> ## Documentation Index
> Fetch the complete documentation index at: https://docs.slm.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Hosted Order Automation with Hosted Fields

Subscribe Hosted Order Automation (HOA) with Hosted Fields allows you to accept and process sensitive customer payment information without involving your own servers, instead submitting the payment information directly from your customer’s browser to Vindicia over HTTPS (a secure HTTP connection using Transport Layer Security (TLS)). When your customer’s browser loads your checkout page, some or all of the input boxes in the checkout form are iframes loaded from Vindicia.com.

This means sensitive information is not loaded, or saved, to your server. Should your server experience some kind of attack, such as a JavaScript injection, the credit card information is still protected. This gives you the ability to create a storefront that processes credit cards without ever loading or saving the card numbers yourself. HOA with Hosted Fields bypasses your server at form submission, eliminating your system's exposure to customer credit card information.

Using your SOAP client, you call `WebSession.initialize()` to generate a web session ID. This ID is placed in a hidden field in your form. At the end, when your form has been submitted, you call `WebSession.finalize()` to create the Subscribe objects (`PaymentMethod`, `AutoBill`, `Transaction`, `Account`). When you call `finalize`, simply pass in the ID of the sparse `webSession` object (the VID). Do not populate any `privateFormValues` or `post` values. In rare cases, you can pass in `MethodParamValues`—for example if you want to pass in a campaign code to an `AutoBill.update` call after collecting it in the payment form.

The WebSession object is used to temporarily store payment method information in the Subscribe database, where it is permanently saved when the `WebSession.finalize()` method is called. For more information on the WebSession object, see The WebSession Object in the Subscribe API Guide.

Use of HOA with Hosted Fields satisfies the minimum audit burden of SAQ-A (Self-Assessment Questionnaire—version A) requirements when accepting payment information from your customers. For that reason, the `WebSession` object is limited in scope and properties, and is meant only to create or authorize `AutoBills`, `PaymentMethods`, and `Transactions`. HOA is not designed to create other Subscribe objects.

**Note:** If you have already integrated HOA with your Subscribe implementation and just want to set up Hosted Fields, see the [User Experience Flow](User_Experience_Flow#), then skip ahead to [Setting Up Hosted Fields](Setting_Up_Hosted_Fields#).

* **[HOA Features](../topics/HOA_Features)**

* **[HOA with Hosted Fields Process Flow](../topics/HOA_with_Hosted_Fields_P)**

* **[Working with HOA with Hosted Fields](../topics/Working_with_HOA_with_Ho)**

* **[Implementing HOA with Hosted Fields](../topics/Implementing_HOA_with_Ho)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.