---
title: "Initiate a Vipps payment"
method: POST
path: "/api/v2/transactions/vipps"
tags: ["Ecom Payments"]
---

# Initiate a Vipps payment

`POST /api/v2/transactions/vipps`

Initiate a Vipps payment.

## Headers

- `x-vfi-api-idempotencykey` string, uuid — A value you specify that uniquely identifies this transaction. This must be used to trigger a reversal if there is a timeout.

## Request body

- VippsPaymentInitiationRequest
  - `payment_provider_contract` string, uuid-flexible, required — The identifier of payment provider contract you want to process the transaction request with.
  - `threed_secure` ThreeDSecure
    - `eci_flag` '00' | '01' | '02' | '03' | '04' | '05' | '06' | '07'
    - `enrolled` string — Possible Values: Y - Yes, Bank is participating in 3-D Secure protocol and will return the ACSUrl. N - No, Bank is not participating in 3-D Secure protocol. U - Unavailable, the DS or ACS is not available for authentication at the time of the request. B - Bypass, merchant authentication rule is triggered to bypass authentication in this use case. NOTE: If the Enrolled value is NOT Y, then the Consumer is NOT eligible for Authentication.
    - `cavv` string — Base64-encoded values of 28 or 32 characters. Hex-encoded values of 40 or 48 characters.
    - `cavv_algorithm` string — Indicates the algorithm used to generate the CAVV value.Please refer to the integration guide for information on its usage.
    - `pares_status` string — Possible Values: Y - Successful Authentication. U - Unable to Complete Authentication A - Successful Attempts Transaction.
    - `xid` string — Transaction identifier resulting from authentication processing.Please refer to the integration guide for information on its usage.
    - `ds_transaction_id` string — The unique transaction identifier assigned by the Directory Server. Supported for 3D Secure v2 only.
    - `threeds_version` '1.0.2' | '2.1.0' | '2.2.0'
  - `app_phone_number` string — The Phone Number registered with Vipps Mobile APP.
  - `redirect_url` string, required — Checkout Redirect URL which will be used by Vipps on Payment Completion.
  - `is_app` boolean — Flag to identify the transaction originated from APP or Browser.
  - `amount` integer, required — Amount is charged without a decimal place e.g. $1.5 = 150. Currencies can have different decimals/exponentials, see Currencies Section for more details. For Account Verification transactions, provide 0 as value for this field.
  - `auth_type` 'PRE_AUTH' | 'FINAL_AUTH' — Flags a payment request for either pre-authorization or final authorization. * `PRE_AUTH` is used when the authorized amount is unknown and can be adjusted later. * `FINAL_AUTH` is used when a final authorized amount is known and the transaction will definitely be captured in whole.
  - `capture_now` boolean — Whether auto-capture or not. Setting the value to 'false' will only authorize the transaction.
  - `customer` string, uuid-flexible, required — The ID of a customer.
  - `customer_ip` union — The IP Address of the customer where the transaction was initiated.
    - string, ipv4
    - string, ipv6
  - `dynamic_descriptor` string — A short [descriptor](https://en.wikipedia.org/wiki/Billing_descriptor) to be shown on bank statement of the customer. Please refer to the integration guide for the format requirements.
  - `merchant_reference` string, required — A reference specified by the merchant to identify the transaction.
  - `shipping_information` ShippingInformationDto — The address where the purchased goods should be delivered to.
    - `address` string, required — Street address of the recipient.
    - `city` string, required — City of the recipient.
    - `country` string, country-code, required — A 2-letter ISO3166 alpha-2 country code for the address.
    - `postal_code` string, required — A postal code for the address.
    - `email` string, email — A valid internationalized email address, as defined by RFC 5322, RFC 6530, and other RFCs. Due to RFC 5321, an email address can be up to 254 characters long even though up to 64 characters are allowed before and 255 characters are allowed after the @ sign. This pattern verifies only that the string contains an unquoted @ sign. See https://tools.ietf.org/html/rfc5322#section-3.4.1.
    - `first_name` string — First name of the recipient.
    - `last_name` string — Last name of the recipient.
    - `phone` number — Numbers only, no dash or any other separator.
    - `state` string — A region / state / province for the address.
  - `user_agent` string — The full user agent string of the device the customer used to submit the transaction.
  - `sales_description` string — A reference used by the merchant to typically capture a description of the service provided. It could then be used by the merchant to help locate transactions. One could envision a situation where a merchant is trying to locate a transaction/ receipt but in speaking with the customer, the only (or at least a predominant) detail is what service was rendered
  - `currency_code` 'NOK', required — Three-letter ISO 4217 alphabetical currency code. e.g. USD. Values correspond to [ISO 4217](https://wikipedia.org/wiki/ISO_4217). Please note that Klarna only supports Norwegian krone (NOK).
  - `sca_compliance_level` 'NONE' | 'WALLET' | 'FORCE_3DS' — * `NONE`: No SCA required. * `WALLET`: Depend on the wallet SCA mechanism. For Google Pay this means that MasterCard will shift liability, Visa will not. * `FORCE_3DS`: Do an additional 3DS step regardless of whether the wallet indicates the token is SCA-compliant.
  - `sca_exemption` '1' | '2' | '3' | '4' | '5' | '6' — Use this field to request your transaction to be exempted from the application of the Strong Customer Authentication (SCA). Be advised that the use of this field may result to your liability in case of fraudulent transaction. Possible Values: 1 - Low value payment 2 - Acquirer Transaction Risk Analysis 3 - Trusted beneficiary exemption 4 - Secure Corporate Payment (SCP) exemption 5 - Merchant Initiated Transaction 6 - SCA Delegation. **NOTE:** This only applies when `sca_compliance_level` = `NONE`

