{ "item": [ { "name": "Authorization", "description": "", "item": [ { "id": "787079f4-3ab7-4f1e-81c8-433f26f7001d", "name": "Get Authorization Code", "request": { "name": "Get Authorization Code", "description": { "content": "## Overview\n\nThis is the [Authorization Endpoint][RFC 6749 §3.1], used as part of the [Authorization Code Grant][RFC 6749 §4.1], with the [PKCE extension][RFC 7636 §4.3]. This endpoint allows clients to securely authenticate into the Paysafe infrastructure by generating an `authorization code`, which can then be exchanged for an `access token`. For an enhanced security all clients must use the `PKCE` extension with the `SHA-256` code challenge method.\n\n[RFC 6749 §3.1]: https://tools.ietf.org/html/rfc6749#section-3.1\n[RFC 6749 §4.1]: https://tools.ietf.org/html/rfc6749#section-4.1\n[RFC 7636 §4.3]: https://tools.ietf.org/html/rfc7636#section-4.3\n\n## How Authorization Code Flow works\n\n1. User initiates a Login process through the Paysafe Embedded Wallet SDK.\n\n2. Paysafe Embedded Wallet SDK redirects user to login page (`/authorize` endpoint).\n\n3. User authenticates using one of the configured login options.\n\n4. Upon successful authentication, the authorization endpoint redirects the user back to the application with a single-use `authorization code`.\n\n5. The application exchanges the `authorization code` with the [Paysafe Embedded Wallet’s Token endpoint](/api/embedded-wallets/common/authentication/issue-access-token), sending along the `client credentials` and `PKCE verifier`.\n\n6. The token endpoint verifies the `authorization code`, `client credentials`, and `PKCE verifier`.\n\n7. The token endpoint responds with an `access token` (optionally `refresh token` and `ID token`).\n\n8. The application uses the `access token` to call the wallet’s APIs to access user information or perform actions.\n\n9. The wallet API responds with the requested data or performs the requested operation.\n\n## Security Considerations\n\n- **Strict Redirect URI Validation**: Only valid `redirect_uri` values are used for redirections to prevent open redirect vulnerabilities.\n- **OAuth 2.0 Compliance**: The Login API strictly adheres to the OAuth 2.0 specification for error reporting and redirection behavior.\n\n## Intended Audience\nThis endpoint is designed for **partner applications** to facilitate secure authentication for their end-users and to enable access to protected resources.", "type": "text/plain" }, "url": { "path": [ "auth", "brands", ":brandIdentity", "authorize" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "(Required) The OAuth2 PKCE `code_challenge`. This is the hashed value of a verifier.", "type": "text/plain" }, "key": "code_challenge", "value": "7bfSRtBCwz4uksn-~ZGFxhXmgu8u_rd-aEQtlQxn0tn" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 PKCE `code_challenge_method`. Only the S256 method (hashing the code_verifier with SHA-256) is supported. (This can only be one of S256)", "type": "text/plain" }, "key": "code_challenge_method", "value": "S256" }, { "disabled": false, "description": { "content": "Preferred languages for a customer", "type": "text/plain" }, "key": "locale", "value": "nz-MY" }, { "disabled": false, "description": { "content": "The Oauth2 `login_hint` hints to the server which user is trying to authenticate.", "type": "text/plain" }, "key": "login_hint", "value": "" }, { "disabled": false, "description": { "content": "The OAuth2 `nonce`. The nonce value sent by the client will be present in the final token.", "type": "text/plain" }, "key": "nonce", "value": "" }, { "disabled": false, "description": { "content": "Optional OAuth2 `prompt` parameter that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. (This can only be one of none,login,consent)", "type": "text/plain" }, "key": "prompt", "value": "login" }, { "disabled": false, "description": { "content": "The OAuth2 `redirect_uri`, to which the authorization server will redirect the user after authorization.", "type": "text/plain" }, "key": "redirect_uri", "value": "" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 `client_id` assigned to the client when it was registered.", "type": "text/plain" }, "key": "client_id", "value": "" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 `response_type`. Only the authorization code workflow is supported. (This can only be one of code)", "type": "text/plain" }, "key": "response_type", "value": "code" }, { "disabled": false, "description": { "content": "The OAuth2 `scope` on which the client requires access.", "type": "text/plain" }, "key": "scope", "value": "" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 `state` parameter sent in the request, for CSRF protection.", "type": "text/plain" }, "key": "state", "value": "" }, { "disabled": false, "description": { "content": "Parameter, which indicates what will be the preferred login method.\n\n* password - The user will be asked to enter password.\n* pin - The user will be asked to enter PIN.\n* biometric - The user will be asked to authenticate using biometric data.\n (This can only be one of pin,password,biometric)", "type": "text/plain" }, "key": "login_strategy", "value": "password" }, { "disabled": false, "description": { "content": "(Required) Unique identifier assigned to individual users or devices, used to create their digital identity.", "type": "text/plain" }, "key": "digital_fingerprint", "value": "" }, { "disabled": false, "description": { "content": "Unique identifier used for pairing the device.", "type": "text/plain" }, "key": "device_id", "value": "" }, { "disabled": false, "description": { "content": "(Required) Parameter used for redirecting the users to a designated credentials reset interface from the Login Screen.", "type": "text/plain" }, "key": "reset_credentials_url", "value": "" } ], "variable": [ { "type": "any", "value": "", "key": "brandIdentity", "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" } } ] }, "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "53d583d8-3e8b-48e1-8054-8b6172d5c072", "name": "This endpoint initiates the OAuth 2.0 authorization process by displaying an authentication page to the end-user’s browser. Once the user completes the authentication and authorization steps, the endpoint redirects to the client’s specified redirection endpoint with the appropriate parameters.\n\n#### Success Behavior \n\nRedirect to the actual HTML content shown to a user agent to begin the OAuth 2 authorization process. If the `client_id` and `redirect_uri` match the client configuration on the authorization server, and the user has entered valid credentials, they are redirected to the specified redirection endpoint as defined by [RFC 6749 §4.1.2] with the following query parameters:\n- `code`: The authorization code, to be exchanged for an access token.\n- `state`: A value originally sent by the client to maintain request integrity and prevent CSRF attacks.\n\n#### Error Handling\n\nIf any required parameters are missing or invalid, or if there is a mismatch in the `client_id` or `redirect_uri`, the authorization server will:\n1. Display an error page to the user.\n2. Redirect to the client’s redirection endpoint (if valid) with the following query parameters as specified by [RFC 6749 §4.1.2.1]:\n- `error`: An error code indicating the reason for the failure.\n- `error_description`: A description of the error to aid troubleshooting.