CyberSource REST Gateway Guide

CyberSource REST fact sheet

Quick Start

New to integrating CyberSource with Spreedly? Here's your setup guide:

Retrieve your CyberSource credentials
1. Contact the CyberSource support team to obtain API credentials
Get familiar with the Spreedly API
1. Review Spreedly API basics
2. Understand the core concepts: Gateways, Payment Methods, and Transactions
Add CyberSource gateway to Spreedly in sandbox mode

📘
Review this documentation to understand more about how to test transactions.

Adding a CyberSource gateway

Required Credentials

merchant_id: Your Cyber source Rest merchant identifier (merchant ID)

passcode: Your Cybersource passcode used authentication

public key: Your public key

private key: Your private key

REQUEST

curl https://core.spreedly.com/v1/gateways.xml \
  -u '7KJJ87DTWD9D79VYZVC19B84BN:a47AmA7kG5n4uMkhGdGVGzstrlrgqBwLC13D4s5L5gXHg8orgks50js2dcjO3u4c' \
  -H 'Content-Type: application/xml' \
  -d '<gateway>
        <gateway_type>cyber_source_rest</gateway_type>
        <merchant_id> Your Merchant ID</merchant_id>
        <public_key> Public Key </public_key>
        <private_key> Private Key </private_key>
      </gateway>'

