Subscription management methods

CreateSubscription — create a subscription

Initialize a subscription. The response contains SubscriptionID, the Pending status and the confirmation channel SubscriberAcceptanceChannel: SMS_PIN for activation by number, AUTH_PAGE for card, SBP and WAP — in that case the response also carries AuthorizeUrl. The SubscriptionStatusNotification callback is sent on actual activation, not right after creation.

POST /Http/Services/CreateSubscription.aspx

Customer field	When to send it
`Subscriber_MSISDN`	`SMS_PIN` activation. The mock also accepts the legacy name `MSISDN`, but the spec calls the field `Subscriber_MSISDN`
`CustomerType` = `Card`	Payment by card or SBP — no number needed
`CustomerId`	Customer identifier in your system, required together with `CustomerType=Card`
`ClientIP`	WAP activation when sent without a number. Together with a number — the country match check

Request — SMS_PIN activation


<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>2001</SubscriptionProjectID>
  <Subscriber_MSISDN>79001234567</Subscriber_MSISDN>
  <Now>20260625120000</Now>
  <Signature>d2f36558ca5455beb28b4ec090ffbea1cf9425106b5dbeb2f93538603956da53</Signature>
  <Localization>ru-RU</Localization>
  <ClientIP>80.70.60.50</ClientIP>
</Request>

Response — SMS_PIN activation


<?xml version="1.0" encoding="utf-8"?>
<Response>
  <StatusName>REQUEST_ACCEPTED</StatusName>
  <SubscriptionID>10000001</SubscriptionID>
  <SubscriberAcceptanceRequired>true</SubscriberAcceptanceRequired>
  <SubscriberAcceptanceChannel>SMS_PIN</SubscriberAcceptanceChannel>
  <OperatorID>22</OperatorID>
  <PaidUntil>2026-07-25T12:00:00+03:00</PaidUntil>
</Response>

Request — card and SBP


<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>2001</SubscriptionProjectID>
  <CustomerType>Card</CustomerType>
  <CustomerId>12345</CustomerId>
  <Now>20260625120000</Now>
  <Signature>d2f36558ca5455beb28b4ec090ffbea1cf9425106b5dbeb2f93538603956da53</Signature>
  <Localization>ru-RU</Localization>
  <ClientIP>80.70.60.50</ClientIP>
</Request>

Sandbox

Response — card and SBP: the same link serves both flows


<?xml version="1.0" encoding="utf-8"?>
<Response>
  <StatusID>0</StatusID>
  <StatusName>REQUEST_ACCEPTED</StatusName>
  <SubscriptionID>10000002</SubscriptionID>
  <SubscriptionStatus>Pending</SubscriptionStatus>
  <SubscriberAcceptanceRequired>true</SubscriberAcceptanceRequired>
  <SubscriberAcceptanceChannel>AUTH_PAGE</SubscriberAcceptanceChannel>
  <AuthorizeUrl>https://subs-sandbox.digitalspb.com/Cards/TB/8c0c8870-d6fb-4ee8-a995-ae183a44b928/Init</AuthorizeUrl>
  <PaidUntil>2026-07-25T12:00:00+03:00</PaidUntil>
  <TrialExists>false</TrialExists>
</Response>

For an SBP QR payment append ?useSbpQr=True to AuthorizeUrl — SBP has neither a separate method nor a separate link. The payment page picks the flow by device: a universal QR code for desktop, a bank list with deep links for a phone.

CreateSubscription

Sandbox

curl


BASE=https://subs-sandbox.digitalspb.com
PROJECT_ID=2001
SECRET=subs_secret_key
NOW=$(date -u +%Y%m%d%H%M%S)
SIG=$(printf '%s%s' "$PROJECT_ID" "$NOW" \
  | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $NF}')
 
curl -X POST "$BASE/Http/Services/CreateSubscription.aspx" \
  -H "Content-Type: text/xml; charset=utf-8" \
  --data-binary @- <<XML
<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>$PROJECT_ID</SubscriptionProjectID>
  <Subscriber_MSISDN>79001234567</Subscriber_MSISDN>
  <Now>$NOW</Now>
  <Signature>$SIG</Signature>
  <Localization>ru-RU</Localization>
  <ClientIP>80.70.60.50</ClientIP>
</Request>
XML

PHP


<?php
$base      = 'https://subs-sandbox.digitalspb.com';
$projectId = '2001';
$now       = gmdate('YmdHis');
$sig       = subsSign('subs_secret_key', $projectId, $now);
 
$xml = <<<XML
<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>{$projectId}</SubscriptionProjectID>
  <Subscriber_MSISDN>79001234567</Subscriber_MSISDN>
  <Now>{$now}</Now>
  <Signature>{$sig}</Signature>
  <Localization>ru-RU</Localization>
  <ClientIP>80.70.60.50</ClientIP>
</Request>
XML;
 
