Request

Endpoint: !PlaceOrder

https://secure.trust-provider.com/products/!PlaceOrder

For GET requests, submit parameters in the query string. For POST requests, submit parameters in application/x-www-form-urlencoded format.

Request parameters

The following table displays the required, optional, and conditional parameters.

Parameter Requirement Type Max.Length Description

Parameter	Requirement	Type	Max.Length	Description
`ap`	optional	string	64 chars	The affiliate brand name.
`currency`	optional	string	3 chars	The three-character ISO4217 currency code of the prices that have been quoted to customer or when `paymentStatus=0` and paid by the customer. The supported currencies are: `USD` (default) `EUR` `GBP`
`region`	optional	string	64 chars	The region where the order originates. The default value is `Unknown`.
`isReturningCustomer`	optional	char		Specifies whether the customer placing the order is new or already in the system. The allowed values are: `Y` — This customer already has an account. `N` — This is a new customer. This parameter is only relevant when `loginName` and `loginPassword` are being used.
`errorURL`	optional	string	255 chars	A URL to which the browser will be redirected if an error occurs.
`successURL`	optional	string	255 chars	Specifies a URL that will be linked from the order confirmation page if `paymentStatus=1` and the order is placed and payment is made successfully. Otherwise, if the order is placed successfully, it specifies a URL to which the browser will be immediately redirected.
`cancelURL`	optional	string	255 chars	Specifies the URL that will be linked from the order cancellation page when `paymentStatus=1` and the order is cancelled from the payment gateway webpage(s).
`confirmURL`	optional	string	255 chars	A URL to which the browser will be redirected after payment, if necessary, bypassing the default order confirmation page.
`paymentStatus`	optional	integer	1 char	Specifies when the payment is to be taken. The allowed values are: `0` — The payment has already been made. The cost(s) are provided in this call. `1` (default) — The payment should be made now. The response to this call will be to redirect the browser to the webpages of the default Sectigo payment gateway. Currently, NobelPay is used for USD transactions that are not part of a regular payment agreement, and Worldpay for everything else. `2` — The payment is deferred until later. The response to this call will contain various additional parameters, and it will be up to the caller to indicate completed payment by some other means.
`optInToMailingList`	optional	char	1 char	Specifies whether the customer placing the order wishes to opt in to the Sectigo mailing list. The allowed values are: `Y` — Opt in to relevant Sectigo mailing list(s). `N` (default) — Do not opt in.
`offerCode`	optional	string	64 chars	Specifies values related to offers and provided in cases of special pricing or when extra products are added. The allowed values are: `FREE_EV_UPGRADE` `FREE_EV_UPGRADE_REQUIRED` `EVSSLPREREGISTRATIONOFFER` `FREE_HP_UPGRADE`
Company address details Some products do not require an address. When an address is required, the state or province name may be omitted if `localityName` is specified, and vice versa. For returning customers, any address details supplied here will replace any details supplied on previous occasions.
`organizationName`	optional	string	64 chars	The organization name.
`organizationalUnitName`	optional	string	64 chars	The organizational unit name.
`postOfficeBox`	optional	string	40 chars	The organization post office box.
`streetAddress1`	optional	string	128 chars	The street address where the organization is incorporated.
`streetAddress2`	optional	string	128 chars	The second part of the company’s street address (if necessary).
`streetAddress3`	optional	string	128 chars	The third part of the company’s street address (if necessary).
`localityName`	optional	string	128 chars	The city in which the organization is incorporated.
`stateOrProvinceName`	optional	string	128 chars	The state or province in which the organization operates.
`postalCode`	optional	string	40 chars	The company’s postal code.
`countryName` or `country`	optional	string	2 chars	The ISO 3166 two-character code for the company’s country. If omitted, the value defaults to `US`.
Other company details
`dunsNumber`	optional	string	20 chars	A unique nine-digit identifier for businesses, provided by the company Dun & Bradstreet.
`companyNumber`	optional	string	64 chars	The company’s registration number
`joiLocalityName`	optional	string	128 chars	(EV only) The jurisdiction of the city in which the organization is incorporated.
`joistateorProvinceName`	optional	string	128 chars	(EV only) The jurisdiction of the state or province in which the organization operates.
`joiCountryName`	optional	string	2 chars	(EV only) The jurisdiction of the country in which the company is incorporated.
`dateOfIncorporation`	optional	string	10 chars	(EV only) The date of incorporation (`YYYY-MM-DD`) of the company. This is useful information for validation purposes.
`AssumedName`	optional	string	64 chars	(EV only) An optional name under which the organization operates that is different from its legal name. This is a so-called DBA (doing business as) name for the company (if any).
`BusinessCategory`	optional	char	1 char	The legal classification of the organization. The allowed values are: `b` — Private `c` — Government `d` — Business Entity
`x_organizationIdentifier`	optional	string	100 chars	The organization identifier, or the PSD2 Authorization Identifier recognized by the National Competent Authority. This parameter is required for: Employee, Seal (including for PSD2) Qualified Certificate Profiles QWAC-legal (including for PSD2) Qualified Certificate Profiles S/MIME Organization-Validated Multipurpose certificates
Tax Details
`vatNumber`	optional	string	14 chars	(EU/UK customers) The VAT registration number.
User personal details
`title`	optional	string	64 chars	The customer’s title (for example, Mr, Mrs, Dr).
`name`	conditional	string	128 chars	The customer’s full name. If `foreName` or `surName` are specified, `name` is not required.
`foreName`	conditional	string	64 chars	The customer’s first name. If `name` is specified, `foreName` and `surName` are not required.
`surName`	optional	string	64 chars	The customer’s last name. If `name` is specified, `foreName` and `surName` are not required.
`emailAddress`	required	string	255 chars	The customer’s email address. If `isReturningCustomer` is not used, then: if this parameter is present, the customer is a New customer. if this parameter is absent, the customer is a Returning customer.
`telephoneNumber`	optional	string	32 chars	The customer’s telephone number.
`faxNumber`	optional	string	32 chars	The customer’s fax number.
User login details
`loginName`	conditional	string	64 chars	Your account username. This value is case sensitive. Whether this field is required depends on the product(s) being ordered.
`loginPassword`	conditional	string	128 chars	Your account password. This value is case sensitive. Whether this field is required depends on the product(s) being ordered.
`licenceCode`	optional	string	255 chars	The relevant 'licence code' from a previous order.
`disableSWP`	optional	string	1 char	(SSL certificates only) Specifies whether to disable inclusion of free web products in a particular SSL certificate order. The allowed values are: `Y` — Disable inclusion of free web products in a particular SSL certificate order. `N` (default) — Free web products will be added to SSL certificate when applicable.
`domainName`	optional	string	64 chars	(SiteLock only) The domain name that the SiteLock product is ordered for.
Shipping details
`shippingOrganizationName`	optional	string	64 chars	Specifies the organization name required for shipping.
`shippingOrganizationalUnitName`	optional	string	64 chars	Specifies the organizational unit name required for shipping.
`shippingStreetAddress1`	optional	string	128 chars	Specifies the street address required for shipping.
`shippingStreetAddress2`	optional	string	128 chars	Specifies the second part of the street address required for shipping.
`shippingStreetAddress3`	optional	string	128 chars	Specifies the third part of the street address required for shipping.
`shippingLocalityName`	optional	string	128 chars	Specifies the city required for shipping.
`shippingStateOrProvinceName`	optional	string	128 chars	Specifies the state or province required for shipping.
`shippingPostalCode`	optional	string	40 chars	Specifies the postal code required for shipping.
`shippingCountryName`	optional	string	2 chars	Specifies the country required for shipping. This parameter must be an ISO 3166 two-character country code.
`shippingTitle`	optional	string	64 chars	The customer’s title (for example, Mr, Mrs, Dr, etc.) to be specified as a contact person in the courier.
`shippingForename`	optional	string	64 chars	The customer’s first name to be specified as a contact person in the courier shipping document.
`shippingSurname`	optional	string	64 chars	The customer’s last name to be specified as a contact person in the courier shipping document.
`shippingEmailAddress`	optional	string	255 chars	The customer’s email address who should be specified as a contact person in the courier shipping document.
`shippingTelephone`	optional	string	32 chars	The customer’s telephone number to be specified as a contact person in the courier shipping document.