RESPONSE

<gateway>
  <token>5CFSXYJ4SP8SCBWPRYCVF3Sxyz</token>
  <gateway_type>cyber_source_rest</gateway_type>
  <name>CyberSource REST</name>
  <description nil="true"/>
  <merchant_profile_key nil="true"/>
  <sub_merchant_key nil="true"/>
  <merchant_id>spreedly_duff_merchant_id</merchant_id>
  <characteristics>
    <supports_purchase type="boolean">true</supports_purchase>
    <supports_authorize type="boolean">true</supports_authorize>
    <supports_capture type="boolean">true</supports_capture>
    <supports_partial_capture type="boolean">true</supports_partial_capture>
    <supports_credit type="boolean">true</supports_credit>
    <supports_partial_credit type="boolean">true</supports_partial_credit>
    <supports_general_credit type="boolean">true</supports_general_credit>
    <supports_void type="boolean">true</supports_void>
    <supports_adjust type="boolean">false</supports_adjust>
    <supports_verify type="boolean">true</supports_verify>
    <supports_reference_purchase type="boolean">false</supports_reference_purchase>
    <supports_purchase_via_preauthorization type="boolean">false</supports_purchase_via_preauthorization>
    <supports_offsite_purchase type="boolean">false</supports_offsite_purchase>
    <supports_offsite_authorize type="boolean">false</supports_offsite_authorize>
    <supports_offsite_synchronous_purchase type="boolean">false</supports_offsite_synchronous_purchase>
    <supports_offsite_synchronous_authorize type="boolean">false</supports_offsite_synchronous_authorize>
    <supports_3dsecure_purchase type="boolean">false</supports_3dsecure_purchase>
    <supports_3dsecure_authorize type="boolean">false</supports_3dsecure_authorize>
    <supports_3dsecure_2_mpi_purchase type="boolean">true</supports_3dsecure_2_mpi_purchase>
    <supports_3dsecure_2_mpi_authorize type="boolean">true</supports_3dsecure_2_mpi_authorize>
    <supports_store type="boolean">true</supports_store>
    <supports_remove type="boolean">true</supports_remove>
    <supports_fraud_review type="boolean">false</supports_fraud_review>
    <supports_network_tokenization type="boolean">true</supports_network_tokenization>
    <supports_inquire_by_gateway_transaction_id type="boolean">false</supports_inquire_by_gateway_transaction_id>
    <supports_inquire_by_order_id type="boolean">false</supports_inquire_by_order_id>
    <supports_transaction_retry type="boolean">true</supports_transaction_retry>
    <supports_stored_stored_credentials type="boolean">false</supports_stored_stored_credentials>
    <supports_stored_credentials type="boolean">true</supports_stored_credentials>
    <supports_card_scheme_ntid type="boolean">true</supports_card_scheme_ntid>
    <supports_level_2_data type="boolean">true</supports_level_2_data>
    <supports_level_3_data type="boolean">true</supports_level_3_data>
  </characteristics>
  <credentials>
    <credential>
      <name>merchant_id</name>
      <value>spreedly_duff_merchant_id</value>
    </credential>
  </credentials>
  <gateway_settings>
  </gateway_settings>
  <gateway_specific_fields>
    <gateway_specific_field>customer_id</gateway_specific_field>
    <gateway_specific_field>ignore_avs</gateway_specific_field>
    <gateway_specific_field>ignore_cvv</gateway_specific_field>
    <gateway_specific_field>zero_amount_verify</gateway_specific_field>
    <gateway_specific_field>sec_code</gateway_specific_field>
    <gateway_specific_field>invoice_number</gateway_specific_field>
    <gateway_specific_field>reconciliation_id</gateway_specific_field>
    <gateway_specific_field>merchant_id</gateway_specific_field>
    <gateway_specific_field>merchant_category_code</gateway_specific_field>
    <gateway_specific_field>installment_sequence</gateway_specific_field>
    <gateway_specific_field>installment_total_count</gateway_specific_field>
    <gateway_specific_field>sequence</gateway_specific_field>
    <gateway_specific_field>total_count</gateway_specific_field>
    <gateway_specific_field>mdd_field_1</gateway_specific_field>
    <gateway_specific_field>mdd_field_2</gateway_specific_field>
    <gateway_specific_field>mdd_field_3</gateway_specific_field>
    <gateway_specific_field>mdd_field_4</gateway_specific_field>
    <gateway_specific_field>mdd_field_5</gateway_specific_field>
    <gateway_specific_field>mdd_field_6</gateway_specific_field>
    <gateway_specific_field>mdd_field_7</gateway_specific_field>
    <gateway_specific_field>mdd_field_8</gateway_specific_field>
    <gateway_specific_field>mdd_field_9</gateway_specific_field>
    <gateway_specific_field>mdd_field_10</gateway_specific_field>
    <gateway_specific_field>mdd_field_11</gateway_specific_field>
    <gateway_specific_field>mdd_field_12</gateway_specific_field>
    <gateway_specific_field>mdd_field_13</gateway_specific_field>
    <gateway_specific_field>mdd_field_14</gateway_specific_field>
    <gateway_specific_field>mdd_field_15</gateway_specific_field>
    <gateway_specific_field>mdd_field_16</gateway_specific_field>
    <gateway_specific_field>mdd_field_17</gateway_specific_field>
    <gateway_specific_field>mdd_field_18</gateway_specific_field>
    <gateway_specific_field>mdd_field_19</gateway_specific_field>
    <gateway_specific_field>mdd_field_20</gateway_specific_field>
    <gateway_specific_field>mdd_field_21</gateway_specific_field>
    <gateway_specific_field>mdd_field_22</gateway_specific_field>
    <gateway_specific_field>mdd_field_23</gateway_specific_field>
    <gateway_specific_field>mdd_field_24</gateway_specific_field>
    <gateway_specific_field>mdd_field_25</gateway_specific_field>
