# First Data (Fiserv)

> First Data was a global payment technology company — merchant acquiring, card
> issuing processing, and the Internet Payment Gateway (IPG) — that merged into
> Fiserv in 2019. This is an independent API Evangelist profile of what remains of
> the First Data developer surface. The First Data Gateway (IPG) is still callable
> at prod.api.firstdata.com and still documented on Fiserv's portal as the IPGNA
> product; Payeezy has been dropped from that portal's sitemap; First Data and
> Payeezy gateway merchants have been directed to Fiserv Commerce Hub. This file
> was generated by API Evangelist from the artifacts in this repository, not
> published by First Data.

Generated: 2026-09-09
Method: generated
Source: apis.yml and the artifacts in this repository

## What an agent needs to know first

- The First Data Gateway publishes **no OpenAPI, GraphQL SDL, AsyncAPI, MCP server
  or A2A agent card** at any URL reachable without credentials. The operation
  surface below was read from the client libraries First Data itself published.
- Authentication is an `Api-Key` header plus a `Message-Signature` header carrying
  a base64 HMAC-SHA256 of `Api-Key + Client-Request-Id + Timestamp + body`, keyed
  on the API Secret. `Timestamp` is valid for 5 minutes.
- `Client-Request-Id` is required on every request and is the idempotency key.
  On a 409, a 5xx or a network timeout, **replay with the same
  `Client-Request-Id`** — a new one creates a second transaction.
- Credentials are not self-service. An API Key and API Secret are issued through
  merchant boarding.
- Default base URL in every First Data SDK is the **certification** host, not
  production.

## APIs

- [First Data Gateway (IPG) v2](https://developer.fiserv.com/product/IPGNA/): card,
  ACH and wallet transaction processing. Production
  `https://prod.api.firstdata.com/gateway/v2`, certification
  `https://cert.api.firstdata.com/gateway/v2`. API version 21.5.0.
- [Fiserv Developer Studio](https://developer.fiserv.com): where the surviving
  legacy First Data products (IPGNA, FirstVision APAC/EMEA/LATAM) are documented.

## Operation surface (First Data Gateway v2)

Payments — `POST /payments`, `POST /payments/{transaction-id}` (secondary),
`PATCH /payments/{transaction-id}` (3DS / UnionPay continuation),
`GET /payments/{transaction-id}`, plus the void and return secondary types.
Orders — `GET /orders/{order-id}`, `POST /orders/{order-id}`.
Payment schedules — `POST`, `GET`, `PATCH`, `DELETE /payment-schedules/{order-id}`.
Payment tokens — `POST`, `GET`, `PATCH`, `DELETE /payment-tokens/{token-id}`.
Hosted payment page — `POST`, `GET`, `DELETE /payment-url`.
Verification — `POST /card-verification`, `POST /account-verification`.
Lookup — `POST /card-information`, `POST /account-information`.
Currency — `POST /exchange-rates`.
Fraud — `POST /fraud/score-only`, `/fraud/client-registration`, `/fraud/payment-registration`.
Auth — `POST /authentication/access-tokens`.

## Artifacts in this profile

- [Authentication](authentication/first-data-authentication.yml): schemes, headers, HMAC signing recipe.
- [Conventions](conventions/first-data-conventions.yml): idempotency (coverage: full), reversibility, tracing, error envelope, regionalization.
- [Error catalog](errors/first-data-problem-types.yml): the nine documented HTTP statuses and what to do about each.
- [Decline codes](errors/first-data-decline-codes.yml): the decline envelope and result-state enumerations. The code registry is not public.
- [Lifecycle](lifecycle/first-data-lifecycle.yml): what is retired, what still answers, and the Q3-2025 gateway deprecation.
- [Sandbox](sandbox/first-data-sandbox.yml): the certification host and the one published test card.
- [Packages / SDKs](packages/first-data-packages.yml): six first-party gateway SDKs, all frozen at 2021-11-19.
- [Components](components/first-data-components.yml): Payment.js hosted fields, hosted payment page, wallet SDKs.
- [Conformance](conformance/first-data-conformance.yml): 3-D Secure, EMV, ACH, DCC, tokenization.
- [Well-known probe](well-known/first-data-well-known.yml): 144 probes across 12 hosts, zero documents.
- [Domain security](security/first-data-domain-security.yml): TLS, HSTS, SPF/DMARC.
- [Plans](plans/first-data-plans-pricing.yml) and [rate limits](rate-limits/first-data-rate-limits.yml): both contract-only, nothing published.

## Source code

- [GBSEcom](https://github.com/GBSEcom): First Data Gateway SDKs (Java, TypeScript, Python, Ruby, .NET, PHP), Payment.js integrations, wallet SDKs.
- [payeezy](https://github.com/payeezy): Payeezy gateway SDKs and samples.
- [firstdata](https://github.com/firstdata): Marketplace / PFAC demos.

## What does not exist

No MCP server. No A2A agent card. No `llms.txt`, `security.txt`, `api-catalog`,
`apis.json`, OpenID or OAuth discovery document on any First Data host. No public
status page — `status.firstdata.com` resolves to an inactive Statuspage. No
published rate limits and no published pricing. `docs.firstdata.com`, still cited
as the home page of the live PyPI and RubyGems packages, no longer resolves.