Digest Calculation VPOS XML API 2.1

At VPOS side there are both validations implemented. If the digest value is present, then VPOS validates the authentication of message using the digest and merchant shared secret.

Similar validation of the digest should also be made from the merchant for the received response message.

Version 2.1 
Base64(SHA256((utf8bytes(canonicalize(Message))+utf8bytes(sharedSecret)))), to be used only if the XML password is not used. The canonicalization method to be used is http://www.w3.org/TR/2001/REC-xml-c14n-20010315

Note that the XML documents should be handled with namespace aware xml libraries (parser/serializer). When the Message element is serialized and canonicalized it should contain xmlns namespace attribute.

For example a non canonicalized Message element

<Message version="2.1" messageId="M1627047946727" lang="en" timeStamp="2021-07-23T16:45:46.000+03:00">
  <SaleRequest>
    <Authentication>
      <Mid>0000001</Mid>
    </Authentication>
    <OrderInfo>
      <OrderId>1627047728798</OrderId>
      <OrderDesc></OrderDesc>
      <OrderAmount>1.25</OrderAmount>
      <Currency>EUR</Currency>
    </OrderInfo>
    <PaymentInfo>
      <PayMethod>visa</PayMethod>
      <CardPan>332211223344</CardPan>
      <CardExpDate>2206</CardExpDate>
      <CardCvv2>756</CardCvv2>
      <CardHolderName>John Smith</CardHolderName>
    </PaymentInfo>
  </SaleRequest>
</Message>

Below is the canonicalized version of Message element (attributes ordered and default xmlns defined):

<Message xmlns=http://www.modirum.com/schemas/vposxmlapi41 xmlns:ns2=http://www.w3.org/2000/09/xmldsig# lang="en" messageId="M1627047946727" timeStamp="2021-07-23T16:45:46.000+03:00" version="2.1">
  <SaleRequest>
    <Authentication>
      <Mid>0000001</Mid>
    </Authentication>
    <OrderInfo>
      <OrderId>1627047728798</OrderId>
      <OrderDesc></OrderDesc>
      <OrderAmount>1.25</OrderAmount>
      <Currency>EUR</Currency>
    </OrderInfo>
    <PaymentInfo>
      <PayMethod>visa</PayMethod>
      <CardPan>332211223344</CardPan>
      <CardExpDate>2206</CardExpDate>
      <CardCvv2>756</CardCvv2>
      <CardHolderName>John Smith</CardHolderName>
    </PaymentInfo>
  </SaleRequest>
</Message>

Also take note that in canonicalized form element attributes are ordered lexicographically see https://www.w3.org/TR/2001/REC-xml-c14n-20010315#DocumentOrder

Note for XML API with Three D Secure:

This is 2 step processing at first step merchant should implement MPI plugin session as decribed in Modirum MPI manual and obtain the Three D Secure authentication results from there and then next step is to fill the corresponding values to XML API ThreeDSecure element and proceed with XML api request to VPOS.

XML API plugin example message and digest

Secret=SecRetDigest1

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<VPOS xmlns=http://www.modirum.com/schemas/vposxmlapi41 xmlns:ns2=http://www.w3.org/2000/09/xmldsig#>
  <Message version="2.1" messageId="M1560776758348" timeStamp="2019-06-17T16:05:58.348+03:00">
    <SaleRequest>
      <Authentication>
        <Mid>0000001</Mid>
      </Authentication>
      <OrderInfo>
        <OrderId>1560776271083</OrderId>
        <OrderDesc>Test</OrderDesc>
        <OrderAmount>1.25</OrderAmount>
        <Currency>EUR</Currency>
        <PayerEmail>
        </PayerEmail>
      </OrderInfo>
      <PaymentInfo>
        <PayMethod>visa</PayMethod>
        <CardPan>4016000000002</CardPan>
        <CardExpDate>2206</CardExpDate>
        <CardCvv2>756</CardCvv2>
        <CardHolderName>John Smith</CardHolderName>
      </PaymentInfo>
    </SaleRequest>
  </Message>
  <Digest>xmSXBhrE99FqiP2b73S 0cS+oLrIi8+lng9IS9KmoWpM=</Digest>
</VPOS>

Message part canonicalized note xmlns added:

<Message xmlns=http://www.modirum.com/schemas/vposxmlapi41 xmlns:ns2=http://www.w3.o rg/2000/09/xmldsig# messageId="M1560776758348" timeStamp="2019-06-17T16:05:58.348+03:00" version="2.1">
  <SaleRequest>
    <Authentication>
      <Mid>0000001</Mid>
    </Authentication>
    <OrderInfo>
      <OrderId>1560776271083</OrderId>
      <OrderDesc>Test</OrderDesc>
      <OrderAmount>1.25</OrderAmount>
      <Currency>EUR</Currency>
      <PayerEmail></PayerEmail>
    </OrderInfo>
    <PaymentInfo>
      <PayMethod>visa</PayMethod>
      <CardPan>4016000000002</CardPan>
      <CardExpDate>2206</CardExpDate>
      <CardCvv2>756</CardCvv2>
      <CardHolderName>John Smith</CardHolderName>
    </PaymentInfo>
  </SaleRequest>
</Message>
SecRetDigest1

Then append SecRetDigest1 and apply sha2-256 function.
You will get digest
<Digest>xmSXBhrE99FqiP2b73S0cS+oLrIi8+lng9IS9KmoWpM=</Digest>

Response example:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<VPOS xmlns=http://www.modirum.com/schemas/vposxmlapi41 xmlns:ns2=http://www.w3.org/2000/09/xmldsig#>
  <Message version="2.1" messageId="M1560776758348" timeStamp="2019-06-17T16:05:58.517+03:00">
    <SaleResponse>
      <OrderId>1560776271083</OrderId>
      <OrderAmount>1.25</OrderAmount>
      <Currency>EUR</Currency>
      <PaymentTotal>1.25</PaymentTotal>
      <Status>CAPTURED</Status>
      <TxId>927703881</TxId>
      <PaymentRef>104040</PaymentRef>
      <RiskScore>10</RiskScore>
      <Description>OK, CAPTURED response code 00</Description>
      <Attribute  name="EXTACQUIRERID">014</Attribute>
    </SaleResponse>
  </Message>
  <Digest>oavTfZECv1L8hKcjw0m V+bOvIjSdq+UNSNU7/xRvnAA=</Digest>
</VPOS>