curl -X POST "https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/EndpointAdministration/RegisterServer" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: 3F9B1A..." \
  -d '{
    "ClientPublicKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjAN...\n-----END PUBLIC KEY-----",
    "ClientPublicKeyFormat": "PEM",
    "KeyDurationInDays": 90,
    "RequestExpirationUTC": "2026-07-10T12:05:00.000Z"
  }'

{
            "ServerPublicKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjAN...\n-----END PUBLIC KEY-----",
            "ServerPublicKeyFormat": "PEM",
            "KeyExpirationUTC": "2026-10-13T12:00:00.000Z"
}

async function registerServer(publicKeyPem) {
  const body = {
    ClientPublicKey: publicKeyPem,
    ClientPublicKeyFormat: 'PEM',
    KeyDurationInDays: 90,
    RequestExpirationUTC: new Date(Date.now() + 5 * 60000).toISOString()
  };
  const signature = signBody(body); // RSA-SHA256 hex, upper-case
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/EndpointAdministration/RegisterServer`,
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-CompanyNumber': process.env.COMPANY,
        'X-StoreNumber':   process.env.STORE,
        'X-ReferenceId':   crypto.randomUUID().replace(/-/g,'').toUpperCase(),
        'X-Signature':     signature
      },
      body: JSON.stringify(body)
    }
  );
  return res.json();
}
// Response: { ServerPublicKey, ServerPublicKeyFormat, KeyExpirationUTC }

import requests, os, uuid
from datetime import datetime, timezone, timedelta
from sign import sign_body  # your RSA-SHA256 helper

def register_server(public_key_pem: str) -> dict:
    body = {
        "ClientPublicKey": public_key_pem,
        "ClientPublicKeyFormat": "PEM",
        "KeyDurationInDays": 90,
        "RequestExpirationUTC": (
            datetime.now(timezone.utc) + timedelta(minutes=5)
        ).strftime("%Y-%m-%dT%H:%M:%S.000Z")
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/EndpointAdministration/RegisterServer",
        headers={
            "Content-Type": "application/json",
            "X-CompanyNumber": os.environ["COMPANY"],
            "X-StoreNumber":   os.environ["STORE"],
            "X-ReferenceId":   uuid.uuid4().hex.upper(),
            "X-Signature":     sign_body(body)
        },
        json=body
    )
    r.raise_for_status()
    return r.json()
# Response: {"ServerPublicKey": "...", "ServerPublicKeyFormat": "PEM", "KeyExpirationUTC": "..."}

public async Task<string> RegisterServerAsync(string publicKeyPem)
{
  var body = new {
        ClientPublicKey = publicKeyPem,
        ClientPublicKeyFormat = "PEM",
        KeyDurationInDays = 90,
        RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5)
            .ToString("yyyy-MM-ddTHH:mm:ss.fffZ")
    };
    var json    = JsonSerializer.Serialize(body);
    var sig     = SignBody(json); // RSA-SHA256 hex upper-case
    var request = new HttpRequestMessage(
        HttpMethod.Post,
        $"{Env("HPP_BASE")}/v1.4/EndpointAdministration/RegisterServer");
    request.Content = new StringContent(json, Encoding.UTF8, "application/json");
    request.Headers.Add("X-CompanyNumber", Env("COMPANY"));
    request.Headers.Add("X-StoreNumber",   Env("STORE"));
    request.Headers.Add("X-ReferenceId",   Guid.NewGuid().ToString("N").ToUpper());
    request.Headers.Add("X-Signature",     sig);
    var response = await _http.SendAsync(request);
    response.EnsureSuccessStatusCode();
    return await response.Content.ReadAsStringAsync();
}
// Response: { ServerPublicKey, ServerPublicKeyFormat, KeyExpirationUTC }

public String registerServer(String publicKeyPem) throws Exception {
    String expiry = Instant.now().plusSeconds(300).toString();
    String json = String.format(
      "{\"ClientPublicKey\":\"%s\"," +
        "\"ClientPublicKeyFormat\":\"PEM\"," +
        "\"KeyDurationInDays\":90," +
        "\"RequestExpirationUTC\":\"%s\"}",
        publicKeyPem.replace("\n", "\\n"), expiry);
    String sig = signBody(json);
    HttpRequest req = HttpRequest.newBuilder()
        .uri(URI.create(HPP_BASE + "/v1.4/EndpointAdministration/RegisterServer"))
        .header("Content-Type",    "application/json")
        .header("X-CompanyNumber", COMPANY)
        .header("X-StoreNumber",   STORE)
        .header("X-ReferenceId",   UUID.randomUUID().toString().replace("-","").toUpperCase())
        .header("X-Signature",     sig)
        .POST(HttpRequest.BodyPublishers.ofString(json))
        .build();
    return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
}
// Response: {"ServerPublicKey":"...","ServerPublicKeyFormat":"PEM","KeyExpirationUTC":"..."}

curl -X POST "https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/PaymentTransactionManagement/InitializeSession" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Client-Application-Name: MyApp" \
  -H "X-Signature: 3A9F12C8D4..." \
  -d '{
    "Amount": 59.99,
    "ReturnMethod": "Redirect",
    "ReturnURL": "https://example.com/pay/return",
    "FrameHostingURL": "https://example.com",
    "RequestExpirationUTC": "2026-07-10T12:05:00.000Z",
    "PaymentMethodType": ["CreditCard","GooglePay"],
    "GooglePayMerchantId": "YOUR_GPAY_MERCHANT_ID",
    "GooglePayMerchantName": "Your Store",
    "TokenRetrievalRequired": true,
    "AccountAddressCollectionMode": "Full",
    "ValidateAccountSecurityCode": true,
    "ValidateAccountAddress": true
  }'

{
  "SessionId": "45016f4cce57e5ab4e308a1822b9b9fc3336",
  "RequestURL": "https://hpp.ncrvoyix.com/WebEPS/HPP?session=45016f4cce57e5ab4e308a1822b9b9fc3336"
}

const crypto = require('crypto');
const fs     = require('fs');

const key = fs.readFileSync('./private.pem', 'utf8');

async function initializeSession(cart) {
  const payload = {
    Amount: cart.total,
    ReturnMethod: 'Redirect',
    ReturnURL: `${process.env.APP_URL}/pay/return`,
    FrameHostingURL: process.env.APP_URL,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString(),
    PaymentMethodType: ['CreditCard', 'GooglePay'],
    GooglePayMerchantId: process.env.GPAY_MERCHANT_ID,
    GooglePayMerchantName: process.env.GPAY_MERCHANT_NAME,
    TokenRetrievalRequired: true,
    AccountAddressCollectionMode: 'Full',
    ValidateAccountSecurityCode: true,
    ValidateAccountAddress: true
  };

  const body = JSON.stringify(payload);
  const sign = crypto.createSign('RSA-SHA256');
  sign.update(body, 'utf8');
  const xSig = sign.sign(
    { key, passphrase: process.env.KEY_PASS }, 'hex'
  ).toUpperCase();

  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/PaymentTransactionManagement/InitializeSession`,
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-CompanyNumber': process.env.COMPANY,
        'X-StoreNumber':   process.env.STORE,
        'X-ReferenceId':   crypto.randomUUID().replace(/-/g,'').toUpperCase(),
        'X-Client-Application-Name': 'MyApp',
        'X-Signature': xSig
      },
      body
    }
  );
  return res.json(); // { SessionId, RequestURL }
}

{
  "SessionId": "45016f4cce57e5ab4e308a1822b9b9fc3336",
  "RequestURL": "https://hpp.ncrvoyix.com/WebEPS/HPP?session=45016f4cce57e5ab4e308a1822b9b9fc3336"
}

import json, os, uuid, requests
from datetime import datetime, timedelta, timezone
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding

with open("private.pem","rb") as f:
    pkey = serialization.load_pem_private_key(
        f.read(), password=os.environ["KEY_PASS"].encode())

def initialize_session(amount: float) -> dict:
    payload = {
        "Amount": amount,
        "ReturnMethod": "Redirect",
        "ReturnURL": f"{os.environ['APP_URL']}/pay/return",
        "FrameHostingURL": os.environ["APP_URL"],
        "RequestExpirationUTC": (
            datetime.now(timezone.utc) + timedelta(minutes=5)
        ).strftime('%Y-%m-%dT%H:%M:%S.000Z'),
        "PaymentMethodType": ["CreditCard", "GooglePay"],
        "GooglePayMerchantId": os.environ["GPAY_MERCHANT_ID"],
        "GooglePayMerchantName": os.environ["GPAY_MERCHANT_NAME"],
        "TokenRetrievalRequired": True,
        "AccountAddressCollectionMode": "Full",
        "ValidateAccountSecurityCode": True,
        "ValidateAccountAddress": True
    }
    body = json.dumps(payload, separators=(',', ':'))
    sig  = pkey.sign(body.encode(), padding.PKCS1v15(), hashes.SHA256())
    x_sig = sig.hex().upper()

    resp = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/PaymentTransactionManagement/InitializeSession",
        headers={
            "Content-Type": "application/json",
            "X-CompanyNumber": os.environ["COMPANY"],
            "X-StoreNumber":   os.environ["STORE"],
            "X-ReferenceId":   uuid.uuid4().hex.upper(),
            "X-Client-Application-Name": "MyApp",
            "X-Signature": x_sig
        },
        data=body, timeout=30
    )
    return resp.json()

{
  "SessionId": "45016f4cce57e5ab4e308a1822b9b9fc3336",
  "RequestURL": "https://hpp.ncrvoyix.com/WebEPS/HPP?session=45016f4cce57e5ab4e308a1822b9b9fc3336"
}

using System.Security.Cryptography;
using System.Text;
using System.Text.Json;

public async Task<(string SessionId, string RequestURL)> InitializeSessionAsync(decimal amount)
{
    using var rsa = RSA.Create();
    rsa.ImportFromEncryptedPem(File.ReadAllText("private.pem"),
        Environment.GetEnvironmentVariable("KEY_PASS"));

    var payload = new {
        Amount = amount,
        ReturnMethod = "Redirect",
        ReturnURL = $"{Env("APP_URL")}/pay/return",
        FrameHostingURL = Env("APP_URL"),
        RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5)
            .ToString("yyyy-MM-ddTHH:mm:ss.fffZ"),
        PaymentMethodType = new[] { "CreditCard", "GooglePay" },
        GooglePayMerchantId   = Env("GPAY_MERCHANT_ID"),
        GooglePayMerchantName = Env("GPAY_MERCHANT_NAME"),
        TokenRetrievalRequired = true,
        AccountAddressCollectionMode = "Full",
        ValidateAccountSecurityCode = true,
        ValidateAccountAddress = true
    };

    var body   = JsonSerializer.Serialize(payload);
    var sigBytes = rsa.SignData(Encoding.UTF8.GetBytes(body),
                      HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
    var xSig   = Convert.ToHexString(sigBytes); // uppercase

    using var client = new HttpClient();
    using var req = new HttpRequestMessage(HttpMethod.Post,
        $"{Env("HPP_BASE")}/v1.4/PaymentTransactionManagement/InitializeSession");
    req.Headers.TryAddWithoutValidation("X-CompanyNumber", Env("COMPANY"));
    req.Headers.TryAddWithoutValidation("X-StoreNumber",   Env("STORE"));
    req.Headers.TryAddWithoutValidation("X-ReferenceId",   Guid.NewGuid().ToString("N").ToUpper());
    req.Headers.TryAddWithoutValidation("X-Client-Application-Name", "MyApp");
    req.Headers.TryAddWithoutValidation("X-Signature", xSig);
    req.Content = new StringContent(body, Encoding.UTF8, "application/json");

    var res  = await client.SendAsync(req);
    var data = await res.Content.ReadFromJsonAsync<InitResponse>();
    return (data!.SessionId, data.RequestURL);
}

{
  "SessionId": "45016f4cce57e5ab4e308a1822b9b9fc3336",
  "RequestURL": "https://hpp.ncrvoyix.com/WebEPS/HPP?session=45016f4cce57e5ab4e308a1822b9b9fc3336"
}

PrivateKey key = /* load PKCS#8 DER key */;

String expiry = ZonedDateTime.now(ZoneOffset.UTC).plusMinutes(5)
    .format(DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"));

String body = """
{
  "Amount": 59.99,
  "ReturnMethod": "Redirect",
  "ReturnURL": "https://example.com/pay/return",
  "FrameHostingURL": "https://example.com",
  "RequestExpirationUTC": "%s",
  "PaymentMethodType": ["CreditCard","GooglePay"],
  "GooglePayMerchantId": "GPAY_MERCHANT_ID",
  "GooglePayMerchantName": "Your Store",
  "TokenRetrievalRequired": true,
  "AccountAddressCollectionMode": "Full",
  "ValidateAccountSecurityCode": true,
  "ValidateAccountAddress": true
}""".formatted(expiry);

Signature signer = Signature.getInstance("SHA256withRSA");
signer.initSign(key);
signer.update(body.getBytes(StandardCharsets.UTF_8));
String xSig = HexFormat.of().formatHex(signer.sign()).toUpperCase();

HttpResponse<String> res = HttpClient.newHttpClient().send(
    HttpRequest.newBuilder()
        .uri(URI.create(HPP_BASE + "/v1.4/PaymentTransactionManagement/InitializeSession"))
        .header("Content-Type", "application/json")
        .header("X-CompanyNumber", COMPANY)
        .header("X-StoreNumber",   STORE)
        .header("X-ReferenceId",   UUID.randomUUID().toString().replace("-","").toUpperCase())
        .header("X-Client-Application-Name", "MyApp")
        .header("X-Signature", xSig)
        .POST(HttpRequest.BodyPublishers.ofString(body))
        .build(),
    HttpResponse.BodyHandlers.ofString()
);

{
  "SessionId": "45016f4cce57e5ab4e308a1822b9b9fc3336",
  "RequestURL": "https://hpp.ncrvoyix.com/WebEPS/HPP?session=45016f4cce57e5ab4e308a1822b9b9fc3336"
}

curl -X POST "https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/PaymentTransactionManagement/CompleteSession" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: B2C3D4E5F6789012345678901234ABCD" \
  -H "X-Signature: 7F2A9B3C1E..." \
  -d '{
    "SessionId": "45016f4cce57e5ab4e308a1822b9b9fc3336",
    "RequestExpirationUTC": "2026-07-10T12:10:00.000Z"
  }'

