SOAP API
The API for accessing the system by agents and merchants is provided through SOAP. For secure messaging, all XML is signed by both parties. The signature is implemented according to the W3C standard described in the XSD scheme [XmlDSig] (https://www.w3.org/TR/xmldsig-core/). All requests and responses are signed and validated.
An example of an API that can be used can be found here: client creation and call. The itself logic of adding meta information and signature is here and here
Suppose we have a request
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Header><certificateNumber xmlns="https://allpay.kz">27</certificateNumber></soap:Header><soap:Body><ns2:createCashInTransaction xmlns:ns2="http://www.allpay.kz/mfs/soap/TransactionManagement/1.1"><CashInRequest><header><lang>ru</lang><timestamp>2018-08-10T19:04:11.385+06:00</timestamp><requester>10124213</requester></header><toUserName>77072734954</toUserName><amount>10</amount><GUID>fa495ffa-4825-485e-9b14-a04c6d8315d2</GUID></CashInRequest></ns2:createCashInTransaction></soap:Body></soap:Envelope>After signing it should look like this (DigestValue should match whatever key you signed because the key does not affect it. However, the SignatureValue value will be different because you will use your key. But you can at least check DigestValue when implementing the algorithm .):
<?xml version="1.0" encoding="UTF-8"?><soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Header><certificateNumber xmlns="https://allpay.kz">27</certificateNumber><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments"/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><Reference URI=""><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>MFkKCT+PVBN914FvQfybUr47YjA=</DigestValue></Reference></SignedInfo><SignatureValue>UkSrOS+/MtHtPylIkqufcn5eVAHuLasmVF+HtBj/x+hUDHzPaNDQ08KufNCmbNenb/2CVnWbbOH0
QY4BT2IWCnLIwyVm34hBmHIASkBPaT3P27k/USW0KCKTXzPAAbZn8ScgxT8QUaem8KNlp/J/kbU7
ZlF+MGq0SbhcNZl6fpY=</SignatureValue></Signature></soap:Header><soap:Body><ns2:createCashInTransaction xmlns:ns2="http://www.allpay.kz/mfs/soap/TransactionManagement/1.1"><CashInRequest><header><lang>ru</lang><timestamp>2018-08-10T19:04:11.385+06:00</timestamp><requester>10124213</requester></header><toUserName>77072734954</toUserName><amount>10</amount><GUID>fa495ffa-4825-485e-9b14-a04c6d8315d2</GUID></CashInRequest></ns2:createCashInTransaction></soap:Body></soap:Envelope>We format both xml for readability (but after the signature and before sending to the allpay server, it is better not to format it, as this may break the signature. Formatting is added here for clarity):
Before signing:
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<ns2:createCashInTransaction xmlns:ns2="http://www.allpay.kz/mfs/soap/TransactionManagement/1.1">
<CashInRequest>
<header>
<lang>ru</lang>
<timestamp>2018-08-10T19:04:11.385+06:00</timestamp>
<requester>10124213</requester>
</header>
<toUserName>77072734954</toUserName>
<amount>10</amount>
<GUID>fa495ffa-4825-485e-9b14-a04c6d8315d2</GUID>
</CashInRequest>
</ns2:createCashInTransaction>
</soap:Body>
</soap:Envelope>After signature
<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Header>
<certificateNumber xmlns="https://allpay.kz">27</certificateNumber>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments"/>
<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<Reference URI="">
<Transforms>
<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<DigestValue>MFkKCT+PVBN914FvQfybUr47YjA=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>UkSrOS+/MtHtPylIkqufcn5eVAHuLasmVF+HtBj/x+hUDHzPaNDQ08KufNCmbNenb/2CVnWbbOH0
aQY4BT2IWCnLIwyVm34hBmHIASkBPaT3P27k/USW0KCKTXzPAAbZn8ScgxT8QUaem8KNlp/J/kbU7
ZlF+MGq0SbhcNZl6fpY=</SignatureValue>
</Signature>
</soap:Header>
<soap:Body>
<ns2:createCashInTransaction xmlns:ns2="http://www.allpay.kz/mfs/soap/TransactionManagement/1.1">
<CashInRequest>
<header>
<lang>ru</lang>
<timestamp>2018-08-10T19:04:11.385+06:00</timestamp>
<requester>10124213</requester>
</header>
<toUserName>77072734954</toUserName>
<amount>10</amount>
<GUID>fa495ffa-4825-485e-9b14-a04c6d8315d2</GUID>
</CashInRequest>
</ns2:createCashInTransaction>
</soap:Body>
</soap:Envelope>Thus the steps to be taken to sign:
- Add "/ Envelope / Header / certificateNumber" tag, where its content represents the certificate number (Contained in the name of the archive which can be downloaded from the site allpay).
- To canonicalize the received message using the method "XML-SEC Rec for exclusive canonicalization with comments"
- Sign the received message as follows example. Namely, to sign the entire document using RSA_SHA1, cannonicalization in metadata use - exclusive with comments. The key itself is taken from the archive, the number of which is specified in the certificateNumber
- Put the signature in the "/ Envelope / Header" to get as in the above example.
