
            name: U2API01CE
  responses:
    TimeoutResponse:
      description: Timeout
      content:
        application/json:
          schema:
            properties:
              result:
                type: array
                items:
                  type: object
                  properties:
                    error:
                      $ref: '#/components/schemas/Error'
                    lighthouse:
                      type: object
                      properties:
                        data:
                          $ref: '#/components/schemas/LighthouseDataResponse'
                    server:
                      $ref: '#/components/schemas/Server'
          example:
            result:
            - error:
                primaryCode: 9951
                secondaryCode: 0
                shortText: RESPONSE TIMEOUT
                longText: Timeout waiting for response across the internet
              lighthouse:
                data: eyJwYXltZW50SWQiOiI4NWM0MWNhNy01NzVjLTQzNGUtODIyZi0xYzZlOTE0ZDAzODYiLCJyZW1haW5pbmdBbW91bnQiOjB9
              server:
                name: U2API01CE
  securitySchemes:
    AccessToken:
      type: apiKey
      name: AccessToken
      in: header
      description: "A security credential used to authenticate API requests and all [i4Go®](https://s4-myportal.s3.amazonaws.com/downloads/documentation/i4go/i4go%20technical%20reference%20guide.pdf) authorizeClient/preauthorizeClient requests. An Access Token is the alias for the merchant account and interface being used. \n\nExample:\n  ```\n  AccessToken: EA79FB05-3AA7-4500-AF9A-73F986FF2C1D\n  ```\n"
    HMAC-SHA256:
      type: http
      scheme: hmac-sha256
      description: "Authentication using HMAC-256 signatures as the authorization scheme.\n\nSent in the `Authorization` header in the following format:\n\n`Authorization`: **HMAC-SHA256** `Credential`={value}&`Signature`={value}\n\n| Argument      | Description                                      |\n|---------------|--------------------------------------------------|\n| HMAC-SHA256   | Authorization scheme.                            |\n| Credential    | The ID of the key used to compute the signature. |\n| Signature     | base64 encoded HMACSHA256 value.                 |\n\nExample: \n  ```\n  Authorization: HMAC-SHA256 Credential=AESKEY1&Signature=8SFtIc6zQlswxAZqDKXL+BpRmlDvIWyjOwU8wdl0zK4=\n  ```\n"