# Glossary (/docs/server-to-server/glossary)

## A [#a]

### 3D Secure (3DS) [#3d-secure-3ds]

A security protocol that provides an additional layer of authentication for online card transactions. 3DS 2.0 supports risk-based authentication, allowing frictionless flows for low-risk transactions while challenging high-risk ones.

### 3DS Challenge [#3ds-challenge]

The authentication step where the cardholder must verify their identity, typically through an OTP, biometric, or password sent by the issuing bank.

### Acquirer [#acquirer]

A financial institution that processes card payments on behalf of merchants. The acquirer maintains the merchant relationship and routes transactions to the appropriate card networks.

### ACS (Access Control Server) [#acs-access-control-server]

The issuing bank's server that handles 3DS authentication. It generates and validates authentication requests during the 3DS flow.

### AoC (Attestation of Compliance) [#aoc-attestation-of-compliance]

A formal declaration confirming that a merchant or service provider meets PCI DSS requirements. Required annually for S2S integrations.

### API Key [#api-key]

A unique identifier used to authenticate API requests. Precium uses two types: Standard API Key (for general operations) and S2S API Key (for card data submission).

### Authorization [#authorization]

The process of verifying that a cardholder has sufficient funds or credit and obtaining approval from the issuing bank to proceed with a transaction.

## B [#b]

### BIN (Bank Identification Number) [#bin-bank-identification-number]

The first 6-8 digits of a card number that identify the issuing bank and card type. Used for routing decisions and fraud detection.

### Brand ID [#brand-id]

A unique identifier assigned to each merchant brand within the Precium platform. Used in API calls to route transactions correctly.

### Browser Fingerprint [#browser-fingerprint]

A collection of browser and device attributes (screen size, timezone, language, etc.) used for 3DS risk assessment and fraud detection.

## C [#c]

### Callback URL [#callback-url]

A URL Precium sends to the customer after 3DS authentication. The URL receives authentication results for further processing.

### Capture [#capture]

The process of finalising a pre-authorized transaction to transfer funds. Can be full (entire authorized amount) or partial (less than authorized).

### Card Network [#card-network]

Organisations such as Visa, Mastercard, and American Express that operate the payment infrastructure connecting issuers and acquirers.

### Card-Not-Present (CNP) [#card-not-present-cnp]

A transaction where the physical card is not presented, such as online or phone payments. Requires additional fraud prevention measures.

### Card Token [#card-token]

A secure substitute for a card number that can be stored and reused for future transactions without exposing the actual card data.

### CAVV (Cardholder Authentication Verification Value) [#cavv-cardholder-authentication-verification-value]

A cryptographic value generated during 3DS authentication that proves the cardholder was authenticated. Included in authorization requests for liability shift.

### Chargeback [#chargeback]

A transaction reversal initiated by the cardholder through their issuing bank, typically due to fraud, non-receipt of goods, or disputes.

### CIT (Customer-Initiated Transaction) [#cit-customer-initiated-transaction]

A transaction where the cardholder is actively participating at the time of payment, requiring their authentication.

### Clear PAN [#clear-pan]

The actual card number (Primary Account Number) as opposed to a tokenized representation.

### Cryptogram [#cryptogram]

A dynamic security value generated by a network token service (MDES/VTS) that provides transaction-specific authentication.

### CVC/CVV (Card Verification Code/Value) [#cvccvv-card-verification-codevalue]

The 3 or 4-digit security code printed on a card, used to verify card-not-present transactions.

## D [#d]

### Delayed Capture [#delayed-capture]

Reserving funds on a cardholder's account without capturing them, by sending `skip_capture: true` with a non-zero purchase total. The purchase reaches `hold` and must be resolved with `POST /purchases/{id}/capture/` or `POST /purchases/{id}/release/`. Formerly called "pre-authorisation" or "auth-only"; in this documentation *Preauthorisation* means the zero-amount verification flow instead.

### Direct Post URL [#direct-post-url]

A dynamically generated, single-use URL where card data is securely submitted in the S2S flow. Unique to each purchase.

### DPAN (Device Primary Account Number) [#dpan-device-primary-account-number]

A network token that represents the actual card number. Used in network tokenization (MDES/VTS).

### DS (Directory Server) [#ds-directory-server]

A card network component that routes 3DS messages between the merchant and the issuer's ACS.

### DS Transaction ID [#ds-transaction-id]

A unique identifier assigned by the Directory Server in 3DS 2.x authentication, used to link authentication to the transaction.