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL            => $base . '/Http/Services/CreateSubscription.aspx',
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $xml,
    CURLOPT_HTTPHEADER     => ['Content-Type: text/xml; charset=utf-8'],
    CURLOPT_RETURNTRANSFER => true,
]);
$response = curl_exec($ch);
curl_close($ch);

Python


import requests
 
BASE = "https://subs-sandbox.digitalspb.com"
PROJECT_ID = "2001"
 
now = datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S")
sig = subs_sign(SECRET_KEY, PROJECT_ID, now)
 
xml = f"""<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>{PROJECT_ID}</SubscriptionProjectID>
  <Subscriber_MSISDN>79001234567</Subscriber_MSISDN>
  <Now>{now}</Now>
  <Signature>{sig}</Signature>
  <Localization>ru-RU</Localization>
  <ClientIP>80.70.60.50</ClientIP>
</Request>"""
 
response = requests.post(
    f"{BASE}/Http/Services/CreateSubscription.aspx",
    data=xml.encode("utf-8"),
    headers={"Content-Type": "text/xml; charset=utf-8"},
    timeout=30,
)

Prod

curl


BASE=https://subs.your-endpoint
PROJECT_ID=1234
SECRET=$SUBS_SECRET_KEY
NOW=$(date -u +%Y%m%d%H%M%S)
SIG=$(printf '%s%s' "$PROJECT_ID" "$NOW" \
  | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $NF}')
 
curl -X POST "$BASE/Http/Services/CreateSubscription.aspx" \
  -H "Content-Type: text/xml; charset=utf-8" \
  --data-binary @- <<XML
<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>$PROJECT_ID</SubscriptionProjectID>
  <Subscriber_MSISDN>79001234567</Subscriber_MSISDN>
  <Now>$NOW</Now>
  <Signature>$SIG</Signature>
  <Localization>ru-RU</Localization>
  <ClientIP>80.70.60.50</ClientIP>
</Request>
XML

PHP


<?php
$base      = 'https://subs.your-endpoint';
$projectId = '1234';
$now       = gmdate('YmdHis');
$sig       = subsSign(getenv('SUBS_SECRET_KEY'), $projectId, $now);
 
$xml = <<<XML
<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>{$projectId}</SubscriptionProjectID>
  <Subscriber_MSISDN>79001234567</Subscriber_MSISDN>
  <Now>{$now}</Now>
  <Signature>{$sig}</Signature>
  <Localization>ru-RU</Localization>
  <ClientIP>80.70.60.50</ClientIP>
</Request>
XML;
 
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL            => $base . '/Http/Services/CreateSubscription.aspx',
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $xml,
    CURLOPT_HTTPHEADER     => ['Content-Type: text/xml; charset=utf-8'],
    CURLOPT_RETURNTRANSFER => true,
]);
$response = curl_exec($ch);
curl_close($ch);

Python


import requests
 
BASE = "https://subs.your-endpoint"
PROJECT_ID = "1234"
 
now = datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S")
sig = subs_sign(SECRET_KEY, PROJECT_ID, now)
 
xml = f"""<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>{PROJECT_ID}</SubscriptionProjectID>
  <Subscriber_MSISDN>79001234567</Subscriber_MSISDN>
  <Now>{now}</Now>
  <Signature>{sig}</Signature>
  <Localization>ru-RU</Localization>
  <ClientIP>80.70.60.50</ClientIP>
</Request>"""
 
response = requests.post(
    f"{BASE}/Http/Services/CreateSubscription.aspx",
    data=xml.encode("utf-8"),
    headers={"Content-Type": "text/xml; charset=utf-8"},
    timeout=30,
)

CreateSubscription — WAP activation

The merchant does not know the subscriber’s number — the operator gateway determines it. ClientIP is sent instead of Subscriber_MSISDN, the response carries AuthorizeUrl; you may append ?ReturnUrl= (a relative path glued to the project’s base return address) and ?ext_lp_template=. After confirmation the subscriber returns to the project address with the result parameters.

Request — WAP


<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>2001</SubscriptionProjectID>
  <ClientIP>80.70.60.50</ClientIP>
  <Localization>ru-RU</Localization>
  <Now>20260625120000</Now>
  <Signature>d2f36558ca5455beb28b4ec090ffbea1cf9425106b5dbeb2f93538603956da53</Signature>
</Request>

Operator	Return redirect parameters
MTS, Beeline (default)	`subscriptionid`, `msisdn`, `action` = `approved` \| `cancelled` \| `alreadyexist`
Megafon	`SubscriptionID`, `operation_status` = `ok` \| `noauth`. The same subscription also gets `CancelUrl` in the `CancelSubscription` response

Sandbox

CreateSubscription — charge cycle

In production a subscription is charged on the project schedule — once every 30 days. That is not something you can wait for in a test, so the cycle is compressed by a <TestInfo> block: the period is given in seconds and the outcome is chosen upfront. Without BillingPeriodSeconds there are no charges at all. The first charge is counted from activation, not from creation.