ap

optional

string

64 chars

The affiliate brand name.

currency

optional

string

3 chars

The three-character ISO4217 currency code of the prices that have been quoted to customer or when paymentStatus=0 and paid by the customer.

The supported currencies are:

USD (default)
EUR
GBP

region

optional

string

64 chars

The region where the order originates.

The default value is Unknown.

isReturningCustomer

optional

char

Specifies whether the customer placing the order is new or already in the system.

The allowed values are:

Y — This customer already has an account.
N — This is a new customer.

This parameter is only relevant when loginName and loginPassword are being used.

errorURL

optional

string

255 chars

A URL to which the browser will be redirected if an error occurs.

successURL

optional

string

255 chars

Specifies a URL that will be linked from the order confirmation page if paymentStatus=1 and the order is placed and payment is made successfully.

Otherwise, if the order is placed successfully, it specifies a URL to which the browser will be immediately redirected.

cancelURL

optional

string

255 chars

Specifies the URL that will be linked from the order cancellation page when paymentStatus=1 and the order is cancelled from the payment gateway webpage(s).

confirmURL

optional

string

255 chars

A URL to which the browser will be redirected after payment, if necessary, bypassing the default order confirmation page.

paymentStatus

optional

integer

1 char

Specifies when the payment is to be taken.

The allowed values are:

0 — The payment has already been made. The cost(s) are provided in this call.
1 (default) — The payment should be made now. The response to this call will be to redirect the browser to the webpages of the default Sectigo payment gateway. Currently, NobelPay is used for USD transactions that are not part of a regular payment agreement, and Worldpay for everything else.
2 — The payment is deferred until later. The response to this call will contain various additional parameters, and it will be up to the caller to indicate completed payment by some other means.

optInToMailingList

optional

char

1 char

Specifies whether the customer placing the order wishes to opt in to the Sectigo mailing list.

The allowed values are:

Y — Opt in to relevant Sectigo mailing list(s).
N (default) — Do not opt in.

offerCode

optional

string

64 chars

Specifies values related to offers and provided in cases of special pricing or when extra products are added.

