[Type text]

MPay Integration Guide

Confidential
MPay Integration Guide

Change Log
Version Date Description
0.1 05.08.2013 Initial version
0.2 12.08.2013 Ready for review
0.3 24.04.2014 Added some sample clarifications
1.0 28.05.2014 Added Glossary of Terms. Added Language to OrderDetailsQuery.
Added Type to OrderProperty.
1.1 25.07.2014 Removed Publish Invoice integration scenario.
1.2 24.12.2015 Added IBAN info and marked as obsolete the following properties
“TreasuryAccountName”, “TreasuryAccount” from
“PaymentAccount”.

Page | 1 of 28
MPay Integration Guide

Table of Contents
1. Executive summary ..................................................................................................................3
2. Glossary of terms ......................................................................................................................4
3. Introduction ................................................................................................................................5
4. Organizational context ...........................................................................................................6
5. System context ..........................................................................................................................7
6. Interaction scenarios ...............................................................................................................8
7. Integration development .................................................................................................... 11
8. Integration testing ................................................................................................................ 12
9. Security considerations ....................................................................................................... 13
10. API Reference ....................................................................................................................... 14
11. Samples .................................................................................................................................. 22

Page | 2 of 28
MPay Integration Guide

1. Executive summary
MPay is a reusable and shared platform-level service the main scope of which is to enable the
payment for any e-Service with any available payment instrument.
This document describes the technical interfaces that must be exposed by information systems
that integrate with MPay and the technical interfaces that MPay exposes for them. Its target
audience is the development teams for those information systems.
The document contains all of the relevant information required for a complete understanding
of MPay from the integration point of view. It contains integrations development details,
security and e-Service registration considerations and an API reference.
This document is also accompanied by a .NET sample that exemplify the main interaction
scenario, i.e. ordering and paying online for the order.

Page | 3 of 28
MPay Integration Guide

2. Glossary of terms
Term Definition

SOAP Simple Object Access Protocol

WSDL Web Services Definition Language

XML Extensible Markup Language

IBAN International Bank Account Number

http://bnm.md/ro/content/iban
http://lex.justice.md/index.php?action=view&view=doc&lang=1&id=354148
http://lex.justice.md/md/351141/

Page | 4 of 28
MPay Integration Guide

3. Introduction

3.1. Scope and target audience

This document describes the technical interfaces used to integrate with MPay. There are
interfaces on both sides, on payable e-Service and MPay side. Its target audience is the
development teams that implement or maintain information systems to be integrated with
MPay.

3.2. Structure of this document

This document contains all of the relevant information required for a complete understanding
of MPay from the integration point of view. It is also accompanied by samples that exemplify
some integration scenarios using certain technologies.
The recommended reading sequence are the following chapters:
- System context
- Interaction scenarios
- Integration development
- Security considerations
The remaining chapters are for reference purpose.

3.3. Notations
This document contains several notation styles; the following details the styles that have a
degree of significance beyond the purpose of communicating information:
Yellow Highlighted Text – Text that is highlighted in yellow irrespective of font attributes (font
type, italics, bold, underlined, etc.) means that the text is waiting clarification or verification.
Red Bold Text – Text that is red in color and bold, defines an important piece of information
that must be read.
Italic Bold Text – Text that is bold and italic detail actual information or scripts that need to
be executed, created, and copied from or to.

Page | 5 of 28
MPay Integration Guide

4. Organizational context

4.1. Service owner

Service Owner
Organization e-Government Center Moldova
Main Point of Contact
Name Dumitru Postu
Position e-Services Manager
E-mail [email protected]
Technical Point of Contact
Name Andrian Mamei
Position Integration Architect
E-mail [email protected]

Page | 6 of 28
MPay Integration Guide

5. System context

5.1. General system description

MPay is a reusable and shared platform-level service the main scope of which is to enable the
payment for any e-Service with any payment instrument available in the market.
The unified technical interface used for integrating e-Services with MPay significantly simplifies
integrations by hiding differences in technical protocols and formats.
There are many non-technical advantages enabled by MPay, such as easier contract
management and simplified clearance, but they are out of scope of this document.

5.2. Service dependencies

The availability of MPay depends on the availability of the IServiceProvider implementation,
i.e. a payer will not be able to query for an order or an invoice for a particular e-Service and
pay for it, if the e-Service provider’s web-service is not available.

5.3. Protocols and standards

MPay exposes WS-I Basic Profile 1.1 interoperable service over HTTPS which corresponds to
basicHttpBinding in WCF. MPay uses SOAP faults for error reporting.
MPay uses WS-Security (X.509) XML Signature (at message level) to enable non-repudiation.

Page | 7 of 28
MPay Integration Guide

6. Interaction scenarios
Because MPay integrates multiple payable e-Service providers and different payment
providers that offer a variety of payment instruments, there are many ways a payer can interact
with it.
A short description of interaction scenarios is following.