Field	Value
`BillingPeriodSeconds`	`1`…`86400`. Enables the charge cycle. Sets both the period between charges and the retry interval after a decline
`MaxIterations`	`1`…`100`, default `3` — how many successful charges happen before the subscription closes
`ExpectedBillingResult`	`Success` (default) or `Failed` — the outcome of every charge attempt
`BillingAmount`	Amount in the notifications’ `CustomerPrice`, default `10.00`
`OperatorID`	Subscription operator, default `22`. The value `20` switches on Megafon behaviour: `operation_status` instead of `action` in the return redirect and `CancelUrl` in the `CancelSubscription` response

Request — subscription with a charge cycle


<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>2001</SubscriptionProjectID>
  <Subscriber_MSISDN>79001234567</Subscriber_MSISDN>
  <Now>20260625120000</Now>
  <Signature>d2f36558ca5455beb28b4ec090ffbea1cf9425106b5dbeb2f93538603956da53</Signature>
  <TestInfo>
    <BillingPeriodSeconds>10</BillingPeriodSeconds>
    <MaxIterations>3</MaxIterations>
    <ExpectedBillingResult>Success</ExpectedBillingResult>
    <BillingAmount>49.00</BillingAmount>
  </TestInfo>
</Request>

ApproveSubscription — confirm the PIN

Confirm the subscription with the PIN code from SMS. A wrong code returns WRONG_PARAMS / InvalidPinCode with the attempts left; after the third failure the subscription moves to ApprovingFailed permanently and the correct PIN no longer helps. Confirming an active subscription again returns SubscriptionAlreadyApproved. The method does not apply to AUTH_PAGE subscriptions: those are activated by the completed payment.

Sandbox

In the sandbox the PIN is fixed — 1234: no SMS is sent. Three attempts are allowed; the same failure arrives if the subscription was not confirmed within 3 hours.

POST /Http/Services/ApproveSubscription.aspx

Request


<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>2001</SubscriptionProjectID>
  <SubscriptionID>12345678</SubscriptionID>
  <PinCode>1234</PinCode>
  <Now>20260625120000</Now>
  <Signature>d2f36558ca5455beb28b4ec090ffbea1cf9425106b5dbeb2f93538603956da53</Signature>
</Request>

ApproveSubscription

curl


curl -X POST "$BASE/Http/Services/ApproveSubscription.aspx" \
  -H "Content-Type: text/xml; charset=utf-8" \
  --data-binary @- <<XML
<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>$PROJECT_ID</SubscriptionProjectID>
  <SubscriptionID>12345678</SubscriptionID>
  <PinCode>1234</PinCode>
  <Now>$NOW</Now>
  <Signature>$SIG</Signature>
</Request>
XML

PHP


<?php
$xml = <<<XML
<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>{$projectId}</SubscriptionProjectID>
  <SubscriptionID>12345678</SubscriptionID>
  <PinCode>1234</PinCode>
  <Now>{$now}</Now>
  <Signature>{$sig}</Signature>
</Request>
XML;
 
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL            => $base . '/Http/Services/ApproveSubscription.aspx',
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $xml,
    CURLOPT_HTTPHEADER     => ['Content-Type: text/xml; charset=utf-8'],
    CURLOPT_RETURNTRANSFER => true,
]);
$response = curl_exec($ch);
curl_close($ch);

Python


xml = f"""<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>{PROJECT_ID}</SubscriptionProjectID>
  <SubscriptionID>12345678</SubscriptionID>
  <PinCode>1234</PinCode>
  <Now>{now}</Now>
  <Signature>{sig}</Signature>
</Request>"""
 
response = requests.post(
    f"{BASE}/Http/Services/ApproveSubscription.aspx",
    data=xml.encode("utf-8"),
    headers={"Content-Type": "text/xml; charset=utf-8"},
    timeout=30,
)

GetSubscriptionStatus — subscription status

Returns the actual subscription status. The subscription is looked up by SubscriptionID, Subscriber_MSISDN or SubscriberID within the project. The callback is not the only source of state: once delivery attempts are exhausted, the status is still available through this method.

