QRIS Merchant Presented Mode (MPM) Dinamis v1.1
What is QRIS Merchant Presented Mode (MPM) Dynamic ?
Quick Response Code Indonesian Standard or QRIS is a combined QR code from every kind of QR code Payment Service Provider. QRIS was developed by the payment service provider industry together with Bank Indonesia with the intention of having a QR code payment service that is easy, fast, and secure.
With QRIS, QR code payment from every kind of service provider application including bank or non-bank will be able to be used at every merchant with QRIS logo.
QRIS Merchant Presented Mode (MPM) Dynamic is a QR code that must be generated and presented to the customer every time the transaction is made. Merchant will need to input the payment amount and the customer will scan the QR code that was generated and printed.
Use Case of API QRIS Merchant Presented Mode (MPM) Dynamic
QRIS Merchant Presented Mode (MPM) Dynamic is suitable for middle and large business merchants with large volume of transactions. With this API merchant will need to input the payment amount and the customer will scan the QR code that was generated and printed.
API Information
Title | QRIS Dinamis - MPM |
---|---|
Version | v1.1 |
URL Sandbox | https://sandbox.partner.api.bri.co.id/ |
URL Production | https://partner.api.bri.co.id/ |
Version Control
API Version | Date | Link to document | Description |
---|---|---|---|
v1.0 | 11 Mei 2022 | Here | Baseline version. |
v1.1 | 31 Juli 2023 | this pages | Addition of Field issuerRrn to the QR Inquiry Endpoint |
Product Description
Product Overview
This document aims to explain the API specifications of the development of Dynamic QRIS - MPM with the scheme of merchants issuing QRIS, customers using tools to scan / scan merchant QRIS. Then from BRI sends a notification / callback in accordance with predetermined specifications.
Endpoint
A. Get Token
Endpoint Description
This endpoint is used to get an access token that serves as authentication when you want to access other APIs. Pilot tests check that the get token is not hit every time you access the endpoint (integrator).
General Information
HTTP Method | POST |
---|---|
Path | /snap/v1.0/access-token/b2b |
Type Format | JSON |
Authentication | Digital Signature |
Header Structure
Key | Value | Format | Mandatory | Length | Description | Example |
---|---|---|---|---|---|---|
X-SIGNATURE | M |
Retrieved from algoritma asymmetric signature SHA256withRSA (Private_Key, stringToSign). stringToSign = client_ID + “|” + XTIMESTAMP |
||||
X-CLIENT-KEY | Alphanumeric | M | Client’s client_id (Nama PJP) (given upon completion of registration process) | |||
X-TIMESTAMP | Datetime | M | Client's current local time yyyy-MM- ddTHH:mm:ss.SSSTZD format | |||
Content-Type | application/json | M |
Request Structure
Field | Data Type | Format | Mandatory | Length | Description | Example |
---|---|---|---|---|---|---|
grantType | String | Alphabet | Y | “client_credentials” : a client may request an access token using only its client credentials (or other supported means of authentication) when the client requests access to a protected resource under its control. (OAuth 2.0: RFC 6749 & 6750) | client_credentials |
Response Structure
Field | Data Type | Format | Mandatory | Length | Description | Example |
---|---|---|---|---|---|---|
responseCode | String | Numeric | C | Response code | (example code) | |
responseMessage | String | Alphabet | C | Response description | (example message) | |
accessToken | String | Alphanumeric | M |
The access token type provides the client with the information necessary to successfully use the access token to protect the resource request (along with type-specific attributes) The type of token type:
Referensi: OAuth2.0 RFC 6749 & 6750 |
(example access token) | |
tokenType | String | Alphabet | M | (example token type) | ||
expiresIn | String | Alphanumeric | M | The session ends in seconds: 900 (15 minutes) | (example expiration) |
{ "grantType": "client_credentials" }
Normal Response:
{ "accessToken": "jwy7GgloLqfqbZ9OnxGxmYOuGu85", "tokenType": "BearerToken", "expiresIn": "899" }
Error Response:
{ "responseCode": "4007301", "responseMessage": "Invalid Field Format" }
List of Error/Response Code
HTTP Status Code | Response Status | Response Description | Deskripsi |
---|---|---|---|
200 | Success | - | - |
400 | 4007300 | Failed Bad Request | - |
400 | 4007301 | Failed Invalid Field Format | - |
401 | 4017300 | Failed Unauthorized Client | - |
401 | 4017300 | Failed Unauthorized stringToSign | - |
401 | 4017300 | Failed Unauthorized Signature | - |
401 | 4017301 | Failed Invalid Token (B2B) | - |
500 | 500000 | Failed General Error | - |
Signature
Signature ensures that the transmitted data is authentic and cannot be refuted. The signature is generated by the service user and verified by the service receiver.
The signature is formed from the specified payload, by implementing the HMAC_SHA512 algorithm with clientSecret as the key.