The allowed values are:

FREE_EV_UPGRADE
FREE_EV_UPGRADE_REQUIRED
EVSSLPREREGISTRATIONOFFER
FREE_HP_UPGRADE

Company address details

Some products do not require an address. When an address is required, the state or province name may be omitted if localityName is specified, and vice versa.

For returning customers, any address details supplied here will replace any details supplied on previous occasions.

organizationName

optional

string

64 chars

The organization name.

organizationalUnitName

optional

string

64 chars

The organizational unit name.

postOfficeBox

optional

string

40 chars

The organization post office box.

streetAddress1

optional

string

128 chars

The street address where the organization is incorporated.

streetAddress2

optional

string

128 chars

The second part of the company’s street address (if necessary).

streetAddress3

optional

string

128 chars

The third part of the company’s street address (if necessary).

localityName

optional

string

128 chars

The city in which the organization is incorporated.

stateOrProvinceName

optional

string

128 chars

The state or province in which the organization operates.

postalCode

optional

string

40 chars

The company’s postal code.

countryName or country

optional

string

2 chars

The ISO 3166 two-character code for the company’s country.

If omitted, the value defaults to US.

Other company details

dunsNumber

optional

string

20 chars

A unique nine-digit identifier for businesses, provided by the company Dun & Bradstreet.

companyNumber

optional

string

64 chars

The company’s registration number

joiLocalityName

optional

string

128 chars

(EV only) The jurisdiction of the city in which the organization is incorporated.

joistateorProvinceName

optional

string

128 chars

(EV only) The jurisdiction of the state or province in which the organization operates.

joiCountryName

optional

string

2 chars

(EV only) The jurisdiction of the country in which the company is incorporated.

dateOfIncorporation

optional

string

10 chars

(EV only) The date of incorporation (YYYY-MM-DD) of the company. This is useful information for validation purposes.

AssumedName

optional

string

64 chars

(EV only) An optional name under which the organization operates that is different from its legal name. This is a so-called DBA (doing business as) name for the company (if any).

BusinessCategory

optional

char

1 char

The legal classification of the organization.

The allowed values are:

b — Private
c — Government
d — Business Entity

x_organizationIdentifier

optional

string

100 chars

The organization identifier, or the PSD2 Authorization Identifier recognized by the National Competent Authority.

This parameter is required for:

Employee, Seal (including for PSD2) Qualified Certificate Profiles
QWAC-legal (including for PSD2) Qualified Certificate Profiles
S/MIME Organization-Validated Multipurpose certificates

Tax Details

vatNumber

optional

string

14 chars

(EU/UK customers) The VAT registration number.

User personal details

title

optional

string

64 chars

The customer’s title (for example, Mr, Mrs, Dr).

name

conditional

string

128 chars

The customer’s full name.

If foreName or surName are specified, name is not required.

foreName

conditional

string

64 chars

The customer’s first name.

If name is specified, foreName and surName are not required.

surName

optional

string

64 chars

The customer’s last name.

If name is specified, foreName and surName are not required.

emailAddress

required

string

255 chars

The customer’s email address.

If isReturningCustomer is not used, then:

if this parameter is present, the customer is a New customer.
if this parameter is absent, the customer is a Returning customer.

telephoneNumber

optional

string

32 chars

The customer’s telephone number.

faxNumber

optional

string

32 chars

The customer’s fax number.

User login details

loginName

conditional

string

64 chars

Your account username.

This value is case sensitive.

Whether this field is required depends on the product(s) being ordered.

loginPassword

conditional

string

128 chars

Your account password.

This value is case sensitive.

Whether this field is required depends on the product(s) being ordered.

licenceCode

optional

string

255 chars

The relevant 'licence code' from a previous order.

disableSWP

optional

string

1 char

(SSL certificates only) Specifies whether to disable inclusion of free web products in a particular SSL certificate order.

The allowed values are:

Y — Disable inclusion of free web products in a particular SSL certificate order.
N (default) — Free web products will be added to SSL certificate when applicable.

domainName

optional

string

64 chars

(SiteLock only) The domain name that the SiteLock product is ordered for.

Shipping details

shippingOrganizationName

optional

string

64 chars

Specifies the organization name required for shipping.

shippingOrganizationalUnitName

optional

string

64 chars

Specifies the organizational unit name required for shipping.

shippingStreetAddress1

optional

string

128 chars

Specifies the street address required for shipping.

shippingStreetAddress2

optional

string

128 chars

Specifies the second part of the street address required for shipping.

shippingStreetAddress3

optional

string

128 chars

Specifies the third part of the street address required for shipping.

shippingLocalityName

optional

string

128 chars

Specifies the city required for shipping.

shippingStateOrProvinceName

optional

string

128 chars

Specifies the state or province required for shipping.

shippingPostalCode

optional

string

40 chars

Specifies the postal code required for shipping.

shippingCountryName

optional

string

2 chars

Specifies the country required for shipping.

