From sign-up to your first payment call

Quickstart

curl -X POST "https://login.microsoftonline.com/<YOUR-TENANT-ID>/oauth2/v2.0/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=<your-client-id>" \
  -d "client_secret=<your-client-secret>" \
  -d "scope=api://<YOUR-API-APP-ID>/.default"

curl -X POST "<request-url-from-the-operation-page>" \
  -H "Ocp-Apim-Subscription-Key: <your-subscription-key>" \
  -H "Authorization: Bearer <access-token>" \
  -H "Content-Type: <content-type-the-operation-expects>" \
  --data-binary "@request-body.txt"

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("Ocp-Apim-Subscription-Key", subscriptionKey);
client.DefaultRequestHeaders.Authorization =
    new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", accessToken);

var body = await File.ReadAllTextAsync("request-body.txt");
using var content = new StringContent(body, Encoding.UTF8, contentType);

var response = await client.PostAsync(requestUrl, content);
Console.WriteLine((int)response.StatusCode);

import requests

with open("request-body.txt", "rb") as f:
    body = f.read()

response = requests.post(
    request_url,
    headers={
        "Ocp-Apim-Subscription-Key": subscription_key,
        "Authorization": f"Bearer {access_token}",
        "Content-Type": content_type,
    },
    data=body,
)

print(response.status_code)

Errors & Exceptions

The CGI ALL PAYMENT SYSTEMS APIs use standard HTTP status codes. Every error response also carries a structured body you can act on programmatically.

HTTP status codes

Error response structure

Errors raised by the payment service return an XML RestExtApiError envelope (Content-Type: application/xml):

<RestExtApiError>
  <status>500</status>
  <message>Internal Server Error</message>
  <statusMessages>
    <RestApiStatusMessage>
      <code>EXWRMPII500</code>
      <message>An unexpected error occurred. Please contact support.</message>
    </RestApiStatusMessage>
  </statusMessages>
  <path>/paymentTransaction/initiate/v1</path>
</RestExtApiError>

Troubleshooting checklist

Before raising a ticket, confirm: both headers are present on the request (Ocp-Apim-Subscription-Key and Authorization: Bearer …), the token was issued less than an hour ago, your subscription is active under Profile → Subscriptions, the request body matches the schema on the operation's reference page, and the Content-Type header matches the body format the operation expects.

Glossary

Subscription key

A key issued when you subscribe to a product. Identifies your application to the gateway; sent in the Ocp-Apim-Subscription-Key header on every request.

Product

A packaged group of APIs you subscribe to as a unit. Your subscription key is scoped to a product, not to individual APIs.

OAuth2 bearer token

A short-lived access token proving your application's identity, obtained from the token endpoint and sent in the Authorization: Bearer header. Used together with — not instead of — the subscription key.

Client credentials flow

The OAuth2 flow used by these APIs: your application authenticates directly with its client_id and client_secret, with no end-user sign-in involved.

Sandbox (connected test environment)

The test environment behind the Try It Out console and your test credentials. Fully isolated from production — no live payments are created.

Try It Out

The interactive console on every operation page in the catalogue. Fills in your subscription key automatically and sends real requests to the sandbox.

CGI ALL PAYMENT SYSTEMS

The CGI payments platform these APIs expose.

Client ID / client secret

The credentials issued for your application registration. The client_id identifies your application; the client_secret authenticates it. Treat the secret like a password — never embed it in client-side code or commit it to source control.

Scope

Declares which API a requested token is valid for. Passed as the scope parameter on the token request; a token issued for one scope will be rejected by APIs expecting another.

API gateway

The single entry point all API requests pass through. It validates your subscription key and bearer token, applies rate and access policies, and routes the request to the backing service.

Asynchronous processing

Some operations return 202 Accepted instead of 200 OK: the request was validated and queued, and processing completes after the response is returned. Each operation's reference page states which success code to expect.

How to read the spec

Every API in the catalogue is described by an OpenAPI (Swagger) specification — a machine-readable contract that the reference pages, the Try It Out console, and the downloadable definitions are all generated from. Once you can read one CGI ALL PAYMENT SYSTEMS spec, you can read them all.

The parts that matter

Download the definition

To generate a client, import into Postman, or diff versions, download the raw definition from any API's page in the catalogue — open the API and use the API definition download (available as OpenAPI YAML or JSON). The download always reflects the currently published version, so prefer it over locally saved copies.

The Try It Out console is the fastest way to see a spec in action: it builds a valid request from the schema for you, so you can compare a working call against your own code side by side.