Cardcom Payment Gateway
Overview
Cardcom is an Israeli payment processor with a unique strength: integrated invoice and receipt generation compliant with Israeli tax law. While other Israeli gateways handle only the payment, Cardcom can automatically generate tax invoices (hashbonit mas) and receipts (kabala) as part of the payment flow, something Israeli businesses are legally required to issue.
This skill guides integration with Cardcom's REST API V11 for payments, tokenization, recurring billing, and document generation. Every endpoint and field name in this skill is taken from the official Cardcom V11 OpenAPI specification.
Official docs: https://secure.cardcom.solutions/Api/v11/Docs
(interactive API reference with the full OpenAPI schema). V11 is the current API as of 2026; there is no public V12.
Support center: https://support.cardcom.solutions
Cardcom in the Israeli landscape: competes with Tranzila, Israpay, and Bit Business. Pricing is quoted per merchant. Cardcom publishes a starting rate of about 1.2% that falls with volume, but that is a floor and not a quote, so treat it as a starting point only and send the user to Cardcom for an actual figure rather than promising them a rate. The distinguishing feature for Israeli businesses remains the built-in tax document generation. For Tranzila integration use the
skill instead.
Instructions
Step 1: Choose Integration Pattern
| Pattern | Card Data Handling | Best For |
|---|
| Low Profile (iframe/redirect) | Cardcom handles card entry | Most integrations, minimal PCI scope (SAQ-A) |
| Transaction (server-to-server) | Raw card data or token | Charging stored tokens, recurring billing |
| CreateDocument (server-to-server) | No card data | Standalone invoice/receipt generation |
Most Israeli merchants use
Low Profile for the initial payment plus token creation, then the
Transaction endpoint with the stored token for recurring charges. All payment flows can auto-generate invoices by attaching a
object.
Step 2: Set Up Authentication
Cardcom API V11 credentials:
- (integer) -- your terminal ID (use for testing)
- (string) -- API username
- (string) -- API password. Required on 19 of the 50 V11 endpoints that take a request body. The rule of thumb: operations that read or act on company-wide data require it; operations that charge a single card do not. It is required on every write, every report, every call, and on
Transactions/ListTransactions
, , and . It is NOT a field on or at all, so do not send it there. When in doubt, check the array for the endpoint's request schema in the V11 OpenAPI spec.
Test environment:
Terminal
with the demo
is widely cited in community libraries as the sandbox, with test card
, any future expiry, CVV
. We have NOT been able to confirm these against an official Cardcom test-credentials page, so treat them as community folklore: confirm your sandbox credentials with Cardcom support before relying on them, and never assume a call against terminal 1000 cannot move money.
Store credentials securely, never in source code or client-side JavaScript.
Step 3: Implement the Payment Flow
Low Profile Integration (Recommended)
This is a two-step process.
Step 3a: Create the payment page
POST https://secure.cardcom.solutions/api/v11/LowProfile/Create
Content-Type: application/json
{
"TerminalNumber": 1000,
"ApiName": "your-api-name",
"Operation": "ChargeAndCreateToken",
"ReturnValue": "unique-order-id",
"Amount": 100.00,
"SuccessRedirectUrl": "https://example.com/success",
"FailedRedirectUrl": "https://example.com/failed",
"WebHookUrl": "https://example.com/webhook",
"ISOCoinId": 1,
"Language": "he",
"Document": {
"DocumentTypeToCreate": "TaxInvoiceAndReceipt",
"Name": "Customer Name",
"Email": "customer@example.com",
"Products": [
{ "Description": "Product name", "UnitCost": 100.00, "Quantity": 1 }
]
}
}
The response is a
: check
(success), read
on failure. On success it returns
(save it) and
(redirect the customer there or embed as an iframe).
and
are also returned when those methods are enabled on your terminal.
The
field controls behaviour:
(default),
,
,
,
.
Step 3b: Get the results
After payment completes, Cardcom calls your
, or you query:
POST https://secure.cardcom.solutions/api/v11/LowProfile/GetLpResult
{
"TerminalNumber": 1000,
"ApiName": "your-api-name",
"LowProfileId": "id-from-step-3a"
}
The response is a
: check
. On success it carries
(transaction details),
(the stored
plus
/
),
(the generated document), and
(for suspended deals). Each nested object is
when not applicable.
