Debit mandate

Register mandate

POST/api/v1/end-user/autodebit-register

Authorization + AESFirm banking

Starts debit registration. On the wire the body is AES-encrypted { data }. This page documents the business payload before encryption.

The sandbox receives { data } encrypted with AES-256-CBC (PKCS7, base64). The key is 32 bytes and the vector is 16 bytes, both UTF-8. Try encrypts the form payload in the browser, then sends it. The key never leaves your machine.

Headers

Fields	Description
`Content-Type`Required	application/json
`Authorization`Required	Authorization key Fintwin issues for the company code.

Body

Fields	Description
`com_cd`Required	Enterprise code.
`bank_cd`Required	NAPAS code of the funding bank.
`contract_id`Required	Enterprise contract id.
`cusType`Required	CA_NHAN or DOANH_NGHIEP.
`nationalId`Required	Test national id.
`registrationNumber`Required	Enterprise registration number when cusType is a business.
`sourceNumber`Required	Funding account number.
`sourceName`Required	Account holder name.
`phoneNumber`Required	Phone number that receives the OTP.
`email`Optional	Email that receives notices.

Samples

curl -X POST 'https://sandbox.example.invalid/api/v1/end-user/autodebit-register' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: <authorization-key>' \
  -d '{"data":"<base64 AES-256-CBC of the business JSON>"}'