---
title: SAIF.Services.WebServices.Epay operations and processes
summary: Operation catalog and cross-operation hub for the US Bank ePay SSO handshake helper.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-07-30
library: SAIF.Services.WebServices.Epay
reference_type: package
---
# SAIF.Services.WebServices.Epay operations and processes
This page is the operation catalog and cross-operation hub for `SAIF.Services.WebServices.Epay`. The library exposes two operations, both implemented in the `USBank` module: generating the encrypted, signed SSO handshake payload sent to US Bank's ePay service, and resolving the distinguished name of the SAIF (non-admin) authentication certificate. Each operation's detailed, step-by-step logic lives in its own page under `operations/`.
## Operation catalog
| Operation | Intent | Trigger | Inputs | Outputs | Rules | Tables | SQL |
| --- | --- | --- | --- | --- | --- | --- | --- |
| [Generate SSO handshake payload](operations/generate-sso-handshake-payload.md) | Encrypt session-transfer data and produce a signed, envelope-encrypted SSO payload for US Bank ePay | Caller invokes `USBank.GetSSOData(sessionTransferData)` | `sessionTransferData` (String) | `AdminSingleSignOnData` DTO (encrypted data, wrapped key, IV, signature) | [BR-001](business-rules.md#br-001-fail-fast-on-missing-signingencryption-certificates), [BR-002](business-rules.md#br-002-symmetric-key-material-is-not-retained-on-the-dto), [BR-003](business-rules.md#br-003-certificate-dn-composition-is-externally-configurable) | — | — |
| [Resolve SAIF certificate DN](operations/resolve-saif-certificate-dn.md) | Build the distinguished name string for the SAIF (non-admin) authentication certificate from configuration | Caller invokes `USBank.GetSAIFCertDistinguishedName()` | None | DN string (String) | [BR-003](business-rules.md#br-003-certificate-dn-composition-is-externally-configurable) | — | — |
This library performs no database access and defines no `IBusinessCriteria`; there is no `database-tables.md` or `sql/` catalog for this library, hence the `—` placeholders in the Tables and SQL columns above.
## Process flow diagram
The following diagram visualizes the primary SSO handshake operational flow, which is the library's main operation. The DN-resolution operation is a smaller, independent utility not depicted here — see its own [process flow](operations/resolve-saif-certificate-dn.md#process-flow).
```mermaid
flowchart TD
Start([Start: sessionTransferData]) --> AES[AES-256 encrypt payload]
AES --> LoadUsBankDN[Resolve US Bank cert DN
via usBankEPaySSOCertDN config]
LoadUsBankDN --> LoadUsBankCert[Load US Bank cert
from LocalMachine Root]
LoadUsBankCert --> CertCheck{US Bank cert
found?}
CertCheck -->|No| ErrUSBank([Throw ApplicationException:
USBank Cert not found.])
CertCheck -->|Yes| RSAWrap[RSA-wrap AES key with
US Bank public key]
RSAWrap --> DiscardKey[Discard raw symmetric key]
DiscardKey --> LoadSaifDN[Resolve SAIF admin cert DN
via usBankEPayAuthenticationAdminCertDN config]
LoadSaifDN --> LoadSaifCert[Load SAIF admin cert
from LocalMachine My]
LoadSaifCert --> SaifCheck{SAIF admin cert
found?}
SaifCheck -->|No| ErrSAIF([Throw ApplicationException:
SAIF cert not found.])
SaifCheck -->|Yes| Sign[Sign encrypted data
with SAIF private key]
Sign --> Bundle[Bundle into AdminSingleSignOnData]
Bundle --> End([Return AdminSingleSignOnData])
```
## Failure and edge-case behavior
- If the US Bank SSO certificate cannot be resolved from `LocalMachine\Root`, [Generate SSO handshake payload](operations/generate-sso-handshake-payload.md) throws `ApplicationException("USBank Cert not found.")` — the handshake is aborted immediately. See [BR-001](business-rules.md#br-001-fail-fast-on-missing-signingencryption-certificates).
- If the SAIF admin authentication certificate cannot be resolved from `LocalMachine\My`, [Generate SSO handshake payload](operations/generate-sso-handshake-payload.md) throws `ApplicationException("SAIF cert not found.")`. See [BR-001](business-rules.md#br-001-fail-fast-on-missing-signingencryption-certificates).
- If any cert-DN configuration key is missing or its JSON value is malformed, `JavaScriptSerializer.Deserialize` throws during `GetCertificateParameters`, and the corresponding certificate-load step never executes, for either operation.
- `wsCreditCardPayment.vb` (excluded from the compiled assembly) references an undefined `USB_EPay.SessionTransfer` type and would not build even if re-added to the compile list — it is not an active operation and is not catalogued above.*
## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Business rules](business-rules.md)
- [Configuration](configuration.md)
- [API reference](api/index.md)
> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.
## Sources
- `Services\SAIF.Services.WebServices.Epay\WebService\USBank.vb`
- `Services\SAIF.Services.WebServices.Epay\WebService\AdminSingleSignOnData.vb`
- `Services\SAIF.Services.WebServices.Epay\WebService\wsCreditCardPayment.vb`