Finalise Masterpass REST Order

Finalises the Masterpass REST order. The body of this request reflects the Masterpass / 3D Secure callback payload. Note that all query string parameters from the request URL are merged into the submitted form data, while the amount form key (if any) is removed before validation. This is the mechanism used to consume 3D Secure return parameters that are appended as query string by the gateway.

Required Fields:

• three_d_secure: Must match pre_order.redirect_to_three_d (set during MasterpassRestOrderNoPage). Submitting a mismatching value returns the error "Transaction failed. Please try again.".

Optional / 3D Secure Callback Fields:

• token: Masterpass payment token.

• oid, md, xid, eci, cavv, rnd, hash, hashParams, hashParamsVal, mdStatus, bankIca, paymentReceived, clientId, sign: 3D Secure callback parameters returned by the bank.

• amount: Decimal value (12 digits, 2 decimal places). When provided, it is divided by 100 and validated against pre_order.get_total_amount_with_interest(). A mismatch returns "Transaction failed. Please try again.". Note that the amount form key in the body is stripped before merging the query string, so the value used is the one provided via the bank callback if any.

• transactionType: One of PURCHASE, PURCHASE_3D, DIRECT_PURCHASE, DIRECT_PURCHASE_3D, REGISTER_AND_PURCHASE, REGISTER_AND_PURCHASE_3D.

• status, completeStatus, paymentId, conversationData, conversationId, callbackStatus: Additional Masterpass status fields.

3D Secure Validation:

• When three_d_secure is true:

  • If the gateway has hash_validation_enabled and the request comes from a non-mobile client (client_type is neither ios nor android), the hash is validated via gateway.is_hash_valid(...). A failure returns "Hash values don't match.".

  • The MD status is validated via gateway.is_md_status_valid(...). A failure returns "Transaction failed. Please try again.".

Processing:

1. The base process() is called with the merged data (form body + request query string, with the form amount removed).

2. The set_defaults step runs with set_number=False because the order number was already assigned in MasterpassRestOrderNoPage.

3. When pre_order.redirect_to_three_d is false, skip_create_transaction returns true and no separate transaction record is created at this step. Otherwise a transaction with id "MASTERPASS_<order_number>_<suffix>" is created.

4. The Masterpass payment is processed via the PaymentPageMixin.process_order flow, which submits the basket, saves contracts, and triggers post-completion notifications.

Next Pages:

• ThankYouPage

Backward Navigation:

• This page does not perform any backward state changes (backward() is a no-op).

available_for_post_order: true

post

Header parameters

x-requested-withstring · enumRequired

Required header for AJAX requests. Must be set to XMLHttpRequest for all checkout requests.

Default: XMLHttpRequestPossible values:

CookiestringOptional

Session cookie header (e.g. sessionid=abc123 or osessionid=<session_id>)

Body

Final Masterpass REST submission payload. The endpoint also merges any request query string parameters into the form data (with the form amount key removed before merging) so that 3D Secure callback parameters appended by the bank are captured automatically.

three_d_securebooleanRequired

Must match pre_order.redirect_to_three_d set in MasterpassRestOrderNoPage. A mismatch returns "Transaction failed. Please try again.".

Example: true

tokenstringOptional

Masterpass payment token issued by the SDK.

Example: mp-token-abc123

oidstringOptional

Order id echoed back by the bank on 3D callback.

Example: ORD-2026-0042

mdstringOptional

3D Secure md parameter from the bank callback.

xidstringOptional

3D Secure xid parameter from the bank callback.

ecistringOptional

3D Secure ECI value from the bank callback.

Example: 05

cavvstringOptional

3D Secure CAVV value from the bank callback.

rndstringOptional

3D Secure random nonce from the bank callback.

hashstringOptional

Bank-issued response hash. Validated via gateway.is_hash_valid when three_d_secure is true and the gateway has hash_validation_enabled (skipped for iOS/Android client types).

hashParamsstringOptional

3D Secure hash params list from the bank callback.

hashParamsValstringOptional

3D Secure hash params values from the bank callback.

mdStatusstringOptional

3D Secure MD status. Validated via gateway.is_md_status_valid when three_d_secure is true. A failure returns "Transaction failed. Please try again.".

Example: 1

bankIcastringOptional

Bank ACQ ICA value passed back by the gateway.

paymentReceivedstringOptional

Payment received indicator returned by the gateway.

amountstring · decimalOptional

Total amount in minor units returned by the bank. Divided by 100 during validation and compared against pre_order.get_total_amount_with_interest(). A mismatch returns "Transaction failed. Please try again.". Note: any amount form field is dropped before request query parameters are merged into the body, so the value used is the one supplied by the bank callback when present.

Example: 16559

clientIdstringOptional

Merchant client id echoed back by the gateway.

signstringOptional

Signature value from the bank callback.

transactionTypestring · enumOptional

Masterpass transaction type.

Example: PURCHASE_3DPossible values:

statusstringOptional

Masterpass status string.

completeStatusstringOptional

Masterpass complete status string.

paymentIdstringOptional

Masterpass payment id.

conversationDatastringOptional

Masterpass conversation data.

conversationIdstringOptional

Masterpass conversation id.

callbackStatusstringOptional

Masterpass callback status string.

Responses

200

Masterpass REST order finalised successfully

application/json

errorsone of · nullableOptional

or

string[]Optional

template_namestringOptional

post/orders/checkout/?page=MasterpassRestCompletePage

POST /orders/checkout/?page=MasterpassRestCompletePage HTTP/1.1
Host: sandbox.akinon.com
x-requested-with: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 50

"three_d_secure=false&token='mp-token-abc123'"

200

Masterpass REST order finalised successfully

{
  "context_list": [
    {
      "page_name": "ThankYouPage",
      "page_slug": "thankyoupage",
      "page_context": {
        "redirect_url": "/orders/checkout-success/abc123:def456:ghi789/",
        "order_id": 5042,
        "order_number": "ORD-2026-0042",
        "new_user": false,
        "token": null,
        "campaigns": []
      }
    }
  ],
  "pre_order": {
    "order": {
      "pk": 5042,
      "number": "ORD-2026-0042",
      "status": "confirmed"
    },
    "payment_option": {
      "pk": 7,
      "slug": "masterpass-rest",
      "payment_type": "masterpass_rest"
    },
    "number": "ORD-2026-0042",
    "total_amount": "165.59",
    "currency_type_label": "TRY"
  },
  "errors": {},
  "template_name": "orders/checkout.html"
}