Guides
Client Login
Start typing to search…

PaySecure API

This guide provides an overview of PaySecure and is useful with the following sections in the API reference:

PaySecure V1

PaySecure card Web services are used to provide end-to-end encryption for sharing sensitive information.

  • Information related to PAN/CVV2/PIN is sensitive and should not be available to any unauthenticated person.
    For this service, we will use RSA and AES algorithms.
  • RSA is an asymmetric key cryptography concept while Advanced Encryption Standard (AES) is a symmetric key cryptography concept.
  • With AES, the same private key is used for both encryption and decryption. While for RSA, we will use the public key to encrypt and the private key for decryption.
  • The RSA public key is provided to the client through email if the client wants to use Paysecure card services while associating with Paymentology and can be regenerated upon request.
  • AES-256 is used for this service. The AES key must be in base64 format. The padding used is the AES/CBC/PKCS5PADDING. Initially, the AES-256 key bit is used as a message for RSA and this message will be encrypted using an RSA public key.
  • The encrypted message will be set as a session id for the API; the API will then decrypt the session id to get the AES key. Then, using the AES key, we will encrypt sensitive information like CVV, PAN and PIN. Finally, the API will return the encrypted CVV, PAN and PIN to the end user.
  • The end user can decrypt the message using the same AES key and 16 bits initialization vector (IV) returned from the API. Hence, the sensitive information is transferred to the end user from the API using RSA and AES algorithms.

End-to-end Flow

When a Paymentology client is created, an associated RSA key is generated and shared with the Paymentology client.
The client can then safely pass this public key to the cardholders ( applications) so they can communicate securely with Paymentology systems without the client in the middle being able to decrypt that information.

Get PAN

Get PAN

Set PIN

Set PIN

Encryption and PIN Format

  • RSA Encryption will be used for asymmetric Encryption between Cardholders and Paymentology. This will prevent any intercept attacks and loss of sensitive data (for more info on RSA: https://www.baeldung.com/java-rsa)
  • AES 256 Encryption (AES/CBC/PKCS5PADDING) will be used for Encryption of the Sensitive data e.g. PIN, PAN, CVV2. this will be a random key generated for each call and shared under the RSA Key Pair, stronger than conventional Tripple DES algorithm.(<https://www.baeldung.com/java-aes-encryption-decryption
  • PIN BLOCK Format iso format 2 will be used to communicate the encrypted PIN block to and from the cardholder to Paymentology.

V1: SESSION-ID: RSA encryption for generating session ID (Java example)

  • Create a 32-character length random string: sessionKey
  • Encrypt sessionKey with rsaPublicKey: sessionId
String rsaPublicKey  = " ";

KeyGenerator keyGenerator = KeyGenerator.getInstance("AES");
keyGenerator.init(256); //key size defines AES encryption. Eg AES 256, AES 128, AES 192
SecretKey key = keyGenerator.generateKey();
String sessionKey = Base64.getEncoder().encodeToString(key.getEncoded());


AsymmetricCryptography ac = new AsymmetricCryptography();
PublicKey publicKey = ac.getPublickey(rsaPublicKey);


// session key has to be base64 encoded before encrypting with rsa public key
// This is the session-id that needs to be passed into header on api request
String sessionId = ac.encryptTextPublicKey(sessionKey, publicKey);

AsymmetricCryptography class reference

public class AsymmetricCryptography {

  private Cipher cipher;


  static {
    Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
  }


  public AsymmetricCryptography() throws NoSuchAlgorithmException, NoSuchPaddingException {
    this.cipher =Cipher.getInstance("RSA");
  }


  public PublicKey getPublickey(String base64) throws InvalidKeySpecException, NoSuchAlgorithmException {
    byte[] keyBytes = java.util.Base64.getDecoder().decode(base64);
    X509EncodedKeySpec spec = new X509EncodedKeySpec(keyBytes);
    KeyFactory kf = KeyFactory.getInstance("RSA");
    return kf.generatePublic(spec);
  }


