Mandiri Direct Debit

Integration Steps

Overview of integration process with Mandiri Direct Debit

1. Card Registration

2. OTP Verification

3. Payment

4. Payment Notification

5. Additional Feature

1. Card Registration

Card Registration process should be done before payment can be made and processed. Merchant will send card registration request from customer to DOKU. The request includes customer's card number that is registered to customer's Mandiri account.

Each card/account can only be registered/bind to one customer on one merchant. Customer needs to verify OTP and input PIN to register the card.

CBC Encryption

To request card registration process, merchant requires to bring object cardData which value should be encrypted using CBC Algorithm.

CBC Encryption - Steps:

1. Prepare shared key from DOKU as Secret Key

   • Substring shared key only 16 digits

   • Example code:

   Copy

   private String getSharedKey(String sharedKey) {
       if (sharedKey.length() != 16) {
   sharedKey = sharedKey.length() > 16 ? sharedKey.substring(0, 16) : String.format("%-16s", sharedKey).replace(' ', '-');
       }
       return sharedKey;
   }

2. Generate Initial Value (IV)

   • Generate initial value with 16 bytes and then encode using Base 64

   • Example code:

   Copy

   byte[] iv = new byte[16];
   new SecureRandom().nextBytes(iv);
   IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
   String ivString = Base64.getEncoder().encodeToString(ivParameterSpec.getIV());

3. Using Cipher CBC

   • Value that will be encrypted combine with secret key generated before

   • After that encode the value using Base 64

   • Example code:

   Copy

   Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding"); //NOSONAR
   cipher.init(Cipher.ENCRYPT_MODE, key, ivParameterSpec);
   byte[] cipherText = cipher.doFinal(input.getBytes());
   String cipherString = Base64.getEncoder().encodeToString(cipherText);

4. Combine CBC and IV

   • Combine value CBC Cipher with IV value with separator (|)

   • Example code:

   Copy

   String value = cipherString + "|" + ivString;

Tools Using Java - Steps:

• Install JDK 17

• Go to folder

• Run with command java -jar cbc-tools.jar

• Input Value that you wish to be encrypted

• Input Key to encrypt

Example Value:

(It should be minified)

{"bankCardNo":"4097662150169210","expiryDate":"2909"}

Card Registration Flow

API Endpoint

Sample of Request Header, Request Body and Response Body

Notes:

Parameter with (*) is mandatory

Parameter without (*) is optional/conditional

POST /direct-debit/core/v1/registration-card-bind HTTP/1.1
Host: {api-domain}
X-TIMESTAMP: 2020-12-21T07:56:11.000Z
X-SIGNATURE: 85be817c55b2c135157c7e89f52499bf0c25ad6eeebe04a986e8c862561b19a5
X-PARTNER-ID: 821508239190
X-EXTERNAL-ID: 418075533589
Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE2OTgwNTA3NDMsImlzcyI6IkRPS1UiLCJjbGllbnRJZCI6IkJSTi0wMjExLTE2OTY5MTk2NTE5MTgifQ.x-D5VlK6TlVZbLPUSCr-Gbfgh4tnp0QDJmedYFHJGHFjg1c4x39pszU4sLvRhr0Jk0vKdMIzxUZeNhKoesWqDJitnG3kfrNZNsMb_WYUC0tJW91onXzYOKXiTgsHwRNFoWPQHlXIEtT3RQm-SRlCpk_E0gsavgkQn2-kbJEBnPhIs4eKg5IUY9GYi4hRr-_GHsudDl8sd2B5UBB_rHYq36BRmLXH7i7MQADHPsB1ktPVgk3ZWF0jebEjI-lJ88p-omL1vQNvRseXej2HKBa9chGLmPDvXYBQaRmmstHz-tv1boFrHfwsHJebcUec-i3WE1vMvP_3EPXdbqb45N4ciQ
Content-Type: application/json
Accept: */*
Content-Length: 524

