# 3. Initiate Pay

#### API Endpoints

{% tabs %}
{% tab title="Production Endpoint" %}

```
Direct Pay Production Base URL /InitiatePay
```

{% endtab %}

{% tab title="Sandbox Endpoint" %}

```
Direct Pay Sandbox Base URL /InitiatePay    
```

{% endtab %}
{% endtabs %}

#### **Sample Request & Response**

The request body should include the following fields:

{% tabs %}
{% tab title="Sample Request" %}

```
 "Initiate pay request{
     "ReferenceId" : "xxxxxxxxx",//15-digit reference id received in the validate requet response
     "MerchantId": xxxxxx, //merchant code
     "ECardData" = "encryptedCard", //card data encrypted using AES Encryption 
     "ECardKey" = "encryptedKey", // Encrypt the 32 digit AES key using the public key
     "ACS_CallbackURL"= "call back url for 3DS"+ReferenceId   //optional
     }
     
 };
```

{% endtab %}

{% tab title="Sample Response" %}

```
{
  "errorCode": 0,
  "errorMessgae": "SUCCESS",
  "result": {
    "authentication": {
      "the3Ds1": null,
      "the3Ds2": null,
      "acceptVersions": null,
      "channel": null,
      "purpose": null,
      "redirect": {
        "customized": null,
        "domainName": "ap.gateway.mastercard.com",
        "html": "<div id=\"threedsChallengeRedirect\" xmlns=\"http://www.w3.org/1999/html\" style=\"height: 100vh\"> <form id =\"threedsChallengeRedirectForm\" method=\"POST\" action=\"https://ap.gateway.mastercard.com/acs/mastercard/v2/prompt\" target=\"challengeFrame\"> <input type=\"hidden\" name=\"creq\" value=\"eyJ0aHJlZURTU2VydmVyVHJhbnNJRCI6IjNmN2E4MmVjLTEzZjYtNDg2Ni05ODVjLTlkOTgxZjIzMGQ0OSJ9\" /> </form> <iframe id=\"challengeFrame\" name=\"challengeFrame\" width=\"100%\" height=\"100%\" ></iframe> <script id=\"authenticate-payer-script\"> var e=document.getElementById(\"threedsChallengeRedirectForm\"); if (e) { e.submit(); if (e.parentNode !== null) { e.parentNode.removeChild(e); } } </script> </div>"
      },
      "redirectHtml": null,
      "version": "3DS2",
      "the3Ds": null,
      "method": "OUT_OF_BAND",
      "payerInteraction": null
    }
  }
}
```

{% endtab %}
{% endtabs %}

<table><thead><tr><th width="161">Field Name</th><th width="100">Type</th><th>Description</th></tr></thead><tbody><tr><td>ReferenceId</td><td>string</td><td>15-digit reference id received in the validate requet response</td></tr><tr><td>MerchantId</td><td>string</td><td>Merchant code</td></tr><tr><td>ECardData</td><td>string</td><td>The encrypted card data encrypted using AES encryption with a 32-bit key. Explained below</td></tr><tr><td>ECardKey</td><td>string</td><td>The AES encryption key, encrypted using an RSA public key generated at <a href="#ecarddata-encryption">here</a></td></tr><tr><td>ACS_CallbackURL</td><td>string</td><td>Explained <a href="#acs_callbackurl">here</a></td></tr></tbody></table>

### Explanation of the `ECardData` Encryption Object <a href="#ecarddata-encryption" id="ecarddata-encryption"></a>

The `ECardData` field in the request is an encrypted representation of the sensitive card details. The following explains the object that is encrypted using AES encryption before being included in the API request:

```
{
    "CardNumber": "xxxxxxxxxxxxxxxx",//16-digit card number
    "CardName": "John Doe", //Name mentioned on card
    "CardExpiry": "mm/yy", //month/year format
    "CardCVV": "xxx" //3 decimal number
}
```

### ACS\_CallbackURL

* If empty, the 3D Secure callback will be handled by the provider, and the user will be redirected to call back url provided in the step 1. For more info about redirection refer [here](/sample-code/3.-callback-merchant-portal.md).
* If provided, the 3D Secure callback will be sent to the merchant's specified URL, and the merchant must call the API at [here](/direct-pay/4.-process-payment.md) for further processing.

### Response Explaination&#x20;

Upon receiving the response from the InitiatePay API, the merchant must verify the errorCode to determine the next steps. If the errorCode is 0, indicating a successful initiation, the merchant should parse the result object and render the HTML content provided in *<mark style="color:blue;">**result.redirect.html**</mark>* to proceed with the 3DS authentication process.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://checkoutdocs.oneglobal.com/direct-pay/3.-initiate-pay.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.