{
  "TransactionStatus": "Approved",
  "AuthorizationCode": "A12345",
  "ReferenceNumber": "TXN-2026-001234",
  "Token": "tok_xxxxxxxxxxxxxxxxxxxxxxxx",
  "CardType": "Visa",
  "Last4Digits": "4242"
}

const crypto = require('crypto');
const fs     = require('fs');

const key = fs.readFileSync('./private.pem', 'utf8');

// completingRef guards against double-call (React StrictMode)
let completing = false;

async function completeSession(sessionId) {
  if (completing) return;
  completing = true;
  try {
    const payload = {
      SessionId: sessionId,
      RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString()
    };
    const body = JSON.stringify(payload);
    const sign = crypto.createSign('RSA-SHA256');
    sign.update(body, 'utf8');
    const xSig = sign.sign(
      { key, passphrase: process.env.KEY_PASS }, 'hex'
    ).toUpperCase();

    const res = await fetch(
      `${process.env.HPP_BASE}/v1.4/PaymentTransactionManagement/CompleteSession`,
      {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'X-CompanyNumber': process.env.COMPANY,
          'X-StoreNumber':   process.env.STORE,
          'X-ReferenceId':   crypto.randomUUID().replace(/-/g,'').toUpperCase(),
          'X-Signature': xSig
        },
        body
      }
    );
    return res.json();
  } finally { completing = false; }
}

{
  "TransactionStatus": "Approved",
  "AuthorizationCode": "A12345",
  "ReferenceNumber": "TXN-2026-001234",
  "Token": "tok_xxxxxxxxxxxxxxxxxxxxxxxx",
  "CardType": "Visa",
  "Last4Digits": "4242"
}

def complete_session(session_id: str) -> dict:
    payload = {
        "SessionId": session_id,
        "RequestExpirationUTC": (
            datetime.now(timezone.utc) + timedelta(minutes=5)
        ).strftime('%Y-%m-%dT%H:%M:%S.000Z')
    }
    body = json.dumps(payload, separators=(',', ':'))
    sig  = pkey.sign(body.encode(), padding.PKCS1v15(), hashes.SHA256())
    x_sig = sig.hex().upper()

    resp = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/PaymentTransactionManagement/CompleteSession",
        headers={
            "Content-Type": "application/json",
            "X-CompanyNumber": os.environ["COMPANY"],
            "X-StoreNumber":   os.environ["STORE"],
            "X-ReferenceId":   uuid.uuid4().hex.upper(),
            "X-Signature": x_sig
        },
        data=body, timeout=30
    )
    return resp.json()

{
  "TransactionStatus": "Approved",
  "AuthorizationCode": "A12345",
  "ReferenceNumber": "TXN-2026-001234",
  "CardType": "Visa",
  "Last4Digits": "4242"
}

public async Task<CompleteResponse> CompleteSessionAsync(string sessionId)
{
    using var rsa = RSA.Create();
    rsa.ImportFromEncryptedPem(File.ReadAllText("private.pem"), Env("KEY_PASS"));

    var payload  = new { SessionId = sessionId,
        RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5)
            .ToString("yyyy-MM-ddTHH:mm:ss.fffZ") };
    var body     = JsonSerializer.Serialize(payload);
    var sigBytes = rsa.SignData(Encoding.UTF8.GetBytes(body),
                     HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
    var xSig     = Convert.ToHexString(sigBytes);

    using var client = new HttpClient();
    using var req = new HttpRequestMessage(HttpMethod.Post,
        $"{Env("HPP_BASE")}/v1.4/PaymentTransactionManagement/CompleteSession");
    req.Headers.TryAddWithoutValidation("X-CompanyNumber", Env("COMPANY"));
    req.Headers.TryAddWithoutValidation("X-StoreNumber",   Env("STORE"));
    req.Headers.TryAddWithoutValidation("X-ReferenceId",   Guid.NewGuid().ToString("N").ToUpper());
    req.Headers.TryAddWithoutValidation("X-Signature", xSig);
    req.Content = new StringContent(body, Encoding.UTF8, "application/json");

    var res = await client.SendAsync(req);
    return await res.Content.ReadFromJsonAsync<CompleteResponse>()!;
}

{
  "TransactionStatus": "Approved",
  "AuthorizationCode": "A12345",
  "ReferenceNumber": "TXN-2026-001234",
  "CardType": "Visa",
  "Last4Digits": "4242"
}

public String completeSession(String sessionId) throws Exception {
    String expiry = ZonedDateTime.now(ZoneOffset.UTC).plusMinutes(5)
        .format(DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"));

    String body = String.format(
        "{\"SessionId\":\"%s\",\"RequestExpirationUTC\":\"%s\"}",
        sessionId, expiry);

    Signature signer = Signature.getInstance("SHA256withRSA");
    signer.initSign(privateKey);
    signer.update(body.getBytes(StandardCharsets.UTF_8));
    String xSig = HexFormat.of().formatHex(signer.sign()).toUpperCase();

    return HttpClient.newHttpClient().send(
        HttpRequest.newBuilder()
            .uri(URI.create(HPP_BASE + "/v1.4/PaymentTransactionManagement/CompleteSession"))
            .header("Content-Type", "application/json")
            .header("X-CompanyNumber", COMPANY)
            .header("X-StoreNumber",   STORE)
            .header("X-ReferenceId",   UUID.randomUUID().toString().replace("-","").toUpperCase())
            .header("X-Signature", xSig)
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build(),
        HttpResponse.BodyHandlers.ofString()
    ).body();
}

{
  "TransactionStatus": "Approved",
  "AuthorizationCode": "A12345",
  "ReferenceNumber": "TXN-2026-001234",
  "CardType": "Visa",
  "Last4Digits": "4242"
}

curl -X POST "https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/v1.4/ReversalAdministration/ReverseTransaction" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: C3D4E5F6789012345678901234ABCDEF" \
  -H "X-Signature: 2E8A4F..." \
  -d '{
    "OriginalReferenceId": "45016f4cce57e5ab4e308a1822b9b9fc3336",
    "ReversalType": "timeout",
    "RequestExpirationUTC": "2026-07-10T12:10:00.000Z"
  }'

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "Approved",
            "HostResponseCode": "00",
            "HostType": 1,
            "AuthorizationCode": "TXN987",
            "HostRetrievalNumber": "123456",
            "RetrievalReferenceNumber": "RRN-2026-001235",
            "CardType": { "Type": "Credit", "Name": "Visa" },
            "MerchantID": "MID-001",
            "MerchantCategoryCode": "5411",
            "NetworkID": "VISA",
            "StoreNumber": 190,
            "AuditId": 42,
            "BusinessTransactionDate": "2026-07-14T12:05:00.000Z",
            "CardProcId": "PROC-001",
            "PaymentAccountReference": null,
            "CreditToDebitConversionType": null,
            "HostValues": {}
          }

async function reverseTransaction(originalRefId, type = 'timeout') {
  const payload = {
    OriginalReferenceId: originalRefId,
    ReversalType: type,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString()
  };
  const body = JSON.stringify(payload);
  const sign = crypto.createSign('RSA-SHA256');
  sign.update(body, 'utf8');
  const xSig = sign.sign(
    { key, passphrase: process.env.KEY_PASS }, 'hex'
  ).toUpperCase();

  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/ReversalAdministration/ReverseTransaction`,
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-CompanyNumber': process.env.COMPANY,
        'X-StoreNumber':   process.env.STORE,
        'X-ReferenceId':   crypto.randomUUID().replace(/-/g,'').toUpperCase(),
        'X-Signature': xSig
      },
      body
    }
  );
  return res.json();
}

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "Approved",
            "HostResponseCode": "00",
            "HostType": 1,
            "AuthorizationCode": "TXN987",
            "HostRetrievalNumber": "123456",
            "RetrievalReferenceNumber": "RRN-2026-001235",
            "CardType": { "Type": "Credit", "Name": "Visa" },
            "MerchantID": "MID-001",
            "MerchantCategoryCode": "5411",
            "NetworkID": "VISA",
            "StoreNumber": 190,
            "AuditId": 42,
            "BusinessTransactionDate": "2026-07-14T12:05:00.000Z",
            "CardProcId": "PROC-001",
            "PaymentAccountReference": null,
            "CreditToDebitConversionType": null,
            "HostValues": {}
          }

def reverse_transaction(original_ref_id: str, reversal_type: str = "timeout") -> dict:
    payload = {
        "OriginalReferenceId": original_ref_id,
        "ReversalType": reversal_type,
        "RequestExpirationUTC": (
            datetime.now(timezone.utc) + timedelta(minutes=5)
        ).strftime('%Y-%m-%dT%H:%M:%S.000Z')
    }
    body  = json.dumps(payload, separators=(',', ':'))
    sig   = pkey.sign(body.encode(), padding.PKCS1v15(), hashes.SHA256())
    x_sig = sig.hex().upper()

    return requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/ReversalAdministration/ReverseTransaction",
        headers={
            "Content-Type": "application/json",
            "X-CompanyNumber": os.environ["COMPANY"],
            "X-StoreNumber":   os.environ["STORE"],
            "X-ReferenceId":   uuid.uuid4().hex.upper(),
            "X-Signature": x_sig
        },
        data=body, timeout=30
    ).json()

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "Approved",
            "HostResponseCode": "00",
            "HostType": 1,
            "AuthorizationCode": "TXN987",
            "HostRetrievalNumber": "123456",
            "RetrievalReferenceNumber": "RRN-2026-001235",
            "CardType": { "Type": "Credit", "Name": "Visa" },
            "MerchantID": "MID-001",
            "MerchantCategoryCode": "5411",
            "NetworkID": "VISA",
            "StoreNumber": 190,
            "AuditId": 42,
            "BusinessTransactionDate": "2026-07-14T12:05:00.000Z",
            "CardProcId": "PROC-001",
            "PaymentAccountReference": null,
            "CreditToDebitConversionType": null,
            "HostValues": {}
          }

public async Task<string> ReverseTransactionAsync(string originalRefId, string type = "timeout")
{
    using var rsa = RSA.Create();
    rsa.ImportFromEncryptedPem(File.ReadAllText("private.pem"), Env("KEY_PASS"));

    var payload = new { OriginalReferenceId = originalRefId, ReversalType = type,
        RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("yyyy-MM-ddTHH:mm:ss.fffZ") };
    var body     = JsonSerializer.Serialize(payload);
    var sigBytes = rsa.SignData(Encoding.UTF8.GetBytes(body),
                     HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
    var xSig     = Convert.ToHexString(sigBytes);

    using var client = new HttpClient();
    using var req = new HttpRequestMessage(HttpMethod.Post,
        $"{Env("HPP_BASE")}/v1.4/ReversalAdministration/ReverseTransaction");
    req.Headers.TryAddWithoutValidation("X-CompanyNumber", Env("COMPANY"));
    req.Headers.TryAddWithoutValidation("X-StoreNumber",   Env("STORE"));
    req.Headers.TryAddWithoutValidation("X-ReferenceId",   Guid.NewGuid().ToString("N").ToUpper());
    req.Headers.TryAddWithoutValidation("X-Signature", xSig);
    req.Content = new StringContent(body, Encoding.UTF8, "application/json");

    var res = await client.SendAsync(req);
    return await res.Content.ReadAsStringAsync();
}

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "Approved",
            "HostResponseCode": "00",
            "HostType": 1,
            "AuthorizationCode": "TXN987",
            "HostRetrievalNumber": "123456",
            "RetrievalReferenceNumber": "RRN-2026-001235",
            "CardType": { "Type": "Credit", "Name": "Visa" },
            "MerchantID": "MID-001",
            "MerchantCategoryCode": "5411",
            "NetworkID": "VISA",
            "StoreNumber": 190,
            "AuditId": 42,
            "BusinessTransactionDate": "2026-07-14T12:05:00.000Z",
            "CardProcId": "PROC-001",
            "PaymentAccountReference": null,
            "CreditToDebitConversionType": null,
            "HostValues": {}
          }

public String reverseTransaction(String originalRefId, String type) throws Exception {
    String expiry = ZonedDateTime.now(ZoneOffset.UTC).plusMinutes(5)
        .format(DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"));

    String body = String.format(
        "{\"OriginalReferenceId\":\"%s\",\"ReversalType\":\"%s\",\"RequestExpirationUTC\":\"%s\"}",
        originalRefId, type, expiry);

    Signature signer = Signature.getInstance("SHA256withRSA");
    signer.initSign(privateKey);
    signer.update(body.getBytes(StandardCharsets.UTF_8));
    String xSig = HexFormat.of().formatHex(signer.sign()).toUpperCase();

    return HttpClient.newHttpClient().send(
        HttpRequest.newBuilder()
            .uri(URI.create(HPP_BASE + "/v1.4/ReversalAdministration/ReverseTransaction"))
            .header("Content-Type", "application/json")
            .header("X-CompanyNumber", COMPANY)
            .header("X-StoreNumber",   STORE)
            .header("X-ReferenceId",   UUID.randomUUID().toString().replace("-","").toUpperCase())
            .header("X-Signature", xSig)
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build(),
        HttpResponse.BodyHandlers.ofString()
    ).body();
}

