Messages

5 min

Toro Payment Gateway records each nexo message that a POI exchanges with the gateway, both requests and responses. This covers payments (authorisations, completions and cancellations) and terminal management. You can read these messages through the Management API to see exactly what a terminal sent and what the gateway sent back.

Messages are read-only. The gateway creates them, and you cannot create, change or delete them.

Your role needs the messages:read permission.

Card data is redacted. Before a message is stored, the gateway removes card data and sensitive authentication data (PAN, track data, PIN blocks and similar) to meet PCI DSS. The redacted fields are not available through this API.

A message group holds every message for one transaction: the authorisation request and response, then any completion or cancellation. The group ID is the SaleReferenceIdentification that the POI sent.

The message object

header, body and trailer are the nexo message converted to JSON. Element names are in PascalCase, as in the nexo specification, and code values are in snake_case (for example "TransactionType":"card_payment").

List messages

GET /messages

Examples

Example: all messages for one transaction

curl -G "https://mgmt-api.torogateway.dev/v1/messages" \
  -H "API-Key: <KEY>" \
  --data-urlencode "message_group_id=PUR-1760957687-204DE0FE" \
  --data-urlencode "sort_by=created_at" \
  --data-urlencode "sort_order=asc"

Example: authorisation requests from one POI on a given day

curl -G "https://mgmt-api.torogateway.dev/v1/messages" \
  -H "API-Key: <KEY>" \
  --data-urlencode "poi_id=poi_..." \
  --data-urlencode "message_name=AcceptorAuthorisationRequest" \
  --data-urlencode "created_at[\$gte]=2026-10-20T00:00:00"

Example: retrieve a message GET /messages/{id}

curl "https://mgmt-api.torogateway.dev/v1/messages/ms_0199a1b2c3d47e8f9a0b1c2d3e4f5a6b" \
  -H "API-Key: <KEY>"

This returns one message object, in the same shape as an item in the list response. If no message has that ID, the API returns 404.

Message and routing rules

Routing rules can read the header, body and trailer of the authorisation request. To find the field paths for a rule, list a transaction's AcceptorAuthorisationRequest messages and look at those three objects.