This parameter must be an ISO 3166 two-character country code.

shippingTitle

optional

string

64 chars

The customer’s title (for example, Mr, Mrs, Dr, etc.) to be specified as a contact person in the courier.

shippingForename

optional

string

64 chars

The customer’s first name to be specified as a contact person in the courier shipping document.

shippingSurname

optional

string

64 chars

The customer’s last name to be specified as a contact person in the courier shipping document.

shippingEmailAddress

optional

string

255 chars

The customer’s email address who should be specified as a contact person in the courier shipping document.

shippingTelephone

optional

string

32 chars

The customer’s telephone number to be specified as a contact person in the courier shipping document.

The parameters for shipping details are only relevant for token-based certificates.

If no parameters for shipping address are provided, the shipping address defaults to the organization address.

Though the parameters related to shipping details are optional, the absence of some of them (flagged as required for shipping below) will trigger sending of an email to the applicant representative requesting to provide the missing shipping details.

If the missing shipping details, which are required for shipping, are not provided before the token is ready for shipment, the token will be shipped to the verified organization address with the applicant representative being specified as a contact person.

Various parameters must also be provided to define the product(s) being purchased. They vary considerably depending on the product(s).

The following table outlines a sample of the types of a parameter. Definitive parameter requirements for each product are documented in the PlaceOrder API for Resellers document.

The x in the following parameters is a placeholder for an integer indicating the 'item number. This allows multiple items to be purchased in a single order, so it should be possible to integrate this with shopping cart systems.

The first 'item number' is 1, the second 'item number' is 2 and so on. This means that either 1_ID or 1_PPP must be specified, because there must be at least one item in the order.

You may prepend an underscore to any of the x_ parameters. This will be necessary if you need to reference such parameters in Javascript, because Javascript variables may not begin with a digit.

Parameters prefixed with x_ are product-specific and their requirements depend on the selected product type.

Parameter Requirement Type Max.Length Description

x_ID

conditional

integer

A product ID.

x_PPP

conditional

integer

A product pricing parameter.

x_visibility

optional

integer

Specifies the visibility of the product in the control panel.

The allowed values are:

-1 (default) — Visible.
0 — Invisible.

x_days

conditional

integer

The number of days.

Its necessity is determined by the specific product.

x_seats, or x_users, or x_servers, or x_quantity

required

integer

Indicates a quantity that affects the pricing.

x_zones

required

integer

Indicates another quantity that affects the pricing.

x_dcvEmailAddress

optional

string

32 chars

The selected method for domain control validation (DCV).

The allowed values are:

<permitted email address>
HTTP CSR Hash
HTTPS CSR Hash
CNAME CSR Hash

If omitted, the value defaults to EMAIL.

For more information, see Domain Control Validation.

Continued use of email-based DCV methods is discouraged. In line with CA/B Forum Ballot SC-090, all email-based DCV methods are on a deprecation path, with full industry deprecation expected by early 2028.

Plan for earlier enforcement and migrate to DNS-based or HTTP-based validation methods in advance.

x_IPAddress

required

string

15 chars

(HackerGuardian only) An IPv4 address.

x_smartCardBased

optional

char

1 char

(Document Signing, non-QWAC eIDAS, EV/OV Code Signing certificates only) Specifies whether the Code Signing certificate is to be issued on a smart card.

The allowed values are:

Y — Provision the certificate on a token.
N — Provide the certificate for collection via API or email.

x_hsmType

optional

string

20 chars

(OV/EV Code Signing and Document Signing certificates only) The hardware type used to generate the keypair in a non-exportable format, CSR and key attestation.

The allowed values are:

YUBIKEY
LUNA
MARVELL_GOOGLE
FORTANIX
YUBIHSM2
NSHIELD

x_keyAttestation

optional

string

32767 chars

(OV/EV Code Signing and Document Signing certificates only) The Base64-encoded HSM-specific attestation package/blob. Proof that the keypair has been generated and stored in secure hardware.

x_webserverSoftwareID

optional

integer

Specifies the web server software that will be used to host the certificate.

The allowed values are:

2 — Apache-ModSSL
10 — Java-based servers
14 — Microsoft IIS 5.x to 6.x
18 — Oracle
30 — Plesk
31 — WHM/cPanel
35 — Microsoft IIS 7.x and later
36 — nginx
-1 — Other

This parameter does not directly affect the certificate content.

The -1 value is preferable as the default option.

x_smimeEmailAddresses

optional

string

255 chars

The email address(es) that are to be included in the Subject Alternative Names (SAN) field of the resulting certificate.

x_smimeSubjectCN

optional

char

1 char

Specifies in the organization-validated S/MIME certificate request whether to include the organization name in the Common Name field of the certificate subject.

The allowed values are:

Y — The organization name will be included in the Common Name field of the certificate subject.
N — No Common Name will be included in the certificate subject.

x_smimeSubjectEmail

optional

string

255 chars

Specifies whether to include the email address in the certificate subject.

x_personalIdentifier

optional

string

100 chars

The semantics information for attributes stored in the subject field related to natural person.

Required for eIDAS Citizen, Employee and QWAC Natural Qualified Certificate Profiles.

This parameter has a deprecated synonym — x_semanticsIdentifier, which is preserved for backwards compatibility.

x_ncaIdentifier

optional

string

100 chars

An abbreviated unique identifier of the National Competent Authority (NCA).

Required for PSD2 Qualified Certificate Profiles.