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "Approved",
            "HostResponseCode": "00",
            "HostType": 1,
            "AuthorizationCode": "TXN987",
            "HostRetrievalNumber": "123456",
            "RetrievalReferenceNumber": "RRN-2026-001235",
            "CardType": { "Type": "Credit", "Name": "Visa" },
            "MerchantID": "MID-001",
            "MerchantCategoryCode": "5411",
            "NetworkID": "VISA",
            "StoreNumber": 190,
            "AuditId": 42,
            "BusinessTransactionDate": "2026-07-14T12:05:00.000Z",
            "CardProcId": "PROC-001",
            "PaymentAccountReference": null,
            "CreditToDebitConversionType": null,
            "HostValues": {}
          }

curl -X GET "https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/Page/Configuration" \
  -H "sessionId: {{SessionId}}" \
  -H "company: YOUR_COMPANY"

const res = await fetch(
  `${process.env.HPP_BASE}/Page/Configuration`,
  {
    headers: {
      'sessionId': sessionId,
      'company':   process.env.COMPANY
    }
  }
);
return res.json();

import requests, os

r = requests.get(
    f"{os.environ['HPP_BASE']}/Page/Configuration",
    headers={
        "sessionId": session_id,
        "company":   os.environ["COMPANY"]
    }
)
r.raise_for_status()
return r.json()

var request = new HttpRequestMessage(HttpMethod.Get,
    $"{Env("HPP_BASE")}/Page/Configuration");
request.Headers.Add("sessionId", sessionId);
request.Headers.Add("company",   Env("COMPANY"));
var response = await _http.SendAsync(request);
response.EnsureSuccessStatusCode();
return await response.Content.ReadAsStringAsync();

HttpRequest req = HttpRequest.newBuilder()
    .uri(URI.create(HPP_BASE + "/Page/Configuration"))
    .header("sessionId", sessionId)
    .header("company",   COMPANY)
    .GET().build();
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();

curl -X POST "https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/PayerAuthentication/Setup" \
  -H "Content-Type: application/json" \
  -H "X-Company: YOUR_COMPANY" \
  -H "X-SessionId: {{SessionId}}" \
  -H "X-UniqueTransactionIdentifier: {{$guid}}" \
  -d '{
    "paymentType": { "sourceType": "CARD", "category": null },
    "sources": [{
      "sourceType": "CARD",
      "encryptionData": {
        "encryptionType": "RSA",
        "encryptionTarget": "WEB",
        "encryptionBlock": "YF6h3iVn..."
      }
    }],
    "profileDetails": { "isDefaultCard": false },
    "billingDetails": {
      "isBillingSameAsShipping": false,
      "address1": "123 Main St",
      "city": "Columbus",
      "state": "OH",
      "country": "US",
      "postalCode": "43240"
    }
  }'

{
  "data": {
    "referenceId": "3ds-setup-ref-abc123"
  }
}

async function threeDSSetup(sessionId, encryptedCard) {
  const body = {
    paymentType: { sourceType: 'CARD', category: null },
    sources: [{ sourceType: 'CARD', encryptionData: {
      encryptionType: 'RSA', encryptionTarget: 'WEB',
      encryptionBlock: encryptedCard
    }}],
    profileDetails: { isDefaultCard: false },
    billingDetails: {
      isBillingSameAsShipping: false,
      address1: '123 Main St', city: 'Columbus',
      state: 'OH', country: 'US', postalCode: '43240'
    }
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/PayerAuthentication/Setup`,
    { method: 'POST',
      headers: { 'Content-Type': 'application/json',
        'X-Company': process.env.COMPANY,
        'X-SessionId': sessionId,
        'X-UniqueTransactionIdentifier': crypto.randomUUID() },
      body: JSON.stringify(body) }
  );
  const data = await res.json();
  return data.data.referenceId; // SetupReferenceId
}

import requests, os, uuid

def three_ds_setup(session_id: str, encrypted_card: str) -> str:
    body = {
        "paymentType": {"sourceType": "CARD", "category": None},
        "sources": [{"sourceType": "CARD", "encryptionData": {
            "encryptionType": "RSA", "encryptionTarget": "WEB",
            "encryptionBlock": encrypted_card
        }}],
        "profileDetails": {"isDefaultCard": False},
        "billingDetails": {
            "isBillingSameAsShipping": False,
            "address1": "123 Main St", "city": "Columbus",
            "state": "OH", "country": "US", "postalCode": "43240"
        }
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/PayerAuthentication/Setup",
        headers={
            "Content-Type": "application/json",
            "X-Company": os.environ["COMPANY"],
            "X-SessionId": session_id,
            "X-UniqueTransactionIdentifier": str(uuid.uuid4())
        }, json=body
    )
    r.raise_for_status()
    return r.json()["data"]["referenceId"]

var body = JsonSerializer.Serialize(new {
    paymentType = new { sourceType = "CARD", category = (string)null },
    sources = new[] { new { sourceType = "CARD", encryptionData = new {
        encryptionType = "RSA", encryptionTarget = "WEB",
        encryptionBlock = encryptedCard } } },
    profileDetails = new { isDefaultCard = false },
    billingDetails = new { isBillingSameAsShipping = false,
        address1 = "123 Main St", city = "Columbus",
        state = "OH", country = "US", postalCode = "43240" }
});
var req = new HttpRequestMessage(HttpMethod.Post,
    $"{Env("HPP_BASE")}/PayerAuthentication/Setup");
req.Content = new StringContent(body, Encoding.UTF8, "application/json");
req.Headers.Add("X-Company",  Env("COMPANY"));
req.Headers.Add("X-SessionId", sessionId);
req.Headers.Add("X-UniqueTransactionIdentifier", Guid.NewGuid().ToString());
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();

String json = "{ \"paymentType\":{\"sourceType\":\"CARD\",\"category\":null}," +
    "\"sources\":[{\"sourceType\":\"CARD\",\"encryptionData\":{" +
    "\"encryptionType\":\"RSA\",\"encryptionTarget\":\"WEB\"," +
    "\"encryptionBlock\":\"" + encryptedCard + "\"}}]," +
    "\"profileDetails\":{\"isDefaultCard\":false}," +
    "\"billingDetails\":{\"isBillingSameAsShipping\":false," +
    "\"address1\":\"123 Main St\",\"city\":\"Columbus\"," +
    "\"state\":\"OH\",\"country\":\"US\",\"postalCode\":\"43240\"}}";
HttpRequest req = HttpRequest.newBuilder()
    .uri(URI.create(HPP_BASE + "/PayerAuthentication/Setup"))
    .header("Content-Type", "application/json")
    .header("X-Company",    COMPANY)
    .header("X-SessionId",  sessionId)
    .header("X-UniqueTransactionIdentifier", UUID.randomUUID().toString())
    .POST(HttpRequest.BodyPublishers.ofString(json)).build();
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();

curl -X POST "https://seps1-rls.paymentslab.ncrvoyix.com/WebEPS/PayerAuthentication/Enrollment" \
  -H "Content-Type: application/json" \
  -H "X-Company: YOUR_COMPANY" \
  -H "X-SessionId: {{SessionId}}" \
  -H "X-UniqueTransactionIdentifier: {{$guid}}" \
  -d '{
    "paymentType": { "sourceType": "CARD", "category": null },
    "sources": [{ "sourceType": "CARD", "encryptionData": {
      "encryptionType": "RSA", "encryptionTarget": "WEB",
      "encryptionBlock": "YF6h3iVn..." }}],
    "profileDetails": { "isDefaultCard": false },
    "billingDetails": { "isBillingSameAsShipping": false,
      "address1": "123 Main St", "city": "Columbus",
      "state": "OH", "country": "US", "postalCode": "43240" },
    "paSetupReferenceId": "{{SetupReferenceId}}",
    "browserInformation": {
      "browserColorDepth": 24,
      "browserJavaEnabled": "False",
      "browserJavaScriptEnabled": "True",
      "browserLanguage": "en-US",
      "browserScreenHeight": 1080,
      "browserScreenWidth": 1920,
      "browserTimeZone": -330,
      "deviceChannel": "Browser",
      "userAgent": "Mozilla/5.0 ..."
    }
  }'

async function threeDSEnrollment(sessionId, encryptedCard, setupRefId) {
  const body = {
    paymentType: { sourceType: 'CARD', category: null },
    sources: [{ sourceType: 'CARD', encryptionData: {
      encryptionType: 'RSA', encryptionTarget: 'WEB',
      encryptionBlock: encryptedCard }}],
    profileDetails: { isDefaultCard: false },
    billingDetails: { isBillingSameAsShipping: false,
      address1: '123 Main St', city: 'Columbus',
      state: 'OH', country: 'US', postalCode: '43240' },
    paSetupReferenceId: setupRefId,
    browserInformation: {
      browserColorDepth: screen.colorDepth,
      browserJavaEnabled: 'False',
      browserJavaScriptEnabled: 'True',
      browserLanguage: navigator.language,
      browserScreenHeight: screen.height,
      browserScreenWidth: screen.width,
      browserTimeZone: new Date().getTimezoneOffset(),
      deviceChannel: 'Browser',
      userAgent: navigator.userAgent
    }
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/PayerAuthentication/Enrollment`,
    { method: 'POST',
      headers: { 'Content-Type': 'application/json',
        'X-Company': process.env.COMPANY,
        'X-SessionId': sessionId,
        'X-UniqueTransactionIdentifier': crypto.randomUUID() },
      body: JSON.stringify(body) }
  );
  return res.json();
}

def three_ds_enrollment(session_id, encrypted_card, setup_ref_id):
    body = {
        "paymentType": {"sourceType": "CARD", "category": None},
        "sources": [{"sourceType": "CARD", "encryptionData": {
            "encryptionType": "RSA", "encryptionTarget": "WEB",
            "encryptionBlock": encrypted_card}}],
        "profileDetails": {"isDefaultCard": False},
        "billingDetails": {"isBillingSameAsShipping": False,
            "address1": "123 Main St", "city": "Columbus",
            "state": "OH", "country": "US", "postalCode": "43240"},
        "paSetupReferenceId": setup_ref_id,
        "browserInformation": {
            "browserColorDepth": 24, "browserJavaEnabled": "False",
            "browserJavaScriptEnabled": "True", "browserLanguage": "en-US",
            "browserScreenHeight": 1080, "browserScreenWidth": 1920,
            "browserTimeZone": -330, "deviceChannel": "Browser",
            "userAgent": "Mozilla/5.0 ..."
        }
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/PayerAuthentication/Enrollment",
        headers={"Content-Type": "application/json",
            "X-Company": os.environ["COMPANY"],
            "X-SessionId": session_id,
            "X-UniqueTransactionIdentifier": str(uuid.uuid4())},
        json=body)
    r.raise_for_status()
    return r.json()

// Build body with paSetupReferenceId and browserInformation
// (same shape as Setup body, plus the two new fields)
var req = new HttpRequestMessage(HttpMethod.Post,
    $"{Env("HPP_BASE")}/PayerAuthentication/Enrollment");
req.Content = new StringContent(body, Encoding.UTF8, "application/json");
req.Headers.Add("X-Company",  Env("COMPANY"));
req.Headers.Add("X-SessionId", sessionId);
req.Headers.Add("X-UniqueTransactionIdentifier", Guid.NewGuid().ToString());
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();

HttpRequest req = HttpRequest.newBuilder()
    .uri(URI.create(HPP_BASE + "/PayerAuthentication/Enrollment"))
    .header("Content-Type", "application/json")
    .header("X-Company",    COMPANY)
    .header("X-SessionId",  sessionId)
    .header("X-UniqueTransactionIdentifier", UUID.randomUUID().toString())
    .POST(HttpRequest.BodyPublishers.ofString(enrollmentJson)).build();
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();

curl -X POST "https://seps1-rls.paymentslab.ncrvoyix.com/Ecommerce/SecurePay/Payment/Capture" \
  -H "Content-Type: application/json" \
  -H "x-company: YOUR_COMPANY" \
  -H "x-sessionid: {{SessionId}}" \
  -H "x-uniquetransactionidentifier: {{$guid}}" \
  -d '{
    "paymentType": { "sourceType": "card", "category": null },
    "sources": [{ "sourceType": "card", "encryptionData": {
      "encryptionType": "RSA", "encryptionTarget": "WEB",
      "encryptionBlock": "XJcQqR77..." }}],
    "billingDetails": { "isBillingSameAsShipping": false,
      "address1": "123 Main St", "city": "Columbus",
      "state": "OH", "country": "US", "postalCode": "43240" },
    "profileDetails": { "isDefaultCard": false }
  }'

async function threeDSCapture(sessionId, encryptedCard) {
  const body = {
    paymentType: { sourceType: 'card', category: null },
    sources: [{ sourceType: 'card', encryptionData: {
      encryptionType: 'RSA', encryptionTarget: 'WEB',
      encryptionBlock: encryptedCard }}],
    billingDetails: { isBillingSameAsShipping: false,
      address1: '123 Main St', city: 'Columbus',
      state: 'OH', country: 'US', postalCode: '43240' },
    profileDetails: { isDefaultCard: false }
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/Ecommerce/SecurePay/Payment/Capture`,
    { method: 'POST',
      headers: { 'Content-Type': 'application/json',
        'x-company': process.env.COMPANY,
        'x-sessionid': sessionId,
        'x-uniquetransactionidentifier': crypto.randomUUID() },
      body: JSON.stringify(body) }
  );
  return res.json();
}

def three_ds_capture(session_id, encrypted_card):
    body = {
        "paymentType": {"sourceType": "card", "category": None},
        "sources": [{"sourceType": "card", "encryptionData": {
            "encryptionType": "RSA", "encryptionTarget": "WEB",
            "encryptionBlock": encrypted_card}}],
        "billingDetails": {"isBillingSameAsShipping": False,
            "address1": "123 Main St", "city": "Columbus",
            "state": "OH", "country": "US", "postalCode": "43240"},
        "profileDetails": {"isDefaultCard": False}
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/Ecommerce/SecurePay/Payment/Capture",
        headers={"Content-Type": "application/json",
            "x-company": os.environ["COMPANY"],
            "x-sessionid": session_id,
            "x-uniquetransactionidentifier": str(uuid.uuid4())},
        json=body)
    r.raise_for_status()
    return r.json()

var req = new HttpRequestMessage(HttpMethod.Post,
    $"{Env("HPP_BASE")}/Ecommerce/SecurePay/Payment/Capture");
req.Content = new StringContent(body, Encoding.UTF8, "application/json");
req.Headers.Add("x-company",  Env("COMPANY"));
req.Headers.Add("x-sessionid", sessionId);
req.Headers.Add("x-uniquetransactionidentifier", Guid.NewGuid().ToString());
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();

