canonical: https://jentic.com/apis/bambora.com/bambora

# Bambora Worldline Payment APIs

Worldline (formerly Bambora) North America offers a payment processing API for card transactions, tokenisation, stored payment profiles, settlement reporting, and recurring billing. The 23 endpoints handle the full transaction lifecycle: process, complete pre-auths, void, refund, and continue 3D Secure flows. Stored cards on a customer profile let merchants charge returning customers without re-collecting card data, while the reporting endpoints expose settlement, statement, and commission data for finance teams.

## For AI agents

Process card payments, manage tokenised payment profiles, refund or void transactions, and pull settlement reports through Worldline (Bambora) North America.

## Scope

Does not handle accounting, payroll, or non-card payment rails like ACH-only direct debit - use for North American card payment processing, tokenisation, and settlement reporting only.

## Capabilities

- Process card payments and capture pre-authorisations through the /payments endpoints
- Tokenise card numbers so the merchant stays outside PCI DSS scope
- Create stored payment profiles and attach, update, or remove cards on file
- Refund or void a transaction using its trans ID
- Continue a 3D Secure flow after the cardholder completes the challenge
- Pull settlement, statement, and commission reports for finance reconciliation
- Retrieve recurring payment account details for an account ID

## Use cases

### Card Payment Processing

Accept one-time card payments through POST /payments, with support for pre-authorisation, completion, void, and refund flows. The API tokenises card data via `/scripts/tokenization/tokens` so merchants stay outside PCI scope. Pre-auths are captured later through `/payments/{transId}/completions`, and 3D Secure challenges resume through `/payments/{merchantData}/continue.`

Example prompt: Tokenise a card via POST `/scripts/tokenization/tokens`, then process a $49.99 USD payment with POST /payments using the returned token.

### Stored Card Profiles for Returning Customers

Create persistent customer payment profiles via POST /profiles and attach one or more cards via POST `/profiles/{profileId}/cards.` On the next purchase the merchant references the profile and stored card instead of collecting card data again, which improves conversion and keeps PCI scope minimal. Cards can be listed, updated, or deleted as the customer's wallet changes.

Example prompt: Create a payment profile for a returning customer via POST /profiles, then add their card via POST `/profiles/{profileId}/cards` and charge it through POST /payments.

### Settlement and Finance Reporting

Finance teams pull settlement data, monthly fee statements, and commission payouts directly via the /reports endpoints. `/reports/settlement` returns the rolling three-month window of settled transactions, `/reports/statements` returns the monthly fee statement, and `/reports/commissions` returns commission detail. This replaces manual extracts from the Worldline back office.

Example prompt: Call GET `/reports/settlement` for the last 30 days, then reconcile the totals against the merchant's accounting system.

### AI Agent Integration via Jentic

An agent built on Jentic can run a card payment end-to-end: tokenise the card, optionally create a profile, process the payment, and surface the transaction ID. Worldline passcodes are held in your Jentic One instance so the agent never touches the encoded merchant_id:passcode pair.

Example prompt: Search Jentic for 'process a worldline payment', load the schema for POST /payments, and execute it with the order amount, currency, and card token.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/payments` | Process a card payment |
| POST | `/payments/{transId}/returns` | Process a refund or return |
| POST | `/payments/{transId}/void` | Void or cancel a transaction |
| POST | `/payments/{transId}/completions` | Complete a pre-authorised payment |
| POST | `/profiles` | Create a customer payment profile |
| POST | `/profiles/{profileId}/cards` | Add a card to a profile |
| POST | `/scripts/tokenization/tokens` | Tokenise a credit card |
| GET | `/reports/settlement` | Retrieve settlement data |

## Key resources

- **Payments** — Process, retrieve, complete, refund, and void card transactions
- **Profiles** — Customer payment profiles with stored cards (CRUD on profile and card)
- **Tokenization** — Generate single-use tokens for card data outside PCI scope
- **Reports** — Settlement, statements, commissions, and merchant detail
- **Recurring** — Recurring payment account details

