XML protocol v2.9

XML API of the Callisto Mobile Payment platform. All requests are sent as POST with an XML body to a single address; the operation type is determined by the name of the child element inside <Request> — e.g. <CreateInvoiceRequest>.

Sandbox


API address	`https://pay-sandbox.digitalspb.com`
Reference & MCP	`https://i-free.money/developers/en/sandbox`


API address	`https://pay-api.digitalspb.com`
XSD schema	`http://pay-api.digitalspb.com/API/XML/InvoiceManagementService.xsd`

Parameter	Value
Content-Type	`text/xml`
Method	always `POST`; the operation type is derived from the name of the `<Request>` child element

Protocol version: 2.9.0

Required HTTP headers


Callisto-Protocol-Version: 2
SignatureVersion: 3
Content-Type: text/xml

Request structure

Each request is wrapped in the root <Request> element with a mandatory <Header> authentication block. The response comes in a root <Response> with ResultCode and ResultDescription fields.

Request skeleton


<?xml version="1.0" encoding="utf-8"?>
<Request>
  <Header>
    <Authentication>
      <Login>demo_login</Login>
      <NowUtc>20210329200008</NowUtc>
      <Signature>802c4e0aa711a24888ea571dd8df6608d03e74bfe7cf8be040fb8b9aba8d3a4f</Signature>
    </Authentication>
    <RequestAttempt>1</RequestAttempt>
  </Header>
  <!-- operation body: <CreateInvoiceRequest>, <GetInvoiceRequest>, … -->
</Request>

Signature

The signature is passed in Header/Authentication/Signature. Additionally, an IP address whitelist is applied at the ProjectID level.

Formula


Signature = LOWERCASE(HMACSHA256(Password, Login + LOWERCASE(HMACSHA256(Password, NowUtc))))

In the XML protocol NowUtc uses the yyyyMMddHHmmss format — no separators and no Z, unlike ISO 8601 in the JSON API. A deviation from the system time of more than 20 minutes yields ResultCode=101.

XML signature calculation

Sandbox

curl


LOGIN=demo_login
PASSWORD=demo_password
NOW=$(date -u +%Y%m%d%H%M%S)
 
INNER=$(printf '%s' "$NOW" \
  | openssl dgst -sha256 -hmac "$PASSWORD" | awk '{print $NF}')
SIG=$(printf '%s%s' "$LOGIN" "$INNER" \
  | openssl dgst -sha256 -hmac "$PASSWORD" | awk '{print $NF}')

PHP


<?php
function signXml(string $password, string $login, string $nowUtc): string
{
    $inner = hash_hmac('sha256', $nowUtc, $password);
 
    return hash_hmac('sha256', $login . $inner, $password);
}
 
$now = gmdate('YmdHis');
$sig = signXml('demo_password', 'demo_login', $now);

Python


import hashlib
import hmac
from datetime import datetime, timezone
 
PASSWORD = "demo_password"
 
 
def sign_xml(password: str, login: str, now_utc: str) -> str:
    def h(msg: str) -> str:
        return hmac.new(
            password.encode(), msg.encode(), hashlib.sha256
        ).hexdigest()
 
    return h(login + h(now_utc))
 
 
now = datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S")
sig = sign_xml(PASSWORD, "demo_login", now)

Operation groups

Group	Operations	Purpose
InvoiceManagement	5	Invoices — create, authorize, get, cancel, refund
CustomerContract	3	Customer contracts — create, authorize, cancel
CustomerBilling	2	Billing support check and available payment methods

Outside the groups, the specification describes two more operations — ConfirmPaymentTransaction and SendInvoiceContent. The sandbox does not implement them: a request with either root element gets HTTP 400 and ResultCode 400 with the text Unknown operation element.

XML protocol v2.9

Sandbox

Prod

Required HTTP headers

Request structure

Signature

Sandbox

curl

PHP

Python

Prod

curl

PHP

Python

Operation groups