Finalise Masterpass Order

Finalises the Masterpass order. All query string parameters from the request URL are merged into the submitted form data, and the amount form key is removed before validation. This is the mechanism used to consume 3D Secure return parameters appended as query string by the gateway.

Required Fields:

• token: The Masterpass payment token received from the gateway.

• three_d_secure: Boolean indicating whether the transaction went through 3D Secure. Defaults to false.

Optional / 3D Secure Callback Fields:

• oid, md, xid, eci, cavv, rnd, hash, hashParams, hashParamsVal, mdStatus, bankIca, paymentReceived, clientId, sign: 3D Secure callback parameters returned by the bank.

• amount: Decimal value from the bank callback. When present, it is validated against the order total. A mismatch returns "Transaction failed. Please try again.". Note: any amount form field is removed before query string parameters are merged.

3D Secure Validation:

• When three_d_secure is true:

  • The hash is validated against the gateway. A failure returns "Hash values doesn't match.".

  • The MD status is validated. A failure returns "Transaction failed. Please try again.".

Processing:

1. Query string parameters from the bank callback are merged into the request body (form amount is removed first).

2. Order defaults are applied without regenerating the order number, as it was already assigned in MasterpassOrderNoPage.

3. When pre_order.redirect_to_three_d is false, no separate transaction record is created at this step. Otherwise a transaction is created with id "MASTERPASS_<order_number>_<suffix>".

4. The payment is processed and the order is finalised.

Backward Navigation:

• This page does not perform any backward state changes.

Next Page:

• ThankYouPage

available_for_post_order: true

post

Header parameters

x-requested-withstring · enumRequired

Required header for AJAX requests. Must be set to XMLHttpRequest for all checkout requests.

Default: XMLHttpRequestPossible values:

CookiestringOptional

Session cookie header (e.g. sessionid=abc123 or osessionid=<session_id>)

Body

Final Masterpass submission payload. The endpoint also merges any request query string parameters into the form data (with the form amount key removed before merging) so that 3D Secure callback parameters appended by the bank are captured automatically.

tokenstringRequired

Masterpass payment token received from the gateway.

Example: mp-token-abc123

three_d_securebooleanRequired

Indicates whether the transaction went through 3D Secure. When true, the hash and MD status are validated. Defaults to false.

Default: falseExample: false

oidstringOptional

Order ID echoed back by the bank on 3D callback.

Example: ORD-2026-0042

mdstringOptional

3D Secure md parameter from the bank callback.

xidstringOptional

3D Secure xid parameter from the bank callback.

ecistringOptional

3D Secure ECI value from the bank callback.

Example: 05

cavvstringOptional

3D Secure CAVV value from the bank callback.

rndstringOptional

3D Secure random nonce from the bank callback.

hashstringOptional

Bank-issued response hash. Validated via the gateway when three_d_secure is true.

hashParamsstringOptional

3D Secure hash params list from the bank callback.

hashParamsValstringOptional

3D Secure hash params values from the bank callback.

mdStatusstringOptional

3D Secure MD status. Validated via the gateway when three_d_secure is true. A failure returns "Transaction failed. Please try again.".

Example: 1

bankIcastringOptional

Bank ACQ ICA value passed back by the gateway.

paymentReceivedstringOptional

Payment received indicator returned by the gateway.

amountstring · decimalOptional

Total amount from the bank callback. When present, it is validated against the order total. A mismatch returns "Transaction failed. Please try again.". Note: any amount form field is removed before query string parameters are merged into the body, so the value used is the one supplied by the bank callback when present.

Example: 16559

clientIdstringOptional

Merchant client ID echoed back by the gateway.

signstringOptional

Signature value from the bank callback.

Responses

200

Masterpass order finalised successfully

application/json

errorsone of · nullableOptional

or

string[]Optional

template_namestringOptional

post/orders/checkout/?page=MasterpassCompletePage

POST /orders/checkout/?page=MasterpassCompletePage HTTP/1.1
Host: sandbox.akinon.com
x-requested-with: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 50

"three_d_secure=false&token='mp-token-abc123'"

200

Masterpass order finalised successfully

{
  "context_list": [
    {
      "page_name": "ThankYouPage",
      "page_slug": "thankyoupage",
      "page_context": {
        "redirect_url": "/orders/checkout-success/abc123:def456:ghi789/",
        "order_id": 5042,
        "order_number": "ORD-2026-0042",
        "new_user": false,
        "token": null,
        "campaigns": []
      }
    }
  ],
  "pre_order": {
    "order": {
      "pk": 5042,
      "number": "ORD-2026-0042",
      "status": "confirmed"
    },
    "payment_option": {
      "pk": 5,
      "slug": "masterpass",
      "payment_type": "masterpass"
    },
    "number": "ORD-2026-0042",
    "total_amount": "165.59",
    "currency_type_label": "TRY"
  },
  "errors": {},
  "template_name": "orders/checkout.html"
}