Alipay+ DocsAlipay+ Docs

authNotifyAlipay+ → ACQP

Alipay+ uses the authNotify API to inform the Acquiring Partner (ACQP) in the following scenarios:

  • An authorization code is created at the Mobile Payment Provider (MPP ) side. Alipay+ sends the authorization code and related parameters to the ACQP.
  • An access token is created at the MPP side. Alipay+ sends the access token and related parameters to the ACQP.
  • An access token is canceled at the MPP side due to one of the following reasons:
    • A user successfully unbinds the merchant platform account and the MPP platform account through the merchant platform with the cancelToken API.
    • A user successfully unbinds the merchant platform account and the MPP platform account the through the MPP side.
    • The MPP has to unbind the user account directly from the back-end system. 

Note: In the following sections, Mobile Payment Partner (MPP) is also known as PSP. For example, pspId refers to the ID that identifies an MPP. 

Structure

A message consists of a header and body. The following sections are focused on the body structure. For the header structure, see:

Note:

Set the data type of each field (except array) as String. This means that you must use double quotation marks (" ") to enclose the field value. Examples:

  • If the data type of a field is Integer and its value is 20, set it as "20". 
  • If the data type of a field is Boolean and its value is true, set it as "true". 

For optional parameters that are not required in your case, you can:

  • exclude it from the request body. 
  • set its value as null (without the double quotation marks).

Do NOT leave it empty by setting its value as ""; otherwise, an error might occur. 

Request parameters

authorizationNotifyType String  REQUIRED

The type of authorization notification. Valid values are:

  • TOKEN_CREATED: indicates that the access token is created by the MPP and is provided in the request.
  • TOKEN_CANCELED: indicates that the access token in the request is revoked.
  • AUTHCODE_CREATED: indicates that the authorization code is created by the MPP and is provided in the request. 

authClientId String  REQUIRED

The unique ID that is assigned by the ACQP to identify the auth client, which is usually the merchant. For an authorization result notification, the value of the authClientId parameter in the authNotify API is the same as the one in the prepare API. 

More information:

  • Maximum length: 64 characters

referenceMerchantId String  REQUIRED

The unique ID that is assigned by the ACQP to identify a merchant. 

More information:

  • Maximum length: 32 characters

accessToken String  

The token that is used to access the MPP user's resources.

This parameter is specified by Alipay+ if the value of the authorizationNotifyType parameter is TOKEN_CREATED or TOKEN_CANCELED. 

More information:

  • Maximum length: 128 characters

authCode String  

The authorization code is used by the auth client to get an access token.

This parameter is specified by Alipay+ if the value of the authorizationNotifyType parameter is AUTHCODE_CREATED. 

More information:

  • Maximum length: 64 characters

authState String  

A string that is generated by the auth client to represent the prepare API request. The value of this parameter must be the same as the one specified in the prepare API.

This parameter is specified by Alipay+ if the value of the authorizationNotifyType parameter is AUTHCODE_CREATED. 

More information:

  • Maximum length: 256 characters

customerId String  

The unique ID that is assigned by Alipay+ to identify an MPP user.

This parameter is specified by Alipay+ if the value of the authorizationNotifyType parameter is TOKEN_CREATED and the MPP provides a unique ID that identifies the user. 

More information:

  • Maximum length: 64 characters

userLoginId String  

The login ID that is used by the MPP user to log in to the MPP platform. The value of userLoginId can be the user's email address or the phone number and is desensitized when returned to the ACQP. The merchant can use this parameter to learn the identity of the user that has completed the authorization.

This parameter is specified by Alipay+ if the value of the authorizationNotifyType parameter is TOKEN_CREATED and the value of the scopes parameter in the prepare API contains USER_LOGIN_ID. 

More information:

  • Maximum length: 64 characters

referenceAgreementId String  

The unique ID that is assigned by the auth client to identify an authorization.

This parameter is specified by Alipay+ if the value of the authorizationNotifyType parameter is AUTHCODE_CREATED or TOKEN_CREATED. 

More information:

  • Maximum length: 64 characters

accessTokenExpiryTime Datetime  

The access token expiration time, after which the access token cannot be used.

This parameter is specified by Alipay+ if the value of the authorizationNotifyType parameter is TOKEN_CREATED. 

