Response

The authorization service response applies to both channels:

Ecommerce
POS

This structure identifies whether the request was processed, the result returned by the card brand, traceability identifiers, and the operation’s internal status.

HTTP response headers

Service HTTP responses must include the following security headers:

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Security-Policy: child-src *; frame-ancestors *;
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin, same-origin
Permissions-Policy: screen-wake-lock=*

Header	Value	Purpose
`Strict-Transport-Security`	`max-age=63072000; includeSubDomains; preload`	Forces HTTPS for the configured period.
`Content-Security-Policy`	`child-src ; frame-ancestors ;`	Defines allowed origins for embedded content and framing.
`X-Frame-Options`	`SAMEORIGIN`	Limits framing of the page to the same origin.
`X-Content-Type-Options`	`nosniff`	Prevents the browser from inferring a different content type.
`Referrer-Policy`	`strict-origin, same-origin`	Controls the referrer information sent during navigation.
`Permissions-Policy`	`screen-wake-lock=*`	Allows Screen Wake Lock according to the configured origin allowlist.

Configure these headers on the server, API gateway, CDN, or reverse proxy that returns the response. frame-ancestors * allows any origin to frame the page and may conflict with X-Frame-Options: SAMEORIGIN. Validate this combination with your security team before using it in production.

Successful response

The main HTTP response contains the security headers and the operation’s JSON body:

HTTP/1.1 200 OK
Content-Type: application/json
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Security-Policy: child-src *; frame-ancestors *;
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin, same-origin
Permissions-Policy: screen-wake-lock=*

{
  "success": "true",
  "transaction": {
    "tk_transaction_identifier": "42c2ff66-3eb0-4a69-9848-430fc722f6bc",
    "processor_response": {
      "message": {
        "code": "00",
        "description": "Successful payment"
      },
      "brand_transaction_identifier": "306190611475347",
      "authorization_identification_response": "087657",
      "retrieval_reference_code": "619016007284",
      "system_trace_audit": "007284",
      "response_code": "00",
      "date_settlement": "0710"
    },
    "meta": {
      "status": {
        "code": "success_operation",
        "message_ilgn": [
          {
            "locale": "en_US",
            "value": "Request processed successfully"
          }
        ]
      },
      "metrics": {
        "aggregate": {
          "start": "1783616336421",
          "end": "1783616348410",
          "duration": {
            "milliseconds": "11988"
          }
        }
      }
    }
  }
}

Field descriptions

Field	Type	Description
`success`	string	Indicates whether the service processed the operation. Values: `true` or `false`.
`transaction.tk_transaction_identifier`	string UUID	Unique transaction identifier in the system.
`transaction.processor_response.message.code`	string	Card-brand response code. `00` indicates an approved operation.
`transaction.processor_response.message.description`	string	Human-readable description of the operation result.
`transaction.processor_response.brand_transaction_identifier`	string	Transaction identifier assigned by the card brand.
`transaction.processor_response.authorization_identification_response`	string	Operation authorization code. It normally contains six digits.
`transaction.processor_response.retrieval_reference_code`	string	RRN, or Retrieval Reference Number. Used for queries, traceability, and reconciliation.
`transaction.processor_response.system_trace_audit`	string	STAN, or System Trace Audit Number. Transaction audit identifier.
`transaction.processor_response.response_code`	string	ISO response code. `00` indicates approval.
`transaction.processor_response.date_settlement`	string	Estimated settlement date in `MMDD` format.
`transaction.meta.status.code`	string	Internal operation status. Examples: `success_operation`, `invalid_request`.
`transaction.meta.status.message_ilgn`	array	List of localized messages associated with the operation result.
`transaction.meta.status.message_ilgn[].locale`	string	Message locale. Example: `en_US`.
`transaction.meta.status.message_ilgn[].value`	string	Descriptive operation result message.
`transaction.meta.metrics.aggregate.start`	string	Processing start timestamp.
`transaction.meta.metrics.aggregate.end`	string	Processing end timestamp.
`transaction.meta.metrics.aggregate.duration.milliseconds`	string	Total processing time in milliseconds.

Interpret a successful response

An authorization is considered approved when the main response fields contain these values:

Field	Expected value	Interpretation
`success`	`true`	The service processed the request.
`processor_response.message.code`	`00`	The card brand returned an approval.
`processor_response.response_code`	`00`	ISO approval code.
`meta.status.code`	`success_operation`	Successful internal status.

Traceability identifiers

Use the following fields for transaction tracking, queries, reconciliation, operational support, and card-brand validation.

Field	Use
`tk_transaction_identifier`	Unique internal transaction identifier.
`brand_transaction_identifier`	Identifier assigned by the card brand.
`authorization_identification_response`	Transaction authorization code.
`retrieval_reference_code`	RRN used for traceability, queries, and reconciliation.
`system_trace_audit`	Transaction STAN.
`date_settlement`	Estimated settlement date.

`processor_response` object

The processor_response object contains the response received from the processor or card brand.

{
  "processor_response": {
    "message": {
      "code": "00",
      "description": "Successful payment"
    },
    "brand_transaction_identifier": "306190611475347",
    "authorization_identification_response": "087657",
    "retrieval_reference_code": "619016007284",
    "system_trace_audit": "007284",
    "response_code": "00",
    "date_settlement": "0710"
  }
}

Field	Description
`message.code`	Card-brand response code.
`message.description`	Description of the operation result.
`brand_transaction_identifier`	Transaction identifier assigned by the brand.
`authorization_identification_response`	Authorization code.
`retrieval_reference_code`	Transaction RRN.
`system_trace_audit`	Transaction STAN.
`response_code`	ISO response code.
`date_settlement`	Estimated settlement date in `MMDD` format.

`meta.status` object

The meta.status object contains the operation’s internal status in the system.

{
  "status": {
    "code": "success_operation",
    "message_ilgn": [
      {
        "locale": "en_US",
        "value": "Request processed successfully"
      }
    ]
  }
}

Field	Description
`code`	Internal operation status code.
`message_ilgn`	List of localized messages.
`message_ilgn[].locale`	Message locale.
`message_ilgn[].value`	Localized result description.

`meta.metrics` object

The meta.metrics object contains operation processing-time information.

{
  "metrics": {
    "aggregate": {
      "start": "1783616336421",
      "end": "1783616348410",
      "duration": {
        "milliseconds": "11988"
      }
    }
  }
}

Field	Description
`aggregate.start`	Processing start timestamp.
`aggregate.end`	Processing end timestamp.
`aggregate.duration.milliseconds`	Total processing time in milliseconds.

Considerations

success indicates whether the service processed the request.
For an approved operation, validate both the card-brand response code and the internal operation status.
Store tk_transaction_identifier for future queries.
retrieval_reference_code and system_trace_audit are relevant for operational traceability.
Use authorization_identification_response as the operation’s authorization code.
date_settlement identifies the estimated settlement date.
Use meta.metrics timing data for monitoring, support, and performance analysis.

Getting started

Help and contact

HTTP response headers

Successful response

Field descriptions

Interpret a successful response

Traceability identifiers

`processor_response` object

`meta.status` object

`meta.metrics` object

Considerations

Authorization channels

Ecommerce

POS

​HTTP response headers

​Successful response

​Field descriptions

​Interpret a successful response

​Traceability identifiers

​processor_response object

​meta.status object

​meta.metrics object

​Considerations

​Authorization channels

Ecommerce

POS

HTTP response headers

Successful response

Field descriptions

Interpret a successful response

Traceability identifiers

`processor_response` object

`meta.status` object

`meta.metrics` object

Considerations

Authorization channels