\n\n[RFC 6749 §4.1.2]: https://tools.ietf.org/html/rfc6749#section-4.1.2\n[RFC 6749 §4.1.2.1]: https://tools.ietf.org/html/rfc6749#section-4.1.2.1", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "authorize" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "(Required) The OAuth2 PKCE `code_challenge`. This is the hashed value of a verifier.", "type": "text/plain" }, "key": "code_challenge", "value": "7bfSRtBCwz4uksn-~ZGFxhXmgu8u_rd-aEQtlQxn0tn" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 PKCE `code_challenge_method`. Only the S256 method (hashing the code_verifier with SHA-256) is supported. (This can only be one of S256)", "type": "text/plain" }, "key": "code_challenge_method", "value": "S256" }, { "disabled": false, "description": { "content": "Preferred languages for a customer", "type": "text/plain" }, "key": "locale", "value": "nz-MY" }, { "disabled": false, "description": { "content": "The Oauth2 `login_hint` hints to the server which user is trying to authenticate.", "type": "text/plain" }, "key": "login_hint", "value": "" }, { "disabled": false, "description": { "content": "The OAuth2 `nonce`. The nonce value sent by the client will be present in the final token.", "type": "text/plain" }, "key": "nonce", "value": "" }, { "disabled": false, "description": { "content": "Optional OAuth2 `prompt` parameter that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. (This can only be one of none,login,consent)", "type": "text/plain" }, "key": "prompt", "value": "login" }, { "disabled": false, "description": { "content": "The OAuth2 `redirect_uri`, to which the authorization server will redirect the user after authorization.", "type": "text/plain" }, "key": "redirect_uri", "value": "" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 `client_id` assigned to the client when it was registered.", "type": "text/plain" }, "key": "client_id", "value": "" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 `response_type`. Only the authorization code workflow is supported. (This can only be one of code)", "type": "text/plain" }, "key": "response_type", "value": "code" }, { "disabled": false, "description": { "content": "The OAuth2 `scope` on which the client requires access.", "type": "text/plain" }, "key": "scope", "value": "" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 `state` parameter sent in the request, for CSRF protection.", "type": "text/plain" }, "key": "state", "value": "" }, { "disabled": false, "description": { "content": "Parameter, which indicates what will be the preferred login method.\n\n* password - The user will be asked to enter password.\n* pin - The user will be asked to enter PIN.\n* biometric - The user will be asked to authenticate using biometric data.\n (This can only be one of pin,password,biometric)", "type": "text/plain" }, "key": "login_strategy", "value": "password" }, { "disabled": false, "description": { "content": "(Required) Unique identifier assigned to individual users or devices, used to create their digital identity.", "type": "text/plain" }, "key": "digital_fingerprint", "value": "" }, { "disabled": false, "description": { "content": "Unique identifier used for pairing the device.", "type": "text/plain" }, "key": "device_id", "value": "" }, { "disabled": false, "description": { "content": "(Required) Parameter used for redirecting the users to a designated credentials reset interface from the Login Screen.", "type": "text/plain" }, "key": "reset_credentials_url", "value": "" } ], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "Found", "code": 302, "header": [], "cookie": [], "_postman_previewlanguage": "text" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "6a187c72-dbee-4f81-b147-a5f2d6d85160", "name": "Get Authorization Code Flow Login UI", "request": { "name": "Get Authorization Code Flow Login UI", "description": { "content": "## Overview\n\nThe **Login API** is an internal endpoint hosted on a dedicated authentication domain. It supports the OAuth 2.0 Authorization Code flow by rendering the login UI. This API is directly invoked via the `/authorize` endpoint, which is partner-facing. The `/authorize` endpoint redirects clients to the `/login` endpoint on the authentication domain, ensuring a seamless and secure user authentication experience.\n\n## How Authorization Code Flow works\n\n1. User initiates a Login process through the Paysafe Embedded Wallet SDK.\n\n2. Paysafe Embedded Wallet SDK redirects user to login page (`/authorize` endpoint).\n\n3. User authenticates using one of the configured login options.\n\n4. Upon successful authentication, the authorization endpoint redirects the user back to the application with a single-use `authorization code`.\n\n5. The application exchanges the `authorization code` with the [Paysafe Embedded Wallet’s Token endpoint](/api/embedded-wallets/common/authentication/issue-access-token), sending along the `client credentials` and `PKCE verifier`.\n\n6. The token endpoint verifies the `authorization code`, `client credentials`, and `PKCE verifier`.\n\n7. The token endpoint responds with an `access token` (optionally `refresh token` and `ID token`).\n\n8. The application uses the `access token` to call the wallet’s APIs to access user information or perform actions.\n\n9. The wallet API responds with the requested data or performs the requested operation.\n\n## Purpose\n\nThe Login API is designed to:\n\n- **Render the Login UI**: Serve the HTML content for the login page on the authentication domain.\n- **Handle Authentication Outcomes**: Manage success and error scenarios, either redirecting users to the provided `redirect_uri` or a custom failure page.\n- **Enhance Security**: Host the login UI on a separate domain to isolate authentication operations.\n\n## Workflow\n\n1. **Initiation via `/authorize`**:\n - A client initiates a request to the `/authorize` endpoint.\n - The `/authorize` endpoint redirects the user (HTTP `302`) to the `/login` endpoint on the authentication domain.\n\n2. **Processing by `/login`**:\n - **Success**:\n - The `/login` endpoint serves a `200 OK` response with the HTML content of the login page.\n - The `/login` endpoint returns a `302 FOUND` response and redirects the user to an external HTML-based login page.\n - **Error**:\n - If the provided `redirect_uri` is **invalid**, the `/login` endpoint redirects to a **custom failure page**.\n - If the `redirect_uri` is **valid**, the `/login` endpoint redirects back to the `redirect_uri` with `error` and `error_description` query parameters, as described by [RFC 6749 §4.1.2.1].\n\n3. **User Authentication**:\n - Users interact with the login UI to authenticate.\n - On successful authentication, the user is redirected to the `redirect_uri` with `code` as a query parameter.\n\n## Security Considerations\n\n- **Domain Isolation**: Hosting the login UI on a separate domain (`auth.paysafe.com`) ensures stricter security controls for authentication processes.\n- **Strict Redirect URI Validation**: Only valid `redirect_uri` values are used for redirections to prevent open redirect vulnerabilities.\n- **OAuth 2.0 Compliance**: The Login API strictly adheres to the OAuth 2.0 specification for error reporting and redirection behavior.\n\n## Intended audience\nThis endpoint is **implicitly triggered** as part of the OAuth 2.0 Authorization Code flow. It facilitates the secure execution of the login process, enabling the rendering of the login UI and managing user authentication. This endpoint is **NOT** intended to be directly invoked by partners, but serves as a critical step within the overall authentication flow.\n\n[RFC 6749 §4.1.2.1]: https://tools.ietf.org/html/rfc6749#section-4.1.2.1", "type": "text/plain" }, "url": { "path": [ "auth", "brands", ":brandIdentity", "login" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "(Required) The OAuth2 PKCE `code_challenge`. This is the hashed value of a verifier.", "type": "text/plain" }, "key": "code_challenge", "value": "7bfSRtBCwz4uksn-~ZGFxhXmgu8u_rd-aEQtlQxn0tn" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 PKCE `code_challenge_method`. Only the S256 method (hashing the code_verifier with SHA-256) is supported. (This can only be one of S256)", "type": "text/plain" }, "key": "code_challenge_method", "value": "S256" }, { "disabled": false, "description": { "content": "(Required) Preferred languages for a customer", "type": "text/plain" }, "key": "locale", "value": "nz-MY" }, { "disabled": false, "description": { "content": "The Oauth2 `login_hint` hints to the server which user is trying to authenticate.", "type": "text/plain" }, "key": "login_hint", "value": "fi4@=AFDlC$k/Ri.Zxq4Q6o3k" }, { "disabled": false, "description": { "content": "The OAuth2 `nonce`. The nonce value sent by the client will be present in the final