Alternative Payment Methods
The Low Profile response includes URLs for alternative payment methods when enabled on your terminal:
| Method | Response Field | Notes |
|---|
| Bit | | Israel's most popular mobile payment app, routed through Cardcom |
| PayPal | | International payments |
| Apple Pay | rendered inside the hosted Low Profile page | Listed on as a supported wallet on the hosted payment page |
| Google Pay | rendered inside the hosted Low Profile page | Same as Apple Pay, surfaced as a wallet button on the Low Profile page |
and
are explicit URL fields you can show alongside the card form. Apple Pay and Google Pay surface as wallet buttons inside the hosted Low Profile page itself once enabled on the terminal, so no separate URL field is exposed. Enable each method on your terminal in the Cardcom admin panel before relying on it in production.
Step 4: Generate Israeli Tax Documents
Cardcom's standout feature is automatic document generation with payments. This is critical for Israeli businesses because tax law requires issuing proper documents for every transaction.
The document type is set with the
field, a STRING enum (not an integer). Common values:
| Value | Hebrew | English | When to Use |
|---|
| --- | Auto | Default; uses your admin-panel configuration |
| hashbonit mas / kabala | Tax Invoice + Receipt | B2C with payment (most common) |
| hashbonit mas | Tax Invoice | B2B, when receipt is issued separately |
| kabala | Receipt | Payment confirmation only |
TaxInvoiceAndReceiptRefund
| --- | Tax Invoice + Receipt Refund | Reversing a |
| --- | Tax Invoice Refund | Reversing a |
| --- | Receipt Refund | Reversing a |
| hashbonit iska / proforma | Proforma Invoice | Pre-sale quote document |
| kabalat trumot | Donation Receipt | Registered non-profits |
The full
enum has 25 values and also includes
,
,
,
,
,
,
and
. Refund variants exist for MOST but not all of these: there is no
and no
. The 11 that do exist are
TaxInvoiceAndReceiptRefund
,
,
,
,
,
ProformaDealInvoiceRefund
,
,
,
,
CouponDocumentAndReceiptRefund
and
ReceiptForTaxInvoiceRefund
. Verify the exact value you need against the official docs at
https://secure.cardcom.solutions/Api/v11/Docs
.
Include a document in a payment flow:
Add the
object to your Low Profile
or
request. Cardcom generates the document automatically when the payment succeeds.
Standalone document creation:
POST https://secure.cardcom.solutions/api/v11/Documents/CreateDocument
{
"ApiName": "your-api-name",
"ApiPassword": "your-api-password",
"Document": {
"DocumentTypeToCreate": "TaxInvoice",
"Name": "Customer Ltd",
"TaxId": "123456789",
"Email": "customer@example.com",
"IsSendByEmail": true,
"Languge": "he",
"ISOCoinID": 1,
"Products": [
{ "Description": "Web development services", "UnitCost": 5000.00, "Quantity": 1 }
]
}
}
The response is a
: check
, then read
,
,
, and
(link to the PDF).
Note the real V11 field spellings inside the
object:
(string enum),
(the "document To", required, max 50 chars),
(business registration or ID number, replaces the older
),
(replaces
),
(the V11 spelling in THIS schema, missing the second
; note that the Low Profile document object
uses the correctly spelled
instead),
(replaces
),
, and
with
,
,
,
. See
references/document-types.md
for the complete field list.
Step 4.5: Allocation Numbers (Mispar Haktzaa) on Tax Invoices
Do not look for an allocation-number field in the API. There isn't one, and that is not an
omission. Cardcom built a direct interface to the Tax Authority, so when you issue a tax
invoice over the threshold the allocation number is requested automatically at document
creation, server-side. The
request body carries no
field, and a developer hunting for one in the OpenAPI spec will conclude, wrongly, that
Cardcom does not support the requirement.
It is not on by default. It needs a one-time setup, and without it your customer cannot
deduct their input VAT. An allocation number on a tax invoice is a precondition for the
recipient to deduct input VAT on any invoice whose pre-VAT amount exceeds the statutory
threshold. The setup, done once by the business owner or director on the Tax Authority
site, is:
- Identify (הזדהות) in the Tax Authority personal area, registering if necessary.
- For a company or a VAT-registered group (איחוד עוסקים), complete corporation
registration (רישום פרטי תאגיד).
