Platform Integration
Build secure and scalable integrations with Cybersource APIs using the tools and guidance you need to create credentials, authenticate requests, and connect your applications with confidence.
Core Capabilities
Whether you’re getting started with Cybersource APIs or expanding an existing integration, these resources can help you securely create and manage access credentials, authenticate API requests, and implement reliable connectivity across your payment experiences.
Learn how to create and manage security keys in Business Center. Security keys help encrypt data, decrypt messages for authorized recipients, and verify that messages were not changed in transit.
Boarding guide
Set up your REST integration to exchange secure API requests and responses with the Cybersource gateway over HTTP. JWT is recommended for new integrations. It uses digitally signed tokens to help verify message integrity and supports message-level encryption (MLE). HTTP Signature uses a shared secret to sign API requests and verify authenticity and integrity. It is not supported for browser-based or mobile applications.
Important: By September 2026, merchants using HTTP Signature must migrate to JWT to support MLE and avoid potential transaction failures.
OAuth 2.0 lets merchants securely authorize your application to access data and process payments through Visa Acceptance Solutions, without sharing credentials. Visa Acceptance Solutions authenticates merchants and helps ensure your application acts only within approved permissions. Use this guide to set up and enable OAuth 2.0 for your application.
Message Level Encryption:
Important: with the upcoming Message Level Encryption (MLE) Mandate, all REST-based clients must have MLE enabled by March 1, 2027.
Note:
- If an endpoint is marked as "Mandatory", you must have MLE enabled for the API call to go through. If it's marked as "Optional", your API call can go through with or without MLE. All REST endpoints are expected to have Mandatory MLE by the mandate deadline.
- GET calls will not need Request MLE, and are therefore marked as N/A
The endpoints below are currently available to integrate with MLE via direct integration or SDK, and will be available on API Reference by mid August.
| Product | Method | Endpoint | Request | Response |
| Agentic Commerce Platform | POST | /icc/v1/checkout-sessions | Mandatory | Mandatory |
| GET | /icc/v1/checkout-sessions/{sessionId} | Not Enabled | Mandatory | |
| PUT | /icc/v1/checkout-sessions/{sessionId} | Mandatory | Mandatory | |
| POST | /icc/v1/checkout-sessions/{session_id}/cancel | Mandatory | Mandatory | |
| POST | /icc/v1/checkout-sessions/{session_id}/complete | Mandatory | Mandatory | |
| POST | /icc/v1/checkout_sessions | Mandatory | Mandatory | |
| GET | /icc/v1/checkout_sessions/{session_id} | Not Enabled | Mandatory | |
| POST | /icc/v1/checkout_sessions/{session_id} | Mandatory | Mandatory | |
| POST | /icc/v1/checkout_sessions/{session_id}/cancel | Mandatory | Mandatory | |
| POST | /icc/v1/checkout_sessions/{session_id}/complete | Mandatory | Mandatory | |
| GET | /icc/v1/products | Not Enabled | Mandatory | |
| POST | /icc/v1/products | Mandatory | Mandatory | |
| GET | /icc/v1/products/{productId} | Not Enabled | Mandatory | |
| PUT | /icc/v1/products/{productId} | Mandatory | Mandatory | |
| DELETE | /icc/v1/products/{productId} | Mandatory | Mandatory | |
| POST | /icc/v1/products/feed | Mandatory | Mandatory | |
| GET | /ucp/v1/checkout-sessions/{sessionId} | Not Enabled | Mandatory | |
| PUT | /ucp/v1/checkout-sessions/{sessionId} | Mandatory | Mandatory | |