  // session key has to be base64 encoded before encrypting with rsa public key
  public String encryptTextPublicKey(String sessionKey, PublicKey key) throws NoSuchAlgorithmException, NoSuchPaddingException, UnsupportedEncodingException,
      IllegalBlockSizeException, BadPaddingException, InvalidKeyException {
    this.cipher.init(Cipher.ENCRYPT_MODE, key);
    return Base64.encodeBase64String(cipher.doFinal(sessionKey.getBytes("UTF-8")));
  }
}

PIN/CVV encryption example

// IV generation
SecureRandom secureRandom = new SecureRandom();
byte[] iv = new byte[16];
secureRandom.nextBytes(iv);
IvParameterSpec IV = new IvParameterSpec(iv);
String iv_payload = new String(BASE64EncoderStream.encode(iv)); // The value is passed in request payload

byte[] decodedKey = Base64.getDecoder().decode(sessionKey); // Use session key generated at first step
SecretKey Aeskey = new SecretKeySpec(decodedKey, 0,  decodedKey.length, "AES");


String CVV2= "024";
// In case pin it should be pin block format.
// 246784FFFFFFFFFF
// 2 = ISO FORMAT, 4 = Pin length , 6784 = Actual pin, FFFFFFF = Padding
Cipher Aesecipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
Aesecipher.init(Cipher.ENCRYPT_MODE, Aeskey, IV);
byte[] utf8 = CVV2.getBytes("UTF8");
byte[] enc = Aesecipher.doFinal(utf8);
String CVV2_enc = new String(BASE64EncoderStream.encode(enc));// pass encrypted cvv2 in request

Decryption Example

String secret = "+AyrdXnhXhc=";  // encrypted cvv2 in response
String iv = "Xb6qbV2L6d1F92YU";  // IV value generated in payapi while decrypting cvv

Cipher Aesdcipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
byte[] iv1= Base64.getDecoder().decode(iv);
IvParameterSpec iv_spec = new IvParameterSpec(iv);
byte[] decodedKey = Base64.getDecoder().decode(sessionKey); // SESSION-KEY is the key generated at client side and passed during request i.e. 32 character random string
SecretKey Aeskey = new SecretKeySpec(decodedKey, 0, decodedKey.length, "AES");


// initialize the ciphers with the given key
Aesdcipher.init(Cipher.DECRYPT_MODE, Aeskey, iv_spec);
byte[] dec = BASE64DecoderStream.decode(secret.getBytes());
byte[] utf8 = Aesdcipher.doFinal(dec);
String decrypted_cvv2 = new String(utf8, "UTF8");   // Final decrypted cvv2

JavaScript example

//Required js
//https://cdnjs.cloudflare.com/ajax/libs/sjcl/1.0.8/sjcl.min.js
//https://cdnjs.cloudflare.com/ajax/libs/forge/1.3.1/forge.min.js

//Use sjcl.random to create session key in hex
//If hex string = 32 then AES 128 GCM used for encrypt/decrypt
//If hex string = 48 then AES 192 GCM used for encrypt/decrypt
//If hex string = 64 then AES 256 GCM used for encrypt/decrypt
let KeyPart1 = sjcl.codec.hex.fromBits(sjcl.random.randomWords(2, 0));
let KeyPart2 = sjcl.codec.hex.fromBits(sjcl.random.randomWords(2, 0));
let KeyPart3 = sjcl.codec.hex.fromBits(sjcl.random.randomWords(2, 0));
let KeyPart4 = sjcl.codec.hex.fromBits(sjcl.random.randomWords(2, 0));
let sessioKey = KeyPart1 + KeyPart2 + KeyPart3 + KeyPart4;
console.log("session-key - " + sessioKey);


// session key to be base64 encoded before encrypting with RSA public key
let b64map = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
let b64pad = "=";
let i;
let c;
let ret = " ";
for (i = 0; i + 3 <= sessioKey.length; i += 3) {
    c = parseInt(sessioKey.substring(i, i + 3), 16);
    ret += b64map.charAt(c >> 6) + b64map.charAt(c & 63);
}
if (i + 1 == sessioKey.length) {
    c = parseInt(sessioKey.substring(i, i + 1), 16);
    ret += b64map.charAt(c << 2);
}
else if (i + 2 == sessioKey.length) {
    c = parseInt(sessioKey.substring(i, i + 2), 16);
    ret += b64map.charAt(c >> 2) + b64map.charAt((c & 3) << 4);
}
while ((ret.length & 3) > 0) ret += b64pad;


console.log("base64 encoded session key - " + ret);