HttpRequest req = HttpRequest.newBuilder()
    .uri(URI.create(HPP_BASE + "/Ecommerce/SecurePay/Payment/Capture"))
    .header("Content-Type", "application/json")
    .header("x-company",    COMPANY)
    .header("x-sessionid",  sessionId)
    .header("x-uniquetransactionidentifier", UUID.randomUUID().toString())
    .POST(HttpRequest.BodyPublishers.ofString(captureJson)).build();
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();

curl -X POST "https://seps1-rls.paymentslab.ncrvoyix.com/ecommerce/securepay/Checkout/Cancel" \
  -H "X-Company: YOUR_COMPANY" \
  -H "X-SessionId: {{SessionId}}" \
  -H "X-UniqueTransactionIdentifier: {{$guid}}"

async function cancelSession(sessionId) {
  const res = await fetch(
    `${process.env.HPP_BASE}/ecommerce/securepay/Checkout/Cancel`,
    { method: 'POST',
      headers: {
        'X-Company':   process.env.COMPANY,
        'X-SessionId': sessionId,
        'X-UniqueTransactionIdentifier': crypto.randomUUID()
      }
    }
  );
  return res.ok;
}

def cancel_session(session_id: str) -> bool:
    r = requests.post(
        f"{os.environ['HPP_BASE']}/ecommerce/securepay/Checkout/Cancel",
        headers={
            "X-Company":   os.environ["COMPANY"],
            "X-SessionId": session_id,
            "X-UniqueTransactionIdentifier": str(uuid.uuid4())
        }
    )
    r.raise_for_status()
    return r.ok

var req = new HttpRequestMessage(HttpMethod.Post,
    $"{Env("HPP_BASE")}/ecommerce/securepay/Checkout/Cancel");
req.Headers.Add("X-Company",  Env("COMPANY"));
req.Headers.Add("X-SessionId", sessionId);
req.Headers.Add("X-UniqueTransactionIdentifier", Guid.NewGuid().ToString());
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();

HttpRequest req = HttpRequest.newBuilder()
    .uri(URI.create(HPP_BASE + "/ecommerce/securepay/Checkout/Cancel"))
    .header("X-Company",    COMPANY)
    .header("X-SessionId",  sessionId)
    .header("X-UniqueTransactionIdentifier", UUID.randomUUID().toString())
    .POST(HttpRequest.BodyPublishers.noBody()).build();
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();

curl -X POST "$HPP_BASE/v1.4/EndpointAdministration/InitializeSessionKey" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "ClientPublicKey": "<ECDHKeyValue>...</ECDHKeyValue>",
    "ClientPublicKeyFormat": "RFC4050XML",
    "ExchangeFormat": "ECDH",
    "KeyDurationInHours": 72,
    "RequestExpirationUTC": "2026-07-15T12:05:00.000Z"
  }'

{
            "KeyId": "key-abc123",
            "ServerPublicKey": "<ECDHKeyValue>...</ECDHKeyValue>",
            "ServerPublicKeyFormat": "RFC4050XML",
            "KeyExpirationUTC": "2026-07-16T12:05:00.000Z"
          }

async function initSessionKey(eccPublicKeyXml) {
  const body = {
    ClientPublicKey: eccPublicKeyXml,
    ClientPublicKeyFormat: 'RFC4050XML',
    ExchangeFormat: 'ECDH',
    KeyDurationInHours: 72,
    RequestExpirationUTC: new Date(Date.now() + 5 * 60000).toISOString()
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/EndpointAdministration/InitializeSessionKey`,
    { method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-CompanyNumber': process.env.COMPANY,
        'X-StoreNumber':   process.env.STORE,
        'X-ReferenceId':   crypto.randomUUID().replace(/-/g,'').toUpperCase(),
        'X-Signature':     signBody(body)
      },
      body: JSON.stringify(body) }
  );
  return res.json();
}

{
            "KeyId": "key-abc123",
            "ServerPublicKey": "<ECDHKeyValue>...</ECDHKeyValue>",
            "ServerPublicKeyFormat": "RFC4050XML",
            "KeyExpirationUTC": "2026-07-16T12:05:00.000Z"
          }

def init_session_key(ecc_public_key_xml: str) -> dict:
    body = {
        "ClientPublicKey": ecc_public_key_xml,
        "ClientPublicKeyFormat": "RFC4050XML",
        "ExchangeFormat": "ECDH",
        "KeyDurationInHours": 72,
        "RequestExpirationUTC": (
            datetime.now(timezone.utc) + timedelta(minutes=5)
        ).strftime("%Y-%m-%dT%H:%M:%S.000Z")
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/EndpointAdministration/InitializeSessionKey",
        headers={
            "Content-Type": "application/json",
            "X-CompanyNumber": os.environ["COMPANY"],
            "X-StoreNumber":   os.environ["STORE"],
            "X-ReferenceId":   uuid.uuid4().hex.upper(),
            "X-Signature":     sign_body(body)
        }, json=body)
    r.raise_for_status()
    return r.json()

{
            "KeyId": "key-abc123",
            "ServerPublicKey": "<ECDHKeyValue>...</ECDHKeyValue>",
            "ServerPublicKeyFormat": "RFC4050XML",
            "KeyExpirationUTC": "2026-07-16T12:05:00.000Z"
          }

var body = new { ClientPublicKey = eccPublicKeyXml,
                  ClientPublicKeyFormat = "RFC4050XML",
                  ExchangeFormat = "ECDH",
                  KeyDurationInHours = 72,
                  RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o") };
var req = BuildRequest(HttpMethod.Post,
    "/v1.4/EndpointAdministration/InitializeSessionKey", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
return await resp.Content.ReadAsStringAsync();

{
            "KeyId": "key-abc123",
            "ServerPublicKey": "<ECDHKeyValue>...</ECDHKeyValue>",
            "ServerPublicKeyFormat": "RFC4050XML",
            "KeyExpirationUTC": "2026-07-16T12:05:00.000Z"
          }

String json = String.format(
    "{\"ClientPublicKey\":\"%s\",\"ClientPublicKeyFormat\":\"RFC4050XML\"," +
    "\"ExchangeFormat\":\"ECDH\",\"KeyDurationInHours\":72," +
    "\"RequestExpirationUTC\":\"%s\"}", eccPublicKeyXml.replace("\"","\\\""),
    Instant.now().plusSeconds(300));
HttpRequest req = buildSignedRequest(
    "/v1.4/EndpointAdministration/InitializeSessionKey", json);
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();

{
            "KeyId": "key-abc123",
            "ServerPublicKey": "<ECDHKeyValue>...</ECDHKeyValue>",
            "ServerPublicKeyFormat": "RFC4050XML",
            "KeyExpirationUTC": "2026-07-16T12:05:00.000Z"
          }

curl -X POST "$HPP_BASE/v1.4/EndpointAdministration/InitializeSessionKey" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "ClientPublicKey": "AQAB...BASE64BLOB==",
    "ClientPublicKeyFormat": "Base64MicrosoftECCBlob",
    "ExchangeFormat": "ECDH",
    "KeyDurationInHours": 72,
    "RequestExpirationUTC": "2026-07-15T12:05:00.000Z"
  }'

{
            "KeyId": "key-abc123",
            "ServerPublicKey": "AQAB...BASE64BLOB==",
            "ServerPublicKeyFormat": "Base64MicrosoftECCBlob",
            "KeyExpirationUTC": "2026-07-16T12:05:00.000Z"
          }

async function initSessionKeyBlob(eccPublicKeyBase64) {
  const body = {
    ClientPublicKey: eccPublicKeyBase64,
    ClientPublicKeyFormat: 'Base64MicrosoftECCBlob',
    ExchangeFormat: 'ECDH',
    KeyDurationInHours: 72,
    RequestExpirationUTC: new Date(Date.now() + 5 * 60000).toISOString()
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/EndpointAdministration/InitializeSessionKey`,
    { method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-CompanyNumber': process.env.COMPANY,
        'X-StoreNumber':   process.env.STORE,
        'X-ReferenceId':   crypto.randomUUID().replace(/-/g,'').toUpperCase(),
        'X-Signature':     signBody(body)
      },
      body: JSON.stringify(body) }
  );
  return res.json();
}

{
            "KeyId": "key-abc123",
            "ServerPublicKey": "AQAB...BASE64BLOB==",
            "ServerPublicKeyFormat": "Base64MicrosoftECCBlob",
            "KeyExpirationUTC": "2026-07-16T12:05:00.000Z"
          }

def init_session_key_blob(ecc_public_key_b64: str) -> dict:
    body = {
        "ClientPublicKey": ecc_public_key_b64,
        "ClientPublicKeyFormat": "Base64MicrosoftECCBlob",
        "ExchangeFormat": "ECDH",
        "KeyDurationInHours": 72,
        "RequestExpirationUTC": (
            datetime.now(timezone.utc) + timedelta(minutes=5)
        ).strftime("%Y-%m-%dT%H:%M:%S.000Z")
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/EndpointAdministration/InitializeSessionKey",
        headers=signed_headers(body), json=body)
    r.raise_for_status()
    return r.json()

{
            "KeyId": "key-abc123",
            "ServerPublicKey": "AQAB...BASE64BLOB==",
            "ServerPublicKeyFormat": "Base64MicrosoftECCBlob",
            "KeyExpirationUTC": "2026-07-16T12:05:00.000Z"
          }

// Export CNG key as Base64 blob
using var ecdh = ECDiffieHellman.Create(ECCurve.NamedCurves.nistP256);
string blob = Convert.ToBase64String(
    ecdh.PublicKey.ExportSubjectPublicKeyInfo());
var body = new { ClientPublicKey = blob,
                  ClientPublicKeyFormat = "Base64MicrosoftECCBlob",
                  ExchangeFormat = "ECDH",
                  KeyDurationInHours = 72,
                  RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o") };
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/EndpointAdministration/InitializeSessionKey", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();

{
            "KeyId": "key-abc123",
            "ServerPublicKey": "AQAB...BASE64BLOB==",
            "ServerPublicKeyFormat": "Base64MicrosoftECCBlob",
            "KeyExpirationUTC": "2026-07-16T12:05:00.000Z"
          }

String json = String.format(
    "{\"ClientPublicKey\":\"%s\",\"ClientPublicKeyFormat\":\"Base64MicrosoftECCBlob\"," +
    "\"ExchangeFormat\":\"ECDH\",\"KeyDurationInHours\":72," +
    "\"RequestExpirationUTC\":\"%s\"}", eccPublicKeyBase64,
    Instant.now().plusSeconds(300));
HttpRequest req = buildSignedRequest(
    "/v1.4/EndpointAdministration/InitializeSessionKey", json);
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();

{
            "KeyId": "key-abc123",
            "ServerPublicKey": "AQAB...BASE64BLOB==",
            "ServerPublicKeyFormat": "Base64MicrosoftECCBlob",
            "KeyExpirationUTC": "2026-07-16T12:05:00.000Z"
          }

curl -X POST "$HPP_BASE/v1.4/EndpointAdministration/InitializeSession" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "RequestExpirationUTC": "2026-07-10T12:05:00.000Z"
  }'

{
            "IsValid": true,
            "KeyExpirationUTC": "2026-07-11T12:05:00.000Z"
          }

async function initEndpointSession() {
  const body = { RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString() };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/EndpointAdministration/InitializeSession`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsValid: true, KeyExpirationUTC: "2026-07-11T12:05:00.000Z" }

def endpoint_init_session() -> dict:
    body = {"RequestExpirationUTC": utc_plus(5)}
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/EndpointAdministration/InitializeSession",
        headers=signed_headers(body), json=body)
    r.raise_for_status()
    return r.json()
# Response: {"IsValid": True, "KeyExpirationUTC": "2026-07-11T12:05:00.000Z"}

var body = new { RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o") };
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/EndpointAdministration/InitializeSession", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { "IsValid": true, "KeyExpirationUTC": "2026-07-11T12:05:00.000Z" }

String json = String.format(
    "{\"RequestExpirationUTC\":\"%s\"}", Instant.now().plusSeconds(300));
HttpRequest req = buildSignedRequest(
    "/v1.4/EndpointAdministration/InitializeSession", json);
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsValid":true,"KeyExpirationUTC":"2026-07-11T12:05:00.000Z"}

curl -X POST "$HPP_BASE/v1.4/EndpointAdministration/GetReceiptTemplates" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{ "RequestExpirationUTC": "2026-07-10T12:05:00.000Z" }'

{
            "Footer": "Thank you for your purchase!",
            "Header": "ACME Store - 123 Main St",
            "LastModifiedAtUTC": "2026-06-01T00:00:00.000Z",
            "Templates": {
              "Receipt": {
                "CustomerCopy": [ { "Line": "{{MerchantName}}", "Format": "Center" } ],
                "MerchantCopy": [ { "Line": "{{MerchantName}}", "Format": "Center" } ]
              }
            }
          }

async function getReceiptTemplates() {
  const body = { RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString() };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/EndpointAdministration/GetReceiptTemplates`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { Footer, Header, LastModifiedAtUTC, Templates }

def get_receipt_templates() -> dict:
    body = {"RequestExpirationUTC": utc_plus(5)}
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/EndpointAdministration/GetReceiptTemplates",
        headers=signed_headers(body), json=body)
    r.raise_for_status()
    return r.json()
# Response: {"Footer": "...", "Header": "...", "LastModifiedAtUTC": "...", "Templates": {...}}

var body = new { RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o") };
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/EndpointAdministration/GetReceiptTemplates", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { Footer, Header, LastModifiedAtUTC, Templates }
return await resp.Content.ReadAsStringAsync();

String json = String.format("{\"RequestExpirationUTC\":\"%s\"}",
    Instant.now().plusSeconds(300));
HttpRequest req = buildSignedRequest(
    "/v1.4/EndpointAdministration/GetReceiptTemplates", json);
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"Footer":"...","Header":"...","LastModifiedAtUTC":"...","Templates":{...}}

curl -X POST "$HPP_BASE/v1.4/PaymentAdministration/PurchaseForToken" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "Token": { "TokenType": "201", "TokenValue": "371449551708431" },
    "Amount": 1200,
    "TenderType": "Credit",
    "EntryMode": "ComputerOrder",
    "ExpirationDate": "1240",
    "RequestExpirationUTC": "2026-07-10T12:05:00.000Z"
  }'