| POST | /icc/v1/instructions | Mandatory | Mandatory | |
| PUT | /icc/v1/instructions/{instructionId} | Mandatory | Mandatory | |
| PUT | /icc/v1/instructions/{instructionId}/cancel | Mandatory | Mandatory | |
| POST | /icc/v1/instructions/{instructionId}/confirmations | Mandatory | Mandatory | |
| POST | /icc/v1/instructions/{instructionId}/credentials | Mandatory | Mandatory | |
| POST | /icc/v1/mpp/credentials | Mandatory | Mandatory | |
| POST | /icc/v1/tokens | Mandatory | Mandatory | |
| GET | /icc/v1/agents | Not Enabled | Mandatory | |
| POST | /icc/v1/agents | Mandatory | Mandatory | |
| PUT | /icc/v1/agents/{agentId} | Mandatory | Mandatory | |
| GET | /icc/v1/agents/{agentId} | Not Enabled | Mandatory | |
| GET | /icc/v1/agents/{agentId}/keys | Not Enabled | Mandatory | |
| POST | /icc/v1/agents/{agentId}/keys | Mandatory | Mandatory | |
| GET | /icc/v1/agents/{agentId}/keys/{keyId} | Not Enabled | Mandatory | |
| PUT | /icc/v1/agents/{agentId}/keys/{keyId} | Mandatory | Mandatory | |
| DELETE | /icc/v1/agents/{agentId}/keys/{keyId} | Mandatory | Mandatory | |
| PUT | /icc/v1/agents/{agentId}/keys/{keyId}/activate | Mandatory | Mandatory | |
| POST | /icc/v1/agents/{agentId}/keys/{keyId}/activate | Mandatory | Mandatory | |
| POST | /icc/v1/merchants | Mandatory | Mandatory | |
| GET | /icc/v1/merchants/{merchantId} | Not Enabled | Mandatory | |
| PUT | /icc/v1/merchants/{merchantId} | Mandatory | Mandatory | |
| GET | /icc/v1/merchants/{merchantId}/keys | Not Enabled | Mandatory | |
| POST | /icc/v1/merchants/{merchantId}/keys | Mandatory | Mandatory | |
| GET | /icc/v1/merchants/{merchantId}/keys/{keyId} | Not Enabled | Mandatory | |
| PUT | /icc/v1/merchants/{merchantId}/keys/{keyId} | Mandatory | Mandatory | |
| DELETE | /icc/v1/merchants/{merchantId}/keys/{keyId} | Mandatory | Mandatory | |
| PUT | /icc/v1/merchants/{merchantId}/keys/{keyId}/activate | Mandatory | Mandatory | |
| POST | /icc/v1/merchants/{merchantId}/keys/{keyId}/activate | Mandatory | Mandatory | |
| Bank Account Validator | POST | /bavs/v1/account-validations | Mandatory | Not Enabled |
| Boarding | POST | /boarding/v1/registrations | Optional | Optional |
| GET | /boarding/v1/registrations/{registrationId} | Mandatory | Mandatory | |
| PATCH | /boarding/v1/registrations/{registrationId} | Optional | Optional | |
| Invoicing | GET | /invoicing/v2/invoiceSettings | Optional | Optional |
| PUT | /invoicing/v2/invoiceSettings | Optional | Optional | |
| GET | /invoicing/v2/invoices | Optional | Optional | |
| POST | /invoicing/v2/invoices | Optional | Optional | |
| GET | /invoicing/v2/invoices/{id} | Optional | Optional | |
| PUT | /invoicing/v2/invoices/{id} | Optional | Optional | |
| POST | /invoicing/v2/invoices/{id}/cancelation | Optional | Optional | |
| POST | /invoicing/v2/invoices/{id}/delivery | Optional | Optional | |
| GET | /ipl/v2/payment-links | Optional | Optional | |
| POST | /ipl/v2/payment-links | Optional | Optional | |
| GET | /ipl/v2/payment-links/{id} | Optional | Optional | |
| PATCH | /ipl/v2/payment-links/{id} | Optional | Optional | |
| Organization Management Service | GET | /oms/v1/groups | Optional | Optional |
| POST | /oms/v1/groups | Optional | Optional | |
| GET | /oms/v1/groups/{groupId} | Optional | Optional | |
| PATCH | /oms/v1/groups/{groupId} | Optional | Optional | |
| DELETE | /oms/v1/groups/{groupId} | Optional | Optional | |
| Payments | POST | /pts/v1/pull-funds-transfer | Optional | Not Enabled |
| POST | /pts/v1/pull-funds-transfer/{id}/refund | Optional | Not Enabled | |
| POST | /pts/v1/pull-funds-transfer/{id}/reversal | Optional | Not Enabled | |