## E [#e]

### ECI (Electronic Commerce Indicator) [#eci-electronic-commerce-indicator]

A code returned during 3DS authentication that indicates the level of authentication achieved:

- 05/02: Fully authenticated (Visa/Mastercard)
- 06/01: Attempted authentication
- 07/00: Non-3DS or failed authentication

## F [#f]

### Force Recurring [#force-recurring]

A flag in purchase creation that signals intent to store card credentials for future recurring transactions. Generates a token when enabled.

### Fraud Score [#fraud-score]

A numerical value representing the risk level of a transaction based on various factors including velocity, geography, device fingerprint, etc.

### Frictionless Flow [#frictionless-flow]

A 3DS authentication that completes without cardholder interaction because the risk assessment deemed the transaction low-risk.

## G [#g]

### Gateway [#gateway]

A service that securely transmits transaction data between merchants and payment processors.

## H [#h]

### Hard Decline [#hard-decline]

A permanent decline that should not be retried. Indicates issues like invalid card, stolen card, or closed account.

## I [#i]

### Idempotency [#idempotency]

A property where repeating the same request produces the same result, preventing duplicate transactions or charges.

### Issuer / Issuing Bank [#issuer--issuing-bank]

The financial institution that issued the card to the cardholder and is responsible for authorizing transactions and managing the cardholder's account.

## L [#l]

### Liability Shift [#liability-shift]

Transfer of fraud liability from the merchant to the issuing bank upon successful 3DS authentication.

### Luhn Check [#luhn-check]

A checksum algorithm used to validate card numbers. The last digit of a card number is a check digit calculated using this algorithm.

## M [#m]

### MCC (Merchant Category Code) [#mcc-merchant-category-code]

A four-digit code classifying the type of business a merchant operates. Affects interchange rates and transaction permissions.

### MD (Merchant Data) [#md-merchant-data]

An opaque value passed through the 3DS flow to maintain state between the redirect to the issuer and the callback.

### MDES (Mastercard Digital Enablement Service) [#mdes-mastercard-digital-enablement-service]

Mastercard's network tokenization service that provisions and manages network tokens for secure digital payments.

### MIT (Merchant-Initiated Transaction) [#mit-merchant-initiated-transaction]

A transaction initiated by the merchant when the cardholder is not present, such as a subscription renewal or scheduled payment.

### MPI (Merchant Plug-In) [#mpi-merchant-plug-in]

A software component that handles 3DS authentication on behalf of a merchant. Can be provided by Precium (internal) or a third-party provider (external).

## N [#n]

### Network Token [#network-token]

A card token provisioned by the card network (Visa, Mastercard) that updates automatically when a card is reissued, providing higher authorization rates.

### Network Transaction ID [#network-transaction-id]

A unique identifier assigned by the card network to link related transactions (e.g., original CIT and subsequent MITs).

## O [#o]

### OTP (One-Time Password) [#otp-one-time-password]

A temporary code sent to the cardholder during 3DS authentication, typically via SMS or an authenticator app.

## P [#p]

### PaReq (Payer Authentication Request) [#pareq-payer-authentication-request]

A message sent to the issuer's ACS containing transaction details for 3DS authentication.

### Partial Capture [#partial-capture]

Capturing less than the pre-authorized amount. Used when the final transaction amount is lower than the original authorisation.

### Partial Refund [#partial-refund]

Returning only a portion of the original transaction amount to the customer.

### PCI DSS (Payment Card Industry Data Security Standard) [#pci-dss-payment-card-industry-data-security-standard]

A set of security standards designed to ensure all companies that accept, process, store, or transmit credit card information maintain a secure environment.

### Preauthorisation [#preauthorisation]

Cardholder verification with no financial transaction: `skip_capture: true` with a purchase total of 0. The purchase reaches `preauthorized` and the card is stored. No funds are reserved — for that, see *Delayed Capture*. Error codes for this flow retain the legacy `zero_auth_` prefix.

### Purchase [#purchase]

In Precium's API, a purchase object represents a transaction intent including amount, currency, products, and redirect URLs.

## Q [#q]

### QSA (Qualified Security Assessor) [#qsa-qualified-security-assessor]

An organisation certified by the PCI Security Standards Council to assess and validate compliance with PCI DSS.

## R [#r]

### RoC (Report on Compliance) [#roc-report-on-compliance]

A detailed document created by a QSA documenting an organisation's compliance status with PCI DSS requirements.

### Recurring Payment [#recurring-payment]

A series of transactions charged to a customer's card at regular intervals based on prior authorization.

### Refund [#refund]

The return of funds to a cardholder, either full or partial, that reverses a previous successful charge.

## S [#s]

### S2S (Server-to-Server) [#s2s-server-to-server]

An integration pattern where card data is transmitted directly from the merchant's server to Precium's API, requiring PCI DSS SAQ-D compliance.