    <gateway_specific_field>mdd_field_26</gateway_specific_field>
    <gateway_specific_field>mdd_field_27</gateway_specific_field>
    <gateway_specific_field>mdd_field_28</gateway_specific_field>
    <gateway_specific_field>mdd_field_29</gateway_specific_field>
    <gateway_specific_field>mdd_field_30</gateway_specific_field>
    <gateway_specific_field>mdd_field_31</gateway_specific_field>
    <gateway_specific_field>mdd_field_32</gateway_specific_field>
    <gateway_specific_field>mdd_field_33</gateway_specific_field>
    <gateway_specific_field>mdd_field_34</gateway_specific_field>
    <gateway_specific_field>mdd_field_35</gateway_specific_field>
    <gateway_specific_field>mdd_field_36</gateway_specific_field>
    <gateway_specific_field>mdd_field_37</gateway_specific_field>
    <gateway_specific_field>mdd_field_38</gateway_specific_field>
    <gateway_specific_field>mdd_field_39</gateway_specific_field>
    <gateway_specific_field>mdd_field_40</gateway_specific_field>
    <gateway_specific_field>mdd_field_41</gateway_specific_field>
    <gateway_specific_field>mdd_field_42</gateway_specific_field>
    <gateway_specific_field>mdd_field_43</gateway_specific_field>
    <gateway_specific_field>mdd_field_44</gateway_specific_field>
    <gateway_specific_field>mdd_field_45</gateway_specific_field>
    <gateway_specific_field>mdd_field_46</gateway_specific_field>
    <gateway_specific_field>mdd_field_47</gateway_specific_field>
    <gateway_specific_field>mdd_field_48</gateway_specific_field>
    <gateway_specific_field>mdd_field_49</gateway_specific_field>
    <gateway_specific_field>mdd_field_50</gateway_specific_field>
    <gateway_specific_field>mdd_field_51</gateway_specific_field>
    <gateway_specific_field>mdd_field_52</gateway_specific_field>
    <gateway_specific_field>mdd_field_53</gateway_specific_field>
    <gateway_specific_field>mdd_field_54</gateway_specific_field>
    <gateway_specific_field>mdd_field_55</gateway_specific_field>
    <gateway_specific_field>mdd_field_56</gateway_specific_field>
    <gateway_specific_field>mdd_field_57</gateway_specific_field>
    <gateway_specific_field>mdd_field_58</gateway_specific_field>
    <gateway_specific_field>mdd_field_59</gateway_specific_field>
    <gateway_specific_field>mdd_field_60</gateway_specific_field>
    <gateway_specific_field>mdd_field_61</gateway_specific_field>
    <gateway_specific_field>mdd_field_62</gateway_specific_field>
    <gateway_specific_field>mdd_field_63</gateway_specific_field>
    <gateway_specific_field>mdd_field_64</gateway_specific_field>
    <gateway_specific_field>mdd_field_65</gateway_specific_field>
    <gateway_specific_field>mdd_field_66</gateway_specific_field>
    <gateway_specific_field>mdd_field_67</gateway_specific_field>
    <gateway_specific_field>mdd_field_68</gateway_specific_field>
    <gateway_specific_field>mdd_field_69</gateway_specific_field>
    <gateway_specific_field>mdd_field_70</gateway_specific_field>
    <gateway_specific_field>mdd_field_71</gateway_specific_field>
    <gateway_specific_field>mdd_field_72</gateway_specific_field>
    <gateway_specific_field>mdd_field_73</gateway_specific_field>
    <gateway_specific_field>mdd_field_74</gateway_specific_field>
    <gateway_specific_field>mdd_field_75</gateway_specific_field>
    <gateway_specific_field>mdd_field_76</gateway_specific_field>
    <gateway_specific_field>mdd_field_77</gateway_specific_field>
    <gateway_specific_field>mdd_field_78</gateway_specific_field>
    <gateway_specific_field>mdd_field_79</gateway_specific_field>
    <gateway_specific_field>mdd_field_80</gateway_specific_field>
    <gateway_specific_field>mdd_field_81</gateway_specific_field>
    <gateway_specific_field>mdd_field_82</gateway_specific_field>
    <gateway_specific_field>mdd_field_83</gateway_specific_field>
    <gateway_specific_field>mdd_field_84</gateway_specific_field>
    <gateway_specific_field>mdd_field_85</gateway_specific_field>
    <gateway_specific_field>mdd_field_86</gateway_specific_field>
    <gateway_specific_field>mdd_field_87</gateway_specific_field>
    <gateway_specific_field>mdd_field_88</gateway_specific_field>
    <gateway_specific_field>mdd_field_89</gateway_specific_field>
    <gateway_specific_field>mdd_field_90</gateway_specific_field>
    <gateway_specific_field>mdd_field_91</gateway_specific_field>
    <gateway_specific_field>mdd_field_92</gateway_specific_field>
    <gateway_specific_field>mdd_field_93</gateway_specific_field>
    <gateway_specific_field>mdd_field_94</gateway_specific_field>
    <gateway_specific_field>mdd_field_95</gateway_specific_field>
    <gateway_specific_field>mdd_field_96</gateway_specific_field>
    <gateway_specific_field>mdd_field_97</gateway_specific_field>
    <gateway_specific_field>mdd_field_98</gateway_specific_field>
    <gateway_specific_field>mdd_field_99</gateway_specific_field>
    <gateway_specific_field>mdd_field_100</gateway_specific_field>
  </gateway_specific_fields>
  <payment_methods>
    <payment_method>credit_card</payment_method>
    <payment_method>apple_pay</payment_method>
    <payment_method>google_pay</payment_method>
    <payment_method>bank_account</payment_method>
    <payment_method>third_party_token</payment_method>
  </payment_methods>
  <state>retained</state>
  <redacted type="boolean">false</redacted>
  <sandbox type="boolean">false</sandbox>
  <mode>default</mode>
  <created_at type="dateTime">2026-06-14T13:54:55Z</created_at>
  <updated_at type="dateTime">2026-06-14T13:54:55Z</updated_at>
</gateway>

