In this case the Merchant, as an organization rather than as a role, would need to be supported by an HTTP client. If a secure connection is required or desired a secure channel that both the HTTP Server and Client support MUST be used. In most environments, the consumer agent will initially be an HTML browser. This message is a stand-in for a request message of some form and the Merchant Server will respond with the first IOTP Message in the form of an XML document. At this point, the IOTP client will be started and have the first message.
IOTP messages are short-lived.
POST responses are not cached. The way in which the data is copied depends on the IOTP Transaction. The data MUST be retained until the end of the transaction, whether by success, failure, or cancelation, and as long thereafter as it is desired for any of the parties to inquire into it. The HTTP client MUST perform full HTTP POST requests. On failure due to time out, treat as an error above.