{
  "cardData": "5cg2G2719+jxU1RfcGmeCyQrLagUaAWJWWhLpm/mbkiTIrb9qA5kQgAZ4jTsMWOgMxB7lJX6k1hiv5Mq4ltG5g==|GbD2PwzJIgpPijLs14BwZQ==",
  "custIdMerchant": "cust001",
  "phoneNo": "628238748728423",
  "journeyId": "861023713017210",
  "additionalInfo": {
    "channel": "DIRECT_DEBIT_MANDIRI_SNAP",
    "customerName": "John Doe",
    "email": "[email protected]",
    "idCard": "12345",
    "country": "Indonesia",
    "address": "Bali",
    "dateOfBirth": "19990101",
    "successRegistrationUrl": "https://merchant.doku.com/success",
    "failedRegistrationUrl": "https://www.merchant.com/failed"
  }
}

{
  "responseCode": "2000700",
  "responseMessage": "Successful",
  "referenceNo": "129260743966",
  "redirectUrl": "https://doku.com/direct-debit/ui/binding/2238230713001534401107183161486001168389",
  "additionalInfo": {
    "custIdMerchant": 12345679504,
    "status": "PENDING",
    "authCode": 2.23823090518282e+39
  }
}

2. OTP Verification

OTP verification is needed to verify the Card Registration request and Payment request. Merchant can hit this API to verify the OTP.

OTP Verification Flow

API Endpoint

Sample of Request Header, Request Body and Response Body

Notes:

Parameter with (*) is mandatory

Parameter without (*) is optional/conditional

POST /direct-debit/core/v1/otp-verification HTTP/1.1
Host: {api-domain}
X-TIMESTAMP: 2020-12-21T07:56:11.000Z
X-SIGNATURE: 85be817c55b2c135157c7e89f52499bf0c25ad6eeebe04a986e8c862561b19a5
X-PARTNER-ID: 821508239190
X-EXTERNAL-ID: 418075533589
Authorization-customer: Bearer fa8sjjEj813Y9JGoqwOeOPWbnt4CUpvIJbU1mMU4a11MNDZ7Sg5u9a
Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE2OTgwNTA3NDMsImlzcyI6IkRPS1UiLCJjbGllbnRJZCI6IkJSTi0wMjExLTE2OTY5MTk2NTE5MTgifQ.x-D5VlK6TlVZbLPUSCr-Gbfgh4tnp0QDJmedYFHJGHFjg1c4x39pszU4sLvRhr0Jk0vKdMIzxUZeNhKoesWqDJitnG3kfrNZNsMb_WYUC0tJW91onXzYOKXiTgsHwRNFoWPQHlXIEtT3RQm-SRlCpk_E0gsavgkQn2-kbJEBnPhIs4eKg5IUY9GYi4hRr-_GHsudDl8sd2B5UBB_rHYq36BRmLXH7i7MQADHPsB1ktPVgk3ZWF0jebEjI-lJ88p-omL1vQNvRseXej2HKBa9chGLmPDvXYBQaRmmstHz-tv1boFrHfwsHJebcUec-i3WE1vMvP_3EPXdbqb45N4ciQ
Content-Type: application/json
Accept: */*
Content-Length: 237

{
  "originalPartnerReferenceNo": "INV-0001",
  "otp": "111000",
  "action": "otpPayment/otpLinkage",
  "additionalInfo": {
    "channel": "DIRECT_DEBIT_MANDIRI_SNAP",
    "bankCardToken": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE2OTgwNTA3NDMsImlzcyI6IkRPS1UiLCJjbGllbnR"
  }
}

{
  "responseCode": 2000400,
  "responseMessage": "Successful",
  "originalReferenceNo": "GuJNX01wKYMdEGNUJ1k"
}

3. Payment

After customer's card is registered, payment process can be requested by bringing the card token generated in card registration process. After merchant hit payment API, DOKU will deduct customer's balance.