- In the Tax Authority digital-actions authorization system (מערכת הרשאה לפעולות
דיגיטליות, linked from the ITA allocation-number service page), grant the authorization
and select BOTH Israel-Invoice subjects, not one of them. One covers verifying the
allocation number on a supplier's invoice; the other covers requesting an allocation
number for an invoice you issue to a customer. Granting only the first is the common
mistake, and it leaves your own invoices without a number. The exact wording of the two
subjects is only visible inside that system, which is behind a login, so match them by
meaning rather than by a string quoted here.
- Choose the authorization duration, and have the grantee confirm it.
Threshold schedule (amounts are pre-VAT):
The model itself took effect on 1 January 2024.
| Effective from | Threshold |
|---|
| 2025 | 20,000 NIS |
| 1 January 2026 | 10,000 NIS |
| 1 June 2026 | 5,000 NIS (in force now) |
An osek patur is unaffected, because they do not issue tax invoices and do not deduct input
VAT. If an integration was written earlier in 2026 against the 10,000 figure, invoices
between 5,000 and 10,000 are the band to re-check.
Step 5: Implement Token-Based Recurring Payments
For subscriptions and recurring billing (hora'ot keva), Cardcom supports two flavours:
- Card-based recurring, charging a stored credit-card on a schedule. Covered in this step.
- MASAV bank standing orders, debiting the customer's Israeli bank account directly. Managed through the endpoints (
RecuringPayments/GetRecurringPayment
, GetRecurringPaymentHistory
, ). Use this when the customer prefers a bank debit over a card charge or when the card is unavailable. The Cardcom dashboard provisions the underlying instruction.
For card-based recurring:
-
Create a token during the first payment. Use Low Profile with
Operation: "ChargeAndCreateToken"
(or
). The
returns
with
,
,
, and
(the date the token is purged from Cardcom).
-
Store the token securely. Save the
string, card expiry, and last 4 digits. The token is bound to your terminal.
-
Charge the token via the Transaction endpoint:
POST https://secure.cardcom.solutions/api/v11/Transactions/Transaction
{
"TerminalNumber": 1000,
"ApiName": "your-api-name",
"Token": "token-uuid",
"CardExpirationMMYY": "1227",
"Amount": 99.00,
"ISOCoinId": 1,
"Document": {
"DocumentTypeToCreate": "TaxInvoiceAndReceipt",
"Name": "Subscriber Name",
"Email": "customer@example.com",
"IsSendByEmail": true,
"Products": [
{ "Description": "Monthly subscription", "UnitCost": 99.00, "Quantity": 1 }
]
}
}
The response is a
: check
(note
and
also count as success for J2/J5 validation-only transactions), then read
,
,
, and
. Each token charge can automatically generate and email an invoice when a
object is attached.
Step 6: Process Refunds
Refund a transaction by its Cardcom transaction id:
POST https://secure.cardcom.solutions/api/v11/Transactions/RefundByTransactionId
{
"ApiName": "your-api-name",
"ApiPassword": "your-api-password",
"TransactionId": 219282004,
"PartialSum": 100.00,
"CancelOnly": false,
"AllowMultipleRefunds": false
}
is required for refunds.
refunds part of the transaction (omit it to refund the full amount).
voids a transaction before it is deposited. The response is a
RefundByTransactionIdResp
: check
, then read
(the id of the refund transaction).
To issue the matching credit document, call
with a refund
such as
TaxInvoiceAndReceiptRefund
or
.
Step 6.5: Query Transactions for Reporting
To pull a date range of transactions (reconciliation, monthly reports, dashboards):
POST https://secure.cardcom.solutions/api/v11/Transactions/ListTransactions
{
"ApiName": "your-api-name",
"ApiPassword": "your-api-password",
"FromDate": "01062026",
"ToDate": "30062026",
"TranStatus": "Success",
"Page": 1,
"Page_size": 100
}
Four things about this endpoint trip up almost every integration:
- is required. This is a company-wide read, not a single charge.
- There is no field. The schema sets
additionalProperties: false
, so sending is rejected outright. To scope results to one terminal, use the optional instead.
- Dates are strings, not ISO. is 1 June 2026.
- and are both required, and must be between 10 and 2000. Paging starts at 1, not 0.
The response is a
: check
, then read
(an array of
), plus the echoed
and
. Keep requesting the next page until a page returns fewer rows than
.