token.", "type": "text/plain" }, "key": "nonce", "value": "" }, { "disabled": false, "description": { "content": "Optional OAuth2 `prompt` parameter that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. (This can only be one of none,login,consent)", "type": "text/plain" }, "key": "prompt", "value": "login" }, { "disabled": false, "description": { "content": "The OAuth2 `redirect_uri`, to which the authorization server will redirect the user after authorization.", "type": "text/plain" }, "key": "redirect_uri", "value": "" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 `client_id` assigned to the client when it was registered.", "type": "text/plain" }, "key": "client_id", "value": "" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 `response_type`. Only the authorization code workflow is supported. (This can only be one of code)", "type": "text/plain" }, "key": "response_type", "value": "code" }, { "disabled": false, "description": { "content": "The OAuth2 `scope` on which the client requires access.", "type": "text/plain" }, "key": "scope", "value": "" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 `state` parameter sent in the request, for CSRF protection.", "type": "text/plain" }, "key": "state", "value": "" }, { "disabled": false, "description": { "content": "(Required) Parameter, which indicates what will be the preferred login method.\n\n* password - The user will be asked to enter password.\n* pin - The user will be asked to enter PIN.\n* biometric - The user will be asked to authenticate using biometric data.\n (This can only be one of pin,password,biometric)", "type": "text/plain" }, "key": "login_strategy", "value": "password" }, { "disabled": false, "description": { "content": "(Required) Unique identifier assigned to individual users or devices, used to create their digital identity.", "type": "text/plain" }, "key": "digital_fingerprint", "value": "" }, { "disabled": false, "description": { "content": "Unique identifier used for pairing the device.", "type": "text/plain" }, "key": "device_id", "value": "" }, { "disabled": false, "description": { "content": "(Required) Parameter used for redirecting the users to a designated credentials reset interface from the Login Screen.", "type": "text/plain" }, "key": "reset_credentials_url", "value": "" } ], "variable": [ { "type": "any", "value": "", "key": "brandIdentity", "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" } } ] }, "header": [ { "key": "Accept", "value": "text/html" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "6020a356-0466-45f6-9470-58fb95123770", "name": "This endpoint initiates the OAuth 2.0 authorization process by displaying an authentication page to the end-user’s browser. Once the user completes the authentication and authorization steps, the endpoint redirects to the client’s specified redirection endpoint with the appropriate parameters.\n\n#### Success Behavior \n\nReturns the actual HTML content shown to a user agent to begin the OAuth 2 authorization process. If the `client_id` and `redirect_uri` match the client configuration on the authorization server, and the user has entered valid credentials, they are redirected to the specified redirection endpoint as defined by [RFC 6749 §4.1.2] with the following query parameters:\n- `code`: The authorization code, to be exchanged for an access token.\n- `state`: A value originally sent by the client to maintain request integrity and prevent CSRF attacks.\n\n[RFC 6749 §4.1.2]: https://tools.ietf.org/html/rfc6749#section-4.1.2", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "login" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "(Required) The OAuth2 PKCE `code_challenge`. This is the hashed value of a verifier.", "type": "text/plain" }, "key": "code_challenge", "value": "7bfSRtBCwz4uksn-~ZGFxhXmgu8u_rd-aEQtlQxn0tn" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 PKCE `code_challenge_method`. Only the S256 method (hashing the code_verifier with SHA-256) is supported. (This can only be one of S256)", "type": "text/plain" }, "key": "code_challenge_method", "value": "S256" }, { "disabled": false, "description": { "content": "(Required) Preferred languages for a customer", "type": "text/plain" }, "key": "locale", "value": "nz-MY" }, { "disabled": false, "description": { "content": "The Oauth2 `login_hint` hints to the server which user is trying to authenticate.", "type": "text/plain" }, "key": "login_hint", "value": "fi4@=AFDlC$k/Ri.Zxq4Q6o3k" }, { "disabled": false, "description": { "content": "The OAuth2 `nonce`. The nonce value sent by the client will be present in the final token.", "type": "text/plain" }, "key": "nonce", "value": "" }, { "disabled": false, "description": { "content": "Optional OAuth2 `prompt` parameter that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. (This can only be one of none,login,consent)", "type": "text/plain" }, "key": "prompt", "value": "login" }, { "disabled": false, "description": { "content": "The OAuth2 `redirect_uri`, to which the authorization server will redirect the user after authorization.", "type": "text/plain" }, "key": "redirect_uri", "value": "" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 `client_id` assigned to the client when it was registered.", "type": "text/plain" }, "key": "client_id", "value": "" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 `response_type`. Only the authorization code workflow is supported. (This can only be one of code)", "type": "text/plain" }, "key": "response_type", "value": "code" }, { "disabled": false, "description": { "content": "The OAuth2 `scope` on which the client requires access.", "type": "text/plain" }, "key": "scope", "value": "" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 `state` parameter sent in the request, for CSRF protection.", "type": "text/plain" }, "key": "state", "value": "" }, { "disabled": false, "description": { "content": "(Required) Parameter, which indicates what will be the preferred login method.\n\n* password - The user will be asked to enter password.\n* pin - The user will be asked to enter PIN.\n* biometric - The user will be asked to authenticate using biometric data.\n (This can only be one of pin,password,biometric)", "type": "text/plain" }, "key": "login_strategy", "value": "password" }, { "disabled": false, "description": { "content": "(Required) Unique identifier assigned to individual users or devices, used to create their digital identity.", "type": "text/plain" }, "key": "digital_fingerprint", "value": "" }, { "disabled": false, "description": { "content": "Unique identifier used for pairing the device.", "type": "text/plain" }, "key": "device_id", "value": "" }, { "disabled": false, "description": { "content": "(Required) Parameter used for redirecting the users to a designated credentials reset interface from the Login Screen.", "type": "text/plain" }, "key": "reset_credentials_url", "value": "" } ], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "key": "Accept", "value": "text/html" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "text/html" } ], "body": "", "cookie": [], "_postman_previewlanguage": "text" }, { "id": "11e37894-c768-481d-a838-6da0d516700c", "name": "The `/login` endpoint returns an HTTP `302` status code in the following scenarios:\n\n#### Redirection to Authentication Content\n\nIn certain cases, the `/login` endpoint may redirect the user to an external HTML-based login page. This ensures that users are presented with the appropriate UI for completing the authentication process, depending on the configured authentication mechanism.\n\n#### Error Handling\n\nIf any required parameters are missing or invalid, or if there is a mismatch in the `client_id` or `redirect_uri`, the authorization server will:\n1. Display an error page to the user.\n2. Redirect to the client’s redirection endpoint (if valid) with the following query parameters as specified by [RFC 6749 §4.1.2.1]:\n- `error`: An error code indicating the reason for the failure.\n- `error_description`: A description of the error to aid troubleshooting.