Authorization Controller API
With the Authorization Controller API (Auth API) Galileo clients have the ability to participate in the approval process for authorization requests that arrive over card-network rails. This guide explains how to use the Auth API and how to interpret the webhook payload.
You can view the full reference guide for the Auth API fields here:
This guide assumes that you are familiar with the concepts explained in these guides:
To see how specific transaction types are represented in the Events API, Program API and RDF data alongside Auth API data, see the Card Transactions Scenarios. For actual Auth API webhook payloads, see Auth API v3 webhook examples on this page.
Prior setup
To coordinate with Galileo to set up Auth API, you need to provide:
- Proof of bank approval
- A signed Statement of Work ("SOW")
Differences between version 2 and version 3
All new clients are set up on version 3. For clients on version 2 who want to upgrade to version 3, these are the differences between the versions of the Auth API:
- Version 3 includes this field:
response_code_objects
— An object that contains a list of response codes and textual descriptions that Galileo calculated when determining the value inresponse_code
.
- Version 3 does not include this field:
response_code_list
— A list of response codes that Galileo calculated when determining the value inresponse_code
.
Warning
Version 3 is a breaking change from version 2.
Requirements
The specifics of your setup will be particular to your use case and to the types of systems you are using. Whatever you construct to handle the Auth API, your endpoint must be able to handle what Galileo sends:
- Authentication uses a JWT with a shared secret. See Security in the Auth API reference for details.
- The webhook payload is sent as an HTTP POST using HTTP over TLS 1.2.
- You must respond within 2 seconds of the value in the message's
timestamp
field, which is when Galileo sent the webhook message. - Galileo initiates multiple, simultaneous TCP sessions and sends webhook messages in parallel on those connections.
- For efficiency, Galileo uses the keep-alive function instead of terminating each connection.
- How many connections per second depends on how many cardholders you have and how often they perform card transactions. You must use your own business logic to obtain this sizing information.
Decisions to make
When designing your implementation of the Auth API, you will need to address issues such as these, as well as others:
- Whether you or Galileo will be the system of record. This decision affects funds flow, how parameters are set on the back end, how you respond to the webhook messages, and other considerations.
- How to respond to balance inquiries.
- When to override the Galileo response code, if permitted.
- Whether to implement a real-time funding strategy to transfer funds into a cardholder account to cover the amount of an authorization.
- How to deal with edge cases. Consult the Card Transactions Scenarios for detailed examples of some of the transaction types you will encounter:
- Completions and settlements
- Incremental authorizations
- Reversals and their expiry
- Advices
Message workflow
This is the general sequence of events for an authorization:
- The merchant sends an authorization request to its acquirer.
- The acquirer forwards the request to the network.
- The network forwards the request to Galileo.
- Gaileo forwards the request to you.
- You return a response to Galileo.
- Galileo forwards the response to the network.
- The network forwards the response to the acquirer.
- The acquirer forwards the response to the merchant, who completes the transaction.
Message types
Messages sent between acquirers and issuers over card-network rails conform to the ISO 8583 standard. (The messages are in EBCDIC format, which does not support international character sets.) The standard defines message type indicators (MTIs), which specify the type of message being sent and indicate what kind of response is expected. MTIs are four-digit codes that are broken out as follows, with the values that are most likely to be included in Auth API webhook payloads:
- First digit — Version of ISO 8583 used
- 0 — 1987 version
- 1 — 1993 version
- Second digit — General purpose of the message
- 1 — Authorization message
- 2 — Financial message
- 4 — Reversals and chargebacks
- Third digit — Message function
- 0 — Request
- 1 — Request response
- 2 — Advice
- 3 — Advice response
- Fourth digit — Session initiator
- 0 — Acquirer
- 2 — Issuer
Note
Galileo is not an issuer—your partner bank issues your cards, and Galileo is the processor; however, Galileo fulfills the issuer role when exchanging ISO 8583 messages with the network.
The typical flow of messages between acquirer and issuer follows this pattern:
- The merchant sends a message to its acquirer.
- The acquirer converts the message into ISO 8583 format and sends the message to the card network with a request or notification-type MTI.
- The network forwards the message to the issuer.
- The issuer processes the message information and then sends a response message to the network with a response-type MTI.
- The network forwards the response to the acquirer.
- The acquirer processes the message and sends the response to the merchant.