// RSA encryption to generate session idlet publicKey = forge.pki.publicKeyFromPem("-----BEGIN PUBLIC KEY-----" + "RSA PUBLIC" + "-----END PUBLIC KEY-----");
let buffer = forge.util.createBuffer(ret);
let binaryString = buffer.getBytes();
let encrypted = publicKey.encrypt(binaryString, 'RSA-OAEP', {
    md: forge.md.sha1.create(),
    mgf: forge.mgf.mgf1.create(forge.md.sha1.create())
});
console.log("Session-id - " + forge.util.encode64(encrypted));


// encrypt pin/cvv
let iv = forge.random.getBytesSync(16);
let key_bytes = forge.util.hexToBytes(sessioKey);


let cipher = forge.cipher.createCipher("AES-GCM", key_bytes);
cipher.start({ iv: iv });
cipher.update(forge.util.createBuffer("241432FFFFFFFFFF"));
cipher.finish();
let tag = cipher.mode.tag.data;
let encoded = cipher.output.data;
let encryptedPin = forge.util.encode64(encoded + tag);
console.log("EncryptedPin_TO_SEND_IN_REQUEST - " + encryptedPin);
console.log("IV_TO_SEND_IN REQUEST - " + forge.util.encode64(iv));


// decrypt pin
let iv_bytes = forge.util.createBuffer(forge.util.decode64(forge.util.encode64(iv))).getBytes();
let decryptedPinBase64 = forge.util.decode64(encryptedPin);


let tag_bytes = forge.random.getBytesSync(16);
let decipher = forge.cipher.createDecipher("AES-GCM", key_bytes);
decipher.start({
    iv: iv_bytes,
    tag: tag_bytes
});
decipher.update(forge.util.createBuffer(decryptedPinBase64));
decipher.finish();
let decryptedBytes = decipher.output.getBytes();
let decryptedPin = decryptedBytes.substr(0, decryptedBytes.length > 16 ? decryptedBytes.length - 16 : decryptedBytes.length);


console.log("Decrypted Pin - " + decryptedPin);

IV-vector key Generation

  • Create a 16 character length random string : IV_KEY.
  • Generate IV spec for the IV_KEY as below.
String IV_KEY = "Xb6qbV2L6d1F92YU"; // pass as iv in request to api
IvParameterSpec IV = new IvParameterSpec(IV_KEY.getBytes("UTF-8"));

Encryption Example

byte[] decodedKey = Base64.getDecoder().decode(SESSION_KEY);  // use 32 characters session key generated at first step
 SecretKey Aeskey = new SecretKeySpec(decodedKey, 0, decodedKey.length, "AES");

 String CVV2= "024";
 Cipher Aesecipher = Cipher.getInstance("AES/CBC/PKCS5PADDING");
 Aesecipher.init(Cipher.ENCRYPT_MODE, Aeskey, IV);
 byte[] utf8 = CVV2.getBytes("UTF8");
 byte[] enc = Aesecipher.doFinal(utf8);
 String CVV2_enc = Base64.getEncoder().encodeToString(enc);  // pass encrypted cvv2 in request

PaySecure V1 API endpoints

You can view all PaySecure V1 endpoints, their specifications and try them out through the links below:

  • Get CVV2 - allows to get CVV2 for a card/token.
  • Get PAN - allows to get the PAN for a card/token.
  • Get PIN - allows to get the PIN for a card/token.
  • PAN To Token - allows to get token for the provided PAN.
  • Set PIN - allows set pin for a card/token.
  • Verify PIN - allows to verify the PIN for the provided PAN.

These endpoints are all located under PaySecure V1 of our API Explorer.

PaySecure V2

RSA encryption is used to generate a session id that will be used to authenticate requests between Paymentology and the cardholder. The generated session id should be passed in api header.

