Sequence Flows
Step-by-step sequence diagrams for all major CardPay transaction flows
Eligibility Check
OCT Push (Push Funds)
AFT Pull (Pull Funds with 3DS)
Two-phase flow
AFT is a two-phase flow: first complete 3DS authentication (via your 3DS provider or platform-managed), then submit the pull transaction with the CAVV/ECI values.
Bill Payment (Async OCT)
Async flow with immediate acknowledgment
The bill payment endpoint processes the OCT asynchronously. The partner receives an immediate 201 REQUEST_RECEIVED response, and the final outcome is delivered via webhook.
Auto-Polling Status Resolution
When a transaction times out, the platform automatically polls the network for the final status and delivers the outcome via webhook:
Auto-Polling Configuration
| Configuration | Default | Description |
|---|---|---|
| Network fetch enabled | Y | Enable/disable automatic network status polling per entity |
| Max fetch retries | 5 | Maximum number of polling attempts before giving up |
| Auto-failure timeout | 6 hours | Time after which PENDING transactions are automatically declined |
Authentication
How partners authenticate with CardPay, and how CardPay authenticates with Visa and Mastercard networks
Pull Funds from Card (AFT) POST
Debit funds from a customer's card (Account Funding Transaction). **Visa Direct only.** > **⚠️ Important**: The response from this API indicates only whether the request was > accepted or a 3DS challenge is required. **Do not rely on this response to determine > final transaction status.** Always call > `GET /Yappay/txn-manager/v2/fetch/{externalTransactionId}` to confirm the final > `txnStatus` (e.g., `PAYMENT_SUCCESS`, `PAYMENT_FAILURE`) after the 3DS flow completes. ## 3DS Authentication Modes This endpoint supports two 3DS flows depending on who performs authentication: ### Mode 1 — Platform-Managed 3DS (`method: THREE_DS`) Submit the request with `authentication.method: "THREE_DS"` and **omit** `cavv`/`eci`. The platform initiates the 3DS challenge and returns an `htmlContent` field containing an HTML form that must be rendered in the customer's browser to complete authentication. Once the customer completes the challenge, resubmit the transaction with the CAVV/ECI received. ### Mode 2 — Partner-Provided CAVV/ECI Complete 3DS externally (via your own 3DS provider) and submit the resulting `cavv` and `eci` in the `authentication` block. Omit `method` or leave it empty. ## Token Types (`tokenType`) - `"01"` — M2P-generated card token (PCI DSS tokenized by M2P) - `"02"` — Network-generated card token (e.g., MDES/VTS network token) - `"03"` — Clear card number (partner is PCI DSS compliant) ## Use Cases - PPI/wallet loading - Prepaid card top-up - Account funding