For example, when an acquirer sends an authorization request over credit rails, the MTI is 0100, and when the issuer responds it's MTI 0110.
These are the most common MTI request/response combinations that you will encounter with the Auth API.
Description | From acquirer | Issuer response |
---|---|---|
Authorization or preauthorization request over credit rails or preauthorization request over debit rails | 0100 | 0110 |
Authorization request over debit rails | 0200 | 0210 |
Advice over credit rails | 0120 | 0130 |
Advice over debit rails | 0220 | 0230 |
Authorization reversal over credit or debit rails | 0420 | 0430 |
When you send your response to Galileo, you are not required to provide the MTI: Galileo will convert your response into ISO 8583 format and include the appropriate MTI to send to the network.
Note
When the third digit is
2
, the message is an advice, which you cannot reject: only a00
response code is permitted.
Alongside the MTI in the webhook message, Galileo further breaks down message types based on other information that it receives in the message to provide you with more detail. This information is provided in the auth_type
and transaction_type
fields. These are the combinations you will most likely encounter.
Description | auth_type | transaction_type | mti |
---|---|---|---|
Authorization request | Auth | Auth | 0100 (credit rails) 0200 (debit rails) |
Preauthorization request | Auth | Preauth | 0100 |
ATM withdrawal request | Auth | ATM | 0200 |
Request for a cash advance from a teller | Auth | Cash Advance | 0200 |
Balance inquiry from an ATM or other vendor | Auth | Balance Inquiry | 0200 |
Request to apply credit from a merchant | Auth | Merchant Credit | 0200 |
Request to load a card | Auth | Payment | 0200 |
Request to convert a card into a token for a mobile wallet | Auth | Tokenization | 0100 |
Notification of a completion | Advice | Auth | 0120 (credit rails) 0220 (debit rails) |
Adjustment | Advice | Adjustment | 0200 |
Notification of a reversal | Reversal | Auth | 0420 |
Reversal of a card load | Reversal | Payment | 0220 |
Data elements
The ISO 8583 standard defines data elements (DEs) that contain details about the transaction, such as transaction amounts, card-reader identifier and PIN capabilities, merchant name and identifier, and currency codes and conversion rates. Galileo extracts information from the DEs and converts it into the human-readable field names and values of the Auth API message. See Data Elements to see which Mastercard and Visa DEs correspond to fields in the Auth API and to correlate those fields with other Galileo resources.
Auth API process
This is the sequence of events between Galileo and you for a typical authorization request.
- Galileo receives an authorization request over a card network's rails in ISO 8583 format.
- Galileo performs validation checks and calculates response codes.
- Galileo converts its response codes and selected elements of the network message into the webhook format and sends it to you.
- You apply logic to decide whether to override Galileo's response code, if permitted.
- You send your response to Galileo within two seconds.
- Galileo converts your response into ISO 8583 format and forwards it to the network.
Validation checks
See Auth API Validation Checks for details on the various response codes that Galileo calculates when evaluating an authorization request.
Additional field information
See the Auth API Field Detail guide for more information on these topics:
Tokenization requests
- Tokenization requests — Details on tokenization requests
IIAS fields
- IIAS fields — Information returned by an inventory information approval system (IIAS)
Advanced Auth API fields
- Advanced Auth API fields — Various DEs specially parsed and included by request
Calculating a response code
Based on the checks Galileo performs, Galileo populates response_code_list
(version 2) or response_code_objects
(version 3). From these lists, Galileo selects the response code to return in the response_code
field. Galileo chooses the response_code
from among multiple codes according to a proprietary algorithm. See the Authorization Response Codes enumeration for the full list of codes.
Galileo returns 00
(success) if no other response codes were generated or if the authorization message is an advice. When the response code is 00
, response_code_objects
or response_code_list
is empty.
Sending a response
If you agree with the response_code
that Galileo sends in the webhook message, or if it is a response_code
that you are not allowed to override, your response should echo the Galileo response code. For example, if Galileo sends response_code: 00
, and you do not want to override it, this should be your response:
{
"response_code": "00"
}
Your response must be in JSON format. More sample responses are in the reference (Version 2, Version 3). The response must arrive at Galileo within two seconds of the time Galileo sent the webhook message to you. If you do not respond in time, Galileo may perform fallback processing, depending on your arrangements with Galileo. See Fallback processing for more information.
Overrides
You are permitted to override Galileo's responses only under certain circumstances.
