---
title: "Payment SRED - Process card-present SRED payload via DecryptX and TECS XML gateway"
method: POST
path: "/public/paymentSred"
tags: ["Merchant Portal services API"]
---

# Payment SRED - Process card-present SRED payload via DecryptX and TECS XML gateway

`POST /public/paymentSred`

## Request

- Base URL: `https://test.tecs.at/merchantservices`
- URL: `https://test.tecs.at/merchantservices/public/paymentSred`
- Auth: HTTP bearer

Processes a card-present SRED payload by decrypting device data via DecryptX API, then authorizing via TECS XML gateway.<br>

<b>Flow:</b><br>
1. Decrypt device payload via DecryptX API (partnerId, partnerKey, deviceType, devicePayload)<br>
2. Extract PAN (12-19 digits, Luhn-valid), EXPY (MMYY), ServiceCode<br>
3. Build and send TECS XML authorization request<br>
4. Parse and return response with SRED data<br>

Required role for operation: BO_VIRTUAL_TERMINAL or VIRTUAL_TERMINAL.<br>
Create MPauditlog record with event type : PaymentSred (36).<br>

Transaction ID is generated automatically as YYYYMMDDhhmmss.<br>
TX-Origin is set to 2 for SALE, 5 for PRE-AUTH.<br>
CVC2 = ServiceCode from decrypted payload.<br>

Supports authentication with Bearer token.<br>

## Request body

- PaymentSredRequest: Payment SRED request for processing card-present SRED payload via DecryptX and TECS XML gateway
  - `terminalId` string, required: Terminal ID - 8 digits
  - `currency` string, required: Currency code - 3 uppercase letters (ISO 4217)
  - `amount` integer, required: Transaction amount in minor units (cents)
  - `txtype` 'SALE' | 'PRE-AUTH', required: Transaction type
  - `devicePayload` string, required: SRED encrypted device payload from the device (minimum 32 characters)
  - `password` string: Terminal password sent as Kennwort in TECS XML (optional)

## Response `200`

Successful operation

- PaymentSredResponse: Payment SRED response from TECS XML gateway with DecryptX data
  - `responseCode` string: Response code - 00 for success, otherwise error code
  - `responseMessage` string: Response message - 'Approved' for success, error description otherwise
  - `transactionId` string: Transaction ID generated by the backend
  - `originalTransactionId` string: Original transaction ID from gateway
  - `terminalId` string: Terminal ID used for the transaction
  - `dateTimeTx` string: Date and time of the transaction
  - `authorizationNumber` string: Authorization number from the gateway
  - `merchantId` string: Merchant ID (VU-NUMMER)
  - `acquirerName` string: Acquirer name parsed from KKG field
  - `cardType` string: Card type parsed from KKG field
  - `sred` SredInfo: SRED information from DecryptX decryption
    - `panMasked` string: Masked PAN (first 6 and last 4 digits)
    - `expDate` string: Card expiry date in MMYY format
    - `serviceCode` string: Service code from the card
    - `device` string: Device type that provided the SRED payload
    - `serial` string: Device serial number
    - `mode` string: Decryption mode

## Other responses

- `400`: * Invalid JSON * Invalid terminalId - must be 8 digits * Invalid currency - must be 3 uppercase letters * Invalid amount - must be greater than 0 * Invalid txtype - must be SALE or PRE-AUTH * Invalid devicePayload - must be at least 32 characters * Decrypt error - DecryptX API returned non-2xx or success=false * Decrypt error - PAN not found in response * Decrypt error - Invalid PAN length (must be 12-19 digits) * Decrypt error - Invalid PAN - Luhn check failed * Decrypt error - Invalid expiry date * Gateway error - TECS XML gateway error
- `401`: Unauthorized - Authentication failed
- `403`: Forbidden - Missing role: BO_VIRTUAL_TERMINAL or VIRTUAL_TERMINAL
- `500`: * Internal server error * DecryptX configuration is missing

## Changes

- **2026-11-03** `6e0e5a5a2b2f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/bluefin-com/apis/merchant-services/changes/public/paymentSred/post.md)

---

[API](https://skmtc.dev/bluefin-com/apis/merchant-services.md) - [All operations](https://skmtc.dev/bluefin-com/apis/merchant-services/llms.txt) - [OpenAPI document](https://skmtc.dev/bluefin-com/apis/merchant-services/revisions/6e0e5a5a2b2f?raw)