This parameter must contain information using the following structure in the presented order:

The two-character ISO 3166-1 [8] country code representing the NCA country.
The hyphen-minus - (0x2D (ASCII), U+002D (UTF-8)).
2-8 character NCA identifier without country code, A-Z uppercase only, no separator.

x_ncaName

optional

char

100 char

The name of National Competent Authority in English that registered the payment service provider.

Required for PSD2 Qualified Certificate Profiles.

If omitted, the value is defined automatically based on the ncaIdentifier value provided in the request.

x_accountServicingRole

optional

char

1 char

Specifies one of possible roles of the payment service provider.

Required for PSD2 Qualified Certificate Profiles.

The allowed values are:

Y — Assign the role.
N — Do not assign the role.

At least one PSD role should be set to Y.

x_paymentInitiationRole

optional

char

1 char

Specifies one of possible roles of the payment service provider.

Required for PSD2 Qualified Certificate Profiles.

The allowed values are:

Y — Assign the role.
N — Do not assign the role.

x_accountInformationRole

optional

char

1 char

Specifies one of possible roles of the payment service provider.

Required for PSD2 Qualified Certificate Profiles.

The allowed values are:

Y — Assign the role.
N — Do not assign the role.

x_paymentServiceRole

optional

char

1 char

One of possible roles of the payment service provider.

Required for PSD2 Qualified Certificate Profiles.

The allowed values are:

Y — Assign the role.
N — Do not assign the role.

An account can contain multiple email templates for the S/MIME certificate orders and provisioning of missing shipping details.

Contact Support when needed.

When configured, the following parameters can be included in the request to identify the email template to be used.

Parameter Requirement Type Max.Length Description

Parameter	Requirement	Type	Max.Length	Description
`languageName`	optional	string	2 chars	Specifies the language for S/MIME emails. An account can contain multiple email templates in different languages for S/MIME emails. Contact Support for the email templates. There may be exactly one of the following values specified: `en` — English `zh` — Chinese-Mandarin `da` — Danish `nl` — Dutch `fr` — French `de` — German `it` — Italian `ja` — Japanese `ko` — Korean `pt` — Portuguese `ru` — Russian `es` — Spanish `sv` — Swedish `tr` — Turkish Any of the following parameters prevail over the `languageName` if provided: `SMIMEVerificationTemplateID` `SMIMERequestTemplateID` `SMIMECollectionTemplateID` `shippingTemplateID` `agreementTemplateID`
`SMIMEVerificationTemplateID`	optional	integer		The S/MIME verification email templates. `SMIMEVerificationTemplateID` prevails over `languageName` if both of these parameters are provided.
`SMIMERequestTemplateID`	optional	integer		The S/MIME request email templates. `SMIMERequestTemplateID` prevails over `languageName` if both of these parameters are provided.
`SMIMECollectionTemplateID`	optional	integer		The S/MIME collection email templates. `SMIMECollectionTemplateID` prevails over `languageName` if both of these parameters are provided.
`shippingTemplateID`	optional	integer		The shipping details email templates. `shippingTemplateID` prevails over `languageName` if both of these parameters are provided.
`agreementTemplateID`	optional	integer		(OV/EV SSL, eIDAS, S/MIME, Code and Document signing certificates only) Specifies the Subscriber Agreement email template ID to be used for the order. `agreementTemplateID` prevails over `languageName` if both of these parameters are provided.

languageName

optional

string

2 chars

Specifies the language for S/MIME emails.

An account can contain multiple email templates in different languages for S/MIME emails.

Contact Support for the email templates.

There may be exactly one of the following values specified:

en — English
zh — Chinese-Mandarin
da — Danish
nl — Dutch
fr — French
de — German
it — Italian
ja — Japanese
ko — Korean
pt — Portuguese
ru — Russian
es — Spanish
sv — Swedish
tr — Turkish

Any of the following parameters prevail over the languageName if provided:

SMIMEVerificationTemplateID
SMIMERequestTemplateID
SMIMECollectionTemplateID
shippingTemplateID
agreementTemplateID

SMIMEVerificationTemplateID

optional

integer

The S/MIME verification email templates.

SMIMEVerificationTemplateID prevails over languageName if both of these parameters are provided.

SMIMERequestTemplateID

optional

integer

The S/MIME request email templates.

SMIMERequestTemplateID prevails over languageName if both of these parameters are provided.

SMIMECollectionTemplateID

optional

integer

The S/MIME collection email templates.

SMIMECollectionTemplateID prevails over languageName if both of these parameters are provided.

shippingTemplateID

optional

integer

The shipping details email templates.

shippingTemplateID prevails over languageName if both of these parameters are provided.

agreementTemplateID

optional

integer

(OV/EV SSL, eIDAS, S/MIME, Code and Document signing certificates only) Specifies the Subscriber Agreement email template ID to be used for the order.

agreementTemplateID prevails over languageName if both of these parameters are provided.

Sample request

curl --location 'https://secure.trust-provider.com/products/!PlaceOrder' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'loginName=login_name' \
--data-urlencode 'loginPassword=login_password' \
--data-urlencode 'isReturningCustomer=Y' \
--data-urlencode 'ap=Affiliate_Brand_Name' \
--data-urlencode '[email protected]' \
--data-urlencode '_1_PPP=400' \
--data-urlencode '1_webserverSoftwareID=-1'

Response

The type of response depends on whether the call was successful and on the successURL, errorURL and paymentStatus parameters supplied in the request.

successURL and errorURL, cancelURL and confirmURL are intended to be used only when PlaceOrder is called by a browser. When PlaceOrder is called from a back-end server, these parameters are irrelevant.