More information:

  • The value follows the ISO 8601 standard format. For example, "2019-11-27T12:01:01+08:00".

refreshToken String  

The refresh token that is used by the auth client to get a new access token to replace the existing one. With this parameter, valid access tokens can be obtained continuously without further interaction with the user.

This parameter is specified by Alipay+ if the value of the authorizationNotifyType parameter is TOKEN_CREATED and the access token is short-term effective. Not specified if the access token is long-term effective. 

More information:

  • Maximum length: 128 characters

refreshTokenExpiryTime Datetime  

The refresh token expiration time, after which the refresh token cannot be used. Usually, the refresh token has a longer validity than the access token.

This parameter is specified by Alipay+ if the value of the authorizationNotifyType parameter is TOKEN_CREATED and the accessToken is short-term effective. 

More information:

  • The value follows the ISO 8601 standard format. For example, "2019-11-27T12:01:01+08:00".

scopes Array<String>  

The authorization scopes, which means what resources or capabilities are authorized to the auth client. Valid values are: 

  • AGREEMENT_PAY: indicates that the auth client can use an access token to deduct funds from the user's MPP app for Auto Debit payments.
  • USER_LOGIN_ID: indicates that the auth client can obtain the desensitized user login ID for the MPP app by using the applyToken API.

This parameter is specified by Alipay+ if the value of the authorizationNotifyType parameter is TOKEN_CREATED. 

pspId String  REQUIRED

The unique ID that is assigned by Alipay+ to identify an MPP.

More information:

  • Maximum length: 64 characters

acquirerId String  REQUIRED

The unique ID that is assigned by Alipay+ to identify an ACQP. 

More information:

  • Maximum length: 64 characters

reason String  

The reason why the authorization is revoked.

This parameter is specified by Alipay+ if the value of the authorizationNotifyType parameter is TOKEN_CANCELED and the user provides the reason for the authorization cancellation. 

More information:

  • Maximum length: 256 characters

tokenCancelSource String  

This parameter indicates which Partner requests to cancel the access token. Valid values are:

  • ACQUIRER: indicates that the ACQP requests to cancel the access token.
  • PSP: indicates that the MPP requests to cancel the access token

This parameter is specified by Alipay+ if the value of the authorizationNotifyType parameter is TOKEN_CANCELED. 

walletForAccountBinding Wallet object 

The wallet that is selected by the user for binding with the user's merchant account.

This parameter is specified by Alipay+ if authorizationNotifyType is TOKEN_CREATED. 

Show child parameters

passThroughInfo String  

The information that is passed through by Alipay+ to the ACQP. The value of this parameter is in the set of key-value pairs.

This parameter is specified by Alipay+ if the MPP wants to pass information to the ACQP. 

More information:

  • Maximum length: 20000 characters

Response parameters

result Result object REQUIRED

The result parameter that indicates whether the notification is received. For more information about how to respond to the notification of the authNotify API, see How to return the result. 

Show child parameters
API Explorer

Request

Case
AuthCode creation notification
Request Body

Response

Response Body

More information

How to return the result

The ACQP needs to return the result (specified in the result parameter) according to the business processing result.

If you received the notification successfully, set the value of result.resultStatus to S to indicate that your server received the call. Otherwise,Alipay+ takes the notification delivery as unsuccessful and retries the notification sending up to 7 times during a period of up to 24h22min. The intervals between two consecutive times are as follows: 2min, 10min, 10min, 1h, 2h, 6h, and 15h. After that, no notifications will be sent anymore.

For more information about how to define your result codes, see the Result codes section below. 

Result/Error codes

CodeValueMessage
SUCCESSSSuccess
ACCESS_DENIEDFAccess is denied.
INVALID_CLIENTFThe client is invalid.
INVALID_SIGNATUREFThe signature is invalid.
KEY_NOT_FOUNDFThe key is not found.
MEDIA_TYPE_NOT_ACCEPTABLEFThe server does not implement the media type that is acceptable to the client.
METHOD_NOT_SUPPORTEDFThe server does not implement the requested HTTPS method.
NO_INTERFACE_DEFFAPI is not defined.
PARAM_ILLEGALFIllegal parameters. For example, non-numeric input, invalid date.
PROCESS_FAILFA general business failure occurred. Do not retry.
REQUEST_TRAFFIC_EXCEED_LIMITUThe request traffic exceeds the limit.
UNKNOWN_EXCEPTIONUAn API call failed, which is caused by unknown reasons.

Learn more about

Home
Get Support
Need more help?