Partners that are at a minimum of PCI DSS SAQ A compliant are able to utilise the XPay API to process the insurance transaction. This will make Cover Genius the Merchant of Record (MoR).
After a customer selects the insurance product and proceeds to the checkout stage, the payment information (credit card details) must be collected and transmitted through the customer tokens endpoint.
Sending Payment Details
The XPay API uses a long lived JSON Web Token (JWT) which will be provided to you by the assigned Client Solutions Engineer (CSE).
Tokenize Card Details
POSThttps://api.xpay.xcover.com/customer-tokens
This API call will tokenize the customers credit card details.
Note, the /cutomer-tokens endpoint will not charge the customer, just tokenise their payment details. The customer is charged on the subsequent /bookings API call.
Making a Booking
After a successful response from the customer tokens endpoint, the partner must confirm the booking by sending a request to the booking endpoint with the customer_token_id set to the id from the previous step, this will charge the customer.