## Why Jentic

- **Setup:** Wiring Worldline (Bambora) by hand means base64-encoding the merchant_id:passcode pair into the Passcode header, adding a Sub-Merchant-Id header where required, and building the tokenise-then-charge and 3D Secure resume flows yourself against the North America host. Through Jentic you install once, import the Worldline Payment API from the API Directory, store the passcode once, and your agent calls it.
- **Permission scoping:** Worldline puts the transaction and profile id in the URL path (`/payments/{transId}/returns`, `/profiles/{profileId}/cards`), so a rule can pin your agent to one profile or the operations it needs, such as tokenising a card with `/scripts/tokenization/tokens` and processing a payment with /payments. You choose those operations, so refunds via `/payments/{transId}/returns` or voids via `/payments/{transId}/void` are not included unless you add them.
- **Credential handling:** Your Worldline base64-encoded merchant_id:passcode pair and any Sub-Merchant-Id are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'process a card payment' or 'refund a transaction', and Jentic returns the matching Worldline operation with its input schema so the agent calls the correct endpoint without parsing the spec.

## Related APIs

- **Bagisto Shop REST API** — E-commerce storefront whose checkout step can hand off to Bambora for card capture
- **Bank of America Merchant Services** — Another payment-related banking API alternative for North American merchants
- **Backendless API** — BaaS that can persist customer-facing receipts and order state alongside Bambora

## FAQ

### What authentication does the Worldline (Bambora) API use?

Authentication uses a Passcode header in the format 'Passcode Base64Encoded(merchant_id:passcode)' (the passcode apiKey scheme). Payment facilitators additionally pass a Sub-Merchant-Id header. Through Jentic, both values live in the encrypted vault and are injected at execution so the agent never sees the encoded credential.

### Can I store a card on file with the Bambora API?

Yes. Create a payment profile with POST /profiles, then attach a card via POST `/profiles/{profileId}/cards.` On the next charge, reference the profile in POST /payments instead of resubmitting card data. Cards on a profile are managed with PUT and DELETE on `/profiles/{profileId}/cards/{cardId}.`

### What are the rate limits for the Bambora API?

Rate limits are not declared in the OpenAPI spec. Worldline enforces limits per merchant and gateway type; consult https://dev.na.bambora.com/ and your merchant agreement before high-volume bulk operations or batch refund jobs.

### How do I refund a payment through Jentic?

Search Jentic for 'refund a worldline payment', load the schema for POST `/payments/{transId}/returns`, and execute with the original transaction ID and refund amount. Jentic injects the Passcode header so the agent never holds the credential.

### Does the Bambora API support 3D Secure?

Yes. When a payment requires cardholder authentication, the initial POST /payments returns a redirect challenge. After the cardholder completes 3D Secure, the merchant resumes the flow with POST `/payments/{merchantData}/continue` using the merchantData token returned by the challenge.

### Can I download settlement reports through this API?

Yes. GET `/reports/settlement` returns up to a three-month window of settled transactions. GET `/reports/statements` returns the monthly fee statement and GET `/reports/commissions` returns commission payout detail. POST /reports queries arbitrary transactions by date range.

### Can I limit what my agent is allowed to do with the Worldline (Bambora) API?

Yes. Because you run Jentic One yourself, your own rules decide which Worldline operations and credentials the agent may use, and the transaction and profile IDs sit in the URL path (`/payments/{transId}/returns`, `/profiles/{profileId}/cards`) so a rule can pin the agent to a single profile or a specific set of calls. For example, you can allow it to tokenise a card with `/scripts/tokenization/tokens` and process a charge with /payments while leaving out refunds via `/payments/{transId}/returns` and voids via `/payments/{transId}/void.` Those higher-risk operations are only available to the agent if you explicitly add them.