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "APPROVAL",
            "HostResponseCode": "00",
            "HostType": 1,
            "AuthorizationCode": "TAS123",
            "AuditId": 123456,
            "BusinessTransactionDate": "2026-07-10T12:05:00.000Z",
            "CardType": "Visa",
            "HostRetrievalNumber": "123456789012",
            "MerchantID": "MERCH001",
            "NetworkID": "NET01",
            "RetrievalReferenceNumber": "123456789012",
            "StoreNumber": 1,
            "ApprovedAmount": 1200,
            "AccountNumberLastFour": "1234",
            "Tokens": []
          }

async function purchaseForToken(tokenValue, amount, expiry) {
  const body = {
    Token: { TokenType: '201', TokenValue: tokenValue },
    Amount: amount, TenderType: 'Credit', EntryMode: 'ComputerOrder',
    ExpirationDate: expiry,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString()
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/PaymentAdministration/PurchaseForToken`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsApproved, ResponseCode, ResponseMessage, HostResponseCode, HostType,
//             AuthorizationCode, AuditId, CardType, MerchantID, NetworkID, StoreNumber, Tokens }

def purchase_for_token(token_value: str, amount: int, expiry: str) -> dict:
    body = {
        "Token": {"TokenType": "201", "TokenValue": token_value},
        "Amount": amount, "TenderType": "Credit",
        "EntryMode": "ComputerOrder", "ExpirationDate": expiry,
        "RequestExpirationUTC": utc_plus(5)
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/PaymentAdministration/PurchaseForToken",
        headers=signed_headers(body), json=body)
    r.raise_for_status()
    return r.json()
# Response: {"IsApproved": True, "ResponseCode": "000", "AuthorizationCode": "TAS123", ...}

var body = new {
    Token = new { TokenType = "201", TokenValue = tokenValue },
    Amount = amount, TenderType = "Credit", EntryMode = "ComputerOrder",
    ExpirationDate = expiry,
    RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o")
};
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/PaymentAdministration/PurchaseForToken", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { IsApproved, ResponseCode, ResponseMessage, AuthorizationCode, Tokens, ... }

String json = String.format(
    "{\"Token\":{\"TokenType\":\"201\",\"TokenValue\":\"%s\"}," +
    "\"Amount\":%d,\"TenderType\":\"Credit\",\"EntryMode\":\"ComputerOrder\"," +
    "\"ExpirationDate\":\"%s\",\"RequestExpirationUTC\":\"%s\"}",
    tokenValue, amount, expiry, Instant.now().plusSeconds(300));
HttpRequest req = buildSignedRequest(
    "/v1.4/PaymentAdministration/PurchaseForToken", json);
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsApproved":true,"ResponseCode":"000","AuthorizationCode":"TAS123",...}

curl -X POST "$HPP_BASE/v1.4/PaymentAdministration/VoidPurchaseForToken" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "Token": { "TokenType": "201", "TokenValue": "371449551708431" },
    "Amount": 1200,
    "OriginalReferenceId": "c7b716bb-1234-5678-abcd-ef0123456789",
    "OriginalAmount": 1200,
    "TenderType": "Credit",
    "EntryMode": "ComputerOrder",
    "ExpirationDate": "1240",
    "RequestExpirationUTC": "2026-07-15T12:05:00.000Z"
  }'

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "APPROVAL",
            "HostResponseCode": "00",
            "HostType": 1,
            "AuthorizationCode": "TAS123",
            "AuditId": 123456,
            "ApprovedAmount": 1200,
            "BusinessTransactionDate": "2026-07-15T12:05:00.000Z",
            "CardType": "Visa",
            "MerchantID": "MERCH001",
            "NetworkID": "NET01",
            "RetrievalReferenceNumber": "123456789012",
            "StoreNumber": 1
          }

async function voidPurchaseForToken(tokenValue, amount, originalReferenceId, expiry) {
  const body = {
    Token: { TokenType: '201', TokenValue: tokenValue },
    Amount: amount, OriginalReferenceId: originalReferenceId,
    OriginalAmount: amount, TenderType: 'Credit', EntryMode: 'ComputerOrder',
    ExpirationDate: expiry,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString()
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/PaymentAdministration/VoidPurchaseForToken`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsApproved, ResponseCode, ResponseMessage, HostResponseCode, HostType,
//             AuthorizationCode, AuditId, ApprovedAmount, CardType, MerchantID, ... }

def void_purchase_for_token(token_value: str, amount: int,
                             original_ref: str, expiry: str) -> dict:
    body = {
        "Token": {"TokenType": "201", "TokenValue": token_value},
        "Amount": amount, "OriginalReferenceId": original_ref,
        "OriginalAmount": amount, "TenderType": "Credit",
        "EntryMode": "ComputerOrder", "ExpirationDate": expiry,
        "RequestExpirationUTC": utc_plus(5)
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/PaymentAdministration/VoidPurchaseForToken",
        headers=signed_headers(body), json=body)
    r.raise_for_status()
    return r.json()
# Response: {"IsApproved": True, "ResponseCode": "000", "AuthorizationCode": "TAS123", ...}

var body = new {
    Token = new { TokenType = "201", TokenValue = tokenValue },
    Amount = amount, OriginalReferenceId = originalReferenceId,
    OriginalAmount = amount, TenderType = "Credit", EntryMode = "ComputerOrder",
    ExpirationDate = expiry,
    RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o")
};
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/PaymentAdministration/VoidPurchaseForToken", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { IsApproved, ResponseCode, ResponseMessage, AuthorizationCode, ApprovedAmount, ... }

String json = String.format(
    "{\"Token\":{\"TokenType\":\"201\",\"TokenValue\":\"%s\"}," +
    "\"Amount\":%d,\"OriginalReferenceId\":\"%s\",\"OriginalAmount\":%d," +
    "\"TenderType\":\"Credit\",\"EntryMode\":\"ComputerOrder\"," +
    "\"ExpirationDate\":\"%s\",\"RequestExpirationUTC\":\"%s\"}",
    tokenValue, amount, originalRefId, amount, expiry, Instant.now().plusSeconds(300));
HttpRequest req = buildSignedRequest(
    "/v1.4/PaymentAdministration/VoidPurchaseForToken", json);
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsApproved":true,"ResponseCode":"000","AuthorizationCode":"TAS123",...}

curl -X POST "$HPP_BASE/v1.4/PaymentAdministration/RefundForToken" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "Token": { "TokenType": "201", "TokenValue": "371449551708431" },
    "Amount": 1200,
    "TenderType": "Credit",
    "EntryMode": "ComputerOrder",
    "ExpirationDate": "1240",
    "RequestExpirationUTC": "2026-07-15T12:05:00.000Z"
  }'

{
  "IsApproved": true,
  "ResponseCode": "000",
  "ResponseMessage": "APPROVAL",
  "HostResponseCode": "00",
  "HostType": 1,
  "AuthorizationCode": "TAS123",
  "AuditId": 123456,
  "ApprovedAmount": 1200,
  "BusinessTransactionDate": "2026-07-15T12:05:00.000Z",
  "CardType": "Visa",
  "HostRetrievalNumber": "123456789012",
  "MerchantID": "MERCH001",
  "NetworkID": "NET01",
  "RetrievalReferenceNumber": "123456789012",
  "StoreNumber": 1
}

async function refundForToken(tokenValue, amount, expiry) {
  const body = {
    Token: { TokenType: '201', TokenValue: tokenValue },
    Amount: amount, TenderType: 'Credit', EntryMode: 'ComputerOrder',
    ExpirationDate: expiry,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString()
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/PaymentAdministration/RefundForToken`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsApproved, ResponseCode, ResponseMessage, HostResponseCode, HostType,
//             AuthorizationCode, AuditId, ApprovedAmount, CardType, MerchantID, ... }

def refund_for_token(token_value: str, amount: int, expiry: str) -> dict:
    body = {
        "Token": {"TokenType": "201", "TokenValue": token_value},
        "Amount": amount, "TenderType": "Credit",
        "EntryMode": "ComputerOrder", "ExpirationDate": expiry,
        "RequestExpirationUTC": utc_plus(5)
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/PaymentAdministration/RefundForToken",
        headers=signed_headers(body), json=body)
    r.raise_for_status()
    return r.json()
# Response: {"IsApproved": True, "ResponseCode": "000", "AuthorizationCode": "TAS123", ...}

var body = new {
    Token = new { TokenType = "201", TokenValue = tokenValue },
    Amount = amount, TenderType = "Credit", EntryMode = "ComputerOrder",
    ExpirationDate = expiry,
    RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o")
};
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/PaymentAdministration/RefundForToken", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { IsApproved, ResponseCode, ResponseMessage, AuthorizationCode, ApprovedAmount, ... }

String json = String.format(
    "{\"Token\":{\"TokenType\":\"201\",\"TokenValue\":\"%s\"}," +
    "\"Amount\":%d,\"TenderType\":\"Credit\",\"EntryMode\":\"ComputerOrder\"," +
    "\"ExpirationDate\":\"%s\",\"RequestExpirationUTC\":\"%s\"}",
    tokenValue, amount, expiry, Instant.now().plusSeconds(300));
HttpRequest req = buildSignedRequest(
    "/v1.4/PaymentAdministration/RefundForToken", json);
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsApproved":true,"ResponseCode":"000","AuthorizationCode":"TAS123",...}

curl -X POST "$HPP_BASE/v1.4/PaymentAdministration/VoidRefundForToken" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "Token": { "TokenType": "201", "TokenValue": "371449551708431" },
    "Amount": 1200,
    "OriginalReferenceId": "c7b716bb-1234-5678-abcd-ef0123456789",
    "OriginalAmount": 1200,
    "TenderType": "Credit",
    "EntryMode": "ComputerOrder",
    "ExpirationDate": "1240",
    "RequestExpirationUTC": "2026-07-15T12:05:00.000Z"
  }'

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "APPROVAL",
            "HostResponseCode": "00",
            "HostType": 1,
            "AuthorizationCode": "TAS123",
            "AuditId": 123456,
            "ApprovedAmount": 1200,
            "BusinessTransactionDate": "2026-07-15T12:05:00.000Z",
            "CardType": "Visa",
            "MerchantID": "MERCH001",
            "NetworkID": "NET01",
            "RetrievalReferenceNumber": "123456789012",
            "StoreNumber": 1
          }

async function voidRefundForToken(tokenValue, amount, originalReferenceId, expiry) {
  const body = {
    Token: { TokenType: '201', TokenValue: tokenValue },
    Amount: amount, OriginalReferenceId: originalReferenceId,
    OriginalAmount: amount, TenderType: 'Credit', EntryMode: 'ComputerOrder',
    ExpirationDate: expiry,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString()
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/PaymentAdministration/VoidRefundForToken`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsApproved, ResponseCode, ResponseMessage, HostResponseCode, HostType,
//             AuthorizationCode, AuditId, ApprovedAmount, CardType, MerchantID, ... }

def void_refund_for_token(token_value: str, amount: int,
                          original_ref: str, expiry: str) -> dict:
    body = {
        "Token": {"TokenType": "201", "TokenValue": token_value},
        "Amount": amount, "OriginalReferenceId": original_ref,
        "OriginalAmount": amount, "TenderType": "Credit",
        "EntryMode": "ComputerOrder", "ExpirationDate": expiry,
        "RequestExpirationUTC": utc_plus(5)
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/PaymentAdministration/VoidRefundForToken",
        headers=signed_headers(body), json=body)
    r.raise_for_status()
    return r.json()
# Response: {"IsApproved": True, "ResponseCode": "000", "AuthorizationCode": "TAS123", ...}

var body = new {
    Token = new { TokenType = "201", TokenValue = tokenValue },
    Amount = amount, OriginalReferenceId = originalReferenceId,
    OriginalAmount = amount, TenderType = "Credit", EntryMode = "ComputerOrder",
    ExpirationDate = expiry,
    RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o")
};
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/PaymentAdministration/VoidRefundForToken", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { IsApproved, ResponseCode, ResponseMessage, AuthorizationCode, ApprovedAmount, ... }

String json = String.format(
    "{\"Token\":{\"TokenType\":\"201\",\"TokenValue\":\"%s\"}," +
    "\"Amount\":%d,\"OriginalReferenceId\":\"%s\",\"OriginalAmount\":%d," +
    "\"TenderType\":\"Credit\",\"EntryMode\":\"ComputerOrder\"," +
    "\"ExpirationDate\":\"%s\",\"RequestExpirationUTC\":\"%s\"}",
    tokenValue, amount, originalRefId, amount, expiry, Instant.now().plusSeconds(300));
HttpRequest req = buildSignedRequest(
    "/v1.4/PaymentAdministration/VoidRefundForToken", json);
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsApproved":true,"ResponseCode":"000","AuthorizationCode":"TAS123",...}

curl -X POST "$HPP_BASE/v1.4/PaymentAdministration/PreauthorizeForToken" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "Token": { "TokenType": "201", "TokenValue": "371449551708431" },
    "Amount": 5000,
    "TenderType": "Credit",
    "EntryMode": "ComputerOrder",
    "ExpirationDate": "1240",
    "RequestExpirationUTC": "2026-07-15T12:05:00.000Z"
  }'

