Initiating the 'Payment Start' Call

The 'Payment start' call must be assembled according to the rafipay-ofo-service API schema.

Endpoint

POST {BaseURL}/v1/ofo/start

Header Fields:

Field	Type	Description
Signature	string (hex)	HMAC signature generated as described above
X-Request-ID	string (uuid)	Unique call identifier in UUID format assigned by the merchant, identifying the given call
X-Correlation-ID	string (uuid)	Unique session identifier in UUID format assigned by the merchant, identifying the entire session

Body

The payload described in the "Assembling the Payload" section – its content and format must match the payload used when creating the signature. If the payload submitted to the endpoint differs from the payload used to generate the HMAC signature, it will result in an HMAC signature error.

request body

{
    "idempotencyKey": "b14107ae-ede2-4313-ab25-57b633ff0e66",
    "technicalUserId": "",
    "language": "HU",
    "url": "https://www.raiffeisen.hu/fizetesikerelem",
    "transactionReference": "ID48275648744066",
    "paymentMethods": [
      "EAM"
    ],
    "transactionCurrency": "HUF",
    "transactionAmount": 101,
    "remittanceInfo": "árvíztűrő tükörfúrógép",
    "shopId": "1234",
    "terminalReference": "string",
    "timestamp": "2026-02-20T13:50:07.883Z"
}

Response In case of a successful request, the service returns the following code: 200: Payment created As a result of a successful call, the Raiffeisen PAY service (rafipay-vpos-service) generates a payment URL and returns it in the response.

{
  "salt": "string",
  "redirectUrl": "string"
}

In case of an unsuccessful request, the service may return the following error codes: 400: General error response 401: Access Denied. Invalid or missing HMAC signature.

{
  "errorId": "string",
  "errorCode": "string",
  "errorDescription": "string",
  "errorDetails": [
    {
      "field": "string",
      "errorDescription": "string"
    }
  ]
}

Redirecting the Customer to the Online Payment Page

The customer must be redirected to the redirect URL received in the response to the Payment start call. The Online Payment Page displays the QR code and/or Deeplink required for instant payment. After the transaction is completed, the transaction result appears on the payment page along with the return/redirect link pointing to the merchant's page (specified as "url" in the payload).

Callback URL

The use of the Callback URL is relevant in cases where the payment process is initiated from an application on the payer's device other than the mobile banking application. The Callback URL allows the payer to return to the interface from which the purchase was initiated at the end of the payment. Such interfaces can be: the payment status page of an online store, the payment status page of an application in the case of in-app purchases, or the post-payment landing page of a loyalty application. The interface itself also indicates the success or rejection of the payment. For internet purchases via EAM initiated by an Aggregator, a URL can be requested; for in-app purchases, a Deeplink can be requested. The "url" field in the payload corresponds to the callback URL.

Good to know

In cases where an IPEW code is to be used, the callback URL must be provided in advance at the time of contract signing; it does not need to be provided during the API call.

Expiry

EAM requests expire after 15 minutes, just like RTP requests, however for RTP the core system expires them later – after 15 minutes it is no longer accepted, but the status query will reflect this change later.