Payload
Payload tergabung dari kata kerja, path, token, timestamp, dan body. Dengan format Symetric-Signature:
HMAC_SHA512 (clientSecret, stringToSign) dengan rumus stringToSign = HTTPMethod + ": "+ EndpointUrl + ": "+ AccessToken + ":" + Lowercase(HexEncode(SHA-256(minify(RequestBody))))+ ":" +TimeStamp
Example:
POST:/snap/v1.1/dummy:muhpwhwOkPRU9nNXYnyYHj8t54x3:8b4e9e83b5231cff4f84358ec8ca81951cfe9f999f635b1566452a501d5c23b2:2021-11- 29T09:22:18.172+07:00
The details of each element in the payload are described below:
Path
Value in path is URL after hostname and port without Query Parameter
Example:
https://sandbox.partner.api.bri.co.id/simulator/qr/qr-cpm-payment-url becomes /simulator/qr/qr-cpm-payment-ur
Verb
Method HTTP with capital letters.
Example: GET, POST, PUT, PATCH, and DELETE.
Token
The token used in the Authorisation header.
Example: Bearer R04XSUbnm1GXNmDiXx9ysWMpFWBr
Timestamp
The time when sending the API request. The time format must follow ISO8601 format (yyyy-MM-ddTHH:mm:ss.SSSZ). Must be within zero UTC offset.
Example:
2021-11-02T13:14:15.678+07:00
Body
Body when submitting an API request. Lowercase(HexEncode(SHA-256(minify(RequestBody))))
Contoh: {"hello":"world"}
Result SHA256 : a47a5f14b3e78b5e3d3f81b1a1468499be964660f818c10adcac792c42709749
If there is no request body, for example using the GET method, just leave it blank.
Rerefrensi : https://developers.bri.co.id/en/snap-bi/apidocs-oauth-snap-bi
B. Generate QR
Endpoint Description
The Generate QR API is used to generate the Dynamic MPM QR.
General Information
HTTP Method |
POST |
---|---|
Path |
/v1.1/qr-dynamic-mpm/qr-mpm-generate-qr |
Type Format |
JSON |
Authentication |
OAuth 2.0 |
Header Structure
Key | Value | Format | Mandatory | Length | Description |
---|---|---|---|---|---|
Authorization | Authorization | Alphanumeric | M | - | Bearer {Token} |
X-TIMESTAMP | BRI - timestamp | Datetime | M | - | Format Timestamp ISO8601 |
X-SIGNATURE | BRI - Signature | Alphanumeric | M | - | HMAC_SHA512 |
Content-Type | application/json | Alpha | M | - | application/json |
X-PARTNER-ID | Alphanumeric | M | 36 | ||
CHANNEL-ID | Alpha | M | 5 | ||
X-EXTERNAL-ID | Numeric | M | 36 |
Request Structure
Field | Data Type | Mandatory | Length | Description | Example |
---|---|---|---|---|---|
partnerReferenceNo | String | M | 6 | Identify transactions in the customer service system | 1234567890133 |
amount | Object | M | - | The detailed contents of the object amount are in the table belowi | |
merchantId | String | M | 64 | A unique ID owned by each merchant | 00007100010926 |
terminalId | String | M | 16 | Terminal ID | 213141251124 |
Request Structure dalam Object "amount"
Field | Data Type | Mandatory | Length | Description | Example |
---|---|---|---|---|---|
value | Decimal | M | 18 | The net amount of the transaction. If it is IDR then the value includes 2 decimal places. for example IDR 10,000,- will be placed with 10000.00 | 123456.00 |
currency | String | M | 3 | 3 digit Code ISO Currency | IDR |
Response Structure
Field | Data Type | Mandatory | Length | Description | Example |
---|---|---|---|---|---|
responseCode | String | M | 7 |
Response code HTTP status code + service code + case code |
2004700 |
responseMessage | String | M | 150 | Description response | Successfull |
partnerReferenceNo | String | M | 6 | Transaction identification number in the customer service system | 1234567890133 |
qrContent | String | M | 512 | QR String MPM | |
referenceNo | String | M | 12 | The transaction identification number on the service provider's system. | 409676201434 |
Request & Response Payload Sample
Request:
{ "partnerReferenceNo": "1234567890133", "amount": { "value": "123456.00", "currency": "IDR" }, "merchantId": "00007100010926", "terminalId": "213141251124" }
Normal Response:
{ "responseCode": "2004700", "responseMessage": "Successful", "partnerReferenceNo": "1234567890133", "qrContent": "0002XXXXXXXXX", "referenceNo": "409676201434" }
C. Inquiry Payment
Endpoint Description
Endpoint to make a Dynamic MPM QR payment inquiry.
