> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developer.americanexpress.ferndocs.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer.americanexpress.ferndocs.com/_mcp/server.
# Online Purchase
POST https://api.qasb.americanexpress.com/risk/fraud/v2/apiplatform/enhanced_authorizations/online_purchase
Content-Type: application/json
The /online_purchases resource supports general web and mobile purchases.
Reference: https://developer.americanexpress.ferndocs.com/fraud-prevention/enhanced-authorization-v-2/api-reference/online-purchase
## Authentication
- `Authorization` header (required) — HMAC (one-way TLS). A `MAC` authorization header signed with your client secret. See https://developer.americanexpress.com/documentation/api-security/hmac
## Servers
- `https://api.qasb.americanexpress.com/risk/fraud/v2/apiplatform/enhanced_authorizations` (Sandbox, default)
- `https://api.qa.americanexpress.com/risk/fraud/v2/apiplatform/enhanced_authorizations` (Qa)
- `https://api.americanexpress.com/risk/fraud/v2/apiplatform/enhanced_authorizations` (Production)
## Request
### Headers
- `x-amex-request-id` (string, required) — A Unique Identifier. Typically, a GUID is displayed as 32 hexadecimal digits, grouped and separated by hyphens and left-aligned.e.g., 30c0fda8-a834-4de8-80b35-bad8f5a1986.A GUID will be used for tracking purposes and the same GUID will be echoed back in the response.
- `x-amex-api-key` (string, required) — This is the key that will be provided once the Consumer is onboarded.
### Body (application/json)
This endpoint expects an enhanced_auth_online_request.
- `timestamp` (datetime, required) — The originating timestamp of the API Call from the Merchant. The format is: yyyy-MM-ddTHH:mm:ss.SSSZ.e.g., 2018-03-01T11:23:10.791-0700
- `transaction_data` (transaction_data, required) — The following fields are specific to the transaction.
- `purchaser_information` (purchaser_information, optional) — Details that are specific to the Purchaser.
- `registration_details` (registration_details, optional) — The Customer's registration details with the Merchant.e.g., You are a major online retailer and a Customer who is registered with you is about to make a purchase. The following details refer to the Customer's registration details with you.
- `registration_details_change_history` (registration_details_change_history, optional) — This is historical information referencing the Customer's registration details with your company.e.g., You are a major online retailer and a Customer that is registered with you is about to make a purchase. The following details refer to the Customer's registration details with you. For each property (unless otherwise indicated), the value is the number of days between the purchase date and the last Update of the registration information. If you do not have tracking at the field level for changes, please use the last update date for the appropriate record.
- `seller_information` (seller_information, optional) — The following Seller details are needed in a situation where your company is submitting the transaction details on behalf of another entity.e.g., A taxi company in which each driver is an independent online marketplace where small vendors can sell their goods leveraging a common infrastructure payment processing center that enables individual Merchants to accept cards. In these situations, the Seller information refers to:the location of the seller;tenure for which they have used your services;details about their business.
## Response
### 200
Successfully processed the Enhanced Authorization request.
- `status` (string, optional) — The API status, displayed as either success or failure.e.g., success
- `timestamp` (datetime, optional) — The originating timestamp from the Merchant request. The format is: yyyy-MM-ddTHH:mm:ss.SSSZ.e.g., 2018-03-06T11:23:10.791-0700
- `resp_code` (string, optional) — The response code which will describe the response received.e.g., ENAUTH000
- `resp_msg` (string, optional) — The detailed response message.e.g., Successfully processed the Enhanced Authorization request.
- `aav_results` (aav_results, optional) — Indicates whether the American Express Authorization System found a match for the individual elements name, phone, address, email and ZIP Code that is passed in the Enhanced Authorization request. Possible values for each element include:Y = The information provided matched with the information on file.N = The information provided does not match with the information on file.U = The information is unavailable to check.R = System unavailable; retry.
- `additional_response` (additional_response, optional) — The additional response requested by the Consumer will be sent in this section.
## Errors
### 400 Bad Request Error
Bad Request.
- `error_code` (string, optional) — The detailed error code. For additional details, please see the Common Error Codes.e.g., EAPERR003
- `error_type` (string, optional) — A short description of the error type.
- `error_description` (string, optional) — A detailed description and/or explanation of the error.