Purchase (Auth and Capture)

curl https://core.spreedly.com/v1/gateways/[gateway_token]/purchase.json \
-u 'EnvironmentKey:AccessSecret' \
-H "Content-Type: application/json" \
-d '{
  "transaction": {
  "payment_method_token": "payment_method_token",
  "amount": 2500,
  "currency_code": "USD",
  "retain_on_success": true
  }
}

ACH/Bank Account Transactions

The ach_description transaction field allows you to set the Company Entry Description for ACH transactions processed through the CyberSource Rest gateway. This field maps directly to the NACHA-required Company Entry Description, which appears on the receiver's bank statement to identify the originating company or purpose of the transaction. At the gateway level, ach_description maps to CyberSource Rest's merchantInformation.merchantDescriptor.alternateName field.

Gateway specific fields

  <gateway_specific_fields>
    <gateway_specific_field>customer_id</gateway_specific_field>
    <gateway_specific_field>ignore_avs</gateway_specific_field>
    <gateway_specific_field>ignore_cvv</gateway_specific_field>
    <gateway_specific_field>zero_amount_verify</gateway_specific_field>
    <gateway_specific_field>sec_code</gateway_specific_field>
    <gateway_specific_field>invoice_number</gateway_specific_field>
    <gateway_specific_field>reconciliation_id</gateway_specific_field>
    <gateway_specific_field>merchant_id</gateway_specific_field>
    <gateway_specific_field>merchant_category_code</gateway_specific_field>
    <gateway_specific_field>installment_sequence</gateway_specific_field>
    <gateway_specific_field>installment_total_count</gateway_specific_field>
    <gateway_specific_field>sequence</gateway_specific_field>
    <gateway_specific_field>total_count</gateway_specific_field>
    <gateway_specific_field>mdd_field_1</gateway_specific_field>
    <gateway_specific_field>mdd_field_2</gateway_specific_field>
    <gateway_specific_field>mdd_field_3</gateway_specific_field>
    <gateway_specific_field>mdd_field_4</gateway_specific_field>
    <gateway_specific_field>mdd_field_5</gateway_specific_field>
    <gateway_specific_field>mdd_field_6</gateway_specific_field>
    <gateway_specific_field>mdd_field_7</gateway_specific_field>
    <gateway_specific_field>mdd_field_8</gateway_specific_field>
    <gateway_specific_field>mdd_field_9</gateway_specific_field>
    <gateway_specific_field>mdd_field_10</gateway_specific_field>
    <gateway_specific_field>mdd_field_11</gateway_specific_field>
    <gateway_specific_field>mdd_field_12</gateway_specific_field>
    <gateway_specific_field>mdd_field_13</gateway_specific_field>
    <gateway_specific_field>mdd_field_14</gateway_specific_field>
    <gateway_specific_field>mdd_field_15</gateway_specific_field>
    <gateway_specific_field>mdd_field_16</gateway_specific_field>
    <gateway_specific_field>mdd_field_17</gateway_specific_field>
    <gateway_specific_field>mdd_field_18</gateway_specific_field>
    <gateway_specific_field>mdd_field_19</gateway_specific_field>
    <gateway_specific_field>mdd_field_20</gateway_specific_field>
    <gateway_specific_field>mdd_field_21</gateway_specific_field>
    <gateway_specific_field>mdd_field_22</gateway_specific_field>
    <gateway_specific_field>mdd_field_23</gateway_specific_field>
    <gateway_specific_field>mdd_field_24</gateway_specific_field>
    <gateway_specific_field>mdd_field_25</gateway_specific_field>
    <gateway_specific_field>mdd_field_26</gateway_specific_field>
    <gateway_specific_field>mdd_field_27</gateway_specific_field>
    <gateway_specific_field>mdd_field_28</gateway_specific_field>
    <gateway_specific_field>mdd_field_29</gateway_specific_field>
    <gateway_specific_field>mdd_field_30</gateway_specific_field>
    <gateway_specific_field>mdd_field_31</gateway_specific_field>
    <gateway_specific_field>mdd_field_32</gateway_specific_field>
    <gateway_specific_field>mdd_field_33</gateway_specific_field>
    <gateway_specific_field>mdd_field_34</gateway_specific_field>
    <gateway_specific_field>mdd_field_35</gateway_specific_field>
    <gateway_specific_field>mdd_field_36</gateway_specific_field>
    <gateway_specific_field>mdd_field_37</gateway_specific_field>