AES encryption (AES/GCM/NoPadding) will be used for encrypting sensitive data e.g. PIN, pan, CVV as a part of the API response in V2 PaySecure Web Services. And corresponding AES decryption to be used client side for response decryption. Random key (session key) should be generated for each API request and shared under the RSA key pair that is considered stronger than conventional triple DES algorithm (https://simple.wikipedia.org/wiki/Advanced_Encryption_Standard)

Depending upon size of session key (that client generates from their end) used to encrypt with the RSA public key, the encryption could be:

  • 256 bits key represent AES 256
  • 192 bits key represent AES 192
  • 128 bits key represent AES 128

Version 2 is more secure in terms of

  • AES/GCM/NoPadding mode
  • SecureRandom way to generate IV in api side for creating encrypted response

PIN Format

Difference between V1 and V2

  • Secure Initialization Vector (IV): **In V2, a secure random method is used to generate the initialization vector (IV) for the encryption of the API response. This ensures that the IV is unpredictable, making it harder for attackers to mount a successful attack.
  • Stronger AES Algorithm: **In V2, AES/GCM/NoPadding is used for encryption of sensitive data, which is a stronger algorithm than the AES/CBC/PKCS5PADDING used in V1. AES/GCM/NoPadding offers better authentication and integrity checks and is less susceptible to attacks like padding oracle attacks.
  • V2 uses RSA/None/OAEPWithSHA-1AndMGF1Padding for session ID generation, which is a more secure option than the RSA used in V1.

V2: SESSION-ID: RSA encryption for generating session ID (Java example)

  • Create a 32-character length random string: sessionKey
  • Encrypt sessionKey with rsaPublicKey: sessionId
String rsaPublicKey = "";

KeyGenerator keyGenerator = KeyGenerator.getInstance("AES");
keyGenerator.init(256); // key size defines AES encryption. Eg AES 256, AES 128, AES 192
SecretKey key = keyGenerator.generateKey();
String sessionKey= Base64.getEncoder().encodeToString(key.getEncoded());

AsymmetricCryptography ac = new AsymmetricCryptography();
PublicKey publicKey = ac.getPublickey(rsaPublicKey);

// session key has to be base64 encoded before encrypting with rsa public key
// This is the session-id that needs to be passed into header on api request
String sessionId = ac.encryptTextPublicKey(sessionKey, publicKey);

AsymmetricCryptography class reference

public class AsymmetricCryptography {

  private Cipher cipher;
 
  static {
    Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
  }

  public AsymmetricCryptography() throws NoSuchAlgorithmException, NoSuchPaddingException {
    this.cipher =Cipher.getInstance("RSA/None/OAEPWithSHA-1AndMGF1Padding", BouncyCastleProvider.PROVIDER_NAME);
  }
  
  public PublicKey getPublickey(String base64)
      throws InvalidKeySpecException, NoSuchAlgorithmException {
    byte[] keyBytes = java.util.Base64.getDecoder().decode(base64);
    X509EncodedKeySpec spec = new X509EncodedKeySpec(keyBytes);
    KeyFactory kf = KeyFactory.getInstance("RSA");
    return kf.generatePublic(spec);
  }
  
  // session key has to be base64 encoded before encrypting with rsa public key
  public String encryptTextPublicKey(String sessionKey, PublicKey key)
      throws NoSuchAlgorithmException, NoSuchPaddingException, UnsupportedEncodingException,
          IllegalBlockSizeException, BadPaddingException, InvalidKeyException {
    this.cipher.init(Cipher.ENCRYPT_MODE, key);
    return Base64.encodeBase64String(cipher.doFinal(sessionKey.getBytes("UTF-8")));
  }
}

PIN/CVV encryption example

 // IV generation
SecureRandom secureRandom = new SecureRandom();
byte[] iv = new byte[16];
secureRandom.nextBytes(iv);
IvParameterSpec IV = new IvParameterSpec(iv);
String iv_payload = new String(BASE64EncoderStream.encode(iv)); // The value is passed in request payload

byte[] decodedKey = Base64.getDecoder().decode(sessionKey); // Use session key generated at first step
SecretKey Aeskey = new SecretKeySpec(decodedKey, 0,  decodedKey.length, "AES");