### 401 Unauthorized Error
Unauthorized. Indicates a failure within the security credentials.
- `error_code` (string, optional) — The detailed error code. For additional details, please see the Common Error Codes.e.g., EAPERR003
- `error_type` (string, optional) — A short description of the error type.
- `error_description` (string, optional) — A detailed description and/or explanation of the error.
### 405 Method Not Allowed Error
Method Not Allowed. Operation not allowed. The error message will have an exception string.
- `error_code` (string, optional) — The detailed error code. For additional details, please see the Common Error Codes.e.g., EAPERR003
- `error_type` (string, optional) — A short description of the error type.
- `error_description` (string, optional) — A detailed description and/or explanation of the error.
### 406 Not Acceptable Error
Not Acceptable. The server cannot serve a representation that meets the Client's preferences. The error message will have an exception string.
- `error_code` (string, optional) — The detailed error code. For additional details, please see the Common Error Codes.e.g., EAPERR003
- `error_type` (string, optional) — A short description of the error type.
- `error_description` (string, optional) — A detailed description and/or explanation of the error.
### 415 Unsupported Media Type Error
Unsupported Media Type. The Client sends the message body in a format that the server does not understand. The error message will have an exception string.
- `error_code` (string, optional) — The detailed error code. For additional details, please see the Common Error Codes.e.g., EAPERR003
- `error_type` (string, optional) — A short description of the error type.
- `error_description` (string, optional) — A detailed description and/or explanation of the error.
### 429 Too Many Requests Error
Too many requests.
- `error_code` (string, optional) — The detailed error code. For additional details, please see the Common Error Codes.e.g., EAPERR003
- `error_type` (string, optional) — A short description of the error type.
- `error_description` (string, optional) — A detailed description and/or explanation of the error.
### 500 Internal Server Error
Internal Error. An error has occurred within the American Express systems.
- `error_code` (string, optional) — The detailed error code. For additional details, please see the Common Error Codes.e.g., EAPERR003
- `error_type` (string, optional) — A short description of the error type.
- `error_description` (string, optional) — A detailed description and/or explanation of the error.
### 503 Service Unavailable Error
Service unavailable.
- `error_code` (string, optional) — The detailed error code. For additional details, please see the Common Error Codes.e.g., EAPERR003
- `error_type` (string, optional) — A short description of the error type.
- `error_description` (string, optional) — A detailed description and/or explanation of the error.
### 504 Gateway Timeout Error
Timeout Error. The error message will have an exception string.
- `error_code` (string, optional) — The detailed error code. For additional details, please see the Common Error Codes.e.g., EAPERR003
- `error_type` (string, optional) — A short description of the error type.
- `error_description` (string, optional) — A detailed description and/or explanation of the error.
## Types
### transaction_data
The following fields are specific to the transaction.
- `card_number` (string, required) — The 15-digit Primary Account Number (PAN) of the Customer's Card.e.g., 371270025401043Masked Card Numbers are allowed, which are the first six digits of the Card Number, followed by five zeros, and the last four digits, (e.g., 123456000001234). If a Merchant sends masked Card Numbers, then the billing_address and billing_postal_code are additionally required variables for the process in order to match the Enhanced Authorization call to the Authorization message.