General Information
HTTP Method |
POST |
---|---|
Path |
/v1.1/qr-dynamic-mpm/qr-mpm-query |
Type Format |
JSON |
Authentication |
OAuth 2.0 |
Header Structure
Key | Value | Format | Mandatory | Length | Deskripsi |
---|---|---|---|---|---|
Authorization | Authorization Bearer {Token} | Alphanumeric | M | ||
X-TIMESTAMP | BRI - timestamp | Datetime | M | Format Timestamp ISO8601 | |
X-SIGNATURE | BRI - Signature | Alphanumeric | M | HMAC_SHA512 | |
Content-Type | application/json | Alpha | M | application/json | |
X-PARTNER-ID | Alphanumeric | M | 36 | ||
CHANNEL-ID | Alpha | M | 5 | ||
X-EXTERNAL-ID | Numeric | M | 36 |
Request Structure
Field | Data Type | Mandatory | Length | Description | Example |
---|---|---|---|---|---|
originalReferenceNo | String | M | 64 | Transaction identification number in the service provider's system | 000008526955 |
serviceCode | String | M | 2 | Transaction type indicator (service code of the original request transaction) | 17 |
additionalInfo | Object | M | Details of the contents of the additionalInfo object are in the table below |
Request Structure dalam Object "additionalInfo"
Field | Data Type | Mandatory | Length | Description | Example |
---|---|---|---|---|---|
terminalId | String | M | 16 | ID Terminal | 100492 |
Response Structure
Field | Data Type | Mandatory | Length | Description | Example |
---|---|---|---|---|---|
responseCode | String | M | 7 |
Response Code HTTP status code + service code + case code |
2005100 |
responseMessage | String | M | 150 | Description Response | Successful |
originalReferenceNo | String | C | 64 | Transaction identification number in the service provider's system | 290005165369 |
serviceCode | String | M | 2 | Service Code | 17 |
latestTransactionStatus | String | M | 2 |
00 - Success 01 - Initiated 02 - Paying 03 - Pending 04 - Refunded 05 - Canceled 06 - Failed 07 - Not found |
00 - Success |
transactionStatusDesc | String | O | 50 | Description of the transaction status | Successfully |
amount | Object | M | Details of the contents of the additionalInfo object are in the table below | ||
terminalId | String | O | 16 | Terminal identification | 10049258 |
additionalInfo | Object | O | Details of the contents of the additionalInfo object are in the table below |
Response Structure dalam Object "amount"
Field | Data Type | Mandatory | Length | Description | Example |
---|---|---|---|---|---|
value | Decimal | M | 18 | The net amount of the transaction. If it is IDR then the value includes 2 decimal places. for example IDR 10,000,- will be placed with 10000.00 | 2000.00 |
currency | String | M | 3 | 3 digit Code ISO Currency | IDR |
Response Structure dalam Object "additionalInfo"
Field | Data Type | Mandatory | Length | Description | Example |
---|---|---|---|---|---|
customerName | String | O | Name of customer | I GEDE TONI DHARMAWAN | |
customerNumber | String | O | Consumer number | 9360015723456789 | |
invoiceNumber | String | O | Invoice number | 10009121031000912103 | |
issuerName | String | O | Issuer name | Finnet 2 | |
issuerRrn | String | O | transaction id of the QR issuer | 110002756582 | |
mpan | String | O | Merchant PAN of the original Payment QR | 9360000201102921379 |
Request & Response Payload Sample Request:
{ "originalReferenceNo":"290005165369", "serviceCode":"17", "additionalInfo":{ "terminalId": "10049258" } }
Normal Response:
{ "responseCode": "2005100", "responseMessage": "Successful", "originalReferenceNo": "290005165369", "serviceCode": "17", "latestTransactionStatus": "00", "transactionStatusDesc": "Successfully", "amount": { "value": "2000.00", "currency": "IDR" }, "terminalId": "10049258", "additionalInfo": { "customerName": "I GEDE TONI DHARMAWAN", "customerNumber": "9360015723456789", "invoiceNumber": "10009121031000912103", "issuerName": "Finnet 2", "issuerRrn": "110002756582", "mpan": "9360000201102921379" } }
List of Error/Response Code
HTTP Status Code | Code | Status | Response Description | Description |
---|---|---|---|---|
200 | 00 | Sukses | Successfull | Success |
202 | 00 | Pending | Transaction still on process | Transaction in progress |
202 | 00 | Pending | Request on progress | Payment is in process / failed |
400 | 01 | Failed | Invalid Field Format Request | Invalid Request Format |
403 | 00 | Failed | Transaction Expired | Refund is no longer possible |
403 | 02 | Failed | Exceeds Transaction Amount Limit | Amount exceeding the limit |
403 | 15 | Failed | Transaction Not Permitted. Invalid Data. Abort Process | Invalid Data. Abort Process |
403 | 15 | Failed | Transaction Not Permitted. QR Expired | QR Expired |
403 | 23 | Failed | Account Limit Exceed | Accumulated Amount Exceeds Limit |
404 | 01 | Failed | Transaction Not Found |
|
404 | 08 | Failed | Invalid Merchant | Invalid Merchant |
404 | 11 | Failed | Invalid Card/Account/Customer [info]/Virtual Account | Invalid CPAN |
404 | 12 | Failed | Invalid Bill | Invalid transaction / invalid number |
404 | 13 | Failed | Invalid Amount | Invalid Amount |
404 | 14 | Failed | Paid Bill | Transaction Paid |
500 | 01 | Failed | Internal Server Error Retrieve Data Failed | Retrieve Data Failed |
500 | 01 | Failed | Internal Server Error Database Error | Database Error |