Response code override
Galileo recommends that you build logic to override these response codes only:
00
— Success10
— Approved for partial amount46
— Suspected fraud (Visa only)51
— Insufficient funds59
— Suspected fraud63
— Suspected fraud (Mastercard only)
Overriding these response codes requires bank approval. To add more response codes to override after initial setup, you will need additional bank approval. For example, you might want to approve tokenization requests for Mastercards that are in status: W
(waiting for payment). In that case, you would get bank approval to override response_code: 78
when transaction_type: Tokenization
and card_status: W
.
When overriding a response code to deny a transaction, card networks advise that you not use the generic response_code: 05
(do not honor) unless other, more-specific response codes do not apply. For example, if Galileo calculates response_code: 10
(partial approval) and you don't want to approve those funds, use response_code: 51
(insufficient funds) instead of response_code: 05
.
When you have obtained bank permission for the overrides, Galileo updates your settings to specify which overrides you can perform. If you attempt to perform an override that is not in your settings, then Galileo performs the action specified in the APIFB parameter (fallback processing).
AVS override
When Galileo performs AVS checks, the verdict is in the avs_result
field and the values used to perform the check are in the avs_data
object. If you have reason to believe that Galileo does not have the latest address information, you can perform AVS yourself on the updated address and populate avs_response
to override Galileo's result. See AVS Codes for valid values.
Overriding insufficient funds
When Galileo returns 51
(insufficient funds), you can override it in one of these ways:
- Approval override — Use only when you hold the ledger for your program.
- Partial authorization — Valid only when the merchant supports partial authorizations.
- Real-time transfers — You must set up a transfer account for this option.
Approval override
If you hold the ledger for your program, Galileo may not have accurate balance information. If Galileo returns 51
, and your ledger shows that there are sufficient funds, you should respond with response_code: 00
. It is not necessary to provide the correct balance in the response.
Partial authorization
Merchants determine whether they will accept partial authorizations. If the merchant accepts partial authorizations, then partial_supported: true
.
If you hold the balance, populate partial_amount
with the amount to authorize for the transaction and return response_code: 10
(approved for partial amount) or response_code: 87
(approved for partial purchase amount but not cash back).
If Galileo holds the balance, the partial_amount
field is already populated with the amount to authorize—which will be the available balance—and response_code: 10
. If you do not want to authorize the partial amount, return response_code: 51
to override Galileo's code.
If you never want to support partial authorizations, set the PAPPR parameter.
Real-time transfers
As desired, you can build logic on your side to transfer funds into a cardholder account to cover the amount of an authorization when the cardholder account has insufficient funds. In that case, you populate these fields:
transfer_prn
— The PRN of the account to provide funds.transfer_amount
— The amount of the transfer.source_transfer_type
— Transaction type code for the account intransfer_prn
.dest_transfer_type
— Transaction type code for the cardholder account.
The activity type will be AD
(adjustment) for both the source account and cardholder account. Use the transfer type codes (otypes) that Galileo provided to you.
For example, if the cardholder has 25.00 in their account and the amount of the authorization is 30.00, you could transfer 5.00 into the cardholder account and return response_code: 00
.
Tip
You can use real-time transfers to partially subsidize transactions. For example, you can build logic on your end to transfer a portion of the request amount from a central account when the request is from a certain MCC or merchant, and the rest of the amount would be drawn from the cardholder account. For example, if a request from the designated MCC arrives for 20.00, you can transfer 5.00 from the central account, and then the remaining 15.00 would automatically come from the cardholder account.
Note
Another method to transfer funds into card accounts at authorization is real-time funding. See Comparison with other methods in the About Real-Time Funding guide for an explanation of the difference.
Overriding limits
With the override_limit
field you can override velocity limits that are set for the product. Use the amt_til_limit
and nearest_limit
fields to see how close an account is to exceeding a limit and which limit that would be.
Exercise caution with this type of override, however. Confirm with your bank that you are able to override limits and ensure that you have clearly defined which circumstances permit an override.
Balance-inquiry responses
A balance inquiry is a standalone authorization request with trans_amount: 0.00
and transaction_type: Balance Inquiry
. (In some jurisdictions such as Mexico, a small fee may be included in the trans_amount
field.) This type of request typically comes from an ATM (MCC 6011).