    <gateway_specific_field>mdd_field_38</gateway_specific_field>
    <gateway_specific_field>mdd_field_39</gateway_specific_field>
    <gateway_specific_field>mdd_field_40</gateway_specific_field>
    <gateway_specific_field>mdd_field_41</gateway_specific_field>
    <gateway_specific_field>mdd_field_42</gateway_specific_field>
    <gateway_specific_field>mdd_field_43</gateway_specific_field>
    <gateway_specific_field>mdd_field_44</gateway_specific_field>
    <gateway_specific_field>mdd_field_45</gateway_specific_field>
    <gateway_specific_field>mdd_field_46</gateway_specific_field>
    <gateway_specific_field>mdd_field_47</gateway_specific_field>
    <gateway_specific_field>mdd_field_48</gateway_specific_field>
    <gateway_specific_field>mdd_field_49</gateway_specific_field>
    <gateway_specific_field>mdd_field_50</gateway_specific_field>
    <gateway_specific_field>mdd_field_51</gateway_specific_field>
    <gateway_specific_field>mdd_field_52</gateway_specific_field>
    <gateway_specific_field>mdd_field_53</gateway_specific_field>
    <gateway_specific_field>mdd_field_54</gateway_specific_field>
    <gateway_specific_field>mdd_field_55</gateway_specific_field>
    <gateway_specific_field>mdd_field_56</gateway_specific_field>
    <gateway_specific_field>mdd_field_57</gateway_specific_field>
    <gateway_specific_field>mdd_field_58</gateway_specific_field>
    <gateway_specific_field>mdd_field_59</gateway_specific_field>
    <gateway_specific_field>mdd_field_60</gateway_specific_field>
    <gateway_specific_field>mdd_field_61</gateway_specific_field>
    <gateway_specific_field>mdd_field_62</gateway_specific_field>
    <gateway_specific_field>mdd_field_63</gateway_specific_field>
    <gateway_specific_field>mdd_field_64</gateway_specific_field>
    <gateway_specific_field>mdd_field_65</gateway_specific_field>
    <gateway_specific_field>mdd_field_66</gateway_specific_field>
    <gateway_specific_field>mdd_field_67</gateway_specific_field>
    <gateway_specific_field>mdd_field_68</gateway_specific_field>
    <gateway_specific_field>mdd_field_69</gateway_specific_field>
    <gateway_specific_field>mdd_field_70</gateway_specific_field>
    <gateway_specific_field>mdd_field_71</gateway_specific_field>
    <gateway_specific_field>mdd_field_72</gateway_specific_field>
    <gateway_specific_field>mdd_field_73</gateway_specific_field>
    <gateway_specific_field>mdd_field_74</gateway_specific_field>
    <gateway_specific_field>mdd_field_75</gateway_specific_field>
    <gateway_specific_field>mdd_field_76</gateway_specific_field>
    <gateway_specific_field>mdd_field_77</gateway_specific_field>
    <gateway_specific_field>mdd_field_78</gateway_specific_field>
    <gateway_specific_field>mdd_field_79</gateway_specific_field>
    <gateway_specific_field>mdd_field_80</gateway_specific_field>
    <gateway_specific_field>mdd_field_81</gateway_specific_field>
    <gateway_specific_field>mdd_field_82</gateway_specific_field>
    <gateway_specific_field>mdd_field_83</gateway_specific_field>
    <gateway_specific_field>mdd_field_84</gateway_specific_field>
    <gateway_specific_field>mdd_field_85</gateway_specific_field>
    <gateway_specific_field>mdd_field_86</gateway_specific_field>
    <gateway_specific_field>mdd_field_87</gateway_specific_field>
    <gateway_specific_field>mdd_field_88</gateway_specific_field>
    <gateway_specific_field>mdd_field_89</gateway_specific_field>
    <gateway_specific_field>mdd_field_90</gateway_specific_field>
    <gateway_specific_field>mdd_field_91</gateway_specific_field>
    <gateway_specific_field>mdd_field_92</gateway_specific_field>
    <gateway_specific_field>mdd_field_93</gateway_specific_field>
    <gateway_specific_field>mdd_field_94</gateway_specific_field>
    <gateway_specific_field>mdd_field_95</gateway_specific_field>
    <gateway_specific_field>mdd_field_96</gateway_specific_field>
    <gateway_specific_field>mdd_field_97</gateway_specific_field>
    <gateway_specific_field>mdd_field_98</gateway_specific_field>
    <gateway_specific_field>mdd_field_99</gateway_specific_field>
    <gateway_specific_field>mdd_field_100</gateway_specific_field>
  </gateway_specific_fields>

