---
title: "Create Transaction"
method: POST
path: "/transactions"
tags: ["Transaction Management"]
---

# Create Transaction

`POST /transactions`

Provide all required data to the Merchant/PSP to build a transaction authorization request.

In case of network token, the token PAN, expiry date and cryptogram are provided.

In case of PCI token, the card PAN and expiry date are provided.

## Headers

- `authorization` string, required
- `x-correlation-id` string, required

## Request body

- object
  - `tokenId` string, required — Identifier of the token
  - `transactionType` 'PURCHASE' | 'REFUND', required — Transaction type
  - `authentication` AuthenticationTransaction — Required only for Visa DAF.
    - `firstFactor` 'LOGIN_PASSWORD' | 'DEVICE_UNLOCK' | 'OTP_SMS' | 'OTP_EMAIL' | 'FIDO_BIOMETRIC' | 'FIDO_PASSCODE' | 'FIDO_NO_AUTH' | 'VISA_CTF_BINDING', required — First factor used to authenticate the card holder.
    - `secondFactor` 'LOGIN_PASSWORD' | 'DEVICE_UNLOCK' | 'OTP_SMS' | 'OTP_EMAIL' | 'FIDO_BIOMETRIC' | 'FIDO_PASSCODE' | 'FIDO_NO_AUTH' | 'VISA_CTF_BINDING' — Second factor used to authenticate the card holder as specified by Visa.
  - `visaSignedPayload` string — Required only for Visa CTF and Visa CTF with DAF. Set with the signature (JWT) generated by Thales ETP SDK.
  - `transactionData` TransactionData — Required only for Visa DAF. When transactionData is present, both amount and currencyCode must be specified.
    - `amount` number, float, required — The amount of the purchase order.
    - `currencyCode` string, required — ISO 4217 alphabetic currency code on 3 characters.
  - `device` DeviceTransaction — Required for Visa DAF only. deviceId and ipAddress are mandated. location is optional.
    - `deviceId` string — DEPRECATED! The unique device identifier. Visa deviceId must have 24 characters at maximum.
    - `ipAddress` string, required — The card holder's device IP address in format IPv4.
    - `location` string — The card holder's device location.</br> </br>Format requirements: * Latitude is between -90 and 90 degrees. * Longitude is between -180 and 180 degrees. * For positive value, the sign '+' shall not be provided. * Values are provided in decimal degrees with a precision of 4 decimal places. * Latitude and longitude are separated by a comma. * Spaces are not allowed. Examples: * '47.0880,2.3635' * '51.5306,-133.7224' * '-10.0000,-111.0000'
  - `cardholder` CardholderTransaction — Required for Visa DAF only.Information about the card holder.
    - `email` string, required — Card holder email address.
    - `billingAddress` CardholderBillingAddress — Card holder billing address.
      - `line1` string, required — Card holder address line 1.
      - `line2` string — Card holder address line 2.
      - `city` string, required — Card holder city.
      - `postalCode` string, required — Card holder postal code or zip code.
      - `country` string, required — Card holder country in ISO-3166-1 alpha-2 two-letter country code.
      - `subdivision` string — Card holder state or province code in ISO-3166-1 alpha-2 two-letter format.

## Response `201`

Created

- object
  - `transactionId` string, required — The unique transaction identifier.
  - `encryptedData` string, required — The payment credentials data encrypted in a JWE structure (see security section in the documentation). Once decrypted, the JWE plaintext contains the following JSON object: |JSON field parameter name|description|MOC|Length| |-------|-------|-------|-------| |dpan|The token PAN value provided for network token.|C|Up to 19| |exp|The token expiry date in the format MMYY provided for network token.|C|4| |cryptogram|The payment cryptogram to use with the token for a payment. Presence of the cryptogram depends on the transaction type and the scheme.|C|Up to 256| |fpan|The funding card PAN value. Only provided for PCI token.|C|Up to 19| |fpanExp|The funding card expiry date in the format MMYY. Only provided for PCI token.</li>|C|4| Example: {"dpan:"9580981500100002", "exp":"1222", "cryptogram": "45f8grzty7f4f5gs5s2c"}
  - `eci` string — The Electronic Commerce Indicator. Payment System-specific value to indicate the results of the attempt to authenticate the cardholder. Provided only for Visa & Mastercard SCOF.
  - `cryptogramExpiryDate` string — Cryptogram expiry date in ISO 8601. Provided for Visa only.
  - `isDAF` boolean — If present and set to 'true', VISA confirms it is a Digital Authentication Framework transaction. Can be present only if the transaction type is 'VISA_DAF'.

## Other responses

- `400` — Bad request - Not Retryable
- `401` — Unauthorized - Not Retryable
- `404` — Not Found - Not Retryable
- `429` — Too Many Requests - Retryable
- `500` — Internal Server Error Retry possible
- `503` — Service Unavailable Retry possible

---

[API](https://skmtc.net/thalescloud/apis/d1-oauth-api.md) · [All operations](https://skmtc.net/thalescloud/apis/d1-oauth-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/thalescloud/d1-oauth-api/revisions/96089514858c/schema)