String CVV2= "024";
// In case pin it should be pin block format. 
// 246784FFFFFFFFFF
// 2 = ISO FORMAT, 4 = Pin length , 6784 = Actual pin, FFFFFFF = Padding
Cipher Aesecipher = Cipher.getInstance("AES/GCM/NoPadding");
Aesecipher.init(Cipher.ENCRYPT_MODE, Aeskey, IV);
byte[] utf8 = CVV2.getBytes("UTF8");
byte[] enc = Aesecipher.doFinal(utf8);
String CVV2_enc = new String(BASE64EncoderStream.encode(enc));// pass encrypted cvv2 in request

Decryption Example

String secret = "+AyrdXnhXhc=";  // encrypted cvv2 in response
String iv = "Xb6qbV2L6d1F92YU";  // IV value generated in payapi while decrypting cvv

Cipher Aesdcipher = Cipher.getInstance("AES/GCM/NoPadding");
byte[] iv1= Base64.getDecoder().decode(iv);
IvParameterSpec iv_spec = new IvParameterSpec(iv);
byte[] decodedKey = Base64.getDecoder().decode(sessionKey); // SESSION-KEY is the key generated at client side and passed during request i.e. 32 character random string
SecretKey Aeskey = new SecretKeySpec(decodedKey, 0, decodedKey.length, "AES");

// initialize the ciphers with the given key
Aesdcipher.init(Cipher.DECRYPT_MODE, Aeskey, iv_spec);
byte[] dec = BASE64DecoderStream.decode(secret.getBytes());

byte[] utf8 = Aesdcipher.doFinal(dec);

String decrypted_cvv2 = new String(utf8, "UTF8");   // Final decrypted cvv2

JavaScript example

//Required js
//https://cdnjs.cloudflare.com/ajax/libs/sjcl/1.0.8/sjcl.min.js
//https://cdnjs.cloudflare.com/ajax/libs/forge/1.3.1/forge.min.js

//Use sjcl.random to create session key in hex
//If hex string = 32 then AES 128 GCM used for encryp/decrypt
//If hex string = 48 then AES 192 GCM used for encryp/decrypt
//If hex string = 64 then AES 256 GCM used for encryp/decrypt
let KeyPart1 = sjcl.codec.hex.fromBits(sjcl.random.randomWords(2, 0));
let KeyPart2 = sjcl.codec.hex.fromBits(sjcl.random.randomWords(2, 0));
let KeyPart3 = sjcl.codec.hex.fromBits(sjcl.random.randomWords(2, 0));
let KeyPart4 = sjcl.codec.hex.fromBits(sjcl.random.randomWords(2, 0));
let sessioKey = KeyPart1 + KeyPart2 + KeyPart3 + KeyPart4;
console.log("session-key - " + sessioKey);

// session key to be base64 encoded before encrypting with RSA public key
let b64map = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
let b64pad = "=";
let i;
let c;
let ret = "";
for (i = 0; i + 3 <= sessioKey.length; i += 3) {
    c = parseInt(sessioKey.substring(i, i + 3), 16);
    ret += b64map.charAt(c >> 6) + b64map.charAt(c & 63);
}
if (i + 1 == sessioKey.length) {
    c = parseInt(sessioKey.substring(i, i + 1), 16);
    ret += b64map.charAt(c << 2);
}
else if (i + 2 == sessioKey.length) {
    c = parseInt(sessioKey.substring(i, i + 2), 16);
    ret += b64map.charAt(c >> 2) + b64map.charAt((c & 3) << 4);
}
while ((ret.length & 3) > 0) ret += b64pad;

console.log("base64 encoded session key - " + ret);



// RSA encryption to generate session id
let publicKey = forge.pki.publicKeyFromPem("-----BEGIN PUBLIC KEY-----" + "RSA PUBLIC" + "-----END PUBLIC KEY-----");
let buffer = forge.util.createBuffer(ret);
let binaryString = buffer.getBytes();
let encrypted = publicKey.encrypt(binaryString, 'RSA-OAEP', {
    md: forge.md.sha1.create(),
    mgf: forge.mgf.mgf1.create(forge.md.sha1.create())
});
console.log("Session-id - " + forge.util.encode64(encrypted));