Payment - Tokenization

In tokenization scheme, every payment needs to be verified by customer with inputting OTP and/or PIN. In order to do that, merchant needs to bring parameter paymentType : "SALE"in payment request body.

And as the response, merchant will receive parameter webRedirectUrl to redirect the customer to merchant's page/platform to complete the payment by inputting OTP and/or PIN. After the payment is completed, merchant then will receive the notification.

Payment - Recurring

In recurring scheme, the payment process will be scheduled. Hence, verification using OTP and/or PIN is not required in every payment. Customers only need to do the verification during card registration process and it will give merchant the authorization to run scheduled payment. In order to do that, merchant needs to bring parameter CHANNEL-ID : "H2H" in request header andpaymentType : "RECURRING"in payment request body.

And as the response, merchant will not receive parameter webRedirectUrl to redirect the customer to merchant's page/platform to complete the payment. Payment request will be directly processed by acquirer and merchant will receive the notification.

Payment Flow

This below payment flow is for tokenization scheme.

API Endpoint

Sample of Request Header, Request Body and Response Body

Notes:

Parameter with (*) is mandatory

Parameter without (*) is optional/conditional

POST /direct-debit/core/v1/debit/payment-host-to-host HTTP/1.1
Host: {api-domain}
X-TIMESTAMP: 2020-12-21T07:56:11.000Z
X-SIGNATURE: 85be817c55b2c135157c7e89f52499bf0c25ad6eeebe04a986e8c862561b19a5
X-PARTNER-ID: 821508239190
X-EXTERNAL-ID: 418075533589
Authorization-customer: Bearer fa8sjjEj813Y9JGoqwOeOPWbnt4CUpvIJbU1mMU4a11MNDZ7Sg5u9a
Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE2OTgwNTA3NDMsImlzcyI6IkRPS1UiLCJjbGllbnRJZCI6IkJSTi0wMjExLTE2OTY5MTk2NTE5MTgifQ.x-D5VlK6TlVZbLPUSCr-Gbfgh4tnp0QDJmedYFHJGHFjg1c4x39pszU4sLvRhr0Jk0vKdMIzxUZeNhKoesWqDJitnG3kfrNZNsMb_WYUC0tJW91onXzYOKXiTgsHwRNFoWPQHlXIEtT3RQm-SRlCpk_E0gsavgkQn2-kbJEBnPhIs4eKg5IUY9GYi4hRr-_GHsudDl8sd2B5UBB_rHYq36BRmLXH7i7MQADHPsB1ktPVgk3ZWF0jebEjI-lJ88p-omL1vQNvRseXej2HKBa9chGLmPDvXYBQaRmmstHz-tv1boFrHfwsHJebcUec-i3WE1vMvP_3EPXdbqb45N4ciQ
Content-Type: application/json
Accept: */*
Content-Length: 280

{
  "partnerReferenceNo": "INV-0001",
  "amount": {
    "value": "10000.00",
    "currency": "IDR"
  },
  "journeyId": "861023713017210",
  "additionalInfo": {
    "channel": "DIRECT_DEBIT_MANDIRI_SNAP",
    "successPaymentUrl": "www.merchant.com/success",
    "failedPaymentUrl": "www.merchant.com/failed",
    "paymentType": "SALE"
  }
}

{
  "responseCode": "2005400",
  "responseMessage": "Successful",
  "webRedirectUrl": "https://app-uat.doku.com/link/283702597342040",
  "partnerReferenceNo": "INV-0001"
}

4. Payment Notification

After payment is completed, DOKU will send HTTP Notification to merchant's defined Notification URL. Learn how to handle the notification from DOKU.

5. Additional Feature

a. Refund

Currently, refund for successful Direct Debit Mandiri transactions can only be done via Manual Refund Flow.