For these transaction types, eligible_for_balance_return: true
and response_code: 00
. Galileo supports returning up to three account balances for a balance inquiry, depending on which accounts the cardholder owns:
- Card account
- Savings account
- Credit limit
The available_funds
field shows the amount that Galileo will return to the requester for the card account. However, if you hold the ledger for any of those three accounts, you can supply the correct balance in these response fields:
available_balance
— The amount to spend in the card accountsavings_balance
— The amount in the cardholder's savings accountavailable_credit
— Available credit to spend, for a secured or revolving credit account
If you do not populate those fields, and Galileo holds the ledger for the accounts, Galileo populates the balance fields with the current balances and returns them to the requester.
If any of the account types do not exist, these are the response codes to return:
39
— Visa, STAR, Pulse. No credit account found52
— Visa, STAR, Pulse. No checking account found (DDA, card account)53
— Visa, STAR, Pulse. No savings account found77
— Mastercard, Discover. Invalid FROM account
Note
Galileo can return the balance for an account type only if the cardholder has only one account of that type. For example, if an account holder has two savings accounts associated with the card account, Galileo cannot provide the savings-account balance.
- In the Authorized Transactions RDF, balance inquiries are identified by
TRANSACTION CODE 10
. - These inquiries are not included in the Posted Transactions RDF, Program API responses, or the CST.
- The VSBLA product parameter determines whether Visa balance inquiries are supported.
- You can request that the
AABI: bal
event be sent for balance inquiries.
A balance return is part of a conventional authorization request for a purchase amount, such as when the merchant wants to print the remaining balance on the receipt. In this case, transaction_type
contains a value other than Balance Inquiry
.
For Mastercard balance returns, you determine merchant eligibility by setting the parameters shown in Balance inquiries in the Galileo setup section of the Authorization guide. If the parameters determine that the merchant is eligible, then eligible_for_balance_return: true
.
If Galileo holds the ledger for the card account, Galileo returns the balance shown in available_funds
with response code 00
(success). However, if eligible_for_balance_return: false
, one of two things can happen:
- Galileo responds with
05
(do not honor), which is the default - You decide to provide the balance anyway, because you hold the ledger for the card account. In your response, populate
available_balance
with the balance to return to the merchant and override the05
withresponse_code: 00
.
Fee-inquiry requests
In Colombia, cardholders at an ATM have the option of previewing the fee amount for a withdrawal, and they can then decide whether to proceed with the transaction or cancel it.
This type of inquiry includes a few new fields in the Auth API message. See Colombia ATM Issuer Fee Inquiries for more information on how to respond to these requests.
Fallback processing
When you do not respond to Galileo in time, Galileo can perform "fallback" processing, meaning that Galileo either responds with 05
(do not honor) for all transactions, or it returns the response that it has calculated, depending on how the APIFB product parameter is set. When this parameter is not set, Galileo returns 05
(do not honor) for all transactions that you do not respond to. When APIFB is set to Y
, Galileo returns the response that it has calculated.
Note
There is no retry mechanism for Auth API messages.
If Galileo will provide fallback processing and you are the system of record, you must devise a way to keep Galileo updated on your account balances so that Galileo can determine whether accounts have sufficient balance. You could send a batch file every few hours, for example.
When Galileo does not receive your response in time, it sends the OATO: Auth_API_Timeout
Account Event message, and then Galileo sends you the AUFB: auth_fallback
Authorization Event message to notify of both approved and denied fallback authorizations.
Stand-in processing
In some cases, a network must process a transaction on Galileo's behalf, such as when Galileo does not respond to an authorization request in time. On other occasions, a network may perform on-behalf services instead of sending the transaction to Galileo for processing.
In both cases, the network has performed stand-in processing (STIP), according to Galileo nomenclature. When you set up your relationship with the card network, you specify how and when the network will perform STIP. In all cases, you arrange for STIP when Galileo does not respond, and you also have the option to sign up for on-behalf services that the network provides. These on-behalf services are performed regardless of Galileo system availability.
When a network performs STIP, it sends Galileo an advice to notify of the action taken. There are two types of STIP transaction:
- Financial — The network action changes the available balance on a cardholder account.
- Non-financial — The network action does not affect the cardholder balance.
Specifically, Galileo classifies a STIP transaction as financial if it meets any of these criteria. Advices that do not meet these criteria are considered non-financial:
- MTI 0420 or 0400
- Approved (incoming DE039 = 00, 10, or 87) MTI 0120 or 0220 advice message
- Multi-clearing advices. Galileo does not adjust the available balance for these transactions until the clearing message arrives in the settlement batch file.