| POST | /pts/v1/push-funds-transfer | Optional | Not Enabled | |
| POST | /pts/v2/payouts | Optional | Not Enabled | |
| POST | /pts/v2/payouts/fx-rates | Mandatory | Mandatory | |
| POST | /pts/v2/payouts/transaction-query/{id} | Mandatory | Mandatory | |
| POST | /pts/v2/billing-agreements | Optional | Optional | |
| PATCH | /pts/v2/billing-agreements/{id} | Optional | Optional | |
| POST | /pts/v2/billing-agreements/{id}/intimations | Optional | Optional | |
| POST | /pts/v2/captures/{id}/refunds | Optional | Optional | |
| POST | /pts/v2/captures/{id}/voids | Optional | Optional | |
| POST | /pts/v2/credits | Optional | Optional | |
| POST | /pts/v2/credits/{id}/voids | Optional | Optional | |
| POST | /pts/v2/intents | Optional | Optional | |
| PATCH | /pts/v2/intents/{id} | Optional | Optional | |
| POST | /pts/v2/payment-references | Optional | Optional | |
| PATCH | /pts/v2/payment-references/{id} | Optional | Optional | |
| POST | /pts/v2/payment-references/{id}/intents | Optional | Optional | |
| POST | /pts/v2/payment-tokens | Optional | Optional | |
| POST | /pts/v2/payments | Optional | Optional | |
| POST | /pts/v2/payments-options | Optional | Optional | |
| PATCH | /pts/v2/payments/{id} | Optional | Optional | |
| POST | /pts/v2/payments/{id}/captures | Optional | Optional | |
| POST | /pts/v2/payments/{id}/refunds | Optional | Optional | |
| POST | /pts/v2/payments/{id}/reversals | Optional | Optional | |
| POST | /pts/v2/payments/{id}/voids | Optional | Optional | |
| POST | /pts/v2/refresh-payment-status/{id} | Optional | Optional | |
| POST | /pts/v2/refunds/{id}/voids | Optional | Optional | |
| POST | /pts/v2/reversals | Optional | Optional | |
| POST | /pts/v2/voids | Optional | Optional | |
| Unified Risk | POST | /unifiedrisk | Mandatory | Not Enabled |
| Subscription Billing Service | GET | /rbs/v1/plans | Not Enabled | Optional |
| POST | /rbs/v1/plans | Optional | Optional | |
| GET | /rbs/v1/plans/code | Not Enabled | Optional | |
| GET | /rbs/v1/plans/{id} | Not Enabled | Optional | |
| PATCH | /rbs/v1/plans/{id} | Optional | Optional | |
| DELETE | /rbs/v1/plans/{id} | Not Enabled | Optional | |
| POST | /rbs/v1/plans/{id}/activate | Not Enabled | Optional | |
| POST | /rbs/v1/plans/{id}/deactivate | Not Enabled | Optional | |
| GET | /rbs/v1/subscriptions | Not Enabled | Optional | |
| POST | /rbs/v1/subscriptions | Optional | Optional | |
| GET | /rbs/v1/subscriptions/code | Not Enabled | Optional | |
| GET | /rbs/v1/subscriptions/follow-ons/{requestId} | Not Enabled | Optional | |
| POST | /rbs/v1/subscriptions/follow-ons/{requestId} | Optional | Optional | |
| GET | /rbs/v1/subscriptions/{id} | Not Enabled | Optional | |
| PATCH | /rbs/v1/subscriptions/{id} | Optional | Optional | |
| POST | /rbs/v1/subscriptions/{id}/activate | Not Enabled | Optional | |
| POST | /rbs/v1/subscriptions/{id}/cancel | Not Enabled | Optional | |
| GET | /rbs/v1/subscriptions/{id}/payments | Not Enabled | Optional | |
| PUT | /rbs/v1/subscriptions/{id}/payments | Optional | Optional | |
| POST | /rbs/v1/subscriptions/{id}/suspend | Not Enabled | Optional | |
| Token Management | POST | /tms/v1/instrumentidentifiers | Not Enabled | Optional |
| DELETE | /tms/v1/instrumentidentifiers/{instrumentIdentifierId} | Not Enabled | Optional | |
| GET | /tms/v1/instrumentidentifiers/{instrumentIdentifierId} | Not Enabled | Optional | |
| PATCH | /tms/v1/instrumentidentifiers/{instrumentIdentifierId} | Not Enabled | Optional | |
| POST | /tms/v1/instrumentidentifiers/{instrumentIdentifierId}/enrollment | Not Enabled | Optional | |
| GET | /tms/v1/instrumentidentifiers/{instrumentIdentifierId}/paymentinstruments | Not Enabled | Optional | |