Page | 8 of 28
MPay Integration Guide

6.1. Order and Pay online

sd Interaction

Browser e-Service MPay Payment Provider

Payer

1. Fill Form and Order()

Save Order()

:Order Confirmation

2. Pay Order()
Pay Order()
3. Redirect to
MPay(OrderID)
4. Get Pay Page(ServiceID, OrderID, ReturnUrl (optional))

5. GetOrderDetails(ServiceID, OrderKey)

:OrderDetails 6. Generate Invoice()

:Invoice Pay Page

7. Select Instrument()
Select Instrument()
Publish Invoice Details()
Redirect to Instrument Page()

8. Get Instrument Pay Page()

:Instrument Pay Page

9. Fill Payment Details() 10. Authorize Payment()

Payment Details()

11. Redirect to MPay Payment Result Page()

12. Get Payment Result Page()

Get Payment Confirmation()
*13. ConfirmOrderPayment(confirmation)

Payment Result Page()

14. Print Receipt()

Download Receipt()
«optional»
:Receipt PDF

15. Return to e-Service()

Return to e-Service()
«optional»
Redirect to e-Service ReturnUrl()
Get ReturnUrl Page()

:ReturnUrl Page

(from Actors)

Here is short description of the scenario steps:

1. A Payer fills in and submits some order at a payable e-Service page. The order is
persisted in e-Service database.
2. e-Service order confirmation page displays a “Pay” button.

Page | 9 of 28
MPay Integration Guide
3. Clicking on this button redirects payer’s browser to MPay’s pay page.
4. The browser posts ServiceID, OrderID and, optionally, a ReturnUrl to MPay’s pay page
(see Performing redirect).
5. Before displaying the pay page, MPay invokes IServiceProvider.GetOrderDetails
operation implemented by e-Service web-service.
6. Based on returned OrderDetails, MPay creates or updates an existing invoice and shows
the invoice details to the payer.
7. Payer selects a payment instrument. For credit card payments this means publishing
invoice details to the appropriate credit card processor (which is one of the payment
providers).
8. MPay redirects the browser to instrument’s specific payment page.
9. Payer fills in the required payment details (such as his credit card details) and submits
the payment for authorization.
10. Payment provider performs the appropriate payment authorization.
11. Payment provider redirects the browser to MPay’s payment result page.
12. Before displaying payment results, MPay retrieves a payment confirmation from the
payment provider.
13. If the payment is successful, MPay sends a payment confirmation to e-Service, by
invoking IServiceProvider.ConfirmOrderPayment operation implemented by e-Service
web-service and displays payment results to the payer. Note that
ConfirmOrderPayment call can be retried multiple times, until it succeeds. This means
that all implementations must be idempotent, i.e. multiple calls must not be considered
as multiple payments.
14. Optionally, payer can download and print a payment receipt.
15. Optionally, if ReturnUrl was provided at step 4, payer can choose to return to e-Service
page. In this case, MPay redirects the browser to the ReturnUrl.

6.2. Pay an existing order

Another scenario is paying for an existing order. In this case:
1. Payer navigates to MPay (https://mpay.gov.md).
2. Payer selects a service he has the order for.
3. Payer enters the order key (such as order/request number, process number, etc.).
4. The scenario then continues with step 5 of the Order and Pay online scenario with
IServiceProvider implementation (except returing to ReturnUrl), i.e. the order is
searched by invoking IServiceProvider.GetOrderDetails operation.
This scenario is also applicable when accessing payment terminals (just replace MPay with
payment terminal in scenario description text).

Page | 10 of 28
MPay Integration Guide

7. Integration development

7.1. Obtaining credentials

MPay uses certificates generated by Certification Authority of the Center of Special
Telecommunications (https://pki.cts.md), by requesting a certificate for digital signature and
authentication. These certificates must be used for both, SSL authentication and SOAP
messages signatures.

7.2. Payable e-Service registration

The following details need to be provided to Service owner for registration.

Information Description
Service MPay must be able to reach the web-service that implements the IServiceProvider
Provider URL interface. Please provide the URL that can be reached by MPay.
Service As specified above, this certificate must be used to sign SOAP messages by e-Service.
Certificate To be able to verify the signatures, MPay must have the certificate registered.

Additionally, if your deployment infrastructure is able to filter calls by incoming IPs, then please
request the External IP address of MPay and configure your filters appropriately.

7.3. Technical contracts

If you develop an implementation of IServiceProvider interface in .NET, please use the
MPay.PublicModel project that is part of the .NET Sample. You can simply create a new “WCF
Service Application”, reference MPay.PublicModel project and implement
MPay.PublicModel.IServiceProvider interface.
If you implement the service provider interface is some other technologies, you can find a copy
of the WSDL that describes the contract to be implemented (and an offline copy of MPay
WSDL) in the same .NET Sample. The WSDL file can be found in the following path:
sample\MPay.Sample.Offline\Service References\SampleServiceProvider\ServiceProvider.wsdl

Page | 11 of 28
MPay Integration Guide

8. Integration testing

8.1. Test cases

[ describe in a formalized table basic test cases that will help integrators to test the integration ]

8.2. Integrations review and audit

[ insert here any checklists for security, performance, conformance, etc. ]
[ describe integration review procedures ]
[ describe any certification process the integration must pass through ]

Page | 12 of 28
MPay Integration Guide

9. Security considerations

9.1. Authentication
An IServiceProvider interface implementation must validate the signature of the incoming
SOAP messages sent by MPay. It is recommended that implementations re-use the existing
validation logic provided by web-service frameworks, such as .NET WCF or J2EE JAX-WS, by
correctly configuring the end-points.
For information regarding obtaining a service certificate and registration, see Obtaining
credentials and Payable e-Service registration.

