MSU Unipay HPP Integration

MSU Unipay HPP Integration

AnyBiz SDK checkout uses the Hosted Payment Page (HPP) model.

Environment URLs (v1)

• API: https://entegrasyon.asseco-see.com.tr/msu/api/v2
• HPP base: https://entegrasyon.asseco-see.com.tr/chipcard/pay3d/

Core flow

1. Create SESSIONTOKEN via server-to-server POST.
2. Redirect browser to HPP_BASE/{sessionToken}.
3. Receive browser return payload on RETURNURL.
4. Receive merchant notification payload (MSU portal setting).
5. Verify status with QUERYTRANSACTION (authoritative).
6. Finalize seat hold to sold ticket only after verification.
7. Redirect user to a friendly website result page.

Return URL strategy

Use a fixed callback URL for MSU RETURNURL:

• https://api.anybiz.rs/api/events/sdk/msu/return (production)

Then configure website redirect per organization via SDK settings:

• SDK returnUrl (friendly page, for example https://merchant-a.com/payment-result)

In short:

• MSU Return URL -> backend callback endpoint (fixed API URL)
• SDK Return URL -> final user-facing destination after backend callback processing

Required request fields (SESSIONTOKEN)

• ACTION=SESSIONTOKEN
• MERCHANTUSER, MERCHANTPASSWORD, MERCHANT
• CUSTOMER, SESSIONTYPE=PAYMENTSESSION
• MERCHANTPAYMENTID (unique)
• AMOUNT, CURRENCY=RSD
• CUSTOMEREMAIL, CUSTOMERNAME, CUSTOMERPHONE
• RETURNURL
• ORDERITEMS (URL-encoded JSON)

Verification and integrity

• Browser return is not authoritative by itself.
• Always call QUERYTRANSACTION using PGTRANID or MERCHANTPAYMENTID.
• Validate SD_SHA512 where available:
  • SHA512(merchantPaymentId|customerId|sessionToken|responseCode|randomKey|secretKey)
• AnyBiz callback handlers accept both camelCase and MSU uppercase payload keys (for example merchantPaymentId/MERCHANTPAYMENTID, pgTranId/PGTRANID).
• Return callback is supported via POST and GET on /api/events/sdk/msu/return for provider compatibility.
• Backend callback endpoint redirects user to configured SDK Return URL, while preserving callback metadata (msuAccepted, responseCode, responseMsg, merchantPaymentId).

Error handling

• responseCode=00 means action approved.
• responseCode=99 means declined.
• Use errorCode (ERR1xxxx/ERR2xxxx) and responseMsg for diagnostics.
• Keep checkout finalize idempotent for retrying callbacks.

Configuration

Configure merchant credentials and endpoint URLs in AnyBiz Settings -> MSU.

Keep MSU Return URL as fixed callback endpoint (.../api/events/sdk/msu/return) unless explicitly instructed otherwise by AnyBiz support.