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "APPROVAL",
            "HostResponseCode": "00",
            "HostType": 1,
            "AuthorizationCode": "TAS123",
            "AuditId": 123456,
            "ApprovedAmount": 5000,
            "BusinessTransactionDate": "2026-07-15T12:05:00.000Z",
            "CardType": "Visa",
            "AccountNumberLastFour": "1234",
            "HostRetrievalNumber": "123456789012",
            "MerchantID": "MERCH001",
            "NetworkID": "NET01",
            "RetrievalReferenceNumber": "123456789012",
            "StoreNumber": 1,
            "Tokens": []
          }

async function preauthorizeForToken(tokenValue, amount, expiry) {
  const body = {
    Token: { TokenType: '201', TokenValue: tokenValue },
    Amount: amount, TenderType: 'Credit', EntryMode: 'ComputerOrder',
    ExpirationDate: expiry,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString()
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/PaymentAdministration/PreauthorizeForToken`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsApproved, ResponseCode, ResponseMessage, HostResponseCode, HostType,
//             AuthorizationCode, AuditId, ApprovedAmount, CardType, Tokens, ... }

def preauthorize_for_token(token_value: str, amount: int, expiry: str) -> dict:
    body = {
        "Token": {"TokenType": "201", "TokenValue": token_value},
        "Amount": amount, "TenderType": "Credit", "EntryMode": "ComputerOrder",
        "ExpirationDate": expiry, "RequestExpirationUTC": utc_plus(5)
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/PaymentAdministration/PreauthorizeForToken",
        headers=signed_headers(body), json=body)
    r.raise_for_status()
    return r.json()
# Response: {"IsApproved": True, "ResponseCode": "000", "AuthorizationCode": "TAS123", ...}

var body = new {
    Token = new { TokenType = "201", TokenValue = tokenValue },
    Amount = amount, TenderType = "Credit", EntryMode = "ComputerOrder",
    ExpirationDate = expiry,
    RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o")
};
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/PaymentAdministration/PreauthorizeForToken", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { IsApproved, ResponseCode, ResponseMessage, AuthorizationCode, ApprovedAmount, Tokens, ... }

String json = String.format(
    "{\"Token\":{\"TokenType\":\"201\",\"TokenValue\":\"%s\"}," +
    "\"Amount\":%d,\"TenderType\":\"Credit\",\"EntryMode\":\"ComputerOrder\"," +
    "\"ExpirationDate\":\"%s\",\"RequestExpirationUTC\":\"%s\"}",
    tokenValue, amount, expiry, Instant.now().plusSeconds(300));
HttpRequest req = buildSignedRequest(
    "/v1.4/PaymentAdministration/PreauthorizeForToken", json);
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsApproved":true,"ResponseCode":"000","AuthorizationCode":"TAS123","Tokens":[],...}

curl -X POST "$HPP_BASE/v1.4/PaymentAdministration/VoidPreauthorizeForToken" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "Token": { "TokenType": "201", "TokenValue": "371449551708431" },
    "Amount": 5000,
    "OriginalReferenceId": "c7b716bb-1234-5678-abcd-ef0123456789",
    "OriginalAmount": 5000,
    "TenderType": "Credit",
    "EntryMode": "ComputerOrder",
    "ExpirationDate": "1240",
    "RequestExpirationUTC": "2026-07-15T12:05:00.000Z"
  }'

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "APPROVAL",
            "HostResponseCode": "00",
            "HostType": 1,
            "AuthorizationCode": "TAS123",
            "AuditId": 123456,
            "ApprovedAmount": 5000,
            "BusinessTransactionDate": "2026-07-15T12:05:00.000Z",
            "CardType": "Visa",
            "MerchantID": "MERCH001",
            "NetworkID": "NET01",
            "RetrievalReferenceNumber": "123456789012",
            "StoreNumber": 1
          }

async function voidPreauthorizeForToken(tokenValue, amount, originalReferenceId, expiry) {
  const body = {
    Token: { TokenType: '201', TokenValue: tokenValue },
    Amount: amount, OriginalReferenceId: originalReferenceId,
    OriginalAmount: amount, TenderType: 'Credit', EntryMode: 'ComputerOrder',
    ExpirationDate: expiry,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString()
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/PaymentAdministration/VoidPreauthorizeForToken`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsApproved, ResponseCode, ResponseMessage, HostResponseCode, HostType,
//             AuthorizationCode, AuditId, ApprovedAmount, CardType, MerchantID, ... }

def void_preauthorize_for_token(token_value: str, amount: int,
                                original_ref: str, expiry: str) -> dict:
    body = {
        "Token": {"TokenType": "201", "TokenValue": token_value},
        "Amount": amount, "OriginalReferenceId": original_ref,
        "OriginalAmount": amount, "TenderType": "Credit",
        "EntryMode": "ComputerOrder", "ExpirationDate": expiry,
        "RequestExpirationUTC": utc_plus(5)
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/PaymentAdministration/VoidPreauthorizeForToken",
        headers=signed_headers(body), json=body)
    r.raise_for_status()
    return r.json()
# Response: {"IsApproved": True, "ResponseCode": "000", "AuthorizationCode": "TAS123", ...}

var body = new {
    Token = new { TokenType = "201", TokenValue = tokenValue },
    Amount = amount, OriginalReferenceId = originalReferenceId,
    OriginalAmount = amount, TenderType = "Credit", EntryMode = "ComputerOrder",
    ExpirationDate = expiry,
    RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o")
};
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/PaymentAdministration/VoidPreauthorizeForToken", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { IsApproved, ResponseCode, ResponseMessage, AuthorizationCode, ApprovedAmount, ... }

String json = String.format(
    "{\"Token\":{\"TokenType\":\"201\",\"TokenValue\":\"%s\"}," +
    "\"Amount\":%d,\"OriginalReferenceId\":\"%s\",\"OriginalAmount\":%d," +
    "\"TenderType\":\"Credit\",\"EntryMode\":\"ComputerOrder\"," +
    "\"ExpirationDate\":\"%s\",\"RequestExpirationUTC\":\"%s\"}",
    tokenValue, amount, originalRefId, amount, expiry, Instant.now().plusSeconds(300));
HttpRequest req = buildSignedRequest(
    "/v1.4/PaymentAdministration/VoidPreauthorizeForToken", json);
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsApproved":true,"ResponseCode":"000","AuthorizationCode":"TAS123",...}

curl -X POST "$HPP_BASE/v1.4/PaymentAdministration/CompleteAuthorizationForToken" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "Token": { "TokenType": "201", "TokenValue": "371449551708431" },
    "Amount": 4800,
    "OriginalReferenceId": "c7b716bb-1234-5678-abcd-ef0123456789",
    "OriginalAmount": 5000,
    "TenderType": "Credit",
    "EntryMode": "ComputerOrder",
    "ExpirationDate": "1240",
    "RequestExpirationUTC": "2026-07-15T12:05:00.000Z"
  }'

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "APPROVAL",
            "HostResponseCode": "00",
            "HostType": 1,
            "AuthorizationCode": "TAS123",
            "AuditId": 123456,
            "ApprovedAmount": 4800,
            "BusinessTransactionDate": "2026-07-15T12:05:00.000Z",
            "CardType": "Visa",
            "HostRetrievalNumber": "123456789012",
            "MerchantID": "MERCH001",
            "NetworkID": "NET01",
            "RetrievalReferenceNumber": "123456789012",
            "StoreNumber": 1
          }

async function completeAuthForToken(tokenValue, amount, originalReferenceId,
                                    originalAmount, expiry) {
  const body = {
    Token: { TokenType: '201', TokenValue: tokenValue },
    Amount: amount, OriginalReferenceId: originalReferenceId,
    OriginalAmount: originalAmount, TenderType: 'Credit', EntryMode: 'ComputerOrder',
    ExpirationDate: expiry,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString()
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/PaymentAdministration/CompleteAuthorizationForToken`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsApproved, ResponseCode, ResponseMessage, HostResponseCode, HostType,
//             AuthorizationCode, AuditId, ApprovedAmount, CardType, MerchantID, ... }

def complete_auth_for_token(token_value: str, amount: int, original_ref: str,
                            original_amount: int, expiry: str) -> dict:
    body = {
        "Token": {"TokenType": "201", "TokenValue": token_value},
        "Amount": amount, "OriginalReferenceId": original_ref,
        "OriginalAmount": original_amount, "TenderType": "Credit",
        "EntryMode": "ComputerOrder", "ExpirationDate": expiry,
        "RequestExpirationUTC": utc_plus(5)
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/PaymentAdministration/CompleteAuthorizationForToken",
        headers=signed_headers(body), json=body)
    r.raise_for_status()
    return r.json()
# Response: {"IsApproved": True, "ResponseCode": "000", "AuthorizationCode": "TAS123", ...}

var body = new {
    Token = new { TokenType = "201", TokenValue = tokenValue },
    Amount = amount, OriginalReferenceId = originalReferenceId,
    OriginalAmount = originalAmount, TenderType = "Credit", EntryMode = "ComputerOrder",
    ExpirationDate = expiry,
    RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o")
};
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/PaymentAdministration/CompleteAuthorizationForToken", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { IsApproved, ResponseCode, ResponseMessage, AuthorizationCode, ApprovedAmount, ... }

String json = String.format(
    "{\"Token\":{\"TokenType\":\"201\",\"TokenValue\":\"%s\"}," +
    "\"Amount\":%d,\"OriginalReferenceId\":\"%s\",\"OriginalAmount\":%d," +
    "\"TenderType\":\"Credit\",\"EntryMode\":\"ComputerOrder\"," +
    "\"ExpirationDate\":\"%s\",\"RequestExpirationUTC\":\"%s\"}",
    tokenValue, amount, originalRefId, originalAmount, expiry, Instant.now().plusSeconds(300));
HttpRequest req = buildSignedRequest(
    "/v1.4/PaymentAdministration/CompleteAuthorizationForToken", json);
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsApproved":true,"ResponseCode":"000","AuthorizationCode":"TAS123",...}

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "Approved",
            "HostResponseCode": "00",
            "HostType": 1,
            "AuthorizationCode": "AUTH12",
            "HostRetrievalNumber": "123456",
            "RetrievalReferenceNumber": "RRN-001",
            "CardType": { "Type": "Credit", "Name": "Visa" },
            "AuditId": 42,
            "StoreNumber": 190
          }

curl -X POST "$HPP_BASE/v1.4/PaymentAdministration/VoidCompleteAuthorizationForToken" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "Token": { "TokenType": "201", "TokenValue": "371449551708431" },
    "Amount": 4800,
    "OriginalReferenceId": "c7b716bb-1234-5678-abcd-ef0123456789",
    "OriginalAmount": 5000,
    "TenderType": "Credit",
    "EntryMode": "ComputerOrder",
    "ExpirationDate": "1240",
    "RequestExpirationUTC": "2026-07-15T12:05:00.000Z"
  }'

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "APPROVAL",
            "HostResponseCode": "00",
            "HostType": 1,
            "AuthorizationCode": "TAS123",
            "AuditId": 123456,
            "ApprovedAmount": 4800,
            "BusinessTransactionDate": "2026-07-15T12:05:00.000Z",
            "CardType": "Visa",
            "MerchantID": "MERCH001",
            "NetworkID": "NET01",
            "RetrievalReferenceNumber": "123456789012",
            "StoreNumber": 1
          }

async function voidCompleteAuthForToken(tokenValue, amount, originalReferenceId,
                                        originalAmount, expiry) {
  const body = {
    Token: { TokenType: '201', TokenValue: tokenValue },
    Amount: amount, OriginalReferenceId: originalReferenceId,
    OriginalAmount: originalAmount, TenderType: 'Credit', EntryMode: 'ComputerOrder',
    ExpirationDate: expiry,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString()
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/PaymentAdministration/VoidCompleteAuthorizationForToken`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsApproved, ResponseCode, ResponseMessage, HostResponseCode, HostType,
//             AuthorizationCode, AuditId, ApprovedAmount, CardType, MerchantID, ... }

def void_complete_auth_for_token(token_value: str, amount: int, original_ref: str,
                                 original_amount: int, expiry: str) -> dict:
    body = {
        "Token": {"TokenType": "201", "TokenValue": token_value},
        "Amount": amount, "OriginalReferenceId": original_ref,
        "OriginalAmount": original_amount, "TenderType": "Credit",
        "EntryMode": "ComputerOrder", "ExpirationDate": expiry,
        "RequestExpirationUTC": utc_plus(5)
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/PaymentAdministration/VoidCompleteAuthorizationForToken",
        headers=signed_headers(body), json=body)
    r.raise_for_status()
    return r.json()
# Response: {"IsApproved": True, "ResponseCode": "000", "AuthorizationCode": "TAS123", ...}

var body = new {
    Token = new { TokenType = "201", TokenValue = tokenValue },
    Amount = amount, OriginalReferenceId = originalReferenceId,
    OriginalAmount = originalAmount, TenderType = "Credit", EntryMode = "ComputerOrder",
    ExpirationDate = expiry,
    RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o")
};
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/PaymentAdministration/VoidCompleteAuthorizationForToken", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { IsApproved, ResponseCode, ResponseMessage, AuthorizationCode, ApprovedAmount, ... }

String json = String.format(
    "{\"Token\":{\"TokenType\":\"201\",\"TokenValue\":\"%s\"}," +
    "\"Amount\":%d,\"OriginalReferenceId\":\"%s\",\"OriginalAmount\":%d," +
    "\"TenderType\":\"Credit\",\"EntryMode\":\"ComputerOrder\"," +
    "\"ExpirationDate\":\"%s\",\"RequestExpirationUTC\":\"%s\"}",
    tokenValue, amount, originalRefId, originalAmount, expiry, Instant.now().plusSeconds(300));
HttpRequest req = buildSignedRequest(
    "/v1.4/PaymentAdministration/VoidCompleteAuthorizationForToken", json);
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsApproved":true,"ResponseCode":"000","AuthorizationCode":"TAS123",...}

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "Approved",
            "HostResponseCode": "00",
            "HostType": 1,
            "AuthorizationCode": "AUTH12",
            "AuditId": 42,
            "StoreNumber": 190
          }

curl -X POST "$HPP_BASE/v1.4/EncryptedPaymentAdministration/Purchase" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "AccountNumber": {
      "EncryptionType": "SessionKey",
      "EncryptionKeyId": "YOUR_KEY_ID",
      "EncryptionAlgorithm": "AES128",
      "EncryptionInitializationVector": "BASE64_IV==",
      "EncryptedValue": "BASE64_ENCRYPTED_PAN=="
    },
    "AccountSecurityCode": {
      "EncryptionType": "SessionKey",
      "EncryptionKeyId": "YOUR_KEY_ID",
      "EncryptionAlgorithm": "AES128",
      "EncryptionInitializationVector": "BASE64_IV==",
      "EncryptedValue": "BASE64_ENCRYPTED_CVV=="
    },
    "Amount": 2500,
    "TenderType": "Credit",
    "EntryMode": "ComputerOrder",
    "ExpirationDate": "1240",
    "RequestExpirationUTC": "2026-07-10T12:05:00.000Z"
  }'