\n\n[RFC 6749 §4.1.2.1]: https://tools.ietf.org/html/rfc6749#section-4.1.2.1", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "login" ], "host": [ "{{baseUrl}}" ], "query": [ { "disabled": false, "description": { "content": "(Required) The OAuth2 PKCE `code_challenge`. This is the hashed value of a verifier.", "type": "text/plain" }, "key": "code_challenge", "value": "7bfSRtBCwz4uksn-~ZGFxhXmgu8u_rd-aEQtlQxn0tn" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 PKCE `code_challenge_method`. Only the S256 method (hashing the code_verifier with SHA-256) is supported. (This can only be one of S256)", "type": "text/plain" }, "key": "code_challenge_method", "value": "S256" }, { "disabled": false, "description": { "content": "(Required) Preferred languages for a customer", "type": "text/plain" }, "key": "locale", "value": "nz-MY" }, { "disabled": false, "description": { "content": "The Oauth2 `login_hint` hints to the server which user is trying to authenticate.", "type": "text/plain" }, "key": "login_hint", "value": "fi4@=AFDlC$k/Ri.Zxq4Q6o3k" }, { "disabled": false, "description": { "content": "The OAuth2 `nonce`. The nonce value sent by the client will be present in the final token.", "type": "text/plain" }, "key": "nonce", "value": "" }, { "disabled": false, "description": { "content": "Optional OAuth2 `prompt` parameter that specifies whether the Authorization Server prompts the End-User for reauthentication and consent. (This can only be one of none,login,consent)", "type": "text/plain" }, "key": "prompt", "value": "login" }, { "disabled": false, "description": { "content": "The OAuth2 `redirect_uri`, to which the authorization server will redirect the user after authorization.", "type": "text/plain" }, "key": "redirect_uri", "value": "" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 `client_id` assigned to the client when it was registered.", "type": "text/plain" }, "key": "client_id", "value": "" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 `response_type`. Only the authorization code workflow is supported. (This can only be one of code)", "type": "text/plain" }, "key": "response_type", "value": "code" }, { "disabled": false, "description": { "content": "The OAuth2 `scope` on which the client requires access.", "type": "text/plain" }, "key": "scope", "value": "" }, { "disabled": false, "description": { "content": "(Required) The OAuth2 `state` parameter sent in the request, for CSRF protection.", "type": "text/plain" }, "key": "state", "value": "" }, { "disabled": false, "description": { "content": "(Required) Parameter, which indicates what will be the preferred login method.\n\n* password - The user will be asked to enter password.\n* pin - The user will be asked to enter PIN.\n* biometric - The user will be asked to authenticate using biometric data.\n (This can only be one of pin,password,biometric)", "type": "text/plain" }, "key": "login_strategy", "value": "password" }, { "disabled": false, "description": { "content": "(Required) Unique identifier assigned to individual users or devices, used to create their digital identity.", "type": "text/plain" }, "key": "digital_fingerprint", "value": "" }, { "disabled": false, "description": { "content": "Unique identifier used for pairing the device.", "type": "text/plain" }, "key": "device_id", "value": "" }, { "disabled": false, "description": { "content": "(Required) Parameter used for redirecting the users to a designated credentials reset interface from the Login Screen.", "type": "text/plain" }, "key": "reset_credentials_url", "value": "" } ], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "Found", "code": 302, "header": [], "cookie": [], "_postman_previewlanguage": "text" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Configurations", "description": "", "item": [ { "id": "a9d5a7bb-0584-4e8d-9b08-cc54e4b14abc", "name": "Get Configurations", "request": { "name": "Get Configurations", "description": { "content": "Retrieves information about all Paysafe Embedded Wallet configurations.", "type": "text/plain" }, "url": { "path": [ "auth", "configurations" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{bearerToken}}" } ] } }, "response": [ { "id": "601ec016-f88d-44c1-9004-01d3de467cab", "name": "OK", "originalRequest": { "url": { "path": [ "auth", "configurations" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"deviceScreening\": {\n \"organizationId\": \"\",\n \"screenHost\": \"\",\n \"sessionExpiry\": 900000\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "9a5df3ae-930c-4319-a5e4-9017ab33c68b", "name": "Internal Server Error", "originalRequest": { "url": { "path": [ "auth", "configurations" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "GET", "body": {} }, "status": "Internal Server Error", "code": 500, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "cfa7cf88-6203-472d-bed2-883e35290cc8", "name": "Service Unavailable", "originalRequest": { "url": { "path": [ "auth", "configurations" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "GET", "body": {} }, "status": "Service Unavailable", "code": 503, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "JSON Web Key Set", "description": "", "item": [ { "id": "e1dda91d-a531-4656-9390-095e21d83195", "name": "Retrieve JSON Web Key Set", "request": { "name": "Retrieve JSON Web Key Set", "description": { "content": "This endpoint contains the JWK used to verify all Paysafe-issued JWTs for this brand.\n\nThe JSON Web Key Set (JWKS) is a set of keys containing the public keys used to verify any JSON Web Token (JWT) issued by the Authorization Server and signed using the specified signing algorithm.\n\nPaysafe uses the JSON Web Key (JWK) specification to represent the cryptographic keys used for signing RS256 tokens. This specification defines two high-level data structures: JSON Web Key (JWK) and JSON Web Key Set (JWKS). Here are the definitions from the specification:\n\n|Item|Description|\n|-----|-----|\n|JSON Web Key (JWK)|A JSON object that represents a cryptographic key. The members of the object represent properties of the key, including its value.|\n|JSON Web Key Set (JWKS)|A JSON object that represents a set of JWKs. The JSON object MUST have a keys member, which is an array of JWKs.", "type": "text/plain" }, "url": { "path": [ "auth", "brands", ":brandIdentity", "certs" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "brandIdentity", "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" } } ] }, "header": [ { "key": "Accept", "value": "application/json" } ], "method": "GET", "body": {}, "auth": null }, "response": [ { "id": "10681c0b-961d-462d-ad37-8a2760ce0598", "name": "A JSON Web Key Set (JWKS) containing the public keys.", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "certs" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"keys\": [\n {\n \"kid\": \"\",\n \"kty\": \"\",\n \"alg\": \"\",\n \"use\": \"\",\n \"n\": \"\",\n \"e\": \"\",\n \"x5c\": [\n \"\",\n \"\"\n ],\n \"x5t\": \"\",\n \"x5t#S256\": \"\"\n },\n {\n \"kid\": \"\",\n \"kty\": \"\",\n \"alg\": \"\",\n \"use\": \"\",\n \"n\": \"\",\n \"e\": \"\",\n \"x5c\": [\n \"\",\n \"\"\n ],\n \"x5t\": \"\",\n \"x5t#S256\": \"\"\n }\n ]\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "dd5e33da-e1d8-4e75-8811-fc8e01dfcadf", "name": "Method Not Allowed", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "certs" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "Method Not Allowed", "code": 405, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "3488a8f9-d364-4b78-8f5e-f13b4ac5ca75", "name": "Too Many Requests", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "certs" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "5c8f1bde-b8b2-44b7-b0a4-4474acd71c70", "name": "Internal Server Error", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "certs" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "Internal Server Error", "code": 500, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "ceb26435-44c4-426e-b95a-9b8f63ea911e", "name": "Service Unavailable", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "certs" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "GET", "body": {} }, "status": "Service Unavailable", "code": 503, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Strong Customer Authentication", "description": "", "item": [ { "id": "12e4487b-259a-4f68-9d4a-1e56462c4119", "name": "Send an Embedded or Hybrid SCA Challenge", "request": { "name": "Send an Embedded or Hybrid SCA Challenge", "description": { "content": "Sends a challenge via a secure communication mechanism as part of the ongoing Embedded or Hybrid SCA process.