Skip to main content
This section describes the data flow from the customer’s browser through your website servers, to the Subscribe WebSession servers and the Subscribe database.
  1. Your customer requests a page from your Web application (makes an HTTP call to your Web site), such as your Order page, which requires that they submit payment information.
  2. Call WebSession.initialize() in the Subscribe API to initialize a WebSession object on the Vindicia server. In the WebSession object, specify two key attributes:
    • The IP address from which the customer requested the order form. For example: billing_CODE_ONLY.php:$ws->setIpAddress($ip_address);
    • The API call HOA should make when the customer submits the form. For example, calling PaymentMethod.update() allows you to create a new payment method. For example: <div id="vin_PaymentMethod_creditCard_account"></div> The initialize call creates a WebSession object, which may include a method data member. You can use this data member to specify the SOAP call for which this WebSession is acting as proxy. Valid input includes:
      • Account_Update
      • Account_UpdatePaymentMethod
      • AutoBill_Update
      • PaymentMethod_Update
      • PaymentMethod_Validate
      • Transaction_Auth
      • Transaction_AuthCapture (The initialize call takes several parameters to mitigate the risk of an unauthenticated call.)
      Note: To help Vindicia assess fraud risk, capture the customer’s IP address. This aids the Vindicia ChargeGuard team in chargeback investigations.
  3. After the initialize() call is made, the WebSession object returns a Vindicia ID (VID). This VID is used to track the HOA session, and serves as a means of control and authentication. Only one VID is generated per session, and it has a time limit for validity. Subscribe returns the WebSession VID to your application in response to the initialize() call. Other form elements, hidden or to be provided by the customer, must be consistent with the data required to complete a PaymentMethod.update() call (or other API call, listed above). The form’s action URL points to the HOA address on the Vindicia server.
  4. Return the checkout form from the merchant server to the browser with thisVID. This will be a hidden field called WebSessionId. Note: Steps 1 through 4 are parts of a single synchronous call and response chain initiated by the customer’s request for the order form.
  5. As the page loads in the browser, iframes will load from Vindicia.com to protect sensitive payment fields (Hosted Fields).
  6. The customer fills out your form, and clicks Save or Submit. The entire form, including the hidden VID is posted directly to the Vindicia servers. Your server is bypassed completely with this form submission.. Note: The customer must complete the form within one hour (the default expiration time), or within your specified expiration time, after which Subscribe marks the WebSession object expired.
  7. Vindicia saves the form data to Subscribe in a temporary area. HOA loads the WebSession object with vin_WebSession_VID, which accompanied the form, and stores the data submitted by the order form. Note that HOA does not make the API call to create the PaymentMethod object at this point in the process. At this point you need only pass in the object attributes you have collected—the remainder can be passed in with the WebSession.finalize call (Step 10).
  8. Subscribe returns the redirectURL back to the browser. If you’re using a pure Ajax solution, the onSubmitCompleteEvent is called. Otherwise the browser is redirected to this URL. This URL (the redirectURL) is either your confirmation page or your error page that you previously defined in your web session.
  9. The browser is either redirected to the merchant page or process for completing the order, or an Ajax call is made to indicate success to the merchant server. The redirect carries the VID for the WebSession back to the merchant site, allowing you to finalize this session
  10. Within the page or process resulting from confirmation or Ajax call on the merchant server, you execute a WebSession.finalize SOAP call to Vindicia. When you call finalize, simply pass in the ID of the sparse webSession object (the VID). Do not populate any privateFormValues or post values. In rare cases, you can pass in MethodParamValues—for example if you want to pass in a campaign code to an AutoBill.update call after collecting it in the payment form. WebSession.finalize returns both the WebSession results and the result for the underlying API calls. (For more information, see Section 19: The WebSession Object in the Subscribe API Guide.) You can also pass other parameters for the Subscribe method that you did not pass initially.
  11. During the Subscribe finalize, all temporary session data is converted to objects in the Vindicia database, which Subscribe begins processing immediately. For example, a new AutoBill might capture the funds on a first transaction.
  12. The results returned by the finalize() call contain enough information to either present a Thank You page to the customer or satisfy your Ajax function call, or react to any errors in case more action is required from the customer.
  13. Your merchant server page communicates results to the browser, either through an HTML or an Ajax response.
Parent topic:HOA with Hosted Fields Process Flow