9.2. Encryption
All communication with MPay SOAP service is encrypted by using standard TLS protocol
(HTTPS). The client certificate used to initiate the encrypted transport is also used for
Authentication.

9.3. Saving SOAP messages

Because all SOAP messages are signed with the digital signature of the caller system, it is
strongly recommended that messages are saved in some logging repository or directly against
business objects, e.g. save payment confirmations along with SOAP message that includes the
MPay signature. These persisted messages can further help in any issues related to clearance
or other kind of disagreements.

Page | 13 of 28
MPay Integration Guide

10. API Reference

10.1. Performing redirect

In the case of online payment, the e-Service must redirect the browser to MPay’s pay page.
Here is a description of the parameters involved in this redirect.

Method POST
URL https://mpay.gov.md/service/pay (note that this depends on environment)
Description Direct user to perform the payment online or to access other payment methods
instructions.
Form or URL parameters
Name Type Required/Optional Description
ServiceID string Required Service identifier.
OrderKey string Required Order key within the service. This must be a uniquely
generated key for this order (such as its primary key or
other kind of reference number).
ReturnUrl URL Optional The URL that MPay will redirect too after payment
(either successful or unsuccessful). This page will be
redirected via GET HTTP method. Please make sure
you URL encode any parameters you use to build this
URL.

10.2. Error handling rules

For errors resulted for SOAP interface invocations, MPay expects SOAP faults with fault codes
and fault reasons describing the fault in plain English. Translating faults to Romanian is
advisable. If there is no SOAP fault returned by a Public Service Provider, MPay considers that
the operation invocation completed successfully, meaning that the corresponding expected
business consequences are now valid.

Fault Code Description

InternalError Unexpected internal error.

AuthenticationFailed Service consumer authentication process failed. See Authentication

AuthorizationFailed Service consumer authorization process failed. See Error! Reference

source not found.

Page | 14 of 28
MPay Integration Guide

InvalidParameter Some input parameter is invalid. Please review the returned Fault
Reason text and called operation description.

UnknownService The provided ServiceID is unknown.

UnknownOrder The provided OrderKey is unknown.

UnknownInvoice The provided InvoiceID is unknown.

UknownPayment The provided PaymentID is unknown.

InvoiceAlreadyPaid This invoice already has some payments and cannot be cancelled.

InvoiceExpired The invoice is no longer valid and will not be paid.

10.3. Operation idempotence

All operations defined in IServiceProvider must be idempotent, i.e. the returned technical result
and resulting business effect of calling such an operation must not be different if called
multiple times with the same input parameters.

10.4. Service operations

Signature GetOrderDetails(query: OrderDetailsQuery): OrderDetails[]
Description Returns matching orders’ details from service provider order registration system.
Returns An array of matching OrderDetails.
Remarks This method might be called multiple times and, in some cases, it might return a
different result, such as a different TotalAmountDue for the same order. This might
naturally happen when an order expires or is later amended. MPay will consider correct
only the latest version of returned details.
Input parameters
Name Type Description
query OrderDetailsQuery A structure that contains order details query criteria.
Faults
Code Reason
InvalidParameter Some input parameter is invalid. Please provide the
appropriate details in Fault Reason.
UnknownService The provided ServiceID is unknown.

Page | 15 of 28
MPay Integration Guide
Signature ConfirmOrderPayment(confirmation: PaymentConfirmation)
Description Confirms a payment for an order.
Returns void
Remarks In some cases this method might be called multiple times for the same payment
(uniquely identified by PaymentID). Please make sure that these calls will not result in
multiple payments being applied to the same Order.
Input parameters
Name Type Description
confirmation PaymentConfirmation A structure that describes the payment confirmation.
Faults
Code Reason
InvalidParameter Some input parameter is invalid. Please provide the
appropriate details in Fault Reason.
UnknownService The provided ServiceID is unknown.
UnknownOrder The provided OrderKey is unknown.

10.5. Structures
Important. The order in which the members are described below is for description purposes
only. The order of the elements in the actual XML structures, as defined in WSDL, is
alphabetical. To get a correct implementation, it is recommended to use an automatic
conversion tool from WSDL to your programming language or environment.

Member Type Required/Optional Description

OrderDetailsQuery

ServiceID string (36) Required Service identifier.

OrderKey string (36) Required Order key within the service.

Language string (2) Optional, default: ro The language in which the

localizable text members must be
returned. Available languages: ro,
ru and en.

OrderDetails

ServiceID string (36) Required Service identifier.

OrderKey string (36) Required Order key within the service.

Reason string (50) Required The reason for the payment of this
order. Localizable.

Status OrderStatus Required The status of the order. The status

indicates in what state the order is
and if it is eligible for payment or

Page | 16 of 28
MPay Integration Guide
not.

IssuedAt DateTime Optional The date and time when the order
was registered in the back-office
system.

DueDate DateTime Optional The due date until the order can be
paid. When this property is not set
then the order has no expiration
date for accepting payments.