\n\nOnce an SCA process is initiated, a challenge must be sent through one of the available verification mechanisms\n(e.g., send an OTP code via SMS). Тhe challenges have their own expiration (e.g., the OTP sent via SMS is valid\nfor only a short time). If a challenge expires, a new one must be sent. A challenge sent for the same process\ncan increment the `currentChallenges` field. This process can only be performed a limited number of times, as\ndefined by `allowableChallenges` (its value is determined by the best security practices). If this limit is\nexceeded, an error will be returned, and no additional challenges can be sent for the same process until a\ncooldown period has elapsed. After this period, the `currentChallenges` are reset, and new challenges can be\nsent for the same process as previously described.\n\nMore details can be found in [Strong Customer Authentication](/docs/embedded-wallets/strong-customer-authentication).", "type": "text/plain" }, "url": { "path": [ "auth", "sca", "events", ":eventId", "challenges" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "eventId", "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event challenge.", "type": "text/plain" } } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PASSKEYS\",\n \"channel\": \"PUSH_NOTIFICATION\",\n \"action\": {\n \"language\": \"en\",\n \"returnUrl\": \"\"\n }\n },\n \"deviceInfo\": {\n \"appType\": \"MOBILE_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{bearerToken}}" } ] } }, "response": [ { "id": "24e5da06-8750-47db-a4f4-23300c390760", "name": "Created", "originalRequest": { "url": { "path": [ "auth", "sca", "events", ":eventId", "challenges" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event challenge.", "type": "text/plain" }, "type": "any", "value": "", "key": "eventId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PASSKEYS\",\n \"channel\": \"PUSH_NOTIFICATION\",\n \"action\": {\n \"language\": \"en\",\n \"returnUrl\": \"\"\n }\n },\n \"deviceInfo\": {\n \"appType\": \"MOBILE_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Created", "code": 201, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"eventId\": \"\",\n \"walletOperationId\": \"\",\n \"authenticationMode\": \"HYBRID\",\n \"verification\": {\n \"method\": \"PIN\",\n \"channel\": \"REDIRECT\",\n \"target\": \"\",\n \"action\": {\n \"language\": \"en\",\n \"returnUrl\": \"\",\n \"redirectUrl\": \"\"\n }\n },\n \"creationTime\": \"\",\n \"currentChallenges\": \"\",\n \"allowableChallenges\": \"\",\n \"expirationTime\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "5cd8529d-99ae-47a5-91c4-621a10b240a0", "name": "Bad Request", "originalRequest": { "url": { "path": [ "auth", "sca", "events", ":eventId", "challenges" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event challenge.", "type": "text/plain" }, "type": "any", "value": "", "key": "eventId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PASSKEYS\",\n \"channel\": \"PUSH_NOTIFICATION\",\n \"action\": {\n \"language\": \"en\",\n \"returnUrl\": \"\"\n }\n },\n \"deviceInfo\": {\n \"appType\": \"MOBILE_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "3bcc3758-a0db-4c5c-9cba-856270f59987", "name": "Unauthorized", "originalRequest": { "url": { "path": [ "auth", "sca", "events", ":eventId", "challenges" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event challenge.", "type": "text/plain" }, "type": "any", "value": "", "key": "eventId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PASSKEYS\",\n \"channel\": \"PUSH_NOTIFICATION\",\n \"action\": {\n \"language\": \"en\",\n \"returnUrl\": \"\"\n }\n },\n \"deviceInfo\": {\n \"appType\": \"MOBILE_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "d1458b83-7b1c-4a5e-b2aa-99243a41f118", "name": "Not Found", "originalRequest": { "url": { "path": [ "auth", "sca", "events", ":eventId", "challenges" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event challenge.", "type": "text/plain" }, "type": "any", "value": "", "key": "eventId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PASSKEYS\",\n \"channel\": \"PUSH_NOTIFICATION\",\n \"action\": {\n \"language\": \"en\",\n \"returnUrl\": \"\"\n }\n },\n \"deviceInfo\": {\n \"appType\": \"MOBILE_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "484e48b3-a74f-46e8-a40a-2649051fb464", "name": "Method Not Allowed", "originalRequest": { "url": { "path": [ "auth", "sca", "events", ":eventId", "challenges" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event challenge.", "type": "text/plain" }, "type": "any", "value": "", "key": "eventId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PASSKEYS\",\n \"channel\": \"PUSH_NOTIFICATION\",\n \"action\": {\n \"language\": \"en\",\n \"returnUrl\": \"\"\n }\n },\n \"deviceInfo\": {\n \"appType\": \"MOBILE_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Method Not Allowed", "code": 405, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "2383a98a-4838-438c-831e-889fc3358db6", "name": "Too Many Requests", "originalRequest": { "url": { "path": [ "auth", "sca", "events", ":eventId", "challenges" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event challenge.", "type": "text/plain" }, "type": "any", "value": "", "key": "eventId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PASSKEYS\",\n \"channel\": \"PUSH_NOTIFICATION\",\n \"action\": {\n \"language\": \"en\",\n \"returnUrl\": \"\"\n }\n },\n \"deviceInfo\": {\n \"appType\": \"MOBILE_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "ab01efb0-fb0a-45b1-8d1a-37806b4dd642", "name": "Internal Server Error", "originalRequest": { "url": { "path": [ "auth", "sca", "events", ":eventId", "challenges" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event challenge.", "type": "text/plain" }, "type": "any", "value": "", "key": "eventId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PASSKEYS\",\n \"channel\": \"PUSH_NOTIFICATION\",\n \"action\": {\n \"language\": \"en\",\n \"returnUrl\": \"\"\n }\n },\n \"deviceInfo\": {\n \"appType\": \"MOBILE_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Internal Server Error", "code": 500, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "b195a9ca-271c-4382-b79f-93a78c507cac", "name": "Service Unavailable", "originalRequest": { "url": { "path": [ "auth", "sca", "events", ":eventId", "challenges" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event challenge.", "type": "text/plain" }, "type": "any", "value": "", "key": "eventId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PASSKEYS\",\n \"channel\": \"PUSH_NOTIFICATION\",\n \"action\": {\n \"language\": \"en\",\n \"returnUrl\": \"\"\n }\n },\n \"deviceInfo\": {\n \"appType\": \"MOBILE_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Service Unavailable", "code": 503, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } }, { "id": "dfd54744-8206-4f70-aaa7-10f03c5b05dc", "name": "Submit an Embedded or Hybrid SCA Attempt", "request": { "name": "Submit an Embedded or Hybrid SCA Attempt", "description": { "content": "Submits an Embedded or Hybrid authentication attempt for a Strong Customer Authentication (SCA) event.\n\nEach challenge must be manually submitted by the user, and the number of submission attempts allowed is\ncontrolled by internal security rules to ensure optimal protection against fraud (e.g., verify the OTP code\nsent via SMS), as defined by the `allowableAttempts`. Each new attempt increments the `currentAttempts` count\nuntil it reaches the predefined limit. When the limit is reached, no further attempts for the same challenge\nare accepted and are automatically denied. There is no cooldown period, and the challenge is marked as failed.