openapi: 3.2.0 info: version: 1.7.57 title: Shift4 Payment Credentials API contact: url: https://www.shift4.com/contact-us/ servers: - url: https://api.shift4test.com/api/rest/v1 description: Host Direct Test URL - url: https://api.shift4api.net/api/rest/v1 description: Host Direct Production URL tags: - name: Credentials paths: /credentials/accesstoken: servers: - url: https://api.shift4test.com/api/rest/v1 description: Host Direct Test URL - url: https://api.shift4api.net/api/rest/v1 description: Host Direct Production URL - url: https://192.168.1.10:277/api/rest/v1 description: Locally Installed UTG URL - url: https://192.168.1.20:8085/api/rest/v1 description: Commerce Engine For On Premise URL - url: https://api.shift4test.com/api/rest/v1 description: Commerce Engine For Cloud Test URL - url: https://api.shift4api.net/api/rest/v1 description: Commerce Engine For Cloud Production URL post: tags: - Credentials summary: Access Token Exchange operationId: accesstokenexchange security: - {} description: 'This function is used to request exchanging a Client GUID and Auth Token for an Access Token. **Integration Methods:** - Host Direct - Locally Installed UTG - Commerce Engine For On Premise - Commerce Engine For Cloud See the [Integration Methods](/guides/quickstart#integration-methods) and [URLs Section](/guides/quickstart#urls) sections of the Development Quick Start guide for details regarding each processing option. ' parameters: - $ref: '#/components/parameters/InterfaceVersion' - $ref: '#/components/parameters/InterfaceName' - $ref: '#/components/parameters/CompanyName' requestBody: required: true content: application/json: schema: required: - dateTime - credential properties: dateTime: $ref: '#/components/schemas/DateTime' credential: $ref: '#/components/schemas/Credential' responses: '200': description: AccessToken request was processed content: application/json: schema: properties: result: type: array items: type: object properties: dateTime: $ref: '#/components/schemas/DateTime' credential: type: object properties: accessToken: $ref: '#/components/schemas/CredentialAccessToken' server: $ref: '#/components/schemas/Server' '400': description: Error content: application/json: schema: properties: result: type: array items: type: object properties: error: $ref: '#/components/schemas/Error' server: $ref: '#/components/schemas/Server' examples: Error: $ref: '#/components/examples/AuthTokenNotValidError' '504': $ref: '#/components/responses/TimeoutResponse' components: schemas: Error: type: object properties: code: $ref: '#/components/schemas/ErrorCode' severity: $ref: '#/components/schemas/ErrorSeverity' shortText: $ref: '#/components/schemas/ErrorShortText' longText: $ref: '#/components/schemas/ErrorLongText' primaryCode: $ref: '#/components/schemas/ErrorPrimaryCode' secondaryCode: $ref: '#/components/schemas/ErrorSecondaryCode' CredentialClientGuid: type: string format: uuid maxLength: 51 example: A3B18F21-AD17-8416-0626C4C9F1CA86A7 writeOnly: true description: 'The Client GUID is a unique identifier that is used to identify an interface across all of the merchant accounts that use it. The same Client GUID can be used for all versions of the same interface. If a completely new interface is certified, then you will receive a new Client GUID, which must be hard coded into the application and must not be a configurable field. The Client GUID is required when making an [Access Token Exchange](/apis/payments-platform-rest/openapi/credentials/accesstokenexchange). For detailed information about the Client GUID, please see [Authentication](/guides/quickstart#access-token-exchange). **Requirement: The Client GUID supplied by your API Analyst must be hard coded into your application because it will permanently identify your interface across all merchant accounts.** ' ServerName: type: string maxLength: 50 example: TM01CE description: 'The name of the server that processed the request. ' CredentialApiSerialNumber: type: string maxLength: 10 example: '266' readOnly: true description: 'The serial number for the merchant account. This field is only used for backwards compatibility with older interfaces and has been replaced by the Access Token. ' ErrorSeverity: type: string enum: - Info - Error - Alert readOnly: true example: Info description: 'Severity level of the error. | Severity | Description | | -------- | ---------------------------------------------------------------- | | Info | Action not required - Data input/formatting is incorrect | | Error | Action may be required - Communication, timeout or network issue | | Alert | Action required - System issue | ' DateTime: type: string format: ISO 8601 example: '2024-05-21T09:18:23.283-07:00' description: 'The date and time in ISO 8601 format including the timezone offset (yyyy-mm-ddThh:mm:ss.nnn+hh:mm). Must be sent as the local date/time of the merchant. For example, a request processed at a merchant in the Pacific time zone at 9:18am on April 15th 2021 would be sent as 2021-04-15T09:18:23.283-07:00 ' Credential: type: object required: - authToken - clientGuid properties: accessToken: $ref: '#/components/schemas/CredentialAccessToken' authToken: $ref: '#/components/schemas/CredentialAuthToken' clientGuid: $ref: '#/components/schemas/CredentialClientGuid' apiSerialNumber: $ref: '#/components/schemas/CredentialApiSerialNumber' apiPassword: $ref: '#/components/schemas/CredentialApiPassword' ErrorLongText: type: string maxLength: 255 readOnly: true example: Card type not recognized description: 'Extended error message that is returned if an error condition exists. ' ErrorShortText: type: string maxLength: 16 readOnly: true example: NOT IN CARDRANGE description: 'Abbreviated error message that