Skip to main content
Subscribe Hosted Order Automation (HOA) with Hosted Fields allows you to accept and process sensitive customer payment information without involving your own servers, instead submitting the payment information directly from your customer’s browser to Vindicia over HTTPS (a secure HTTP connection using Transport Layer Security (TLS)). When your customer’s browser loads your checkout page, some or all of the input boxes in the checkout form are iframes loaded from Vindicia.com. This means sensitive information is not loaded, or saved, to your server. Should your server experience some kind of attack, such as a JavaScript injection, the credit card information is still protected. This gives you the ability to create a storefront that processes credit cards without ever loading or saving the card numbers yourself. HOA with Hosted Fields bypasses your server at form submission, eliminating your system’s exposure to customer credit card information. Using your SOAP client, you call WebSession.initialize() to generate a web session ID. This ID is placed in a hidden field in your form. At the end, when your form has been submitted, you call WebSession.finalize() to create the Subscribe objects (PaymentMethod, AutoBill, Transaction, Account). When you call finalize, simply pass in the ID of the sparse webSession object (the VID). Do not populate any privateFormValues or post values. In rare cases, you can pass in MethodParamValues—for example if you want to pass in a campaign code to an AutoBill.update call after collecting it in the payment form. The WebSession object is used to temporarily store payment method information in the Subscribe database, where it is permanently saved when the WebSession.finalize() method is called. For more information on the WebSession object, see The WebSession Object in the Subscribe API Guide. Use of HOA with Hosted Fields satisfies the minimum audit burden of SAQ-A (Self-Assessment Questionnaire—version A) requirements when accepting payment information from your customers. For that reason, the WebSession object is limited in scope and properties, and is meant only to create or authorize AutoBills, PaymentMethods, and Transactions. HOA is not designed to create other Subscribe objects. Note: If you have already integrated HOA with your Subscribe implementation and just want to set up Hosted Fields, see the User Experience Flow, then skip ahead to Setting Up Hosted Fields.