TotalAmountDue decimal Optional Total amount due for the order. It

indicates how much MPay must
accept when paying the order.
If this property has no value, then
it is a sign that the amount due for
the order is not yet known. In this
case, MPay will allow the payer to
enter the amount information.

Currency CurrencyCode Required The currency in which the payment

of the order must be made (e.g.
MDL).

AllowPartialPayment boolean Optional, default: A flag indicating if partial

false payments are allowed for the
order.

AllowAdvancePayment boolean Optional, default: A flag indicating if the order might

false be paid in advance, i.e. with higher
amount than required.

CustomerType CustomerType Optional, default: The type of the customer this order
Unspecified was created for.

CustomerID string (13) Optional The identifier of the customer (e.g.

its IDNP or IDNO).

CustomerName string (60) Optional The name of the customer.

Lines array of OrderLine Required, at least Contains structured information for

one individual payment lines for the
order. Each order information (i.e.
OrderDetail instance) must have at
least one line defined in the Lines
property.

Properties array of OrderProperty Optional Extended contextual properties for

the order. For instance, when
paying for electricity a relevant
property might be the number of
kW included for payment.

OrderLine

LineID string (36) Required The identifier of the line within

order lines.

Reason string (50) Required The reason for the payment behind
this line. Localizable.

AmountDue decimal Optional The amount due for this line.

AllowPartialPayments boolean Optional, default: as A flag indicating if the line allows

specified in partial payments.

Page | 17 of 28
MPay Integration Guide
OrderDetails

AllowAdvancePayments boolean Optional, default: as A flag indicating if the line allows

specified in advance payments.
OrderDetails

DestinationAccount PaymentAccount Optional, default: as Indicates details of the Treasury

specified by service account or a Bank account where
provider in MPay the money received for this line will
agreement or be finally delivered.
contract Details not sent in this field have
default service provider values
(according to the agreement or
contract).

Properties array of OrderProperty Optional Extended contextual properties for

the order line. For instance, when
paying for electricity a relevant
property might be the number of
kW included for payment. Order
line extended properties are
optional.

OrderProperty

Name string (36) Required The name of the property. Can

contain letters, numbers and
spaces only.

DisplayName string (36) Optional, default: The display name of the property.
same as Name Localizable.

Value string (255) Optional The value of the property.

Modifiable boolean Optional, default: A flag indicating that the property

false can be modified at the time of
payment on the payer side. A
relevant example would be the tax
code of the payer when unknown
or the current indication in kW of
electricity counter.

Required boolean Optional, default: A flag indicating if the property is

false required to be filled in by the payer
or not.

Type string Optional, default: The type of the property. The

string following types are currently
supported:
- string, any string;
- idn, meaning a valid IDNP
(personal identifier) or IDNO
(organization identifier);
- tc, a tax code, either an IDNx (see
above) or any string containing
non-digits (minim 5 chars).

PaymentConfirmationsQuery

ServiceID string (36) Optional Service identifier for which

payment was made.

OrderKey string (36) Optional Order key within the service for

Page | 18 of 28
MPay Integration Guide
which payment was made.

InvoiceID string (36) Optional Invoice identifier for which

payment was made.

PaymentID string(36) Optional The actual Payment transaction

identifier, unique within MPay.

PaymentConfirmation

ServiceID string (36) Required Service identifier for which

payment was made.

OrderKey string (36) Required Order key within the service for
which payment was made.

InvoiceID string (36) Optional Invoice identifier for this payment

operation.

PaymentID string (36) Required The actual Payment transaction

identifier, unique within MPay.

PaidAt DateTime Required Payment transaction time.

TotalAmount decimal Required Total amount received in this

payment transaction.

Currency CurrencyCode Required The currency of the payment

transaction.

Lines array of Required, at least Detailed information about each

PaymentConfirmationLine one payment line as part of this
payment transaction.

Properties array of PaymentProperty Optional Values of modifiable extended

properties for the order paid in this
payment transaction.

PaymentConfirmationLine

LineID string (36) Required Payment line identifier within order

lines.

Amount decimal Required Amount paid for this line within

the payment.

DestinationAccount PaymentAccount Optional The receiving account used for this

payment line.

Properties array of PaymentProperty Optional Values of modifiable extended

properties for the order line paid in
this payment transaction

PaymentAccount

ConfigurationCode string (36) Optional The code of a predefined account

configuration.

BankCode string (20) Optional The code of the receiving bank.

BankFiscalCode string (20) Optional The fiscal code of the receiving

bank.

BankAccount string (20) Optional The receiving bank account

string (24) number.
IBAN

BeneficiaryName string (60) Optional The name of the beneficiary of the

Page | 19 of 28
MPay Integration Guide
payment.

TreasuryAccountName string (60) Optional The receiving treasury account

OBSOLETE name.

TreasuryAccount string (20) Optional The receiving treasury account

OBSOLETE number.

PaymentProperty

Name string (36) Required Payment property name.

Value string (255) Optional Payment property value. It can be

left unset by the payer if not
Required.