If an Affiliate calls PlaceOrder from their back-end code, they should specify paymentStatus=2.

Unspecified errorURL

If an error occurs but errorURL was not supplied, then the MIME type of the response will be application/x-www-form-urlencoded, because the format of the response will be the same URL-encoded format as the request. For example, name1=value1&name2=value2.

Response parameters

Various parameters may appear in the response:

Parameter Type Max.Length Description

Parameter	Type	Max.Length	Description
`errorCode`	integer		A numeric code that identifies the type of the error. For more information, see Error codes
`orderNumber`	string	128 chars	A newly assigned order number if the order was placed successfully.
`errorMessage`	string	255 chars	A description of the error.
`errorItem`	string	255 chars	The name of the request parameter that caused the error if applicable.

errorCode

integer

A numeric code that identifies the type of the error.

For more information, see Error codes

orderNumber

string

128 chars

A newly assigned order number if the order was placed successfully.

errorMessage

string

255 chars

A description of the error.

errorItem

string

255 chars

The name of the request parameter that caused the error if applicable.

Specified errorURL or successURL

If the call is successful and a successURL was supplied, or an error occurs and an errorURL was supplied, then the browser will be redirected to the successURL or errorURL, whichever is applicable. The parameters listed in Unspecified errorURL will be passed as GET parameters in the 'query string' of the URL. This query string can be parsed by some JavaScript code.

If paymentStatus=1, the browser will first be redirected through the payment pages of the default Sectigo payment gateway. Once the payment has been received successfully, the browser will either be redirected to the confirmURL if specified. Otherwise, the confirmation webpage will provide a link to the successURL if supplied.

If paymentStatus=0 or 2, then successURL, errorURL, cancelURL and confirmURL are completely ignored. Instead, the response is specified like for the unspecified errorURL.

For orders that are cancelled from the payment gateway webpage, the order cancellation webpage will provide a link to the cancelURL if specified.

Specified `paymentStatus`

If paymentStatus=0, the following additional parameters are required in the request:

Parameter Type Max.Length Description

Parameter	Type	Max.Length	Description
`x_cost`	number		The total itemized cost without tax, in the specified currency, that has been paid already.
`x_tax`	number		The total itemized tax in the specified currency, that has been paid already.
`paymentMethod`	integer		Specifies the payment method used for the order. The possible values are: `0` — Test `1` — Free `2` — WorldPay `3` — PayPal `4` — Cheque `5` — Wire Transfer `7` — SectigoPayments `8` — NobelPay
`paymentID`	string	64 chars	The payment transaction identifier provided by the payment gateway. For WorldPay, NobelPay, PayPal and SectigoPayments this parameter represents a 'transaction ID' assigned by the payment gateway. For cheque and wire transfer it is an optional comment assigned by whoever took the payment. `paymentID` is only required for WorldPay, NobelPay, PayPal and SectigoPayments payment methods. Otherwise, `paymentID` must not be specified.
`paymentTimestamp`	integer		The date/time at which payment occurred. It is expressed as a UNIX time value.

x_cost

number

The total itemized cost without tax, in the specified currency, that has been paid already.

x_tax

number

The total itemized tax in the specified currency, that has been paid already.

paymentMethod

integer

Specifies the payment method used for the order.

The possible values are:

0 — Test
1 — Free
2 — WorldPay
3 — PayPal
4 — Cheque
5 — Wire Transfer
7 — SectigoPayments
8 — NobelPay

paymentID

string

64 chars

The payment transaction identifier provided by the payment gateway.

For WorldPay, NobelPay, PayPal and SectigoPayments this parameter represents a 'transaction ID' assigned by the payment gateway.

For cheque and wire transfer it is an optional comment assigned by whoever took the payment.

paymentID is only required for WorldPay, NobelPay, PayPal and SectigoPayments payment methods. Otherwise, paymentID must not be specified.

paymentTimestamp

integer

The date/time at which payment occurred.

It is expressed as a UNIX time value.

The response will be the same application/x-www-form-urlencoded response as for the unspecified errorURL.

The caller must be authenticated more strongly. This must be done using an SSL client certificate issued by the Sectigo CA. Also, the URL will be https://private.sectigo.com/products/!PlaceOrder instead of the endpoint URL in Request.

As the caller will be a server rather than the end customer’s browser, and as SSL Client authentication will strongly authenticate the caller, the caller need not supply the loginPassword of the customer. The customer will be identified by just their loginName. If paymentStatus=1, the behavior is as defined in other sections of this specification.

If any items in the order require payment using a regular payment agreement (such as FuturePay, FlexiPay, or FlexiBurn), then paymentStatus=1.

If paymentStatus=2, then the MIME type of the response will be application/x-www-form-urlencoded, because the format of the response will be the same URL-encoded format as the request (for example, name1=value1&name2=value2).

