Contiant

Open banking payment provider using instant bank transfers. The payer authenticates directly with their bank on a Contiant-hosted page, so no card, IBAN, or account data passes through the Mozarto API.

Operations: Pay-In ✓ | Pay-Out - | Webhook ✓
Processing: Asynchronous - redirect the payer to a hosted page, then receive settlement by webhook
Payment type: Open banking / instant bank transfer

Fields marked with * are required.

Configuration (Mozarto back office)

Merchant credentials, the beneficiary account, and the payer return URL all live on the PSP configuration, not on the per-transaction request.

Field	Description
`clientId` *	Contiant OAuth client ID
`clientSecret` *	Contiant OAuth client secret
`siteUrl` *	URL the payer returns to after completing or cancelling payment on the Contiant hosted page
`merchantName` *	Beneficiary merchant name shown to the payer
`country`	Beneficiary account country
`postcode`	Beneficiary postal code. Required for EU and UK payments
`iban` / `bic`	Beneficiary IBAN and BIC. Required for EU; used for UK when available
`accountNumber` / `sortCode`	Beneficiary UK account number and sort code. Used for UK when IBAN and BIC are not set
`webhookUrl`	Endpoint Mozarto calls with the settlement notification once the payment completes
`notificationSecret`	Signature secret for Contiant's inbound notifications. Mozarto validates the `X-Contiant-Signature` header (HMAC-SHA256) on every notification Contiant sends and ignores any that fail. Take it from your Contiant subscription. Stored per brand, encrypted at rest, and masked in the back office. If left blank, Mozarto processes notifications without signature validation (legacy fallback)

Beneficiary requirements by payer country

The merchant beneficiary details Contiant needs depend on the country sent in the request:

Payer country	Required beneficiary configuration
EU (AT, BE, CY, EE, FI, FR, DE, GR, IE, IT, LV, LT, LU, MT, NL, PT, SK, SI, ES)	`iban` + `bic` + `postcode`
United Kingdom (GB)	`postcode` plus either `iban` + `bic` or `accountNumber` + `sortCode`
New Zealand (NZ), Australia (AU)	None. Routed via Contiant Direct Flow, no beneficiary IBAN required

If the required configuration is missing for the payer's country, the Pay-In call returns a 400 configuration error.

Pay-In

POST /v1/api/mozarto/cashier

The cashier call does not move funds directly. It creates a transaction and returns a paymentUrl. Redirect the payer to that URL to authenticate with their bank on the Contiant hosted page.

Request body

Field	Type	Description
`pspType` *	string	Always `"CONTIANT"`
`type` *	string	Always `"PAYIN"`
`baseamount` *	number	Amount in the currency's main unit, up to 2 decimals (e.g. `100` = 100 EUR, `100.50` = 100.50 EUR)
`currency` *	string	Currency code (e.g. `"EUR"`)
`country` *	string	ISO 3166-1 alpha-2 payer country code. Selects the beneficiary routing (see table above)
`email` *	string	Payer email, forwarded to Contiant
`merchantReference`	string	Your reference for the order, echoed back in the response
`firstName`	string	Payer first name, forwarded to Contiant
`lastName`	string	Payer last name, forwarded to Contiant

The payer identifier (consumerId at Contiant) is resolved from the X-User-token, so userId is not required in the request body.

Example request

{
  "pspType": "CONTIANT",
  "type": "PAYIN",
  "baseamount": 100,
  "currency": "EUR",
  "merchantReference": "Test-001",
  "country": "DE"
}

Response

{
  "status": "success",
  "message": "Successfully",
  "isSuccess": true,
  "data": {
    "paymentUrl": "https://pay.contiant.com/checkout/64a1f2b3c4d5e6f7a8b9c0d1",
    "transactionId": "64a1f2b3c4d5e6f7a8b9c0d1",
    "merchantReference": "Test-001",
    "amount": 100,
    "transaction_status": "Pending"
  }
}

Field	Type	Description
`paymentUrl`	string	Contiant hosted page URL to redirect the payer to
`transactionId`	string	Mozarto transaction identifier. Use it to match the settlement webhook
`merchantReference`	string	Your reference from the request, or an empty string if none was sent
`amount`	number	The transaction `baseamount`
`transaction_status`	string	Always `"Pending"` at this point. The final outcome arrives by webhook

Redirect the payer to paymentUrl. They authenticate with their bank on the Contiant hosted page and return to the configured siteUrl.

Settlement webhook

Once Contiant reports the payment result, Mozarto sends a POST to your configured webhookUrl. The payload is the same shape for approvals and declines; read transaction_status for the outcome.

{
  "transaction_id": "64a1f2b3c4d5e6f7a8b9c0d1",
  "user_id": "test-003",
  "status": "success",
  "transaction_status": "Approved",
  "amount": 100,
  "currency": "EUR"
}

Field	Description
`transaction_id`	Mozarto transaction identifier returned by the Pay-In call
`user_id`	The payer identifier resolved from the Pay-In request
`status`	Raw settlement result - `success`, `failed`, or `pending`
`transaction_status`	Normalized outcome - `Approved`, `Failed`, or `Pending`. Use this for business logic
`amount`	Settled amount in the transaction currency's major unit
`currency`	Transaction currency

Contiant reports COMPLETED and SETTLED as successful; FAILED, CANCELLED, REJECTED, and ABANDONED as failed. Any other status keeps the transaction pending.

The request carries an Authorization header with a Mozarto-generated signature token. Verify it before applying any balance or state change. See Webhook setup.

Inbound notification signature (Contiant → Mozarto)

Before Mozarto raises the settlement above, it receives the raw notification from Contiant and validates its authenticity. Contiant signs each notification with an X-Contiant-Signature header:

X-Contiant-Signature: t=1699858882,v1=1191d9f6939a71b4b55fe3a416ae3871dda90c9f9299878e7d078c4a5f0b8e94

t — UNIX timestamp

v1 — HMAC-SHA256("<t>|<raw request body>", notificationSecret) in hex

Mozarto recomputes the HMAC using the brand's configured notificationSecret and compares it to v1. Notifications that fail validation are rejected with 401 and left unprocessed — no transaction update, no merchant forward. If no notificationSecret is configured for the brand, validation is skipped and the notification is processed (legacy fallback).

Error codes

The Pay-In call returns an error when the request cannot be set up. Payment declines are reported later through the settlement webhook with transaction_status: "Failed", not on this call.

HTTP status	Response	When
400	`message: "PSP Configuration not found. Please check you psp Configuration"`	Contiant credentials, `siteUrl`, `merchantName`, or the beneficiary account for the payer's country are missing from the back office configuration
500	`message: "Internal server error"` with the raw failure in `data`	Contiant authentication or payment creation failed

For the full list of errorCode values and retryability guidance, see Errors.

Configuration (Mozarto back office)#

Beneficiary requirements by payer country#

Pay-In#

Request body#

Example request#

Response#

Settlement webhook#

Inbound notification signature (Contiant → Mozarto)#

Error codes#