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "APPROVAL",
            "HostResponseCode": "00",
            "HostType": 1,
            "VerificationMethod": "None",
            "AuthorizationCode": "TAS456",
            "AuditId": 234567,
            "BusinessTransactionDate": "2026-07-10T12:05:00.000Z",
            "CardType": "Visa",
            "HostRetrievalNumber": "234567890123",
            "MerchantID": "MERCH001",
            "NetworkID": "NET01",
            "RetrievalReferenceNumber": "234567890123",
            "StoreNumber": 1,
            "ApprovedAmount": 2500,
            "AccountNumberFirstSix": "411111",
            "AccountNumberLastFour": "1111",
            "Tokens": []
          }

async function encPurchase(encPan, encCvv, keyId, amount, expiry) {
  const encObj = (encVal) => ({
    EncryptionType: 'SessionKey', EncryptionKeyId: keyId,
    EncryptionAlgorithm: 'AES128',
    EncryptionInitializationVector: encVal.iv,
    EncryptedValue: encVal.data
  });
  const body = {
    AccountNumber: encObj(encPan), AccountSecurityCode: encObj(encCvv),
    Amount: amount, TenderType: 'Credit', EntryMode: 'ComputerOrder',
    ExpirationDate: expiry,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString()
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/EncryptedPaymentAdministration/Purchase`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsApproved, ResponseCode, ResponseMessage, HostResponseCode, HostType,
//             AuthorizationCode, AuditId, CardType, MerchantID, Tokens, ... }

def enc_obj(encrypted_value: str, iv: str, key_id: str) -> dict:
    return {"EncryptionType": "SessionKey", "EncryptionKeyId": key_id,
            "EncryptionAlgorithm": "AES128",
            "EncryptionInitializationVector": iv, "EncryptedValue": encrypted_value}

def enc_purchase(enc_pan, enc_cvv, key_id: str, amount: int, expiry: str) -> dict:
    body = {
        "AccountNumber": enc_obj(enc_pan["data"], enc_pan["iv"], key_id),
        "AccountSecurityCode": enc_obj(enc_cvv["data"], enc_cvv["iv"], key_id),
        "Amount": amount, "TenderType": "Credit", "EntryMode": "ComputerOrder",
        "ExpirationDate": expiry, "RequestExpirationUTC": utc_plus(5)
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/EncryptedPaymentAdministration/Purchase",
        headers=signed_headers(body), json=body)
    r.raise_for_status(); return r.json()
# Response: {"IsApproved": True, "ResponseCode": "000", "AuthorizationCode": "TAS456", ...}

object EncObj(string val, string iv, string kid) => new {
    EncryptionType = "SessionKey", EncryptionKeyId = kid,
    EncryptionAlgorithm = "AES128",
    EncryptionInitializationVector = iv, EncryptedValue = val };
var body = new {
    AccountNumber = EncObj(encPan, panIv, keyId),
    AccountSecurityCode = EncObj(encCvv, cvvIv, keyId),
    Amount = amount, TenderType = "Credit", EntryMode = "ComputerOrder",
    ExpirationDate = expiry,
    RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o")
};
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/EncryptedPaymentAdministration/Purchase", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { IsApproved, ResponseCode, ResponseMessage, AuthorizationCode, Tokens, ... }

// Use a JSON library (e.g. Jackson) to build the encrypted payload
ObjectNode body = mapper.createObjectNode();
body.set("AccountNumber", encryptedField(encPan, panIv, keyId));
body.set("AccountSecurityCode", encryptedField(encCvv, cvvIv, keyId));
body.put("Amount", amount).put("TenderType", "Credit")
    .put("EntryMode", "ComputerOrder").put("ExpirationDate", expiry)
    .put("RequestExpirationUTC", Instant.now().plusSeconds(300).toString());
HttpRequest req = buildSignedRequest(
    "/v1.4/EncryptedPaymentAdministration/Purchase", mapper.writeValueAsString(body));
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsApproved":true,"ResponseCode":"000","AuthorizationCode":"TAS456",...}

curl -X POST "$HPP_BASE/v1.4/EncryptedPaymentAdministration/VoidPurchase" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "Amount": 2500,
    "OriginalReferenceId": "c7b716bb-1234-5678-abcd-ef0123456789",
    "RequestExpirationUTC": "2026-07-10T12:05:00.000Z",
    "OriginalAmount": 2500,
    "OriginalApprovalCode": "TAS456",
    "OriginalAuditId": 234567,
    "OriginalBusinessTransactionDate": "2026-07-10T12:00:00.000Z",
    "OriginalHostResponseCode": "00",
    "OriginalRetrievalReferenceNumber": "234567890123"
  }'

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "APPROVAL",
            "HostResponseCode": "00",
            "HostType": 1,
            "VerificationMethod": "None",
            "AuthorizationCode": "TAS456",
            "AuditId": 234568,
            "BusinessTransactionDate": "2026-07-10T12:06:00.000Z",
            "CardType": "Visa",
            "MerchantID": "MERCH001",
            "StoreNumber": 1
          }

async function encVoidPurchase(originalReferenceId, amount, originalData) {
  const body = {
    Amount: amount,
    OriginalReferenceId: originalReferenceId,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString(),
    OriginalAmount: originalData.amount,
    OriginalApprovalCode: originalData.approvalCode,
    OriginalAuditId: originalData.auditId,
    OriginalBusinessTransactionDate: originalData.businessDate,
    OriginalHostResponseCode: originalData.hostResponseCode,
    OriginalRetrievalReferenceNumber: originalData.retrievalReferenceNumber
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/EncryptedPaymentAdministration/VoidPurchase`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsApproved, ResponseCode, ResponseMessage, HostResponseCode, HostType,
//             VerificationMethod, AuthorizationCode, AuditId, CardType, ... }

def enc_void_purchase(original_ref: str, amount: int, original_data: dict) -> dict:
    body = {
        "Amount": amount,
        "OriginalReferenceId": original_ref,
        "RequestExpirationUTC": utc_plus(5),
        "OriginalAmount": original_data["amount"],
        "OriginalApprovalCode": original_data["approval_code"],
        "OriginalAuditId": original_data["audit_id"],
        "OriginalBusinessTransactionDate": original_data["business_date"],
        "OriginalHostResponseCode": original_data["host_response_code"],
        "OriginalRetrievalReferenceNumber": original_data["retrieval_ref"]
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/EncryptedPaymentAdministration/VoidPurchase",
        headers=signed_headers(body), json=body)
  r.raise_for_status(); return r.json()
# Response: {"IsApproved": True, "ResponseCode": "000", "VerificationMethod": "None", "AuthorizationCode": "TAS456", ...}

var body = new {
    Amount = amount,
    OriginalReferenceId = originalReferenceId,
    RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o"),
    OriginalAmount = originalAmount,
    OriginalApprovalCode = originalApprovalCode,
    OriginalAuditId = originalAuditId,
    OriginalBusinessTransactionDate = originalBusinessDate,
    OriginalHostResponseCode = originalHostResponseCode,
    OriginalRetrievalReferenceNumber = originalRetrievalRef
};
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/EncryptedPaymentAdministration/VoidPurchase", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { IsApproved, ResponseCode, ResponseMessage, VerificationMethod, AuthorizationCode, ... }

ObjectNode body = mapper.createObjectNode();
body.put("Amount", amount)
    .put("OriginalReferenceId", originalReferenceId)
    .put("RequestExpirationUTC", Instant.now().plusSeconds(300).toString())
    .put("OriginalAmount", originalAmount)
    .put("OriginalApprovalCode", originalApprovalCode)
    .put("OriginalAuditId", originalAuditId)
    .put("OriginalBusinessTransactionDate", originalBusinessDate)
    .put("OriginalHostResponseCode", originalHostResponseCode)
    .put("OriginalRetrievalReferenceNumber", originalRetrievalRef);
HttpRequest req = buildSignedRequest(
    "/v1.4/EncryptedPaymentAdministration/VoidPurchase", mapper.writeValueAsString(body));
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsApproved":true,"ResponseCode":"000","VerificationMethod":"None","AuthorizationCode":"TAS456",...}

curl -X POST "$HPP_BASE/v1.4/EncryptedPaymentAdministration/Refund" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "AccountNumber": {
      "EncryptionType": "SessionKey",
      "EncryptionKeyId": "YOUR_KEY_ID",
      "EncryptionAlgorithm": "AES128",
      "EncryptionInitializationVector": "BASE64_IV==",
      "EncryptedValue": "BASE64_ENCRYPTED_PAN=="
    },
    "Amount": 2500,
    "RequestExpirationUTC": "2026-07-10T12:05:00.000Z",
    "TenderType": "Credit",
    "EntryMode": "ComputerOrder",
    "ExpirationDate": "1240"
  }'

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "APPROVAL",
            "HostResponseCode": "00",
            "HostType": 1,
            "AuthorizationCode": "REF789",
            "AuditId": 345678,
            "BusinessTransactionDate": "2026-07-10T12:05:00.000Z",
            "CardType": "Visa",
            "MerchantID": "MERCH001",
            "StoreNumber": 1,
            "ApprovedAmount": 2500,
            "AccountNumberFirstSix": "411111",
            "AccountNumberLastFour": "1111",
            "Tokens": []
          }

async function encRefund(encPan, keyId, amount, expiry) {
  const body = {
    AccountNumber: { EncryptionType: 'SessionKey', EncryptionKeyId: keyId,
      EncryptionAlgorithm: 'AES128',
      EncryptionInitializationVector: encPan.iv, EncryptedValue: encPan.data },
    Amount: amount, TenderType: 'Credit', EntryMode: 'ComputerOrder',
    ExpirationDate: expiry,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString()
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/EncryptedPaymentAdministration/Refund`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsApproved, ResponseCode, ResponseMessage, HostResponseCode, HostType,
//             AuthorizationCode, AuditId, ApprovedAmount, Tokens, ... }

def enc_refund(enc_pan, key_id: str, amount: int, expiry: str) -> dict:
    body = {
        "AccountNumber": enc_obj(enc_pan["data"], enc_pan["iv"], key_id),
        "Amount": amount, "TenderType": "Credit", "EntryMode": "ComputerOrder",
        "ExpirationDate": expiry, "RequestExpirationUTC": utc_plus(5)
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/EncryptedPaymentAdministration/Refund",
        headers=signed_headers(body), json=body)
    r.raise_for_status(); return r.json()
# Response: {"IsApproved": True, "ResponseCode": "000", "ApprovedAmount": 2500, ...}

var body = new {
    AccountNumber = EncObj(encPan, panIv, keyId),
    Amount = amount, TenderType = "Credit", EntryMode = "ComputerOrder",
    ExpirationDate = expiry,
    RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o")
};
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/EncryptedPaymentAdministration/Refund", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { IsApproved, ResponseCode, ResponseMessage, AuthorizationCode, ApprovedAmount, Tokens, ... }

ObjectNode body = mapper.createObjectNode();
body.set("AccountNumber", encryptedField(encPan, panIv, keyId));
body.put("Amount", amount).put("TenderType", "Credit")
    .put("EntryMode", "ComputerOrder").put("ExpirationDate", expiry)
    .put("RequestExpirationUTC", Instant.now().plusSeconds(300).toString());
HttpRequest req = buildSignedRequest(
    "/v1.4/EncryptedPaymentAdministration/Refund", mapper.writeValueAsString(body));
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsApproved":true,"ResponseCode":"000","ApprovedAmount":2500,...}

curl -X POST "$HPP_BASE/v1.4/EncryptedPaymentAdministration/VoidRefund" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "Amount": 2500,
    "RequestExpirationUTC": "2026-07-10T12:05:00.000Z",
    "OriginalReferenceId": "c7b716bb-1234-5678-abcd-ef0123456789",
    "OriginalAmount": 2500,
    "OriginalAuthorizationCode": "REF789",
    "OriginalAuditId": 345678,
    "OriginalDateTimeUTC": "2026-07-10T12:00:00.0000000Z",
    "OriginalHostResponseCode": "00",
    "OriginalRetrievalReferenceNumber": "345678901234"
  }'

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "APPROVAL",
            "HostResponseCode": "00",
            "HostType": 1,
            "VerificationMethod": "None",
            "AuthorizationCode": "REF789",
            "AuditId": 345679,
            "BusinessTransactionDate": "2026-07-10T12:06:00.000Z",
            "CardType": "Visa",
            "MerchantID": "MERCH001",
            "StoreNumber": 1
          }

async function encVoidRefund(originalReferenceId, amount, originalData) {
  const body = {
    Amount: amount,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString(),
    OriginalReferenceId: originalReferenceId,
    OriginalAmount: originalData.amount,
    OriginalAuthorizationCode: originalData.authorizationCode,
    OriginalAuditId: originalData.auditId,
    OriginalDateTimeUTC: originalData.dateTimeUTC,
    OriginalHostResponseCode: originalData.hostResponseCode,
    OriginalRetrievalReferenceNumber: originalData.retrievalReferenceNumber
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/EncryptedPaymentAdministration/VoidRefund`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsApproved, ResponseCode, ResponseMessage, HostResponseCode, HostType,
//             VerificationMethod, AuthorizationCode, AuditId, CardType, ... }

def enc_void_refund(original_ref: str, amount: int, original_data: dict) -> dict:
    body = {
        "Amount": amount,
        "RequestExpirationUTC": utc_plus(5),
        "OriginalReferenceId": original_ref,
        "OriginalAmount": original_data["amount"],
        "OriginalAuthorizationCode": original_data["authorization_code"],
        "OriginalAuditId": original_data["audit_id"],
        "OriginalDateTimeUTC": original_data["date_time_utc"],
        "OriginalHostResponseCode": original_data["host_response_code"],
        "OriginalRetrievalReferenceNumber": original_data["retrieval_ref"]
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/EncryptedPaymentAdministration/VoidRefund",
        headers=signed_headers(body), json=body)
    r.raise_for_status(); return r.json()
# Response: {"IsApproved": True, "ResponseCode": "000", "VerificationMethod": "None", ...}

var body = new {
    Amount = amount,
    RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o"),
    OriginalReferenceId = originalReferenceId,
    OriginalAmount = originalAmount,
    OriginalAuthorizationCode = originalAuthorizationCode,
    OriginalAuditId = originalAuditId,
    OriginalDateTimeUTC = originalDateTimeUTC,
    OriginalHostResponseCode = originalHostResponseCode,
    OriginalRetrievalReferenceNumber = originalRetrievalRef
};
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/EncryptedPaymentAdministration/VoidRefund", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { IsApproved, ResponseCode, ResponseMessage, VerificationMethod, AuthorizationCode, ... }