Transactions/SpecialTransactions
is a sibling read endpoint (it returns other transactions when Cardcom is your acquirer) and takes exactly the same four required fields:
,
,
,
. Despite the name, it does not create anything.
Step 7: Suspended Deals (Deferred Charges)
A suspended deal authorizes a payment intent without an immediate charge:
- Create a Low Profile session with
Operation: "SuspendedDeal"
.
- The returns with a .
- Charge the suspended deal later through the Cardcom admin panel or the endpoint (the group also exposes and ).
Useful for pre-authorizations and services billed after delivery. Verify the exact
request fields against the official docs before wiring the charge-later call.
Step 8: Handle Errors
Every V11 endpoint returns a
integer and a
string.
means success; any non-zero value is a developer/transaction error and
carries the human-readable reason.
python
import requests
resp = requests.post(
"https://secure.cardcom.solutions/api/v11/Transactions/Transaction",
json=payload,
).json()
if resp.get("ResponseCode") == 0:
deal_id = resp["TranzactionId"]
else:
log_error(f"Cardcom error {resp.get('ResponseCode')}: {resp.get('Description')}")
Always check both the HTTP status (200 means the request was received) AND
(0 means the operation succeeded). The official docs at
https://secure.cardcom.solutions/Api/v11/Docs
carry the full numeric error reference; do not hardcode error-code-to-message mappings, read
instead. See
references/api-responses.md
for the handling pattern.
Examples
Example 1: E-commerce Checkout with Invoice
User says: "I need to accept payments on my Israeli e-commerce site and generate tax invoices automatically"
Actions:
- Choose Low Profile with
DocumentTypeToCreate: "TaxInvoiceAndReceipt"
.
- Create the Low Profile page via with product details in the object.
- Implement a handler that calls .
Result: Customer pays and receives an automatic hashbonit mas/kabala emailed as a PDF.
Example 2: Monthly SaaS Subscription
User says: "I run a SaaS product, I need to charge users 149 NIS monthly and send them invoices"
Actions:
- First payment: with
Operation: "ChargeAndCreateToken"
.
- Store the , , from .
- Monthly cron: with the token and a object for each billing cycle.
Result: Automated recurring billing with monthly invoice generation.
Example 3: Standalone Invoice Without Payment
User says: "I need to generate a tax invoice for a bank transfer payment I already received"
Actions:
- Use (no payment processing).
- Set
DocumentTypeToCreate: "TaxInvoice"
.
- Include , , , set with the customer email.
Result: Tax invoice generated and emailed without credit card processing.
Example 4: Process a Refund with Credit Note
User says: "Customer wants a refund for order #5678, need to issue a credit note too"
Actions:
- Call
Transactions/RefundByTransactionId
with and .
- Check and read .
- Call with
DocumentTypeToCreate: "TaxInvoiceAndReceiptRefund"
.
Result: Refund processed and the matching credit document generated.
Example 5: Accept Bit, Apple Pay, and Google Pay
User says: "I want to let customers pay with Bit, Apple Pay, and Google Pay in addition to credit cards"
Actions:
- Enable each method (Bit, Apple Pay, Google Pay) on your Cardcom terminal via the dashboard.
- Create a Low Profile session as usual via .
- Display from the response alongside the card form. Apple Pay and Google Pay surface as wallet buttons inside the Low Profile page itself, no extra URL needed.
Result: Customers can choose between credit card, Bit, Apple Pay, and Google Pay, same webhook flow.
Community Libraries
- @tsdiapi/cardcom (TypeScript/Node.js) -- V11 API client with payments, refunds, tokenization, transaction queries. Install:
npm install @tsdiapi/cardcom
- CardCom/OpenFields-FrontEnd-React (React) -- official OpenFields example. See
https://github.com/CardCom/OpenFields-FrontEnd-React
- CardCom/OpenFields-Backend-Node (Node.js) -- official Node.js backend example. See
https://github.com/CardCom/OpenFields-Backend-Node
Reference Links
| Resource | URL |
|---|
| V11 API documentation (OpenAPI reference) | https://secure.cardcom.solutions/Api/v11/Docs
|
| Cardcom support center | https://support.cardcom.solutions
|
| OpenFields React example | https://github.com/CardCom/OpenFields-FrontEnd-React
|
| OpenFields Node.js example | https://github.com/CardCom/OpenFields-Backend-Node
|
Bundled Resources
References
references/api-endpoints.md
-- Cardcom REST API V11 endpoint reference: LowProfile, Transactions, Documents, RecuringPayments, Financial, and CompanyOperations paths with their key request/response fields. Consult when building API integrations.
references/api-responses.md
-- the V11 + response pattern, the per-operation response objects, and the recommended error-handling flow. Consult when debugging failed API calls.
references/document-types.md
-- the string enum, the object field list, and VAT handling per Israeli tax law. Consult when determining which document type to generate.
