InStore Payment REST API

Go to Swagger for testing:

Introduction

Use the InStore Payment REST API to make payments easily and securely from a cash register/kiosk using an external payment terminal in wireless mode. With this API you can process sales and refunds.

Before integrating the REST API payment solution in your shop, you need an API Key for the staging and production environments. Contact Comercia to get your API Key.

Instore Payment API works with two architectures:

InStore Payment Service installed on Windows to use the various methods that point to localhost. The base URL will be “localhost:3000/”. You can use an HTTP connection.
InStore Payment Service installed on the payment device (e.g.: APOS A8) to use the various methods that point to a specific device. For this solution, you have to know the IP of the payment device, using the corresponding base URL (e.g.: “192.168.1.60:3000/”). You must use a secure HTTPS connection.

The InStore Payment API solution requires:

A payment device.
A Windows device if the solution used includes the InStore Payment Windows service.

These sequencing diagrams show how a full payment transaction works:

To facilitate integration, the InStore Payment API installed on the payment terminal allows you to run a payment simulation so you don’t have to depend on a real payment application and don’t need physical cards to check the full workflow.

This simulator is simply a series of screens that are shown directly in the InStore Payment API, so you don’t need an additional request. So, although by default the Comercia payment app will always be used, you can also use the simulator.

All methods are synchronous. You cannot initiate a second transaction if the first one has not been completed.

Call the HTTPS endpoints with a personalized certificate on Postman

To explain how to use secure HTTPS connections, we recommend the following using the Postman program as an example of an ECR cash register.

The problem:

When calling an HTTP endpoint, Postman normally checks the server certificate is valid and was generated by a known authority. When the server uses a personalized certificate, it isn’t detected as a known authority so, by default, the request is blocked and the following message shown:

Error: Unable to get local issuer certificate

Solution:

To initiate the request, you can disable certificate verification. Then, Postman will allow connections to any HTTPS, even if the certificate is unknown or not valid.

To disable verification, click on “settings” in the upper right corner: