Device Binding

Delete Device Binding

delete

Delete the binding between a device and a token.

Path parameters

tokenIdstring · max: 128Required

The token identifier.

deviceIdstring · max: 36Required

The unique device identifier. Visa deviceId must have 24 characters at maximum.

Header parameters

authorizationstring · min: 1 · max: 512Required

Technical identifier pre-defined at on-boarding that identifies the API consumer. Format shall be the string 'APIKEY' followed by a space and the api key value.
Example: APIKEY c03f88fe-01ba-11e8-ba89-0ed5f89f718b

x-correlation-idstring · min: 1 · max: 36Required

Technical identifier used for troubleshooting.
It helps on customer support when needed.
Each API request must be identified with a unique correlation Id.
It correlates the response and the request and eventually a notification if any.

mcCertifiedSolutionIdstring · min: 1 · max: 128Optional

Unique identifier of the Mastercard TAF certified MFA method. Must be provided for Mastercard TAF when the binding was created using the Merchant API.

credentialIdstring · min: 1 · max: 128Optional

The identifier used during Mastercard TAF binding, must be provided for Mastercard TAF when the binding was created using the Merchant API.

Responses

204

No Content

No content

400

Bad request - Not Retryable

401

Unauthorized - Not Retryable

404

Not Found - Not Retryable

429

Too Many Requests - Retryable

500

Internal Server Error - Not Retryable

503

Service Unavailable - Retryable

delete/device-bindings/{tokenId}/{deviceId}

HTTPcURLJavaScriptPython

DELETE /tsh-cof/device-bindings/{tokenId}/{deviceId} HTTP/1.1
Host: thales.api.com
authorization: text
x-correlation-id: text
Accept: */*

No content

Create Binding

post

Binds a token with a FIDO authenticator as per Mastercard TAF.

Header parameters

authorizationstring · min: 1 · max: 512Required

Technical identifier pre-defined at on-boarding that identifies the API consumer. Format shall be the string 'APIKEY' followed by a space and the api key value.
Example: APIKEY c03f88fe-01ba-11e8-ba89-0ed5f89f718b

x-correlation-idstring · min: 1 · max: 36Required

Technical identifier used for troubleshooting.
It helps on customer support when needed.
Each API request must be identified with a unique correlation Id.
It correlates the response and the request and eventually a notification if any.

Body

application/json

tokenIdstring · min: 1 · max: 128Required

The token identifier.

Pattern: ^[a-zA-Z0-9_-]+$

bindingTypestring · enum · max: 64Required

The request content depends on the binding type.

Example: MASTERCARD_TAF_FIDO_IAAVPossible values:

Responses

204

No Content

No content

400

Bad request - Not Retryable

application/json

401

Unauthorized - Not Retryable

404

Not Found - Not Retryable

429

Too Many Requests - Retryable

500

Internal Server Error - Not Retryable

503

Service Unavailable - Retryable

post/device-bindings

HTTPcURLJavaScriptPython

POST /tsh-cof/device-bindings HTTP/1.1
Host: thales.api.com
authorization: text
x-correlation-id: text
Content-Type: application/json
Accept: */*
Content-Length: 863

{
  "tokenId": "COFTG-M-ce464906-cf39-4990-b4a8-c160e67c603a",
  "bindingType": "MASTERCARD_TAF_FIDO_IAAV",
  "MASTERCARD_TAF_FIDO_IAAV": {
    "mcCertifiedSolutionId": "43SA5",
    "credentialId": "bf8c5b2b-28ce-48d8-acbc-cc82f51478c6",
    "deviceId": "1234567890",
    "fidoRelyingParty": "relyingparty.com",
    "fidoUserId": "ca7ac6fe-1eec-11ed-861d-0242ac120002",
    "isSpcEnabled": false,
    "fidoRegistrationResponse": {
      "type": "public-key",
      "id": "h0mC9xtLjggpcvxq4YXepkemUt2oNL5F_-NPpCCcHNE",
      "rawId": "h0mC9xtLjggpcvxq4YXepkemUt2oNL5F_-NPpCCcHNE",
      "authenticatorAttachment": "platform",
      "response": {
        "clientDataJSON": "Base64 encoded string",
        "authenticatorData": "Base64 encoded string",
        "signature": "Base64 encoded string",
        "userHandle": "ca7ac6fe-1eec-11ed-861d-0242ac120002"
      }
    },
    "mcIaav": "Base64 Encoded IAAV",
    "verificationTimestamp": "'2025-07-01T10:25:11.142Z",
    "mcBindingAssertion": "Mastercard bindingAssertionJWT"
  }
}

No content