POST /Http/Services/GetSubscriptionStatus.aspx

Request


<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>2001</SubscriptionProjectID>
  <SubscriptionID>12345678</SubscriptionID>
  <Now>20260625120000</Now>
  <Signature>d2f36558ca5455beb28b4ec090ffbea1cf9425106b5dbeb2f93538603956da53</Signature>
</Request>

Response


<?xml version="1.0" encoding="utf-8"?>
<Response>
  <StatusName>REQUEST_ACCEPTED</StatusName>
  <SubscriptionStatus>Active</SubscriptionStatus>
  <Country>ru</Country>
  <OperatorID>22</OperatorID>
  <PaidUntil>2026-07-25T12:00:00+03:00</PaidUntil>
</Response>

CancelSubscription — cancel a subscription

Cancellation initiated by the partner. The subscription is identified by SubscriptionID, Subscriber_MSISDN, or SubscriberID. The status becomes Cancelled and an EventType=CANCELLED callback arrives. For Megafon subscriptions (OperatorID=20) the response additionally carries CancelUrl.

POST /Http/Services/CancelSubscription.aspx

Request


<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>2001</SubscriptionProjectID>
  <SubscriptionID>12345678</SubscriptionID>
  <Now>20260625120000</Now>
  <Signature>d2f36558ca5455beb28b4ec090ffbea1cf9425106b5dbeb2f93538603956da53</Signature>
</Request>

ResendPinCode — resend the PIN

Resending the PIN — no more than three times and only for SMS_PIN subscriptions.

POST /Http/Services/ResendPinCode.aspx

Request


<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>2001</SubscriptionProjectID>
  <SubscriptionID>12345678</SubscriptionID>
  <Now>20260625120000</Now>
  <Signature>d2f36558ca5455beb28b4ec090ffbea1cf9425106b5dbeb2f93538603956da53</Signature>
</Request>

Approve / Cancel / ResendPin response


<?xml version="1.0" encoding="utf-8"?>
<Response>
  <StatusName>REQUEST_ACCEPTED</StatusName>
</Response>

GetSubscriptions — list the project subscriptions

Returns the project subscriptions — active and closed, newest first. The subscriber filter is optional: without Subscriber_MSISDN and SubscriberID the whole project is listed. An empty list is a legitimate answer.

POST /Http/Services/GetSubscriptions

The only method of the service whose path carries no .aspx — that is how the platform specification declares it. List items follow one another as repeated <Subscriptions> elements with no common wrapper.

Request


<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>2001</SubscriptionProjectID>
  <Subscriber_MSISDN>79001234567</Subscriber_MSISDN>
  <Now>20260625120000</Now>
  <Signature>d2f36558ca5455beb28b4ec090ffbea1cf9425106b5dbeb2f93538603956da53</Signature>
</Request>

Response


<?xml version="1.0" encoding="utf-8"?>
<Response>
  <StatusName>REQUEST_ACCEPTED</StatusName>
  <Subscriptions>
    <SubscriptionID>12345678</SubscriptionID>
    <SubscriptionProjectID>2001</SubscriptionProjectID>
    <SubscriptionStatus>Active</SubscriptionStatus>
    <Country>ru</Country>
    <OperatorID>22</OperatorID>
    <PaidUntil>2026-07-25T12:00:00+03:00</PaidUntil>
    <TrialExists>false</TrialExists>
    <CreateTime>2026-06-25T12:00:00+03:00</CreateTime>
    <Active>true</Active>
    <Approved>true</Approved>
    <AcceptanceChannel>SMS_PIN</AcceptanceChannel>
    <Subscriber_MSISDN>79001234567</Subscriber_MSISDN>
  </Subscriptions>
</Response>

Sandbox

The listing is capped at 50 records — the sandbox project is shared, and without a cap the list would grow until the logs are cleaned. Only the fields the sandbox actually keeps are printed: MerchantSubsID, RenewPeriod, ActualRenewCount, ClosedTime and NetworkID are not stored.

RefundBillingOperation — refund a charge

Refunds a subscription charge. BillingOperationID is the identifier of the billing operation taken from the charge notification.

POST /Http/Services/RefundBillingOperation.aspx

Request


<?xml version="1.0" encoding="utf-8"?>
<Request>
  <SubscriptionProjectID>2001</SubscriptionProjectID>
  <BillingOperationID>3f1b2c4d-0000-4000-8000-000000000003</BillingOperationID>
  <Now>20260625120000</Now>
  <Signature>d2f36558ca5455beb28b4ec090ffbea1cf9425106b5dbeb2f93538603956da53</Signature>
</Request>

Response — the operation id comes back as an echo


<?xml version="1.0" encoding="utf-8"?>
<Response>
  <StatusName>REQUEST_ACCEPTED</StatusName>
  <BillingOperationID>3f1b2c4d-0000-4000-8000-000000000003</BillingOperationID>
</Response>

Sandbox

Billing operations have no state. The BillingOperationID is born in the notification itself and is stored nowhere, so only the shape of the identifier (a UUID) is checked; the refund is treated as instant and always successful — just like an invoice refund. The method changes neither the subscription status nor the charge schedule.