Scripts
scripts/validate_cardcom_response.py
-- Validates a Cardcom V11 API response: checks , surfaces , and verifies expected fields for transaction, token, and document operations. Only 0 counts as success; 700/701 are rejected unless you pass , because they mean a J2/J5 card check passed and NO money moved. Run: python scripts/validate_cardcom_response.py --help
Gotchas
- The V11 success check is , NOT . does not exist in V11; agents trained on older Cardcom examples invent it. Every V11 endpoint returns plus a string.
- is a STRING enum (, , , ...), not an integer code. Integer document codes like or belong to legacy interfaces, not V11.
- The must be sent as an integer, not a string. Agents commonly wrap it in quotes.
- is required on 19 of the 50 V11 endpoints that take a request body, not just refunds and documents. Company-wide reads and writes need it (, , , all writes, all reports, all ); single-card charges do not. It is not even a property on or , so sending it there is wrong too. Agents routinely omit it on because older guidance described it as "refunds and documents only".
- The reporting endpoints and do NOT accept , and both set
additionalProperties: false
, so including it fails the call. Scope to a terminal with on . Their dates are strings, and additionally requires plus a between 10 and 2000.
- Watch the real V11 field spellings: / , (not ), (not ). The language field is spelled differently depending on which document object you are in, and every one of these schemas rejects unknown properties, so getting it wrong fails the call outright: (standalone ) and () use the misspelled , while , the document you attach to , uses the correctly spelled . Applying everywhere breaks the Low Profile flow, which is the flow this skill recommends first.
- The current Israeli VAT rate is 18% (effective January 2025; the January 2026 budget proposal to raise it to 19% was rejected). Cardcom calculates VAT server-side, so document amounts are treated per the flag.
- PCI scope: hosted Low Profile keeps you in SAQ-A. Server-to-server with raw / lands in SAQ-D. The current standard is PCI DSS v4.0.1 (a limited revision published June 2024), and the 51 future-dated requirements became effective 31 March 2025, so all of them are now in force. Prefer Low Profile or tokens unless you have a real reason to touch raw card data.
- Settlement timing is configured on the terminal, not per request, and is not settable via the API. Cardcom publishes three cycles: monthly (transactions from the 1st through the day before month-end are credited on the 6th of the following month), weekly (Sunday through Friday, credited the Wednesday of the following week), and bi-monthly (the 1st to the 15th credited on the 2nd of the following month; the 16th through the day before month-end credited on the 8th). Still confirm the cycle actually configured on the merchant's terminal before promising a business a specific day.
- Apple Pay and Google Pay don't have separate URL fields like / . They surface as wallet buttons inside the hosted Low Profile page once enabled on the terminal in the admin panel.
Troubleshooting
Error: a non-zero on
Cause: a validation or authentication problem with the request.
Solution: Read the
string in the response, it names the exact issue. Verify
is an integer and
is correct. The full numeric error reference is at
https://secure.cardcom.solutions/Api/v11/Docs
.
Error: "Low Profile page loads but payment fails"
Cause: often a
or redirect URL issue.
Solution: Ensure
,
, and
are publicly accessible HTTPS URLs. Localhost URLs do not work, use a tunnel (ngrok) for development.
Error: "Refund returns a non-zero "
Cause:
missing, or the transaction is already deposited and you sent
.
Solution: Include
on every refund request. Use
only before deposit; after deposit, send a real refund (omit
or set it
).
Error: "Invoice created but not emailed"
Cause:
not set or email address missing.
Solution: Set
and include a valid
in the
object. Check spam folders, Cardcom sends from its own domain.
Error: "Token charge succeeds but no invoice"
Cause:
object missing from the
request.
Solution: Include the full
object with
,
, and
in every token charge. Document generation is opt-in per transaction.