is always returned if an error condition exists ' LighthouseDataResponse: type: string example: eyJwYXltZW50SWQiOiI4NWM0MWNhNy01NzVjLTQzNGUtODIyZi0xYzZlOTE0ZDAzODYiLCJyZW1haW5pbmdBbW91bnQiOjB9 description: 'Base64 encoded JSON formatted data that will be returned from Lighthouse to be passed back to SkyTab. This data will contain variable information. ' ErrorPrimaryCode: type: integer maxLength: 4 readOnly: true example: 9842 description: 'Code indicating the type of error that occurred. Refer to the [Error Codes](/guides/appendices/error-codes) section of this document for more details. ' CredentialAccessToken: type: string format: uuid maxLength: 52 example: EA79FB05-3AA7-4500-AF9A-73F986FF2C1D readOnly: true description: 'A security credential used to authenticate API requests and all [i4Go®](https://s4-myportal.s3.amazonaws.com/downloads/documentation/i4go/i4go%20technical%20reference%20guide.pdf) authorizeClient/preauthorizeClient requests. An Access Token is the alias for the merchant account and interface being used. The Access Token is required in all requests except an [Access Token Exchange](/apis/payments-platform-rest/openapi/credentials/accesstokenexchange) request, which generates an Access Token using an `authToken` and `clientGuid`. ' ErrorCode: type: integer maxLength: 5 readOnly: true example: 64100 description: 'Code indicating the type of error that occurred. Refer to the [Error Codes](/guides/appendices/error-codes) section of this document for more details. **Note: This is currently only supported for European merchant processing.** ' CredentialApiPassword: type: string maxLength: 32 example: 9YCR23G7%BY#9+ readOnly: true description: 'A credential used to authenticate the API Serial Number when processing a request. This field is only used for backwards compatibility with older interfaces and has been replaced by the Access Token. ' CredentialAuthToken: type: string format: uuid maxLength: 51 example: 3504489F-A774-88E0-80114FBBC925E207 writeOnly: true description: 'A unique encrypted identifier that refers to a specific merchant account. It is required when making an [Access Token Exchange](/apis/payments-platform-rest/openapi/credentials/accesstokenexchange) request. For detailed information about the AuthToken, please see [Authentication](/guides/quickstart#access-token-exchange) ' ErrorSecondaryCode: type: integer maxLength: 4 readOnly: true example: 0 description: 'This code supplements the code specified in the `error.primaryCode` field to provide additional information about the error that occurred. ' Server: type: object readOnly: true properties: name: $ref: '#/components/schemas/ServerName' parameters: CompanyName: required: true name: CompanyName in: header schema: type: string maxLength: 26 example: PAWS description: 'Refers to the vendor or partner that designed and certified the interface. The information you use in this field should match what Shift4 has on file or what was agreed upon in your Integration Plan. The following special characters are not allowed: $ % : ^ - ~ ` < > , ? “ ” ‘ ’ { } [ ] \ + = ' InterfaceVersion: required: true name: InterfaceVersion in: header schema: type: string maxLength: 11 example: '2.1' description: 'Refers to the version of the program or application that is sending requests to Shift4. The following special characters are not allowed: $ % : ^ - ~ < > , ? “ ” ‘ ’ { } [ ] \ + = ' InterfaceName: required: true name: InterfaceName in: header schema: type: string maxLength: 25 example: ForwardPOS description: 'Refers to the name of the program or application that is sending requests to Shift4. This should be the name of the program that you purchased or created. The following special characters are not allowed: $ % : ^ - ~ ` < > , ? “ ” ‘ ’ { } [ ] \ + = ' examples: AuthTokenNotValidError: summary: AuthToken Not Valid value: result: - error: primaryCode: 9862 secondaryCode: 0 shortText: AuthToken longText: AuthToken not valid ENGINE01CE server: name: U2API01CE responses: TimeoutResponse: description: Timeout content: application/json: schema: properties: result: type: array items: type: object properties: error: $ref: '#/components/schemas/Error' lighthouse: type: object properties: data: $ref: '#/components/schemas/LighthouseDataResponse' server: $ref: '#/components/schemas/Server' example: result: - error: primaryCode: 9951 secondaryCode: 0 shortText: RESPONSE TIMEOUT longText: Timeout waiting for response across the internet lighthouse: data: eyJwYXltZW50SWQiOiI4NWM0MWNhNy01NzVjLTQzNGUtODIyZi0xYzZlOTE0ZDAzODYiLCJyZW1haW5pbmdBbW91bnQiOjB9 server: name: U2API01CE securitySchemes: AccessToken: type: apiKey name: AccessToken in: header description: "A security credential used to authenticate API requests and all [i4Go®](https://s4-myportal.s3.amazonaws.com/downloads/documentation/i4go/i4go%20technical%20reference%20guide.pdf) authorizeClient/preauthorizeClient requests. An Access Token is the alias for the merchant account and interface being used. \n\nExample:\n ```\n AccessToken: EA79FB05-3AA7-4500-AF9A-73F986FF2C1D\n ```\n" HMAC-SHA256: type: http scheme: hmac-sha256 description: "Authentication using HMAC-256 signatures as the authorization scheme.\n\nSent in the `Authorization` header in the following format:\n\n`Authorization`: **HMAC-SHA256** `Credential`={value}&`Signature`={value}\n\n| Argument | Description |\n|---------------|--------------------------------------------------|\n| HMAC-SHA256 | Authorization scheme. |\n| Credential | The ID of the key used to compute the signature. |\n| Signature | base64 encoded HMACSHA256 value. |\n\nExample: \n ```\n Authorization: HMAC-SHA256 Credential=AESKEY1&Signature=8SFtIc6zQlswxAZqDKXL+BpRmlDvIWyjOwU8wdl0zK4=\n ```\n"