merchant_id: This field can be used to specify a destination merchant_id different from the one used to create the CyberSource gateway. This enables portfolio merchants to utilize meta keys and direct funds to linked merchants.

ignore_avs: Flag for a sale request that indicates whether to allow the capture service to run even when the authorization.

ignore_cvv: Flag for a sale request that indicates whether to allow the capture service to run even when the authorization receives a CVN decline.

mdd_field_1 .. mdd_field_100: Fields available to store merchant defined values in the transaction.

reconciliation_id: Reference number for the transaction, the actual value used in the request to the processor is provided back to you by Cybersource in the response.

customer_id: CyberSource customer id.

zero_amount_verify: Flag to specify if the verify transaction should attempt a $0 auth verification.

sec_code: Specifies the authorization method for the transaction (ARC|CDD|POP|PPD|TEL|WEB).

invoice number: Field to support an invoice number for a transaction

merchant_category_code: Field used to override the default account-level merchant category code.

sequence : Field to identify the current capture's position within a series of multiple captures

total_count : Field to specify the final number of capture requests intended. This allows the gateway to track when the full amount of the original order has been processed across multiple transactions

merchant_descriptor_name: Field to support the merchant business name.

merchant_descriptor_address1: Field to support the merchant business street address.

merchant_descriptor_locality: Field to support the merchant business city.

Gateway specific response fields

<gateway_specific_response_fields>
    <cyber_source_rest>
      <reconciliation_id>72492858TG3K5GB1</reconciliation_id>
      <processor_response>100</processor_response>
      <authorization_code>BaqFSnLKKLoZ7EfcEkj540VkxFr</authorization_code>
      <payment_network_transaction_id>123456789619999</payment_network_transaction_id>
    </cyber_source_rest>
  </gateway_specific_response_fields>

Stored Credentials

For Cybersource REST, sending stored credential fields can be done using Spreedly's first class support. For any Authorize or Purchase request, you need to include two fields which tell Spreedly a little bit more about the nature of the transaction:

stored_credential_initiator
stored_credential_reason_type

📘
Learn more about how Spreedly enables use of stored credentials by reviewing our Stored Credentials guide

First Credential-on-File Setup (CIT)

`reason_type`	`initiator`	Cybersource mapped fields (`processingInformation`)
`recurring`	cardholder	`recurring`
`installment`	cardholder	`install`
`unscheduled`	cardholder	`internet`

Subsequent use

`reason_type`	`initiator`	Cybersource mapped fields (`processingInformation`)
`recurring`	merchant	`recurring`
`installment`	merchant	`install`
`unscheduled`	merchant	`internet`
`recurring`	cardholder	`recurring`
`installment`	cardholder	`install`
`unscheduled`	cardholder	`internet`

📘

For Discover subsequent transactions, Spreedly also sends merchantInitiatedTransaction.originalAuthorizedAmount (the original authorized amount).

If a reason_code is supplied, it is passed as merchantInitiatedTransaction.reason.

Any reason_type that is not recurring or installment (e.g. unscheduled) maps to commerceIndicator: internet.

Additional resources

📘
If you need support with this gateway, please contact Support at [email protected].

📘
CyberSource documentation: CyberSource Rest API explorer.
API Endpoint: https://apitest.cybersource.com (Production)
Test Endpoint: https://api.cybersource.com (Test)