For financial STIP transactions, Galileo relays the advice to you over the Auth API webhook. For non-financial STIP transactions, Galileo does not send an Auth API message.
Galileo also sends event messages according to the type of STIP transaction:
STPA: auth_stip_advice
— Mastercard or Visa approval or denial. The STIPA parameter must be enabled. Ifis_stip_denial: Y
, then the transaction was denied and no Auth API message was sent.BAUT: auth
— Visa approvals. No STIP information is provided with this message.STPD: auth_stip_info
— Mastercard or Visa non-financial STIP transactions, which do not affect the available balance. The STIPD parameter must be enabled. An Auth API message is not sent for these transactions.
STIP reason codes
To indicate why they performed stand-in processing, Visa and Mastercard send an advice reason code in the advice notification. Galileo forwards this reason code in these fields:
stip_info
— In theSTPD: auth_stip_info
event messagestip_advice
— In theSTPA: auth_stip_advice
event messagestip: {detail}
— In the Auth API webhook payloadDE60
— In the Authorized Transactions RDF and the Posted Transactions RDF. (This field contains any advice reason code, not just STIP-related codes.)
Next-generation STIP reporting
Galileo is moving to a new model for STIP reporting that provides you with additional information on STIP transactions. You must arrange with Galileo to use this new reporting model, which replaces the previous model.
- Instead of enabling STIPA or STIPD, the new STIPR (STIP Reporting) parameter is enabled.
- A new event message,
STPN: auth_stip_notification
, replacesSTPA: auth_stip_advice
andSTPD: auth_stip_info
. It is triggered by both financial and non-financial STIP advices. - Four STIP-specific fields are provided across Galileo systems. This table shows how the fields are represented by each Galileo system.
STIP response | Is STIP denial | STIP detail | Additional STIP detail | |
---|---|---|---|---|
Auth API | stip_decision | is_stip_denial | detail | stip_additional_detail |
Events API | stip_decision | is_stip_denial | stip_detail | stip_additional_detail |
RDFs | STIP RESPONSE | STIP STATUS | DE60 | DE121 REASON CODES |
- STIP response — The Authorization Response Code that was returned to the merchant by the STIP process. Replaces
in_de39
for Events. - Is STIP denial — A Boolean to indicate whether the financial transaction was denied.
- STIP detail — The Advice Reason Code.
- Additional STIP detail — Further information provided by the network.
DE121
is for Mastercard credit only, andREASON CODES
is for Visa only.
Authorization Events API
You can arrange for Galileo to send you Events API webhook messages to notify of approvals and denials. See the Authorization Events index for the list of webhooks you can set up.
For common Authorization Events sequences, see Authorization events in the Events API Scenarios guide. Also see the examples in the Card Transactions Scenarios.
Galileo setup
These are some of the parameters that control the behavior of the Auth API. Also see Galileo setup in the Authorization guide for parameters that affect authorization behavior.
Parameter | Description |
---|---|
APIFB | Controls whether to perform fallback processing when your response to the webhook message times out. When this parameter is N or not set, Galileo returns response code 05 (do not honor) for all fallback transactions. When this parameter is Y , Galileo returns the response code that it has calculated. |
APPOL | Controls whether you review all transactions via the Auth API or only transactions that pass Galileo’s initial check. |
AUAPI | Contains host:port addresses for servers that Galileo sends webhook messages to. |
AUAPR | Controls whether Galileo waits for a response to an advice. When set to Y or not set, Galileo waits for your response for all Auth API webhook messages. When set to N , Galileo doesn't wait for your response for advice authorizations. (For all other authorizations, Galileo still waits for your response.) |
MLAPI | Contains the host:port address of the server to use for machine-learning fraud detection. |
RULAP | Controls whether to send a comma-separated list of rule names that caused a DENY or WARN for an authorization in the Auth API request payload. The DENY rules are in the rules_denied field and the WARN rules are in the rules_warned field. Valid only when using Galileo's fraud-detection process. |
Auth API v3 webhook examples
Use these code samples (called Recipes) to help test your system. These samples come from actual Auth API v3 webhook messages. You can also find these Recipes by clicking Recipes in the top navigation bar.
Updated about 2 months ago