| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Process a card payment directly from your backend using the Embedded Integration flow. This endpoint supports both sale and authorization-only transactions, and automatically handles 3-D Secure authentication when required.
PCI DSS Required
This endpoint accepts raw cardholder data. Your backend must be PCI DSS compliant and card data must never be collected or transmitted from client-side JavaScript.
Request Hash Required
Every Direct Sale request must include a valid
hashgenerated on your backend. See the hash generation section in the Embedded Integration Overview.
Request
| Method | POST |
| URL | {baseUrl}/payment/s2s/sale |
| Authentication | Header x-api-key |
Request Body
| Parameter | Type | Required | Description |
|---|---|---|---|
orderId | string | Yes | Your unique order reference |
amount | number | Yes | Payment amount |
currency | string | Yes | ISO currency code (for example SAR) |
paymentMethod | string | Yes | Payment method |
auth | string | Yes | N = Sale • Y = Authorization Only |
card | object | Yes | Card details |
customer | object | Yes | Customer information |
successUrl | string | Yes | Redirect URL after successful 3DS |
failureUrl | string | Yes | Redirect URL after failed 3DS |
hash | string | Yes | Request signature |
Generate the request hash immediately before sending the request. The hash must match the card number, customer email, and merchant API key used in the request.
Request Example
{
"orderId": "ORD-1001",
"amount": 10.00,
"currency": "SAR",
"paymentMethod": "card",
"auth": "N",
"card": {
"cardNumber": "4111111111111111",
"cardExpiryMonth": "12",
"cardExpiryYear": "2028",
"cardCvv": "123",
"cardHolder": "Ahmed Ali"
},
"customer": {
"name": "Ahmed Ali",
"email": "[email protected]",
"phone": "501223324"
},
"successUrl": "https://yourstore.com/payment/success",
"failureUrl": "https://yourstore.com/payment/failure",
"hash": "COMPUTED_MD5_HASH"
}Never log or store full card numbers or CVV values. Sensitive payment data should only exist in memory during request processing.
Responses
{
"code": 200,
"message": "Success",
"data": {
"result": "ACCEPTED",
"paymentId": "c09fba3c-59e2-434a-9ec1-5d2e71a44a8d",
"status": "APPROVED",
"html": null
}
}{
"code": 200,
"message": "Success",
"data": {
"result": "PENDING",
"paymentId": "c09fba3c-59e2-434a-9ec1-5d2e71a44a8d",
"status": "PENDING",
"html": "<form>...</form>"
}
}{
"code": 200,
"message": "Success",
"data": {
"result": "DECLINED",
"paymentId": "c09fba3c-59e2-434a-9ec1-5d2e71a44a8d",
"status": "DECLINED",
"declineReason": "Insufficient funds",
"html": null
}
}{
"statusCode": 400,
"message": "Invalid request hash",
"error": "Bad Request"
}{
"statusCode": 401,
"message": "Missing API key",
"error": "Unauthorized"
}Response Fields
| Field | Description |
|---|---|
result | Payment result (ACCEPTED, PENDING, DECLINED) |
status | Gateway payment status |
paymentId | Internal DigetPay payment identifier |
html | 3-D Secure HTML page when customer authentication is required |
If the response contains
html, render it in the customer's browser to complete the 3-D Secure authentication flow. Do not fulfill the order until you receive a successful webhook or verify the transaction status.
Store the returned
paymentId. It is required for subsequent Status, Capture, Void, and Recurring operations.