\nTo retry the process, a new challenge must be sent, and the user can attempt the verification again. The\nchallenge status is always determined by the most recent verification attempt, regardless of what happened in\nprevious attempts (e.g., the challenge will be marked as failed if the last attempt failed, even if earlier\nattempts were successful).\n\nMore details can be found in [Strong Customer Authentication](/docs/embedded-wallets/strong-customer-authentication).", "type": "text/plain" }, "url": { "path": [ "auth", "sca", "events", ":eventId", "attempts" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "eventId", "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event attempt.", "type": "text/plain" } } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PIN\",\n \"channel\": \"REDIRECT\"\n },\n \"value\": \"\",\n \"deviceInfo\": {\n \"appType\": \"WEB_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "auth": { "type": "bearer", "bearer": [ { "key": "token", "value": "{{bearerToken}}" } ] } }, "response": [ { "id": "14e05be9-d96a-400a-90ec-077e18811514", "name": "Created", "originalRequest": { "url": { "path": [ "auth", "sca", "events", ":eventId", "attempts" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event attempt.", "type": "text/plain" }, "type": "any", "value": "", "key": "eventId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PIN\",\n \"channel\": \"REDIRECT\"\n },\n \"value\": \"\",\n \"deviceInfo\": {\n \"appType\": \"WEB_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Created", "code": 201, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"id\": \"\",\n \"eventId\": \"\",\n \"walletOperationId\": \"\",\n \"authenticationMode\": \"EMBEDDED\",\n \"verification\": {\n \"method\": \"PASSWORD\",\n \"channel\": \"REDIRECT\",\n \"target\": \"\",\n \"action\": {\n \"language\": \"en\",\n \"returnUrl\": \"\",\n \"redirectUrl\": \"\"\n }\n },\n \"currentAttempts\": \"\",\n \"allowableAttempts\": \"\",\n \"status\": \"REJECTED\",\n \"creationTime\": \"\",\n \"statusReason\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "77e5c61c-dfbb-4b59-95ea-482dc1436b75", "name": "Bad Request", "originalRequest": { "url": { "path": [ "auth", "sca", "events", ":eventId", "attempts" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event attempt.", "type": "text/plain" }, "type": "any", "value": "", "key": "eventId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PIN\",\n \"channel\": \"REDIRECT\"\n },\n \"value\": \"\",\n \"deviceInfo\": {\n \"appType\": \"WEB_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "f36c8449-311f-403c-8b4f-a1b5c96841cd", "name": "Unauthorized", "originalRequest": { "url": { "path": [ "auth", "sca", "events", ":eventId", "attempts" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event attempt.", "type": "text/plain" }, "type": "any", "value": "", "key": "eventId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PIN\",\n \"channel\": \"REDIRECT\"\n },\n \"value\": \"\",\n \"deviceInfo\": {\n \"appType\": \"WEB_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "0b318db7-f45d-4dc1-b1c9-e6123cb1aaaf", "name": "Not Found", "originalRequest": { "url": { "path": [ "auth", "sca", "events", ":eventId", "attempts" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event attempt.", "type": "text/plain" }, "type": "any", "value": "", "key": "eventId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PIN\",\n \"channel\": \"REDIRECT\"\n },\n \"value\": \"\",\n \"deviceInfo\": {\n \"appType\": \"WEB_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Not Found", "code": 404, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "954b904c-211e-402d-b6a1-82c8151b9a60", "name": "Too Many Requests", "originalRequest": { "url": { "path": [ "auth", "sca", "events", ":eventId", "attempts" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event attempt.", "type": "text/plain" }, "type": "any", "value": "", "key": "eventId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PIN\",\n \"channel\": \"REDIRECT\"\n },\n \"value\": \"\",\n \"deviceInfo\": {\n \"appType\": \"WEB_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Too Many Requests", "code": 429, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "9d7fbcbc-f095-432e-bc59-393a302baddb", "name": "Internal Server Error", "originalRequest": { "url": { "path": [ "auth", "sca", "events", ":eventId", "attempts" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event attempt.", "type": "text/plain" }, "type": "any", "value": "", "key": "eventId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PIN\",\n \"channel\": \"REDIRECT\"\n },\n \"value\": \"\",\n \"deviceInfo\": {\n \"appType\": \"WEB_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Internal Server Error", "code": 500, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "0d70cd48-6b37-4e25-8bee-32fa3a794f6b", "name": "Service Unavailable", "originalRequest": { "url": { "path": [ "auth", "sca", "events", ":eventId", "attempts" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) Unique identifier for the SCA event, associated with the current event attempt.", "type": "text/plain" }, "type": "any", "value": "", "key": "eventId" } ] }, "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: bearer", "type": "text/plain" }, "key": "Authorization", "value": "Bearer " } ], "method": "POST", "body": { "mode": "raw", "raw": "{\n \"walletOperationId\": \"\",\n \"verification\": {\n \"method\": \"PIN\",\n \"channel\": \"REDIRECT\"\n },\n \"value\": \"\",\n \"deviceInfo\": {\n \"appType\": \"WEB_APP\",\n \"threatMetrixSessionId\": \"\",\n \"deviceId\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } } }, "status": "Service Unavailable", "code": 503, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] }, { "name": "Token Management", "description": "", "item": [ { "id": "5fd03455-1a93-4949-a707-200258457043", "name": "Issue an Access Token", "request": { "name": "Issue an Access Token", "description": { "content": "## Overview\nThe token endpoint is used by the client to obtain an access token utilizing the following grant types:\n* Client Credentials\n* Refresh Token\n* Token Exchange\n* Password\n* Authorization Code\n\nSince the requests to the token endpoint result in the transmission of clear-text credentials (in the HTTP \nrequest and response), the client server MUST use TLS when sending requests to it.\n\n## Basic Authentication\nBasic Authentication is used for authenticating a client. In this mechanism, the client sends its client ID and \nclient secret as part of the Authorization header in an HTTP request. The Authorization header contains a \nBase64-encoded string of `{URL-encoded-client-ID}:{URL-encoded-client-secret}`.\n\n## SCA Authentication\nThe necessity for SCA Authentication arises when customers need to adhere to the particular regulations \noutlined in the PSD2 directive.\n\nThe HTTP `WWW-Authenticate` response header defines the SCA authentication methods that might be used to gain \naccess to the specific resource:\n```http\nHTTP/2 401 Unauthorized\nWWW-Authenticate: SCA realm=\"Authentication\" auth-param1=\"ewogICJzY2FEZXRhaWxzIjogewogICAgImV2ZW50SWQiOiAiMDZiZGMyYzAtY2NlLTRiMzYtOTdlYy0yODFjOGY1ZDc0M2MiLAogICAgIndhbGxldE9wZXJhdGlvbklkIjogImE1ODY1ZmQ2LTE4YzItNDVhOC05OTUzLTFjMDBlYWMzNmMzNiIsCiAgICAiYXV0aGVudGljYXRpb25Nb2RlIjogIk9VVFNPVVJDRUQiLAogICAgImF2YWlsYWJsZVZlcmlmaWNhdGlvbnMiOiBbCiAgICAgIHsKICAgICAgICAibWV0aG9kIjogIlBJTiIKICAgICAgfSwKICAgICAgewogICAgICAgICJtZXRob2QiOiAiT1RQIiwKICAgICAgICAiY2hhbm5lbCI6ICJTTVMiLAogICAgICAgICJ0YXJnZXQiOiAiam8qKipAZXhhbXBsZS5jb20iCiAgICAgIH0KICAgIF0sCiAgICAiY3JlYXRpb25UaW1lIjogIjIwMjEtMDctMTVUMTc6NTQ6MTJaIiwKICAgICJleHBpcmF0aW9uVGltZSI6ICIyMDIxLTA3LTE1VDE4OjA5OjEyWiIKICB9Cn0=\"\n```\n\nUpon the successful completion of the SCA authentication process, the user should re-request the same wallet \nresource. This should be done using the `SCA-Authorization` request header:\n```http\nPOST /digitalwallets/v1/auth/brands/{brandIdentity}/token HTTP/2\nHost: api.paysafe.com\nSCA-Authorization: ewogICJzY2FEZXRhaWxzIjogewogICAgImV2ZW50SWQiOiAiMDZiZGNkMmMtMGNjZS00YjM2LTk3ZWMtMjgxYzhmNWQ3NDNjIiwKICAgICJ3YWxsZXRPcGVyYXRpb25JZCI6ICJhNTg2NWZkNi0xOGMyLTQ1YTgtOTk1My0xYzAwZWFjMzZjMzYiCn0=\n```\n\nMore details can be found in [Strong Customer Authentication](/docs/embedded-wallets/strong-customer-authentication).