10.6. Enumerations
Member Description

OrderStatus

Active The order is active and can be paid. Can be paid

PartiallyPaid The order was partially paid and can be additionally paid. Can be paid

Paid The order is fully paid. Already paid

Completed The order is complete, i.e. the service is delivered. Cannot be paid

Expired The order expired and cannot be paid. Cannot be paid

Cancelled The order is cancelled and cannot be paid. Cannot be paid

Refunding The order is being refunded. Cannot be paid

Refunded The order was refunded. Cannot be paid

CustomerType

Unspecified The customer is Unspecified.

Person The customer is a Person.

Organization The customer is an Organization.

CurrencyCode

MPay uses ISO 4217 currency codes. The following list is just a subset of the active codes.

MDL Moldovan leu

Page | 20 of 28
MPay Integration Guide

EUR Euro

USD United States dollar

Page | 21 of 28
MPay Integration Guide

11. Samples

11.1. .NET Sample

This document is accompanied by a .NET integration sample. If the sample archive is encrypted
(for e-mail filtering pass-through purposes), the password is “mpay” (without quotes).
The sample demonstrates a complete implementation of Order and Pay online scenario. The
sample includes a simple offline implementation of MPay, including a fake “Pay” button, which
simulates a payment.

11.1.1. Software requirements

The sample is build using Visual Studio 2013 based on ASP.NET 4.5, MVC 5 and WCF using C#
and NuGet package manager. The MVC applications are configured to run under IIS Express.
There are no third party licenses required to build the sample.

11.1.2. Installing or Re-generating certificates

The sample includes some self-signed certificates that are used in configuration for SOAP
message signing. You can find the included certificates in sample\Certificates folder. The
password for all private keys is “123456”.
To install certificates on your development machine, please run InstallCertificates.cmd batch
file under an administrative account from Developer Command prompt for Visual Studio. You
can also re-generate the certificates by running GenerateCertificets.cmd batch file.
The following table describes the meaning of the generated files.

File Name Description Certificate Store

MPaySampleRootCA.cer Sample self-signed root CA certificate Trusted Root Certification

Authorities

MPaySampleRootCA.pvk Root certificate private key none

MPaySampleRootCA.crl Root certificate revocation list Trusted Root Certification

Authorities

MPaySampleServiceProvider.pfx The key-pair (private and public keys, Personal

signed by root CA) used by sample
service provider implementation

MPayOfflineSample.pfx The key-pair (private and public keys, Personal and Trusted
signed by root CA) used by sample offline People
MPay implementation

Page | 22 of 28
MPay Integration Guide

11.1.3. Running sample

To run the sample, please follow the steps below:
1. Ensure the certificates are properly installed in LocalMachine store as described in the
previous section.
2. Run VS2013 or later as Administrator and open MPay.Sample.sln solution.
3. Set MPay.Sample.ServiceProvider as StartUp Project.
4. Rebuild the solution.
5. Run the solution.
6. A browser should open, showing sample service provider home page.
7. Click on “Order” button.
8. You shall be redirected to offline MPay sample that will display new order details and
propose to “Pay”.
9. Click on “Pay” button.
10. You shall be redirected back to sample service provider order status page.
When clicking “Order” (step 7 above), you actually execute steps 1-6 described in Order and
Pay online scenario. When clicking “Pay” (step 9 above), you see a sample implementation of
steps 7-15.

11.1.4. Error handling

For an example of how to throw SOAP faults, please see the helper method named
MPay.Sample.ServiceProvider.Api.ServiceProvider.Error. There is an internal ErrorCode
enumeration defined just for convenience.
An example of how to generate (or throw) such a fault can be found in
MPay.Sample.ServiceProvider.Api.ServiceProvider.ConfirmOrderPayment operation.
An example of how to handle (or catch) such faults can be found in
MPay.Sample.Offline.Controllers.ServiceController.Pay action.

11.1.5. Saving SOAP messages

An example of how to save an incoming SOAP request, please see the code of
MPay.Sample.ServiceProvider.Api.ServiceProvider.ConfirmOrderPayment operation (the need
is described in 9.3). Note that the full incoming SOAP request message is saved in
ConfirmationSignature property of the Payment.

Page | 23 of 28
MPay Integration Guide

11.2. SOAP messages

We will present here samples of exchanged SOAP messages. This might be useful for those
that integrate with MPay but do not fully support WSDL-based service proxy generation.

