GuidesAPI ReferenceChangelog
Log In
Guides
  1. Moneris API
  2. Online Payments
  3. Core Payment Flows

Purchase

Overview

A Purchase processes payment between a merchant and customer for a sale of goods or services. This payment includes both the authorization of funds on the card and the capture of funds for deposit to the merchant’s bank account in a single API call.


1. Collect Cardholder Data

Before you send the server-to-server API call for payment, collect the cardholder's credit card details to populate the transaction. The available options are:

  • Hosted Tokenization: This Moneris service embeds a box for card data input on your website hosted on Moneris systems and returns a temporary token for use in the payment instead. This protects your website from handling sensitive card data directly and avoids burdens of certification to Payment Card Industry (PCI) compliance.

  • Network Tokens: The Moneris API support payments with tokens issued through the card brand networks. From a Moneris point of view, this capability allows merchants to send network tokens through the Moneris platform for payment processing while benefiting from stronger protection of card data and broader token usability than traditional vault-only models.

  • Merchant Collection: You can collect credit card numbers, expiry dates, and card verification details directly from the cardholder on your website and handle that data throughout the payment process. Doing so requires PCI compliance to ensure the security of the data.

  • Payment Method On-file: If you have stored a payment method for this cardholder previously, such as a permanent token in the Moneris Vault service or as a Payment Method via our API, you no longer need to collect it again on subsequent transactions and can proceed with next steps. During the API call, you can use these stored methods in place of cardholder input.

  • Digital Wallets: Moneris API enables merchants to accept payments through supported digital wallets, allowing customers to use their preferred wallet experience while benefiting from a secure and seamless checkout process.

3-D Secure Authentication

Moneris recommends completing 3-D Secure (3DS) Authentication before payment to help reduce card-not-present fraud. 3DS assesses transaction and device data, may challenge the cardholder when needed, and can provide a liability shift for eligible fraud-related chargebacks.

If you already have 3-D Secure features enabled on your merchant account, see here for steps on implementing it before the payment transaction flow. Link to 3DS overview here.

3DS - Browser Channel 3DS - Requestor Initiated 3DS Data Only


2. Create Payment

Your server initiates a payment by sending an API request to Moneris. Use the POST /payment endpoint to submit the transaction details and complete a purchase, which includes both authorization and settlement in a single business flow.

"AutomaticCapture" = "true"

This parameter controls if the payment will settle automatically. Using a value of "false" reserved for the pre-authorization & completion flow instead.

A key step in building the payment request is identifying the payment method the customer will use. This decision determines which fields your business must include in the API call and which fields can be omitted. The examples below illustrate common payment scenarios and explain how each scenario affects the required request fields:

  • When using an existing Payment Method ID to process a payment (paymentMethod = PAYMENT_METHOD_ID), you do not need to include any card objects in the transaction request. Instead, provide the applicable Payment Method ID in the paymentMethodID field of the storePaymentMethodIdRequest object. This approach streamlines the request and supports a more efficient payment workflow.
  • For transactions using a collected credit card (paymentMethodType = CARD), include all required card and cardholder information to ensure the payment can be processed successfully. Provide the details in the following objects: card, cardholderInformation, contactDetails, billingAddress, and paymentMethodSource.
  • For payments made with encrypted Google Pay (paymentMethodSource = GOOGLE_PAY_ENCRYPTED), merchants must submit the storeGooglePayEncryptedWalletRequest object. This object provides the cardholder details and cryptogram information required to process the transaction securely. In this flow, the standard card object is not included.
  • For payments that use stored credentials, include the credentialOnFileInformation object and populate it with the values that match the applicable merchant-initiated subsequent transaction scenario. This helps ensure the transaction is identified correctly and supports smoother authorization processing.

More information about Credential on File Go to Credential on File

Ensure the credentialOnFileInformation object is included with appropriate values for a first transaction. Storing a permanent payment method requires notifying the card brand on the intended use-case for the credential; for more information, consult Credential on File.

In the Payments section of the API Reference, you’ll find the guidance and technical details needed to process transactions across the payment methods supported by the Moneris API. Use this resource to understand the required fields, choose the right payment flow, and implement a reliable checkout experience for your customers.


3. Response

After you submit a purchase, Moneris sends a response to your server that confirms whether the transaction was successful or declined. Review both the HTTP response status code and the transactionDetails object in the response body to understand the outcome, support business decisions, and determine the next step in the customer checkout experience.

Learn more about responses with the link below

Access Response Handling

Samples

{
  "idempotencyKey": "5d8f812e-9969-4885-85bb-d03948eccac1",
  "orderId": "1q2w3e4r5t6t78",
  "invoiceNumber": "1a2s3d45v6",
  "amount": {
    "amount": "16000",
    "currency": "CAD"
  },
  "customerId": "ci0105ARZ3NDEKTSV4RRFFQ69G5FAV",
  "paymentMethod": {
    "paymentMethodSource": "TEMPORARY_TOKEN",
    "temporaryToken": "ot-y2mxjFqmqDisQQGB6hQ8xwQ2"
  },
  "ecommerceIndicator": "AUTHENTICATED_ECOMMERCE",
  "automaticCapture": "true",
  "customData": {
    "property1": "string",
    "property2": "string"
  },
  "dynamicDescriptor": "moneris",
  "ipv4": "192.0.2.146",
  "ipv6": "2345:0425:2CA1:0000:0000:0567:5673:23b5"
}

Additional Information

📘

Learn more with the API Definitions

Preuse the endpoints, request/response formats, and authentication methods covered in this scenario.

API References

Updated 9 days ago

Did this page help you?