\n\n## Attestation Authentication \nThe necessity for ATT Authentication arises when customers need to adhere to the particular secuirty standards.\n\nThe HTTP `WWW-Authenticate` response header defines the ATT authentication specifics that might be used to gain access to the specific resource:\n```http\nHTTP/2 401 Unauthorized\nWWW-Authenticate: ATT realm=\"Authentication\" auth-param1=\"ewogICAgImF0dGVzdGF0aW9uRGV0YWlscyI6IHsKICAgICAgICAiZGV2aWNlSWQiOiAiODk1NEJGRjItNTc3NC00Q0VCLTkwMTctRjhBNzk3RUJFODk3IiwKICAgICAgICAid29ya2Zsb3dJZCI6ICJlYTk4Y2FhNi1lODc3LTQwY2ItODIwZS0wMTRkYWI4Nzg2YWYiLAogICAgICAgICJvc05hbWUiOiAiQU5EUk9JRCIsCiAgICAgICAgIndhbGxldE9wZXJhdGlvbiI6ICJBVVRIRU5USUNBVElPTiIsCiAgICAgICAgImF0dGVzdGF0aW9uTW9kZSI6ICJSRVFVSVJFRCIsCiAgICAgICAgIm5vbmNlIjogImUzZDljM2M0LWUwYzktNGZkYS1iZDU1LWUwODBlN2M4Mzc4MyIsCiAgICAgICAgImV4cGlyYXRpb25UaW1lIjogIjIwMTktMDgtMjRUMTQ6MTU6MjJaIgogICAgfQp9\"\n```\n\nUpon the successful completion of the ATT authentication process, the system should re-request the same wallet resource. This should be done using the ATT-Authorization request header:\n```http\nPOST /digitalwallets/v1/auth/brands/{brandIdentity}/token HTTP/2\nHost: api.paysafe.com\nATT-Authorization: ewogICAgImF0dGVzdGF0aW9uRGV0YWlscyI6IHsKICAgICAgICAiZGV2aWNlSWQiOiAiODk1NEJGRjItNTc3NC00Q0VCLTkwMTctRjhBNzk3RUJFODk3IiwKICAgICAgICAiYXR0ZXN0YXRpb25LZXlJZCI6ICJRV2s2bHhmaUFDSDlWaU94SDlYdFZ4K2h3Tk1NMXcrUmFET1VvL3JiYk84PSIsCiAgICAgICAgImF0dGVzdGF0aW9uVG9rZW4iOiAiZXlKaGJHY2lPaUpTVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5IiwKICAgICAgICAidG14U2Vzc2lvbklkIjogImJlMDY2NWY3LTE5OTAtNGQ2Ni04NDY5LWFjYWQ0ZTk3NmFiOSIsCiAgICAgICAgIm9zTmFtZSI6ICJBTkRST0lEIgogICAgfQp9\n```", "type": "text/plain" }, "url": { "path": [ "auth", "brands", ":brandIdentity", "token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "type": "any", "value": "", "key": "brandIdentity", "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" } } ] }, "header": [ { "disabled": false, "description": { "content": "Distinct identifier, created by the mobile application, associated with the streamlined wallet operation. The workflowId must be the unique identifier of the customer or the process within the wallet operation request. This ensures that if the wallet operation is re-executed with the same unique identifier, the same attestation can be reused as long as it's still valid.", "type": "text/plain" }, "key": "Workflow-Id", "value": "" }, { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" } ], "method": "POST", "body": { "mode": "urlencoded", "urlencoded": [ { "disabled": false, "description": { "content": "(Required) It is used in token requests to specify the type of authorization grant being utilized. The acceptable values are:\n * `client_credentials`: client credentials grant type\n * `refresh_token`: refresh token grant type\n * `urn:ietf:params:oauth:grant-type:token-exchange`: token exchange grant type\n * `password`: resource owner password (or \"password\") grant type\n * `authorization_code`: authorization code grant type", "type": "text/plain" }, "key": "grant_type", "value": "refresh_token" } ] }, "auth": { "type": "basic", "basic": [ { "key": "username", "value": "{{basicAuthUsername}}" }, { "key": "password", "value": "{{basicAuthPassword}}" } ] } }, "response": [ { "id": "37bdbd84-78d5-4c41-8177-c2fb5f625b39", "name": "OK", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "disabled": false, "description": { "content": "Distinct identifier, created by the mobile application, associated with the streamlined wallet operation. The workflowId must be the unique identifier of the customer or the process within the wallet operation request. This ensures that if the wallet operation is re-executed with the same unique identifier, the same attestation can be reused as long as it's still valid.", "type": "text/plain" }, "key": "Workflow-Id", "value": "" }, { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "urlencoded", "urlencoded": [ { "disabled": false, "description": { "content": "(Required) It is used in token requests to specify the type of authorization grant being utilized. The acceptable values are:\n * `client_credentials`: client credentials grant type\n * `refresh_token`: refresh token grant type\n * `urn:ietf:params:oauth:grant-type:token-exchange`: token exchange grant type\n * `password`: resource owner password (or \"password\") grant type\n * `authorization_code`: authorization code grant type", "type": "text/plain" }, "key": "grant_type", "value": "refresh_token" } ] } }, "status": "OK", "code": 200, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"access_token\": \"\",\n \"token_type\": \"Bearer\",\n \"expires_in\": \"\",\n \"refresh_token\": \"\",\n \"refresh_expires_in\": \"\",\n \"id_token\": \"\",\n \"scope\": \"\"\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "4e8e0449-cdff-4488-8fe1-652370ba7f2a", "name": "Bad request", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "disabled": false, "description": { "content": "Distinct identifier, created by the mobile application, associated with the streamlined wallet operation. The workflowId must be the unique identifier of the customer or the process within the wallet operation request. This ensures that if the wallet operation is re-executed with the same unique identifier, the same attestation can be reused as long as it's still valid.", "type": "text/plain" }, "key": "Workflow-Id", "value": "" }, { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "urlencoded", "urlencoded": [ { "disabled": false, "description": { "content": "(Required) It is used in token requests to specify the type of authorization grant being utilized. The acceptable values are:\n * `client_credentials`: client credentials grant type\n * `refresh_token`: refresh token grant type\n * `urn:ietf:params:oauth:grant-type:token-exchange`: token exchange grant type\n * `password`: resource owner password (or \"password\") grant type\n * `authorization_code`: authorization code grant type", "type": "text/plain" }, "key": "grant_type", "value": "refresh_token" } ] } }, "status": "Bad Request", "code": 400, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "c52a2ce4-8a8f-400d-989b-6db0a5f17f84", "name": "Unauthorized", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "disabled": false, "description": { "content": "Distinct identifier, created by the mobile application, associated with the streamlined wallet operation. The workflowId must be the unique identifier of the customer or the process within the wallet operation request. This ensures that if the wallet operation is re-executed with the same unique identifier, the same attestation can be reused as long as it's still valid.", "type": "text/plain" }, "key": "Workflow-Id", "value": "" }, { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "urlencoded", "urlencoded": [ { "disabled": false, "description": { "content": "(Required) It is used in token requests to specify the type of authorization grant being utilized. The acceptable values are:\n * `client_credentials`: client credentials grant type\n * `refresh_token`: refresh token grant type\n * `urn:ietf:params:oauth:grant-type:token-exchange`: token exchange grant type\n * `password`: resource owner password (or \"password\") grant type\n * `authorization_code`: authorization code grant type", "type": "text/plain" }, "key": "grant_type", "value": "refresh_token" } ] } }, "status": "Unauthorized", "code": 401, "header": [ { "key": "Content-Type", "value": "application/json" }, { "disabled": false, "description": { "content": "(Required) Specifies the necessity of employing the `SCA` security scheme within the specific wallet domain.", "type": "text/plain" }, "key": "WWW-Authenticate", "value": "" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "aa427ffb-8239-4d3c-bfcd-777a8c187fa0", "name": "Forbidden", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "disabled": false, "description": { "content": "Distinct identifier, created by the mobile application, associated