11.2.1. GetOrderDetails
Request:
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-
1.0.xsd">
<s:Header>
<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-
200401-wss-wssecurity-secext-1.0.xsd">
<u:Timestamp u:Id="uuid-2e4cc486-0b5d-4af2-a361-e6c2fdaf900a-1">
<u:Created>2013-08-12T05:06:20.247Z</u:Created>
<u:Expires>2013-08-12T05:11:20.247Z</u:Expires>
</u:Timestamp>
<o:BinarySecurityToken u:Id="uuid-5746b093-5944-45eb-ae43-bffc5e52c49d-2"
ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-
1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-
message-security-
1.0#Base64Binary">MIIDCTCCAfWgAwIBAgIQksFqROhPr7JCKKE3HuXP7DAJBgUrDgMCHQUAMBsxGTAXBgNVBAMTE
E1QYXlTYW1wbGVSb290Q0EwHhcNMTMwNzMwMDkwNTM1WhcNMzkxMjMxMjM1OTU5WjAcMRowGAYDVQQDExFNUGF5T2Zm
bGluZVNhbXBsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJWnLnPdBmHyXWeS7+IWM9TMe7yh5NG9qAx
Y5HFQGCq1PcA0bbsUIFxEccO8V9ztxRZIGdqOzRwdwb/zcPXfQ3uaWLYA66wq6fETzR8v5O4+YFNs0OqO0XqKESR6bm
5pbdoMkqiviWw1P1w6bvTCTSlx3WQUSMpAGWDFY13BxmMkHz/JQ1/yX/PCjFV05V39YBZPxPlZVLeqfckxA12XfT1MG
5oVCy3sokYlqiQ51APvoiKp2QwY6n2w6N7gLs6HJOxA4wjgmVS4cb3Xj/VsmtY+l4OPBToNf3OTK2K0UstoS2deh9zq
cnvcOQFCXHha6+U7fBY/nKmFu+mBzPI5eOUCAwEAAaNQME4wTAYDVR0BBEUwQ4AQdQYVXqL6CsO0g2khLKFvOKEdMBs
xGTAXBgNVBAMTEE1QYXlTYW1wbGVSb290Q0GCEGOzQZGBOD2lQKnbBdaYewQwCQYFKw4DAh0FAAOCAQEAwUDG5RAG8N
3QyjCO2Zuu1bR4R/P77IjimRGp6EVWkO00C9jAmDX4yNlSs27h7xNliqx3HBJml93vTshtlua06K1Dw1hGXfXNAq6+f
bvoRBum36yNryrA32uHUkCHUknktTS+CDspIjcp6GaTh1Aon6cuyB1EnUosOLylNlsKoDyPt/4x0Jv3U2YGP/q7WjrL
bRdrwPOMf6XWNv605SF/W24yXZbNpmRPfxcfcUUzQ28SKrL/WkeQOiaw6yvafWxjxrpXpcSd7WqlUejB65cYFvkuYT+
E7dYA6fo0uSRse4kLCL4ANqb7kL+VVaxWi7LLiGCuldRTukl1O+HQdBFIhg==</o:BinarySecurityToken>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
<Reference URI="#_1">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>uj8/5tcROY0xWO0QUqBMZINDEcQ=</DigestValue>
</Reference>
<Reference URI="#uuid-2e4cc486-0b5d-4af2-a361-e6c2fdaf900a-1">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>lFDD+mLHGZMbI6udnmfLc/JvdH0=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>HBCY+FGbrZVNJSkp0ugthMH9OIIfLxwqetncOLDpi2n51zmiTe9YnVngu+3UGxf5UqUzvJ2AZ7u
VAishCNLz2mYVymP5eoBjkNCbCKC8URRCYlfLbqs1suG4TuHeZl5Yqq8AYkmEtQtjSVxLW2eYMeQ1ss1gIjGqunIHp9
ZmHKrUTcvn4nWz4/lxml/Jjh0yR+Yw6S07rBOFL5QlLL4iGxiIQF5L3s1FBeXPw3jRLUgw/D/3kRbEQuENq2GttKzZH
/T9oCFTIz0iTkJPv1Xt9UsMsL146tsN9uLO/sISF6NxaYMukZ+fNFHNS1kWyXWBmFM8hnygAjX+l6y7uQ5hsA==</Si
gnatureValue>
<KeyInfo>
<o:SecurityTokenReference>

Page | 24 of 28
MPay Integration Guide
<o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-
wss-x509-token-profile-1.0#X509v3" URI="#uuid-5746b093-5944-45eb-ae43-bffc5e52c49d-2" />
</o:SecurityTokenReference>
</KeyInfo>
</Signature>
</o:Security>
<To s:mustUnderstand="1"
xmlns="http://schemas.microsoft.com/ws/2005/05/addressing/none">http://localhost:2155/Api/S
erviceProvider.svc</To>
<Action s:mustUnderstand="1"
xmlns="http://schemas.microsoft.com/ws/2005/05/addressing/none">https://mpay.gov.md/IServic
eProvider/GetOrderDetails</Action>
</s:Header>
<s:Body u:Id="_1">
<GetOrderDetails xmlns="https://mpay.gov.md">
<query xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
<OrderKey>002</OrderKey>
<ServiceID>SERVICE1</ServiceID>
</query>
</GetOrderDetails>
</s:Body>
</s:Envelope>