### SAQ (Self-Assessment Questionnaire) [#saq-self-assessment-questionnaire]

A PCI DSS compliance validation tool. Different types exist based on how card data is handled:

- **SAQ A**: Card data never touches merchant systems
- **SAQ A-EP**: Card data touches merchant systems via redirect
- **SAQ D**: Merchant stores, processes, or transmits card data (required for S2S)

### Settlement [#settlement]

The process of transferring funds from the cardholder's issuing bank to the merchant's acquiring bank after transaction authorization.

### Soft Decline [#soft-decline]

A temporary decline that may succeed if retried later. Often due to insufficient funds, velocity limits, or temporary system issues.

## T [#t]

### Token / Tokenization [#token--tokenization]

The process of replacing sensitive card data with a non-sensitive substitute (token) that can be safely stored and used for future transactions.

### Transaction ID [#transaction-id]

A unique identifier assigned to each payment transaction for tracking and reference purposes.

## V [#v]

### Velocity Check [#velocity-check]

Fraud prevention rules that limit the number or value of transactions within a time period to detect suspicious patterns.

### Void [#void]

Cancellation of an authorized transaction before settlement occurs. Also used to cancel refunds before settlement.

### VTS (Visa Token Service) [#vts-visa-token-service]

Visa's network tokenization service that provisions and manages network tokens for secure digital payments.

## W [#w]

### Webhook [#webhook]

An HTTP callback that Precium sends to your server when specific events occur (payment completed, refund processed, etc.).

### Webhook Public Key [#webhook-public-key]

The PEM-encoded RSA public key used to verify that a callback genuinely came from Precium. Signing is **asymmetric** — Precium holds the private key and you hold only the public key, so there is no shared secret to store or rotate. Read it from `public_key` on the webhook object, or from `GET /public_key/` for a per-purchase `success_callback`.

### Webhook Signature [#webhook-signature]

A base64-encoded **RSA PKCS#1 v1.5** signature of the SHA-256 digest of the raw callback body, sent in the `X-Signature` header. Verification is asymmetric — there is no shared secret. Obtain the public key from `public_key` on the webhook object, or from `GET /public_key/` for a per-purchase `success_callback`. Verify the raw body bytes before parsing; re-serialising the JSON invalidates the signature.

## X [#x]

### XID (Transaction Identifier) [#xid-transaction-identifier]

A unique identifier used in 3DS 1.x authentication to link the authentication to the transaction.

## Common Abbreviations Quick Reference [#common-abbreviations-quick-reference]

| Abbreviation | Full Term |
|---|---|
| 3DS | 3D Secure |
| ACS | Access Control Server |
| AoC | Attestation of Compliance |
| API | Application Programming Interface |
| BIN | Bank Identification Number |
| CAVV | Cardholder Authentication Verification Value |
| CIT | Customer-Initiated Transaction |
| CNP | Card Not Present |
| CVC/CVV | Card Verification Code/Value |
| DPAN | Device Primary Account Number |
| DS | Directory Server |
| ECI | Electronic Commerce Indicator |
| MCC | Merchant Category Code |
| MD | Merchant Data |
| MDES | Mastercard Digital Enablement Service |
| MIT | Merchant-Initiated Transaction |
| MPI | Merchant Plug-In |
| OTP | One-Time Password |
| PAN | Primary Account Number |
| PaReq | Payer Authentication Request |
| PCI | Payment Card Industry |
| QSA | Qualified Security Assessor |
| RoC | Report on Compliance |
| S2S | Server-to-Server |
| SAQ | Self-Assessment Questionnaire |
| VTS | Visa Token Service |
| XID | Transaction Identifier (3DS1) |

## Currency Codes (ISO 4217) [#currency-codes-iso-4217]

| Code | Currency |
|---|---|
| ZAR | South African Rand |
| USD | United States Dollar |
| EUR | Euro |
| GBP | British Pound Sterling |
| AUD | Australian Dollar |
| CAD | Canadian Dollar |

## HTTP Status Codes [#http-status-codes]

| Code | Meaning |
|---|---|
| 200 | Success |
| 201 | Created (resource successfully created) |
| 400 | Bad Request (invalid input) |
| 401 | Unauthorized (invalid API key) |
| 403 | Forbidden (insufficient permissions) |
| 404 | Not Found (resource doesn't exist) |
| 422 | Unprocessable Entity (validation error) |
| 429 | Too Many Requests (rate limited) |
| 500 | Internal Server Error |
| 502 | Bad Gateway |
| 503 | Service Unavailable |