with the streamlined wallet operation. The workflowId must be the unique identifier of the customer or the process within the wallet operation request. This ensures that if the wallet operation is re-executed with the same unique identifier, the same attestation can be reused as long as it's still valid.", "type": "text/plain" }, "key": "Workflow-Id", "value": "" }, { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "urlencoded", "urlencoded": [ { "disabled": false, "description": { "content": "(Required) It is used in token requests to specify the type of authorization grant being utilized. The acceptable values are:\n * `client_credentials`: client credentials grant type\n * `refresh_token`: refresh token grant type\n * `urn:ietf:params:oauth:grant-type:token-exchange`: token exchange grant type\n * `password`: resource owner password (or \"password\") grant type\n * `authorization_code`: authorization code grant type", "type": "text/plain" }, "key": "grant_type", "value": "refresh_token" } ] } }, "status": "Forbidden", "code": 403, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "0bee94ee-ef3e-4697-bb8b-b04700256530", "name": "Method Not Allowed", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "disabled": false, "description": { "content": "Distinct identifier, created by the mobile application, associated with the streamlined wallet operation. The workflowId must be the unique identifier of the customer or the process within the wallet operation request. This ensures that if the wallet operation is re-executed with the same unique identifier, the same attestation can be reused as long as it's still valid.", "type": "text/plain" }, "key": "Workflow-Id", "value": "" }, { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "urlencoded", "urlencoded": [ { "disabled": false, "description": { "content": "(Required) It is used in token requests to specify the type of authorization grant being utilized. The acceptable values are:\n * `client_credentials`: client credentials grant type\n * `refresh_token`: refresh token grant type\n * `urn:ietf:params:oauth:grant-type:token-exchange`: token exchange grant type\n * `password`: resource owner password (or \"password\") grant type\n * `authorization_code`: authorization code grant type", "type": "text/plain" }, "key": "grant_type", "value": "refresh_token" } ] } }, "status": "Method Not Allowed", "code": 405, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "2fd35fd8-dc7f-4d4a-9cce-0abe34e72459", "name": "Conflict", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "disabled": false, "description": { "content": "Distinct identifier, created by the mobile application, associated with the streamlined wallet operation. The workflowId must be the unique identifier of the customer or the process within the wallet operation request. This ensures that if the wallet operation is re-executed with the same unique identifier, the same attestation can be reused as long as it's still valid.", "type": "text/plain" }, "key": "Workflow-Id", "value": "" }, { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "urlencoded", "urlencoded": [ { "disabled": false, "description": { "content": "(Required) It is used in token requests to specify the type of authorization grant being utilized. The acceptable values are:\n * `client_credentials`: client credentials grant type\n * `refresh_token`: refresh token grant type\n * `urn:ietf:params:oauth:grant-type:token-exchange`: token exchange grant type\n * `password`: resource owner password (or \"password\") grant type\n * `authorization_code`: authorization code grant type", "type": "text/plain" }, "key": "grant_type", "value": "refresh_token" } ] } }, "status": "Conflict", "code": 409, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "ccfbe5cd-edc4-4f11-b757-a3d038531c52", "name": "Internal Server Error", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "disabled": false, "description": { "content": "Distinct identifier, created by the mobile application, associated with the streamlined wallet operation. The workflowId must be the unique identifier of the customer or the process within the wallet operation request. This ensures that if the wallet operation is re-executed with the same unique identifier, the same attestation can be reused as long as it's still valid.", "type": "text/plain" }, "key": "Workflow-Id", "value": "" }, { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "urlencoded", "urlencoded": [ { "disabled": false, "description": { "content": "(Required) It is used in token requests to specify the type of authorization grant being utilized. The acceptable values are:\n * `client_credentials`: client credentials grant type\n * `refresh_token`: refresh token grant type\n * `urn:ietf:params:oauth:grant-type:token-exchange`: token exchange grant type\n * `password`: resource owner password (or \"password\") grant type\n * `authorization_code`: authorization code grant type", "type": "text/plain" }, "key": "grant_type", "value": "refresh_token" } ] } }, "status": "Internal Server Error", "code": 500, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" }, { "id": "5c53bf69-25fb-4df3-bcbd-8d4a41586569", "name": "Service Unavailable", "originalRequest": { "url": { "path": [ "auth", "brands", ":brandIdentity", "token" ], "host": [ "{{baseUrl}}" ], "query": [], "variable": [ { "disabled": false, "description": { "content": "(Required) The identity of the partner using the Embedded Wallet.", "type": "text/plain" }, "type": "any", "value": "", "key": "brandIdentity" } ] }, "header": [ { "disabled": false, "description": { "content": "Distinct identifier, created by the mobile application, associated with the streamlined wallet operation. The workflowId must be the unique identifier of the customer or the process within the wallet operation request. This ensures that if the wallet operation is re-executed with the same unique identifier, the same attestation can be reused as long as it's still valid.", "type": "text/plain" }, "key": "Workflow-Id", "value": "" }, { "key": "Content-Type", "value": "application/x-www-form-urlencoded" }, { "key": "Accept", "value": "application/json" }, { "description": { "content": "Added as a part of security scheme: basic", "type": "text/plain" }, "key": "Authorization", "value": "Basic " } ], "method": "POST", "body": { "mode": "urlencoded", "urlencoded": [ { "disabled": false, "description": { "content": "(Required) It is used in token requests to specify the type of authorization grant being utilized. The acceptable values are:\n * `client_credentials`: client credentials grant type\n * `refresh_token`: refresh token grant type\n * `urn:ietf:params:oauth:grant-type:token-exchange`: token exchange grant type\n * `password`: resource owner password (or \"password\") grant type\n * `authorization_code`: authorization code grant type", "type": "text/plain" }, "key": "grant_type", "value": "refresh_token" } ] } }, "status": "Service Unavailable", "code": 503, "header": [ { "key": "Content-Type", "value": "application/json" } ], "body": "{\n \"error\": {\n \"code\": \"\",\n \"message\": \"\",\n \"details\": [\n \"\",\n \"\"\n ],\n \"fieldErrors\": [\n {\n \"field\": \"\",\n \"error\": \"\"\n },\n {\n \"field\": \"\",\n \"error\": \"\"\n }\n ]\n }\n}", "cookie": [], "_postman_previewlanguage": "json" } ], "event": [], "protocolProfileBehavior": { "disableBodyPruning": true } } ] } ], "auth": { "type": "basic", "basic": [ { "type": "any", "value": "{{basicAuthUsername}}", "key": "username" }, { "type": "any", "value": "{{basicAuthPassword}}", "key": "password" } ] }, "event": [], "variable": [ { "key": "baseUrl", "value": "https://api.paysafe.com/digitalwallets/v1" } ], "info": { "_postman_id": "a344cfd0-1fc9-4f40-8297-c454c3a49a92", "name": "Authentication API", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "description": { "content": "## Introduction\n\nThe Authentication API provides endpoints for obtaining access tokens and configurations for the Paysafe Embedded Wallet.\n\nContact Support:\n Name: Paysafe\n Email: info@paysafe.com", "type": "text/plain" } } }