| POST | /tms/v1/paymentinstruments | Not Enabled | Optional | |
| DELETE | /tms/v1/paymentinstruments/{paymentInstrumentId} | Not Enabled | Optional | |
| GET | /tms/v1/paymentinstruments/{paymentInstrumentId} | Not Enabled | Optional | |
| PATCH | /tms/v1/paymentinstruments/{paymentInstrumentId} | Not Enabled | Optional | |
| POST | /tms/v2/customer-shipping-addresses | Optional | Optional | |
| GET | /tms/v2/customer-shipping-addresses/{tokenId} | Not Enabled | Optional | |
| PATCH | /tms/v2/customer-shipping-addresses/{tokenId} | Optional | Optional | |
| DELETE | /tms/v2/customer-shipping-addresses/{tokenId} | Not Enabled | Optional | |
| POST | /tms/v2/customers | Optional | Optional | |
| GET | /tms/v2/customers/{customerId} | Not Enabled | Optional | |
| PATCH | /tms/v2/customers/{customerId} | Optional | Optional | |
| DELETE | /tms/v2/customers/{customerId} | Not Enabled | Optional | |
| GET | /tms/v2/customers/{customerId}/devices | Not Enabled | Optional | |
| POST | /tms/v2/customers/{customerId}/devices | Optional | Optional | |
| GET | /tms/v2/customers/{customerId}/devices/{deviceId} | Not Enabled | Optional | |
| PATCH | /tms/v2/customers/{customerId}/devices/{deviceId} | Optional | Optional | |
| DELETE | /tms/v2/customers/{customerId}/devices/{deviceId} | Not Enabled | Optional | |
| GET | /tms/v2/customers/{customerId}/payment-instruments | Not Enabled | Optional | |
| POST | /tms/v2/customers/{customerId}/payment-instruments | Optional | Optional | |
| GET | /tms/v2/customers/{customerId}/payment-instruments/{paymentInstrumentId} | Not Enabled | Optional | |
| PATCH | /tms/v2/customers/{customerId}/payment-instruments/{paymentInstrumentId} | Optional | Optional | |
| DELETE | /tms/v2/customers/{customerId}/payment-instruments/{paymentInstrumentId} | Not Enabled | Optional | |
| GET | /tms/v2/customers/{customerId}/shipping-addresses | Not Enabled | Optional | |
| POST | /tms/v2/customers/{customerId}/shipping-addresses | Optional | Optional | |
| GET | /tms/v2/customers/{customerId}/shipping-addresses/{shippingAddressId} | Not Enabled | Optional | |
| PATCH | /tms/v2/customers/{customerId}/shipping-addresses/{shippingAddressId} | Optional | Optional | |
| DELETE | /tms/v2/customers/{customerId}/shipping-addresses/{shippingAddressId} | Not Enabled | Optional | |
| POST | /tms/v2/devices | Mandatory | Optional | |
| GET | /tms/v2/devices/{tokenId} | Not Enabled | Optional | |
| PATCH | /tms/v2/devices/{tokenId} | Optional | Optional | |
| DELETE | /tms/v2/devices/{tokenId} | Not Enabled | Optional | |
| POST | /tms/v2/instruments | Optional | Optional | |
| GET | /tms/v2/instruments/{tokenId} | Not Enabled | Optional | |
| PATCH | /tms/v2/instruments/{tokenId} | Optional | Optional | |
| DELETE | /tms/v2/instruments/{tokenId} | Not Enabled | Optional | |
| POST | /tms/v2/tokenize | Mandatory | Optional | |
| POST | /tms/v2/tokenized-cards | Not Enabled | Optional | |
| GET | /tms/v2/tokenized-cards/{tokenizedCardId} | Not Enabled | Optional | |
| POST | /tms/v2/tokenized-cards/{tokenizedCardId}/delete | Not Enabled | Optional |
If you would like to enable MLE via our SDKs, please follow this guide Set Up a JSON Web Token Message Using the REST SDK.
You can also follow along to this video for an easy tutorial for integrating with SDKs
MLE Integrations are supported for both REST-Certificate and REST-Shared Secret Key Types. Please follow the guide that correlates to your preferred integration:
Explore APIs
Kickstart your integration journey to build agent driven payment experiences faster with access to APIs in Sandbox environment