Supported refund types via Manual refund Flow:

• Full refund

• Partial refund

• Multiple partial refunds

Manual Refund Flow

Steps to Request Manual Refund

Send email to DOKU

• To: [email protected]

• Cc: [email protected]

• Subject: [Merchant Name] Refund Manual Request – DD Mandiri SNAP

Include in your email

• Merchant Name

• Invoice Number

• Date of Transaction

• Transaction Amount

• Refund Amount

Processing Time

• Refunds are processed within 7 working days from the date Mandiri receives the request.

• If no update after 7 working days, escalate by replying to the same email.

Online Refund Flow

API Endpoint

Parameter without (*) is optional/conditional

b. Card Registration Unbinding

If a registered customer no longer wants their account/card to be bind/linked and wish to remove it from DOKU's and merchant’s system, merchant can send account unbinding request that is initiated by customer.

API Endpoint

Sample of Request Header, Request Body and Response Body

Notes:

Parameter with (*) is mandatory

Parameter without (*) is optional/conditional

POST /direct-debit/core/v1/registration-card-unbind HTTP/1.1
Host: {api-domain}
X-TIMESTAMP: 2020-12-21T07:56:11.000Z
X-SIGNATURE: 85be817c55b2c135157c7e89f52499bf0c25ad6eeebe04a986e8c862561b19a5
X-PARTNER-ID: 821508239190
X-EXTERNAL-ID: 418075533589
Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE2OTgwNTA3NDMsImlzcyI6IkRPS1UiLCJjbGllbnRJZCI6IkJSTi0wMjExLTE2OTY5MTk2NTE5MTgifQ.x-D5VlK6TlVZbLPUSCr-Gbfgh4tnp0QDJmedYFHJGHFjg1c4x39pszU4sLvRhr0Jk0vKdMIzxUZeNhKoesWqDJitnG3kfrNZNsMb_WYUC0tJW91onXzYOKXiTgsHwRNFoWPQHlXIEtT3RQm-SRlCpk_E0gsavgkQn2-kbJEBnPhIs4eKg5IUY9GYi4hRr-_GHsudDl8sd2B5UBB_rHYq36BRmLXH7i7MQADHPsB1ktPVgk3ZWF0jebEjI-lJ88p-omL1vQNvRseXej2HKBa9chGLmPDvXYBQaRmmstHz-tv1boFrHfwsHJebcUec-i3WE1vMvP_3EPXdbqb45N4ciQ
Content-Type: application/json
Accept: */*
Content-Length: 587

{
  "tokenId": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE2OTg4MjI3NTQsImlzcyI6IkRPS1UiLCJjbGllbnRJZCI6IkJSTi0wMjAyLTE2OTAyNzUzNTM3OTgiLCJhY2NvdW50SWQiOiJjZTBhZWIyM2YyMmZhOTgxZWViNTE1MjFmZmNkYmUzNyJ9.QZ2z0p2PoCYbuBSId7LleLqTUwNyNIeM1PUSaV4DwGKO05l7xQ3EbpdAPK62hxKNcczKqQqGY2Om6rzS78s2Tj88dkDD2vl46o3xEPd_plqQW8ayFqS74Z_HcFJfdo-egqFv9rAX7qgiE5AJHSx_hFolET9B3o3Jx82lmQutnXOjYb5gW9PV0FCPIZRWOaXppOSJSVcmTvXZxF0KUID9-2QVmQ5aPZroHjShYJKGyUu-1tCPClD_CbZMCi3TxhKLnI3e2oIoK7VjXEsrJjuil8O1zZTT7_aXAGgTu5UcPCrc0U9_3Nj-wQlEjDpedMVypKAWATWBUVpMo2MAsBRDAw",
  "additionalInfo": {
    "channel": "DIRECT_DEBIT_MANDIRI_SNAP"
  }
}

{
  "responseCode": "2000500",
  "responseMessage": "Successful",
  "referenceNo": "UNB-0001",
  "redirectUrl": "https://doku.com/direct-debit/ui/binding/2238230713001534401107183161486001168389"
}