## Response `201`

The Vipps Payment Initiation Response.

- VippsPaymentInitiationResponse
  - `id` string, uuid-flexible — The ID of the transaction.
  - `redirect_url` string — Vipps Host Redirection URL.
  - `amount` integer — Amount is charged without a decimal place e.g. $1.5 = 150. Currencies can have different decimals/exponentials, see Currencies Section for more details. For Account Verification transactions, provide 0 as value for this field.
  - `blocked` boolean — True if the transaction has been blocked by a ruleset, false otherwise
  - `created_at` string, date-time — The time at which the transaction was created.
  - `customer` string — The ID of a customer
  - `details` EcomPaymentResponseDetails
    - `auto_capture` boolean — Indicates whether the transaction would be automatically captured upon authorisation.
    - `mid` string, integer — Merchant ID (MID)
  - `merchant_reference` string — A reference specified by the merchant to identify the transaction.
  - `processor` string — The name of the processor used for this transaction
  - `payment_product` string — The payment product corresponding to this transaction
  - `payment_product_type` 'Affirm' | 'Amex' | 'Crypto' | 'Diners Club International' | 'Discover' | 'JCB' | 'Klarna' | 'Maestro' | 'Mastercard' | 'OP Online Payment' | 'Swish' | 'Unknown' | 'Visa' — The payment product type corresponding to this transaction. Fees applied to the transaction, is based on the payment product
  - `shipping_information` ShippingInformationDto — The address where the purchased goods should be delivered to.
    - `address` string, required — Street address of the recipient.
    - `city` string, required — City of the recipient.
    - `country` string, country-code, required — A 2-letter ISO3166 alpha-2 country code for the address.
    - `postal_code` string, required — A postal code for the address.
    - `email` string, email — A valid internationalized email address, as defined by RFC 5322, RFC 6530, and other RFCs. Due to RFC 5321, an email address can be up to 254 characters long even though up to 64 characters are allowed before and 255 characters are allowed after the @ sign. This pattern verifies only that the string contains an unquoted @ sign. See https://tools.ietf.org/html/rfc5322#section-3.4.1.
    - `first_name` string — First name of the recipient.
    - `last_name` string — Last name of the recipient.
    - `phone` number — Numbers only, no dash or any other separator.
    - `state` string — A region / state / province for the address.
  - `status` 'INITIATED' | 'AUTHORIZED' | 'AUTHORIZATION_VOIDED' | 'CANCELLED' | 'CUSTOMER_ACCEPTED' | 'REFUNDED' | 'FAILED' | 'PENDING' | 'DECLINED' | 'SETTLEMENT_CANCELLED' | 'SETTLEMENT_REQUESTED' | 'SETTLEMENT_SUBMITTED' | 'SETTLEMENT_COMPLETED' | 'SETTLEMENT_PARTIAL' | 'SETTLEMENT_DECLINED' | 'VOIDED' | 'UNKNOWN' — The outcome of the payment request.
  - `status_reason` string — Message provided by the 3rd party service as additional information, when the transaction does not succeed.
  - `created_by` string — The ID of the user who initiated the transaction. Only set when shopper_interaction = moto, mail_order or telephone_order
  - `shopper_interaction` 'ECOMMERCE' | 'MAIL' | 'TELEPHONE' — Determines the sales channel the shopper gives their card details through: * `ECOMMERCE` Online transactions where the cardholder is present. * `MAIL` order transactions where the shopper is in contact with the merchant via email. * `TELEPHONE` order transactions where the shopper is in contact with the merchant via telephone.
  - `geo_location` number[] — The latitude / longitude resolved from the customer's ip address.
  - `city` string — The city resolved from the customer's ip address.
  - `country_code` string — The [ISO 3166-1 alpha-2](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) country code.<blockquote><strong>Note:</strong> The country code for Great Britain is <code>GB</code> and not <code>UK</code> as is used in that country's top-level domain names.</blockquote>.

## Other responses

- `400` — Bad Request
- `401` — Unauthorised Request
- `403` — Forbidden Request
- `404` — Not Found Request
- `500` — Internal Error

---

[API](https://skmtc.net/verifone/apis/checkout-api.md) · [All operations](https://skmtc.net/verifone/apis/checkout-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/verifone/checkout-api/revisions/ed8dc1f12a5a/schema)