---
title: "Create a transaction plugin"
slug: "dpo-api-server-plugins-create-a-transaction-plugin"
updated: 2026-10-27T20:13:21Z
published: 2026-10-27T20:13:21Z
canonical: "docs.onespan.com/dpo-api-server-plugins-create-a-transaction-plugin"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a transaction plugin

The Transaction plugin stored in com.noknok.gateway.plugin.transaction.JWTTransactionManager is used in the API Server default configuration. A user-written custom transaction manager plugin must implement the ITransactionManager interface.

For information about building and deploying custom API Server plugins, see [Create a plugin](/dpoa/docs/s3suite94-create-a-custom-api-server-plugin-1).

## Interface

```java
package com.noknok.gateway.sdk;
        /**
        * This interface defines methods for generating transaction text and
        * performing post-transaction actions. Implementations should have a single
        * constructor with the following signature:
        * public MyTransactionManager(IConfigurationManager configurationManager,
        * String tenantID, String objectType);
        */
        public interface ITransactionManager {
        /**
        * The API Server calls this method on every INIT_AUTH/START_OOB_AUTH
        * operation before sending a request to the Auth Server. The implementation
        * should identify whether it is a transaction (for example, by checking for
        * transaction.id presence in the request) or an authentication operation.
        * If it is a transaction operation, the implementation should retrieve
        * the transaction text based on the given transaction.id and put the
        * transaction.text into jsonRequest to be sent to the Auth Server.
        * If the operation is not a transaction (instead it is an authentication),
        * the implementation should just return.
        * Parameters:
        * request - HTTP request from client.
        * jsonRequest - REST request from client to be sent to
        * Authentication Server (MFAS).
        * Throws:
        * BadRequestException - if the request is invalid.
        * InternalErrorException - if another error occurred.
        */
        void startTransaction​(javax.servlet.http.HttpServletRequest request,
        com.google.gson.JsonObject jsonRequest)
        /**
        * Called on every FINISH_AUTH/FINISH_OOB_AUTH/STATUS_OOB_AUTH operation
        * after receiving a response from the Auth Server. Implement any expected
        * behavior after the transaction operation such as removing DB entry
        * at failure.
        * Parameters:
        * response - HTTP response to client.
        * jsonResponse - REST response from Authentication Server (MFAS) to
        * be sent to the client.
        * Throws:
        * InternalErrorException - if another error occurred.
        */
        void finishTransaction​(javax.servlet.http.HttpServletResponse response,
        com.google.gson.JsonObject jsonResponse)
        }
```