ObjectNode body = mapper.createObjectNode();
body.put("Amount", amount)
    .put("RequestExpirationUTC", Instant.now().plusSeconds(300).toString())
    .put("OriginalReferenceId", originalReferenceId)
    .put("OriginalAmount", originalAmount)
    .put("OriginalAuthorizationCode", originalAuthorizationCode)
    .put("OriginalAuditId", originalAuditId)
    .put("OriginalDateTimeUTC", originalDateTimeUTC)
    .put("OriginalHostResponseCode", originalHostResponseCode)
    .put("OriginalRetrievalReferenceNumber", originalRetrievalRef);
HttpRequest req = buildSignedRequest(
    "/v1.4/EncryptedPaymentAdministration/VoidRefund", mapper.writeValueAsString(body));
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsApproved":true,"ResponseCode":"000","VerificationMethod":"None","AuthorizationCode":"REF789",...}

curl -X POST "$HPP_BASE/v1.4/EncryptedPaymentAdministration/Preauthorize" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \
  -H "X-Signature: $SIGNATURE" \
  -d '{
    "Amount": 10000,
    "RequestExpirationUTC": "2026-07-10T12:05:00.000Z",
    "EntryMode": "ComputerOrder",
    "ExpirationDate": "1240",
    "AccountNumber": {
      "EncryptionType": "SessionKey",
      "EncryptionKeyId": "YOUR_KEY_ID",
      "EncryptionAlgorithm": "AES128",
      "EncryptionInitializationVector": "BASE64_IV==",
      "EncryptedValue": "BASE64_ENCRYPTED_PAN=="
    },
    "TenderType": "Credit"
  }'

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "APPROVAL",
            "HostResponseCode": "00",
            "HostType": 1,
            "VerificationMethod": "None",
            "ApprovedAmount": 10000,
            "AuthorizationCode": "AUTH001",
            "AuditId": 456789,
            "BusinessTransactionDate": "2026-07-10T12:05:00.000Z",
            "CardType": "Visa",
            "AccountNumberFirstSix": "411111",
            "AccountNumberLastFour": "1111",
            "HostRetrievalNumber": "456789012345",
            "MerchantID": "MERCH001",
            "NetworkID": "NET01",
            "RetrievalReferenceNumber": "456789012345",
            "StoreNumber": 1,
            "Tokens": []
          }

async function encPreauthorize(encPan, keyId, amount, expiry) {
  const body = {
    Amount: amount,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString(),
    EntryMode: 'ComputerOrder',
    ExpirationDate: expiry,
    AccountNumber: { EncryptionType: 'SessionKey', EncryptionKeyId: keyId,
      EncryptionAlgorithm: 'AES128',
      EncryptionInitializationVector: encPan.iv, EncryptedValue: encPan.data },
    TenderType: 'Credit'
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/EncryptedPaymentAdministration/Preauthorize`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsApproved, ResponseCode, ResponseMessage, HostResponseCode, HostType,
//             VerificationMethod, AuthorizationCode, AuditId, ApprovedAmount, Tokens, ... }

def enc_preauthorize(enc_pan, key_id: str, amount: int, expiry: str) -> dict:
    body = {
        "Amount": amount,
        "RequestExpirationUTC": utc_plus(5),
        "EntryMode": "ComputerOrder",
        "ExpirationDate": expiry,
        "AccountNumber": enc_obj(enc_pan["data"], enc_pan["iv"], key_id),
        "TenderType": "Credit"
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/EncryptedPaymentAdministration/Preauthorize",
        headers=signed_headers(body), json=body)
    r.raise_for_status(); return r.json()
# Response: {"IsApproved": True, "ResponseCode": "000", "VerificationMethod": "None",
#            "AuthorizationCode": "AUTH001", "ApprovedAmount": 10000, ...}

var body = new {
    Amount = amount,
    RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o"),
    EntryMode = "ComputerOrder",
    ExpirationDate = expiry,
    AccountNumber = EncObj(encPan, panIv, keyId),
    TenderType = "Credit"
};
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/EncryptedPaymentAdministration/Preauthorize", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { IsApproved, ResponseCode, VerificationMethod, AuthorizationCode, ApprovedAmount, Tokens, ... }

ObjectNode body = mapper.createObjectNode();
body.put("Amount", amount)
    .put("RequestExpirationUTC", Instant.now().plusSeconds(300).toString())
    .put("EntryMode", "ComputerOrder")
    .put("ExpirationDate", expiry)
    .put("TenderType", "Credit");
body.set("AccountNumber", encryptedField(encPan, panIv, keyId));
HttpRequest req = buildSignedRequest(
    "/v1.4/EncryptedPaymentAdministration/Preauthorize", mapper.writeValueAsString(body));
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsApproved":true,"ResponseCode":"000","VerificationMethod":"None","AuthorizationCode":"AUTH001",...}

curl -X POST "$HPP_BASE/v1.4/EncryptedPaymentAdministration/VoidPreauthorization" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \  -H "X-Signature: $SIGNATURE" \
  -d '{
    "Amount": 10000,
    "RequestExpirationUTC": "2026-07-10T12:05:00.000Z",
    "OriginalReferenceId": "c7b716bb-1234-5678-abcd-ef0123456789",
    "OriginalAmount": 10000,
    "OriginalAuthorizationCode": "AUTH001",
    "OriginalAuditId": 456789,
    "OriginalDateTimeUTC": "2026-07-10T12:00:00.0000000Z"
  }'

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "APPROVAL",
            "HostResponseCode": "00",
            "HostType": 1,
            "VerificationMethod": "None",
            "AuthorizationCode": "AUTH001",
            "AuditId": 456790,
            "BusinessTransactionDate": "2026-07-10T12:06:00.000Z",
            "CardType": "Visa",
            "MerchantID": "MERCH001",
            "StoreNumber": 1
          }

async function encVoidPreauthorization(originalReferenceId, amount, originalData) {
  const body = {
    Amount: amount,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString(),
    OriginalReferenceId: originalReferenceId,
    OriginalAmount: originalData.amount,
    OriginalAuthorizationCode: originalData.authorizationCode,
    OriginalAuditId: originalData.auditId,
    OriginalDateTimeUTC: originalData.dateTimeUTC
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/EncryptedPaymentAdministration/VoidPreauthorization`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsApproved, ResponseCode, ResponseMessage, HostResponseCode, HostType,
//             VerificationMethod, AuthorizationCode, AuditId, CardType, ... }

def enc_void_preauthorization(original_ref: str, amount: int, original_data: dict) -> dict:
    body = {
        "Amount": amount,
        "RequestExpirationUTC": utc_plus(5),
        "OriginalReferenceId": original_ref,
        "OriginalAmount": original_data["amount"],
        "OriginalAuthorizationCode": original_data["authorization_code"],
        "OriginalAuditId": original_data["audit_id"],
        "OriginalDateTimeUTC": original_data["date_time_utc"]
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/EncryptedPaymentAdministration/VoidPreauthorization",
        headers=signed_headers(body), json=body)
    r.raise_for_status(); return r.json()
# Response: {"IsApproved": True, "ResponseCode": "000", "VerificationMethod": "None", ...}

var body = new {
    Amount = amount,
    RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o"),
    OriginalReferenceId = originalReferenceId,
    OriginalAmount = originalAmount,
    OriginalAuthorizationCode = originalAuthorizationCode,
    OriginalAuditId = originalAuditId,
    OriginalDateTimeUTC = originalDateTimeUTC
};
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/EncryptedPaymentAdministration/VoidPreauthorization", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { IsApproved, ResponseCode, ResponseMessage, VerificationMethod, AuthorizationCode, ... }

ObjectNode body = mapper.createObjectNode();
body.put("Amount", amount)
    .put("RequestExpirationUTC", Instant.now().plusSeconds(300).toString())
    .put("OriginalReferenceId", originalReferenceId)
    .put("OriginalAmount", originalAmount)
    .put("OriginalAuthorizationCode", originalAuthorizationCode)
    .put("OriginalAuditId", originalAuditId)
    .put("OriginalDateTimeUTC", originalDateTimeUTC);
HttpRequest req = buildSignedRequest(
    "/v1.4/EncryptedPaymentAdministration/VoidPreauthorization", mapper.writeValueAsString(body));
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsApproved":true,"ResponseCode":"000","VerificationMethod":"None","AuthorizationCode":"AUTH001",...}

curl -X POST "$HPP_BASE/v1.4/EncryptedPaymentAdministration/CompleteAuthorization" \
  -H "Content-Type: application/json" \
  -H "X-CompanyNumber: YOUR_COMPANY" \
  -H "X-StoreNumber: YOUR_STORE" \
  -H "X-ReferenceId: A1B2C3D4E5F6789012345678901234AB" \  -H "X-Signature: $SIGNATURE" \
  -d '{
    "Amount": 9500,
    "RequestExpirationUTC": "2026-07-10T12:05:00.000Z",
    "OriginalReferenceId": "c7b716bb-1234-5678-abcd-ef0123456789",
    "OriginalAmount": 10000,
    "OriginalAuthorizationCode": "AUTH001",
    "OriginalAuditId": 456789,
    "OriginalDateTimeUTC": "2026-07-10T12:00:00.0000000Z"
  }'

{
            "IsApproved": true,
            "ResponseCode": "000",
            "ResponseMessage": "APPROVAL",
            "HostResponseCode": "00",
            "HostType": 1,
            "VerificationMethod": "None",
            "ApprovedAmount": 9500,
            "AuthorizationCode": "CAP002",
            "AuditId": 567890,
            "BusinessTransactionDate": "2026-07-10T12:05:00.000Z",
            "CardType": "Visa",
            "HostRetrievalNumber": "567890123456",
            "MerchantID": "MERCH001",
            "NetworkID": "NET01",
            "RetrievalReferenceNumber": "567890123456",
            "StoreNumber": 1,
            "Tokens": []
          }

async function encCompleteAuthorization(originalReferenceId, amount, originalData) {
  const body = {
    Amount: amount,
    RequestExpirationUTC: new Date(Date.now() + 5*60000).toISOString(),
    OriginalReferenceId: originalReferenceId,
    OriginalAmount: originalData.amount,
    OriginalAuthorizationCode: originalData.authorizationCode,
    OriginalAuditId: originalData.auditId,
    OriginalDateTimeUTC: originalData.dateTimeUTC
  };
  const res = await fetch(
    `${process.env.HPP_BASE}/v1.4/EncryptedPaymentAdministration/CompleteAuthorization`,
    { method: 'POST', headers: signedHeaders(body), body: JSON.stringify(body) });
  return res.json();
}
// Response: { IsApproved, ResponseCode, ResponseMessage, HostResponseCode, HostType,
//             VerificationMethod, AuthorizationCode, AuditId, ApprovedAmount, Tokens, ... }

def enc_complete_authorization(original_ref: str, amount: int, original_data: dict) -> dict:
    body = {
        "Amount": amount,
        "RequestExpirationUTC": utc_plus(5),
        "OriginalReferenceId": original_ref,
        "OriginalAmount": original_data["amount"],
        "OriginalAuthorizationCode": original_data["authorization_code"],
        "OriginalAuditId": original_data["audit_id"],
        "OriginalDateTimeUTC": original_data["date_time_utc"]
    }
    r = requests.post(
        f"{os.environ['HPP_BASE']}/v1.4/EncryptedPaymentAdministration/CompleteAuthorization",
        headers=signed_headers(body), json=body)
    r.raise_for_status(); return r.json()
# Response: {"IsApproved": True, "ResponseCode": "000", "VerificationMethod": "None", "ApprovedAmount": 9500, ...}

var body = new {
    Amount = amount,
    RequestExpirationUTC = DateTime.UtcNow.AddMinutes(5).ToString("o"),
    OriginalReferenceId = originalReferenceId,
    OriginalAmount = originalAmount,
    OriginalAuthorizationCode = originalAuthorizationCode,
    OriginalAuditId = originalAuditId,
    OriginalDateTimeUTC = originalDateTimeUTC
};
var req  = BuildRequest(HttpMethod.Post,
    "/v1.4/EncryptedPaymentAdministration/CompleteAuthorization", body);
var resp = await _http.SendAsync(req);
resp.EnsureSuccessStatusCode();
// Response: { IsApproved, ResponseCode, ResponseMessage, VerificationMethod, AuthorizationCode, ApprovedAmount, Tokens, ... }

ObjectNode body = mapper.createObjectNode();
body.put("Amount", amount)
    .put("RequestExpirationUTC", Instant.now().plusSeconds(300).toString())
    .put("OriginalReferenceId", originalReferenceId)
    .put("OriginalAmount", originalAmount)
    .put("OriginalAuthorizationCode", originalAuthorizationCode)
    .put("OriginalAuditId", originalAuditId)
    .put("OriginalDateTimeUTC", originalDateTimeUTC);
HttpRequest req = buildSignedRequest(
    "/v1.4/EncryptedPaymentAdministration/CompleteAuthorization", mapper.writeValueAsString(body));
return HTTP.send(req, HttpResponse.BodyHandlers.ofString()).body();
// Response: {"IsApproved":true,"ResponseCode":"000","VerificationMethod":"None","AuthorizationCode":"CAP002",...}