In addition to the parameters listed in, the following parameters will appear in the response:

Parameter Type Max.Length Description

Parameter	Type	Max.Length	Description
`totalCost`	number		The total cost required to be paid, including any applicable tax.
`currency`	string	3 chars	The three-character ISO4217 currency code of `totalCost`.

totalCost

number

The total cost required to be paid, including any applicable tax.

currency

string

3 chars

The three-character ISO4217 currency code of totalCost.

Specified `confirmURL`

If a confirmURL is specified, then after successful payment through the default Sectigo payment gateway, currently NobelPay or WorldPay, the default Sectigo confirmation page will not be displayed. Instead, the browser will be redirected to confirmURL with the following parameters supplied in the query string:

Parameter Type Max.Length Description

Parameter	Type	Max.Length	Description
`orderNumber`	string	64 chars	The newly assigned order number.
`currency`	string	3 chars	The three-character ISO4217 currency code of the `n_itemCost` and `n_itemTax` parameters.
`n_itemDescription`	string	255 chars	A description of the item where `n` is the number of the item within the order, starting with `n=1`.
`n_itemCost`	number		The cost without tax for the item where `n` is the number of the item within the order, starting with `n=1`.
`n_itemTax`	number		The tax for the item where `n` is the number of the item within the order, starting with `n=1`.

orderNumber

string

64 chars

The newly assigned order number.

currency

string

3 chars

The three-character ISO4217 currency code of the n_itemCost and n_itemTax parameters.

n_itemDescription

string

255 chars

A description of the item where n is the number of the item within the order, starting with n=1.

n_itemCost

number

The cost without tax for the item where n is the number of the item within the order, starting with n=1.

n_itemTax

number

The tax for the item where n is the number of the item within the order, starting with n=1.

Sample success response

orderNumber=1234567

Sample error response

errorCode=-16&errorItem=Incorrect+login+details%2C+account+is+locked%2C+password+has+expired+or+your+source+IP+is+blocked.

Error codes

The following table outlines error responses returned by the PlaceOrder API endpoint for Affiliates. Each error response consists of an errorCode and an errorMessage indicating why the request failed.

Error Code Error Message Description

Error Code	Error Message	Description
`-1`	`Request was not made over HTTPS!`	The request must use HTTPS protocol.
`-2`	`'xxxx' is an unrecognized argument!`	The provided argument is not recognized.
`-3`	`The 'xxxx' argument is missing!`	A required argument is missing from the request.
`-4`	`The value of the 'xxxx' argument is invalid!`	The argument value does not meet validation requirements.
`-13`	`The CSR uses an unsupported key size!`	The key size in the CSR is not supported.
`-14`	`An unknown error occurred!`	An unknown error occurred.
`-16`	`Incorrect login details, account is locked, password has expired or your source IP is blocked.`	Authentication has failed due to one of the specified reasons. Verify your login credentials or check account restrictions.
`-38`	`Certain details that must be validated for 'errorItem' are missing from this Account!`	Certain required details for validation are missing from the account.
`-39`	`At least 1 item is missing from this order!`	The order does not contain all items.
`-44`	`Not a white-listed public key!`	The provided public key is not on the whitelist.
`-45`	`This offer is limited to one free license per account!`	The offer allows only one free license per account.
`-53`	`Incorrect duration for main HG licence or/and Additional IP addresses pack!`	The duration specified for the main HackerGuardian license or additional IP address pack is incorrect.
`-54`	`The order can have one main license only!`	The order is limited to one main license.
`-56`	`Your current license expires on 'YYYY-MM-DD'. Licenses can only be renewed up to 30 days prior to the expiry of your existing license.`	The current license is not eligible for renewal at this time.
`-57`	`The company name already exists in the service Qualys!`	The provided company name is already registered in the Qualys service.
`-58`	`Additional IP Addresses pack is not available for trial licence!`	The additional IP address pack cannot be requested for a trial license.
`-59`	`Additional IP Address Packs may only be purchased for an existing HackerGuardian account!`	The additional IP address packs can only be purchased for existing HackerGuardian accounts.
`-60`	`To renew your access to the PCI portal you must purchase enough IP Addresses to support those currently setup. Previously you have purchased 'XXXX' IP addresses.`	To renew access to the PCI portal, you must purchase enough IP addresses to cover the existing setup.
`-61`	`The number of IP addresses does not match the specified product.`	The number of IP addresses provided does not correspond to the selected product.
`-62`	`Company name is required but missing.`	The required company name is missing.
`-63`	`The e-mail already exists in the service CodeGuard!`	The provided email address is already registered in the CodeGuard service.
`-64`	`Unknown partner for the service CodeGuard!`	The specified partner for the CodeGuard service is not recognized.
`-65`	`PlanID for this product not found.`	The specified PlanID for the product could not be found.
`-66`	`CodeGuard partner is not activated.`	The CodeGuard partner is not currently activated.
`-67`	`The order can have one CodeGuard license only!`	The order is limited to one CodeGuard license.
`-69`	`CodeGuard service disabled!`	The CodeGuard service is currently disabled.
`-70`	`Invalid Email Address!`	The provided email address is not valid.
`-72`	`You can not renew trial Qualys licence!`	You cannot renew a trial Qualys license.
`-73`	`This account has already ordered this SWP product!`	The account has already placed an order for this Sectigo Web Platform (SWP) product.
`-83`	`'xxxx' is not applicable to this order!`	The specified argument is not applicable for the current order.
`-91`	`Permission Denied. 'xxx'`	The user does not have permission for the specified context.
`-97`	`Session is expired`	The session has expired.
`-120`	`'Role' arguments are missing for PSD2 certificate type!`	The required "Role" arguments are missing for the PSD2 certificate type.
`-124`	`SiteLock Monitor can only be ordered together with SSL product`	The SiteLock Monitor must be ordered alongside an SSL product.
`-126`	`HTTP(S) CSR Hash DCV Methods are not allowed to validate Wildcard Domain!`	The HTTP(S) CSR Hash DCV methods cannot be used to validate a wildcard domain.
`-127`	`Document Signing Anchors are restricted for PlaceOrder API`	The use of Document Signing Anchors is restricted when using the `PlaceOrder` API for Affiliates.
`-128`	`You can not buy the addon.`	You are not permitted to purchase the specified addon.
`-129`	`Error in key attestation verification 'Context'`	The key attestation verification failed.