Reply:
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-
open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-
200401-wss-wssecurity-secext-1.0.xsd">
<u:Timestamp u:Id="uuid-90baf5bc-f038-4fb3-ab83-7b63a73fbccf-1">
<u:Created>2013-08-12T05:19:51.066Z</u:Created>
<u:Expires>2013-08-12T05:24:51.066Z</u:Expires>
</u:Timestamp>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
<Reference URI="#_1">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>ePBF8NCKbsJnW+RT7NxSG+ssiEo=</DigestValue>
</Reference>
<Reference URI="#uuid-90baf5bc-f038-4fb3-ab83-7b63a73fbccf-1">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>egFIGTnIlnlmOv/Kx1ulkKqK58g=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>Id5Dg3WIfcMlQwH2G0TFFZ4A3NsRdHZQiozY5Bmv3UibW86J6PhucW72xz7FhlBsIK3o5fFNve+
aFNfNmpZGxzux6EeB2QV3/GiGE6P0bvQCQ6+Cx/aNdMy2d9rFX6yseDejyMrXK148anUY4tvVjBkaa0I33haNV/0l9W
pvt4ANXxrvOG6q889NnhkJ47s3qr4GxGuZST50EjJl9pol2hXBgkpofQB7m9vHOsE0OTndGpMdrgPV3IiF7gGSx0161
bJLBDiFKnSoLnmzoqth/ped+joaM+PwSzFeti6s3wHKuxHIyzD4D1G23mbNfWIpFnBSpbMyoAJPiBRjK+GCFw==</Si
gnatureValue>
<KeyInfo>
<o:SecurityTokenReference>
<X509Data>
<X509IssuerSerial>
<X509IssuerName>CN=MPaySampleRootCA</X509IssuerName>

Page | 25 of 28
MPay Integration Guide
<X509SerialNumber>-
62593173075056624188289871685237271978</X509SerialNumber>
</X509IssuerSerial>
</X509Data>
</o:SecurityTokenReference>
</KeyInfo>
</Signature>
</o:Security>
</s:Header>
<s:Body u:Id="_1">
<GetOrderDetailsResponse xmlns="https://mpay.gov.md">
<GetOrderDetailsResult xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
<OrderDetails>
<Currency>MDL</Currency>
<Lines>
<OrderLine>
<AmountDue>12.3</AmountDue>
<LineID>DEFAULT</LineID>
<Reason>Sample Service Certificate</Reason>
</OrderLine>
</Lines>
<OrderKey>001</OrderKey>
<Reason>Sample Service Certificate</Reason>
<ServiceID>SERVICE1</ServiceID>
<Status>Active</Status>
<TotalAmountDue>12.3</TotalAmountDue>
</OrderDetails>
</GetOrderDetailsResult>
</GetOrderDetailsResponse>
</s:Body>
</s:Envelope>

11.2.2. ConfirmOrderPayment
Request:
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-
open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-
200401-wss-wssecurity-secext-1.0.xsd">
<u:Timestamp u:Id="uuid-b59a970b-0038-443a-81d6-218a0b457262-2">
<u:Created>2013-08-12T05:22:18.491Z</u:Created>
<u:Expires>2013-08-12T05:27:18.491Z</u:Expires>
</u:Timestamp>
<o:BinarySecurityToken u:Id="uuid-30865158-af80-4edb-89f0-8231f6be1198-5"
ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-
1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-
message-security-
1.0#Base64Binary">MIIDCTCCAfWgAwIBAgIQksFqROhPr7JCKKE3HuXP7DAJBgUrDgMCHQUAMBsxGTAXBgNVBAMTE
E1QYXlTYW1wbGVSb290Q0EwHhcNMTMwNzMwMDkwNTM1WhcNMzkxMjMxMjM1OTU5WjAcMRowGAYDVQQDExFNUGF5T2Zm
bGluZVNhbXBsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJWnLnPdBmHyXWeS7+IWM9TMe7yh5NG9qAx
Y5HFQGCq1PcA0bbsUIFxEccO8V9ztxRZIGdqOzRwdwb/zcPXfQ3uaWLYA66wq6fETzR8v5O4+YFNs0OqO0XqKESR6bm
5pbdoMkqiviWw1P1w6bvTCTSlx3WQUSMpAGWDFY13BxmMkHz/JQ1/yX/PCjFV05V39YBZPxPlZVLeqfckxA12XfT1MG
5oVCy3sokYlqiQ51APvoiKp2QwY6n2w6N7gLs6HJOxA4wjgmVS4cb3Xj/VsmtY+l4OPBToNf3OTK2K0UstoS2deh9zq
cnvcOQFCXHha6+U7fBY/nKmFu+mBzPI5eOUCAwEAAaNQME4wTAYDVR0BBEUwQ4AQdQYVXqL6CsO0g2khLKFvOKEdMBs
xGTAXBgNVBAMTEE1QYXlTYW1wbGVSb290Q0GCEGOzQZGBOD2lQKnbBdaYewQwCQYFKw4DAh0FAAOCAQEAwUDG5RAG8N
3QyjCO2Zuu1bR4R/P77IjimRGp6EVWkO00C9jAmDX4yNlSs27h7xNliqx3HBJml93vTshtlua06K1Dw1hGXfXNAq6+f
bvoRBum36yNryrA32uHUkCHUknktTS+CDspIjcp6GaTh1Aon6cuyB1EnUosOLylNlsKoDyPt/4x0Jv3U2YGP/q7WjrL
bRdrwPOMf6XWNv605SF/W24yXZbNpmRPfxcfcUUzQ28SKrL/WkeQOiaw6yvafWxjxrpXpcSd7WqlUejB65cYFvkuYT+
E7dYA6fo0uSRse4kLCL4ANqb7kL+VVaxWi7LLiGCuldRTukl1O+HQdBFIhg==</o:BinarySecurityToken>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>