// encrypt pin/cvv
let iv = forge.random.getBytesSync(16);
let key_bytes = forge.util.hexToBytes(sessioKey);

let cipher = forge.cipher.createCipher("AES-GCM", key_bytes);
cipher.start({ iv: iv });
cipher.update(forge.util.createBuffer("241432FFFFFFFFFF"));
cipher.finish();
let tag = cipher.mode.tag.data;
let encoded = cipher.output.data;
let encryptedPin = forge.util.encode64(encoded + tag);
console.log("EncryptedPin_TO_SEND_IN_REQUEST - " + encryptedPin);
console.log("IV_TO_SEND_IN REQUEST - " + forge.util.encode64(iv));


// decrypt pin
let iv_bytes = forge.util.createBuffer(forge.util.decode64(forge.util.encode64(iv))).getBytes();
let decryptedPinBase64 = forge.util.decode64(encryptedPin);

let tag_bytes = forge.random.getBytesSync(16);
let decipher = forge.cipher.createDecipher("AES-GCM", key_bytes);
decipher.start({
    iv: iv_bytes,
    tag: tag_bytes
});
decipher.update(forge.util.createBuffer(decryptedPinBase64));
decipher.finish();
let decryptedBytes = decipher.output.getBytes();
let decryptedPin = decryptedBytes.substr(0, decryptedBytes.length > 16 ? decryptedBytes.length - 16 : decryptedBytes.length);

console.log("Decrypted Pin - " + decryptedPin);

IV-vector key Generation

  • Create a byte array of 16 character length : IV_KEY.
  • Generate IV spec for the IV_KEY as below:
byte[] iv = new byte[16];
secureRandom.nextBytes(iv);
IvParameterSpec IV = new IvParameterSpec(iv);

Encryption Example

import java.io.UnsupportedEncodingException;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.security.Security;
import java.util.Base64;
import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.SecretKey;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import org.bouncycastle.jce.provider.BouncyCastleProvider;

public class Aes {
    static {
        Security.addProvider(new BouncyCastleProvider());
    }

    public static void encrypt(String msg, String key) {
        SecureRandom secureRandom = new SecureRandom();
        try {
            byte[] iv = new byte[16];
            secureRandom.nextBytes(iv);
            System.out.println("iv: "+ Base64.getEncoder().encodeToString(iv));
            IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);

            Cipher cipher;
            byte[] decodedKey = Base64.getDecoder().decode(key);
            SecretKey secretKey = new SecretKeySpec(decodedKey, "AES");
            cipher = Cipher.getInstance("AES/GCM/NoPadding");
            cipher.init(Cipher.ENCRYPT_MODE, secretKey, ivParameterSpec);
            byte[] utf8 = msg.getBytes("UTF-8");
            byte[] enc = cipher.doFinal(utf8);
           System.out.println("encrypted:"+ Base64.getEncoder().encodeToString(enc));

        } catch (NoSuchAlgorithmException e) {
         e.printStackTrace();
        } catch (NoSuchPaddingException e) {
            e.printStackTrace();
        } catch (InvalidKeyException e) {
            e.printStackTrace();
        } catch (InvalidAlgorithmParameterException e) {
            e.printStackTrace();
        } catch (IllegalBlockSizeException e) {
            e.printStackTrace();
        } catch (BadPaddingException e) {
            e.printStackTrace();
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
        }
        catch (IllegalArgumentException e){
            e.printStackTrace();
        }
    }
}

PaySecure V2 API endpoints

You can view all PaySecure V2 endpoints, their specifications and try them out through the links below:

These endpoints are all located under PaySecure V2 of our API Explorer.

PaySecure V3 API endpoints

You can view all PaySecure V3 endpoints, their specifications and try them out through the links below:

These endpoints are all located under PaySecure V3 of our API Explorer.

❕

PaySecure V3 uses the same security protocols as PaySecure V2

Updated 5 months ago