- `amount` (double, required) — The amount for the transaction in decimal format.e.g., 100
- `transaction_timestamp` (datetime, required) — The timestamp of the transaction itself. The format is: yyyy-MM-ddTHH:mm:ss.SSSZ.e.g., 2018-03-01T11:23:10.791-0700
- `currency_code` (string, optional) — The currency used for the transaction. Use the three-letter alphabetic or three-digit numeric The country on the Shipping information, represent by a three-digit \",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.json())
```
```javascript
const url = 'https://api.qasb.americanexpress.com/risk/fraud/v2/apiplatform/enhanced_authorizations/online_purchase';
const options = {
method: 'POST',
headers: {
'x-amex-api-key': 'x-amex-api-key',
'x-amex-request-id': 'x-amex-request-id',
Authorization: '',
'Content-Type': 'application/json'
},
body: '{"timestamp":"2024-01-15T09:30:00Z","transaction_data":{"card_number":"string","amount":1.1,"transaction_timestamp":"2024-01-15T09:30:00Z"}}'
};
try {
const response = await fetch(url, options);
const data = await response.json();
console.log(data);
} catch (error) {
console.error(error);
}
```
```go
package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.qasb.americanexpress.com/risk/fraud/v2/apiplatform/enhanced_authorizations/online_purchase"
payload := strings.NewReader("{\n \"timestamp\": \"2024-01-15T09:30:00Z\",\n \"transaction_data\": {\n \"card_number\": \"string\",\n \"amount\": 1.1,\n \"transaction_timestamp\": \"2024-01-15T09:30:00Z\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-amex-api-key", "x-amex-api-key")
req.Header.Add("x-amex-request-id", "x-amex-request-id")
req.Header.Add("Authorization", "")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(res)
fmt.Println(string(body))
}
```
```ruby
require 'uri'
require 'net/http'
url = URI("https://api.qasb.americanexpress.com/risk/fraud/v2/apiplatform/enhanced_authorizations/online_purchase")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-amex-api-key"] = 'x-amex-api-key'
request["x-amex-request-id"] = 'x-amex-request-id'
request["Authorization"] = ''
request["Content-Type"] = 'application/json'
request.body = "{\n \"timestamp\": \"2024-01-15T09:30:00Z\",\n \"transaction_data\": {\n \"card_number\": \"string\",\n \"amount\": 1.1,\n \"transaction_timestamp\": \"2024-01-15T09:30:00Z\"\n }\n}"
response = http.request(request)
puts response.read_body
```
```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;
HttpResponse response = Unirest.post("https://api.qasb.americanexpress.com/risk/fraud/v2/apiplatform/enhanced_authorizations/online_purchase")
.header("x-amex-api-key", "x-amex-api-key")
.header("x-amex-request-id", "x-amex-request-id")
.header("Authorization", "")
.header("Content-Type", "application/json")
.body("{\n \"timestamp\": \"2024-01-15T09:30:00Z\",\n \"transaction_data\": {\n \"card_number\": \"string\",\n \"amount\": 1.1,\n \"transaction_timestamp\": \"2024-01-15T09:30:00Z\"\n }\n}")
.asString();
```
```php
request('POST', 'https://api.qasb.americanexpress.com/risk/fraud/v2/apiplatform/enhanced_authorizations/online_purchase', [
'body' => '{
"timestamp": "2024-01-15T09:30:00Z",
"transaction_data": {
"card_number": "string",
"amount": 1.1,
"transaction_timestamp": "2024-01-15T09:30:00Z"
}
}',
'headers' => [
'Authorization' => '',
'Content-Type' => 'application/json',
'x-amex-api-key' => 'x-amex-api-key',
'x-amex-request-id' => 'x-amex-request-id',
],
]);
echo $response->getBody();
```
```csharp
using RestSharp;
var client = new RestClient("https://api.qasb.americanexpress.com/risk/fraud/v2/apiplatform/enhanced_authorizations/online_purchase");
var request = new RestRequest(Method.POST);
request.AddHeader("x-amex-api-key", "x-amex-api-key");
request.AddHeader("x-amex-request-id", "x-amex-request-id");
request.AddHeader("Authorization", "");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n \"timestamp\": \"2024-01-15T09:30:00Z\",\n \"transaction_data\": {\n \"card_number\": \"string\",\n \"amount\": 1.1,\n \"transaction_timestamp\": \"2024-01-15T09:30:00Z\"\n }\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```
```swift
import Foundation
let headers = [
"x-amex-api-key": "x-amex-api-key",
"x-amex-request-id": "x-amex-request-id",
"Authorization": "",
"Content-Type": "application/json"
]
let parameters = [
"timestamp": "2024-01-15T09:30:00Z",
"transaction_data": [
"card_number": "string",
"amount": 1.1,
"transaction_timestamp": "2024-01-15T09:30:00Z"
]
] as [String : Any]
let postData = JSONSerialization.data(withJSONObject: parameters, options: [])
let request = NSMutableURLRequest(url: NSURL(string: "https://api.qasb.americanexpress.com/risk/fraud/v2/apiplatform/enhanced_authorizations/online_purchase")! as URL,
cachePolicy: .useProtocolCachePolicy,
timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data
let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
if (error != nil) {
print(error as Any)
} else {
let httpResponse = response as? HTTPURLResponse
print(httpResponse)
}
})
dataTask.resume()
```