Page | 26 of 28
MPay Integration Guide
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
<Reference URI="#_1">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>lFDM+hr7AtA543IqT759GKSwgCU=</DigestValue>
</Reference>
<Reference URI="#uuid-b59a970b-0038-443a-81d6-218a0b457262-2">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>i2XCBmhBNf+9ibajweh//4YggJQ=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>kpIMFpjrVwKGA4HtRAdj3pCwB0YDLymslJURrBwbNNJ7YeQNFVZW3Hub4wMXCxHgMhqJBb/vDXl
MzyWUWrnftHb0kYn/dC+ngjHCuuapqWvqRh9Sawo/phbEeG1gyOkz+16DOqCGfB0jPk1bf8EAfjl3QOhlgaoq6KJhGa
l+e2Mfoiraa0wjifOFMUnODPigB0tI9lJXxNBZiwYkA0UswfE5yN8apHrZ06YEl4UXSDdN0UyEyK6CSvHT6xVIUEMnM
y24hRyoezFVo8FQMB63pi3Q4h27yeSP/Q/tjnluBZsOe7DMxQK/bGuWM0O0nxL8JZUfAfrctzpKjYgw7pb1/Q==</Si
gnatureValue>
<KeyInfo>
<o:SecurityTokenReference>
<o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-
wss-x509-token-profile-1.0#X509v3" URI="#uuid-30865158-af80-4edb-89f0-8231f6be1198-5" />
</o:SecurityTokenReference>
</KeyInfo>
</Signature>
</o:Security>
<To s:mustUnderstand="1"
xmlns="http://schemas.microsoft.com/ws/2005/05/addressing/none">http://localhost:2155/Api/S
erviceProvider.svc</To>
<Action s:mustUnderstand="1"
xmlns="http://schemas.microsoft.com/ws/2005/05/addressing/none">https://mpay.gov.md/IServic
eProvider/ConfirmOrderPayment</Action>
</s:Header>
<s:Body u:Id="_1">
<ConfirmOrderPayment xmlns="https://mpay.gov.md">
<confirmation xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
<Currency>MDL</Currency>
<InvoiceID>FE2EF45C357D</InvoiceID>
<Lines>
<PaymentConfirmationLine>
<Amount>321.00</Amount>
<DestinationAccount>
<BankAccount>MD89TRGAAA11452101110000</BankAccount>
<BankCode>TRES</BankCode>
<BankName>State Treasury</BankName>
<BeneficiaryName>Sample Service Provider</BeneficiaryName>
</DestinationAccount>
<LineID>DEFAULT</LineID>
</PaymentConfirmationLine>
</Lines>
<OrderKey>002</OrderKey>
<PaidAt>2013-08-12T08:22:18.4874003+03:00</PaidAt>
<PaymentID>9B3DBC6F268E</PaymentID>
<ServiceID>SERVICE1</ServiceID>
<TotalAmount>321.00</TotalAmount>
</confirmation>
</ConfirmOrderPayment>
</s:Body>
</s:Envelope>

Page | 27 of 28
MPay Integration Guide
Reply:
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-
open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<s:Header>
<o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-
200401-wss-wssecurity-secext-1.0.xsd">
<u:Timestamp u:Id="uuid-6e662454-9946-45ec-9346-eb213f9bac92-2">
<u:Created>2013-08-12T05:24:25.578Z</u:Created>
<u:Expires>2013-08-12T05:29:25.578Z</u:Expires>
</u:Timestamp>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
<Reference URI="#_1">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>L41Owi7n0DjiORvo/aMpYbSQXHo=</DigestValue>
</Reference>
<Reference URI="#uuid-6e662454-9946-45ec-9346-eb213f9bac92-2">
<Transforms>
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<DigestValue>d00O1f5pMDJy7W2hRqYDAjo7bMs=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>fbTRxM2A8FwXi6DwMqRxiBeuVpS7FYS9t5Gzzc5pHsYtGZq9sO1Ya9pNcWsOHpt/a2yHs9lAD0C
yoECZ9YOU+lrETB9vD9Twv0PwZbuZxYAObV4xPVXQaOxnbBqarQIgS2wt7eN0WC20m0ShW8VXwnVFXF7Yhw6PfbFFoO
1teJK3bULYp38oQXKbZWWaGXyG1BrTugC+4usSWqKzfzkgQOUAtyZ8KWzx76kWpfNfqMnzix9+EcOl/UFcTJUQf+Syh
QuDHAn6bJyyPQx48uTvvCc8pR5SN15arGtz7QKHGpkNExTGTRcZz7kRmAkWEEOGCh4O8a9pMIJETZnkcJrO4w==</Si
gnatureValue>
<KeyInfo>
<o:SecurityTokenReference>
<X509Data>
<X509IssuerSerial>
<X509IssuerName>CN=MPaySampleRootCA</X509IssuerName>
<X509SerialNumber>-
62593173075056624188289871685237271978</X509SerialNumber>
</X509IssuerSerial>
</X509Data>
</o:SecurityTokenReference>
</KeyInfo>
</Signature>
</o:Security>
</s:Header>
<s:Body u:Id="_1">
<ConfirmOrderPaymentResponse xmlns="https://mpay.gov.md" />
</s:Body>
</s:Envelope>

Page | 28 of 28