The Donation API allows processing of credit card online donations online, and logging of donations processed offline. The donation API methods operate on "Donations 2" (not "Donations Classic") shadow donation forms.
The donate method, used to process online credit card donations, supports only Client API calls. To maintain PCI data security standards for credit card transactions, you must call this method directly from the client's browser and never proxy the call through an external server.
Tip: To protect against activity such as carding runs, enable fraud protection on the Blackbaud Merchant Services or Payflow Pro gateway. However, if you use the TeamRaiser integration with Facebook Fundraiser, do not select the option to reject transactions when the country of the card's BIN doesn't match the IP country address, or transactions will fail.
The addOfflineDonation and refundOfflineDonation methods record monetary transactions processed outside the Luminate Online system. These methods provide only Server APIs and are accessible only to white-listed servers. You must create an API Administrator account to call these methods and assign it to an Administrative Security Group having appropriate permissions of the "Offline Donation API" permission type. The built-in "API Administrators" group does not have "Offline Donation API" permissions by default. If these APIs will be used by a third-party payment processor to record transactions on your site, you should limit the permissions on the accounts you create for that purpose, and not grant additional permissions by assigning these accounts to the "API Administrators" group.