MerasDocs
Get API keys
Products · POS

WebPOS Terminals

Cybersource card-present integration with TopWise EMV hardware. Key-injected P2PE so your servers never touch raw PANs.

5 endpointsterm_
✓

P2PE — out of scope for PCI DSS SAQ P2PE

PANs are encrypted from the moment the card is swiped, dipped, or tapped — all the way to Cybersource's HSM. Your integration qualifies for the simplified SAQ P2PE self-assessment; your servers are completely out of PCI DSS scope for cardholder data.

How it works

  1. 1

    Provision a TopWise terminal

    TopWise injects terminal encryption keys (TDEAs) at the factory using Cybersource's key-injection facility. The device ships to you already key-loaded — no key ceremony required on your end.
  2. 2

    Register the terminal via API

    Call POST /v1/terminals with the device serial number and model to create a terminal record in MerasPay. The terminal is initially inactive; call POST /v1/terminals/{id}/activate to bring it live.
  3. 3

    Terminal captures card data

    On card swipe, dip (chip), or tap (NFC), the TopWise hardware encrypts the track data and EMV cryptogram using the injected TDEA key. The encrypted payload is sent to your POS application over USB, serial, or TCP — never as plaintext.
  4. 4

    MerasPay decrypts via P2PE and forwards to Cybersource CP

    Your POS application posts the encrypted payload to MerasPay. MerasPay passes it to the Cybersource P2PE decryption service, then forwards the authorisation request to the Cybersource CP gateway. No plaintext PAN ever reaches your infrastructure.
  5. 5

    Receipt printed and webhook fires

    Cybersource returns an authorisation response in under 3 seconds. MerasPay books the ledger, sends an authorisation code back to the terminal for receipt printing, and dispatches a payment_intent.succeeded webhook to your endpoint.

Endpoints

POST/v1/terminals

Register a new TopWise terminal.

GET/v1/terminals

List all terminals for the merchant (limit ≤ 100).

GET/v1/terminals/{id}

Retrieve a specific terminal and its status.

POST/v1/terminals/{id}/activate

Activate a registered terminal — enables transaction processing.

DELETE/v1/terminals/{id}

Deregister a terminal — blocks all future transactions.

Register — parameters

NameTypeDescription
serial_number
required
stringTopWise factory serial number. Found on the label on the back of the device.
modelstringTopWise model identifier (e.g. "EFT930M", "T3"). Used to select the correct P2PE decryption profile.
outlet_idstringBranch or location ID. Appears in transaction records and settlement reports for reconciliation.
labelstringHuman-readable terminal name (e.g. "Checkout lane 3"). ≤60 chars.
metadatamapFree-form string-string map; round-trips on every response.

Sample — register + card-present charge webhook

POST /v1/terminalsbash
curl -X POST https://api.merashub.com/v1/terminals \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "serial_number": "TW930M-0042891",
    "model": "EFT930M",
    "outlet_id": "branch_main_djibouti",
    "label": "Checkout lane 1"
  }'
201 Createdjson
{
  "id": "term_01HZJ3EYJX7H2R1UP4I9A8BN5Q",
  "status": "inactive",
  "serial_number": "TW930M-0042891",
  "model": "EFT930M",
  "outlet_id": "branch_main_djibouti",
  "label": "Checkout lane 1",
  "created_at": "2026-05-25T10:15:30Z"
}
payment_intent.succeeded webhook (card-present via P2PE)json
{
  "id": "evt_01HZJ4FYJX8I3S2VQ5J0B9CO6R",
  "type": "payment_intent.succeeded",
  "data": {
    "object": {
      "id": "pi_01HZJ4FYJX8I3S2VQ5J0B9CO6R",
      "amount_minor": 84500,
      "currency": "DJF",
      "status": "succeeded",
      "payment_method_details": {
        "type": "card_present",
        "card_present": {
          "brand": "mastercard",
          "last4": "5100",
          "entry_mode": "chip",
          "terminal_id": "term_01HZJ3EYJX7H2R1UP4I9A8BN5Q",
          "auth_code": "831042",
          "p2pe": true
        }
      }
    }
  }
}

Supported hardware

  • TopWise EFT930M

    Full-featured countertop terminal. EMV Level 1, 2, and 3 certified. Supports swipe, chip, and NFC contactless. Built-in printer.

  • TopWise T3

    Compact mobile terminal with 4G + WiFi. EMV Level 1, 2, and 3 certified. Ideal for delivery and field agents. 12-hour battery.

All supported devices are EMVCo Level 1+2+3 certified and Cybersource P2PE validated. Contact hardware@merashub.com for procurement.

⚠

Key injection — factory only

Terminal encryption keys are injected at the TopWise factory using Cybersource's certified key-injection facility. Never attempt to re-inject keys yourself. If a terminal is compromised or keys are suspected to be exposed, call DELETE /v1/terminals/{id} immediately to block it, then contact support for a replacement unit.