Integration and Testing

[conzone]

Problem:

Looking for a quick way when updating a customers payment profile to not have to re submit all of the information again and ensure that nothing that wasn't resent is cleared out of their profile by accident.

The exact process I was trying to follow is the same as documented in the CIM SOAP guide page 47.

UpdateCustomerPaymentProfile

"If some fields in this request are not submitted or are submitted with a blank value, the values in the original profile will be removed. As a best practice to prevent this from happening, call GetCustomerPaymentProfile before calling UpdateCustomerPaymentProfile. That will return all current information including masked payment information. Then, simply change the field that needs updating and use that to call UpdateCustomerPaymentProfile."

The only problem I was having with this is when you call getCustomerPaymentProfile the object returned is of type CustomerPaymentProfileMaskedType while on the other hand the object required when calling updateCustomerPaymentProfile is of type CustomerPaymentProfileExType. So if following the suggestion from the guide to get the existing profile, "...simply change the field that needs updating and use that to call..." update is not possible that easily that I can tell because of the different class types.

For now I can do it the long way of coping a bunch of data between their Masked and unmasked versions which seems a little more tedious than it needs to be. Wondering if anyone else knows of a faster and simpler solution or a utility that I may be overlooking to convert from Masked --> Ex.

Thanks,

B

[itdevworks]

My guess is that comment originally came from the CIM XML Implementation Guide, where doing such a thing is a little easier (although you still have to change the root request element from getCustomerPaymentProfileResponse to updateCustomerPaymentProfileRequest).  In code I have written (which all uses the XML API), I create class which takes in the XML for a CustomerProfile, PaymentProfile and ShippingAddress and exposes all of the elements as properties. Then those classes each have a way of generating the proper XML for a request to the web.  In the case of SOAP, though, you could use a similar mechanism but take in the various SOAP generated classes and output different ones, but that is basically the "copy" method that you already mentioned in your post.  So unless you want to switch to using the XML API, then copying structures is probably your best, or perhaps only, choice.

[7219]

Hi,

I use CIM SOAP API to call 'GetCustomerProfile' . as the OP said the returned payment data are masked . i'm trying to read the xml response from this function call and store info in a java class.

I wonder if there is a way to get real values of cardnumber ,expirationDate etc.. not the masked values. is this possible to do? can you show some Java code to retrive real values from masked values for creditcard ?

thanks.

[itdevworks]

No, you cannot retrieve the masked values.  The whole purpose of CIM is to allow organizations to achieve PCI-DSS[^] compliance without having to go through the rigorous auditing required if you store credit card data on your own.  If the API were to allow retrieving the card data then it would be no more secure than a local db.  The way it is, once the data is saved in the profiles, nobody can get it back out, but you can still use it to make payment transactions.  Thus, your company/organization is relieved of any responsibility for the storage of the credit card data (beyond the process of getting it from the customer and in to CIM).

[7219]

---

itdevworks wrote:

No, you cannot retrieve the masked values.  The whole purpose of CIM is to allow organizations to achieve PCI-DSS[^] compliance without having to go through the rigorous auditing required if you store credit card data on your own.  If the API were to allow retrieving the card data then it would be no more secure than a local db.  The way it is, once the data is saved in the profiles, nobody can get it back out, but you can still use it to make payment transactions.  Thus, your company/organization is relieved of any responsibility for the storage of the credit card data (beyond the process of getting it from the customer and in to CIM).

---

Yes this absolutely makes sense. in fact i reviewed my requirements again and found that all i need is the masked data not the real sensitive data.

However i found it strange the <expirationdate> is also masked. is this field really very sensitive so AUTH decided to mask it? In some other payment systems the expiry date is not masked.

[itdevworks]

I am not certain why Authorize.net chose to mask the expiration date.  The PCI-DSS says it is okay to store it as long as it is not with the credit card number.  It may have been just to err on the side of caution, but whatever the case, that is the way it is.  If you need access to the exipiration date you will have to store it on your own along with your customer records or somewhere similar.

[7219]

---

itdevworks wrote:

I am not certain why Authorize.net chose to mask the expiration date.  The PCI-DSS says it is okay to store it as long as it is not with the credit card number.  It may have been just to err on the side of caution, but whatever the case, that is the way it is.  If you need access to the exipiration date you will have to store it on your own along with your customer records or somewhere similar.

---

Ok Thanks for helpfull reply.

In fact i realized that in my project requirement i'll be implementing an UpdatePayment() method like the OP described. I didn't understand what you mean by deep copy of data etc...can you please explain more how to preform a customer payment profile update in java with CIM SOAP?

thanks

[itdevworks]

Sorry, but you are talking to the wrong person for that.  I always use the XML API and I am predominantly a .NET programmer.  I have dabbled in PHP but have never written a line of Java.

[7219]

---

itdevworks wrote:

Sorry, but you are talking to the wrong person for that.  I always use the XML API and I am predominantly a .NET programmer.  I have dabbled in PHP but have never written a line of Java.

---

Ok no problem .thanks .