-1

Request was not made over HTTPS!

The request must use HTTPS protocol.

-2

'xxxx' is an unrecognized argument!

The provided argument is not recognized.

-3

The 'xxxx' argument is missing!

A required argument is missing from the request.

-4

The value of the 'xxxx' argument is invalid!

The argument value does not meet validation requirements.

-13

The CSR uses an unsupported key size!

The key size in the CSR is not supported.

-14

An unknown error occurred!

An unknown error occurred.

-16

Incorrect login details, account is locked, password has expired or your source IP is blocked.

Authentication has failed due to one of the specified reasons.

Verify your login credentials or check account restrictions.

-38

Certain details that must be validated for 'errorItem' are missing from this Account!

Certain required details for validation are missing from the account.

-39

At least 1 item is missing from this order!

The order does not contain all items.

-44

Not a white-listed public key!

The provided public key is not on the whitelist.

-45

This offer is limited to one free license per account!

The offer allows only one free license per account.

-53

Incorrect duration for main HG licence or/and Additional IP addresses pack!

The duration specified for the main HackerGuardian license or additional IP address pack is incorrect.

-54

The order can have one main license only!

The order is limited to one main license.

-56

Your current license expires on 'YYYY-MM-DD'. Licenses can only be renewed up to 30 days prior to the expiry of your existing license.

The current license is not eligible for renewal at this time.

-57

The company name already exists in the service Qualys!

The provided company name is already registered in the Qualys service.

-58

Additional IP Addresses pack is not available for trial licence!

The additional IP address pack cannot be requested for a trial license.

-59

Additional IP Address Packs may only be purchased for an existing HackerGuardian account!

The additional IP address packs can only be purchased for existing HackerGuardian accounts.

-60

To renew your access to the PCI portal you must purchase enough IP Addresses to support those currently setup. Previously you have purchased 'XXXX' IP addresses.

To renew access to the PCI portal, you must purchase enough IP addresses to cover the existing setup.

-61

The number of IP addresses does not match the specified product.

The number of IP addresses provided does not correspond to the selected product.

-62

Company name is required but missing.

The required company name is missing.

-63

The e-mail already exists in the service CodeGuard!

The provided email address is already registered in the CodeGuard service.

-64

Unknown partner for the service CodeGuard!

The specified partner for the CodeGuard service is not recognized.

-65

PlanID for this product not found.

The specified PlanID for the product could not be found.

-66

CodeGuard partner is not activated.

The CodeGuard partner is not currently activated.

-67

The order can have one CodeGuard license only!

The order is limited to one CodeGuard license.

-69

CodeGuard service disabled!

The CodeGuard service is currently disabled.

-70

Invalid Email Address!

The provided email address is not valid.

-72

You can not renew trial Qualys licence!

You cannot renew a trial Qualys license.

-73

This account has already ordered this SWP product!

The account has already placed an order for this Sectigo Web Platform (SWP) product.

-83

'xxxx' is not applicable to this order!

The specified argument is not applicable for the current order.

-91

Permission Denied. 'xxx'

The user does not have permission for the specified context.

-97

Session is expired

The session has expired.

-120

'Role' arguments are missing for PSD2 certificate type!

The required "Role" arguments are missing for the PSD2 certificate type.

-124

SiteLock Monitor can only be ordered together with SSL product

The SiteLock Monitor must be ordered alongside an SSL product.

-126

HTTP(S) CSR Hash DCV Methods are not allowed to validate Wildcard Domain!

The HTTP(S) CSR Hash DCV methods cannot be used to validate a wildcard domain.

-127

Document Signing Anchors are restricted for PlaceOrder API

The use of Document Signing Anchors is restricted when using the PlaceOrder API for Affiliates.

-128

You can not buy the addon.

You are not permitted to purchase the specified addon.

-129

Error in key attestation verification 'Context'

The key attestation verification failed.

Request

Request parameters

Sample request

Response

Unspecified errorURL

Response parameters

Specified errorURL or successURL

Specified paymentStatus

Specified confirmURL

Sample success response

Sample error response

Error codes

Specified `paymentStatus`

Specified `confirmURL`