Operations

Different operations that can be done on a card.

Resume

post

https://api.d1.thalescloud.io/banking/v1https://api.d1-stg.thalescloud.io/banking/v1

/issuers/{issuerId}/cards/{cardId}/operations:resume

This request is used by the issuer backend to request the reactivation of a card that has been suspended.

This operation is only applicable to the card, and needs to be consistent with the other states. For instance, it's useless/forbidden to resume a card from a deactivated end user.

For registered cards that are managed directly by the issuer, the issuer has the responsability to call the processor first then D1 to make sure the states are always synched.

Note: It cannot be used to activate a physical card for the very first time. For that, please refer to activatePhysicalCard

Autorizaciones

bearerAuth

AuthorizationstringRequerido

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Parámetros de ruta

issuerIdstring · mín: 10 · máx: 10Requerido

The id of the issuer

cardIdstring · mín: 1 · máx: 48Requerido

Unique identifier of the card.

Pattern: [A-Za-z0-9_-]{1,48}

Parámetros de encabezado

x-correlation-idstring · mín: 1 · máx: 64Opcional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for purposes other than logging and troubleshooting.

Pattern: [a-zA-Z0-9_\-\. ]{1,64}

Cuerpo

application/json

reasonstringOpcional

The reason why the action is performed.

This a free text field in case the Issuer wants to send details, that will be returned in the operations list.

Example: customer was contacted on June 28Pattern: ^[a-zA-Z0-9 ]{1,64}$

reasonCodestring · enumOpcional

The reason why the action has been performed. If not provided, default reason code is ISSUER_DECISION.

Valores posibles:

Respuestas

200

Card resumed successfully

application/json

Operation result information.

operationIdstring · mín: 1 · máx: 64Opcional

Unique identifier of the operation

Pattern: [A-Za-z0-9_-]{1,64}

statusstring · enumOpcional

Status of the operation

Valores posibles:

400

Bad Request, Invalid request URI or header, or unsupported nonstandard parameter

application/json

401

The provided Authorization header is missing or invalid

application/json

403

Forbidden operation. Check the state of the end user (consumer) is ACTIVE.

After a migration done from D1 V1 APIs to D1 V2 APIs a 403 may be returned if

• The reasonCode provided is not allowed. Check the card status, or set the reason code to ISSUER_DECISION

application/json

404

Card not found.

application/json

500

Internal Server Error

application/json

post

/issuers/{issuerId}/cards/{cardId}/operations:resume

HTTPcURLJavaScriptPython

POST /banking/v1/issuers/{issuerId}/cards/{cardId}/operations:resume HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 77

{
  "reason": "customer was contacted on June 28",
  "reasonCode": "ISSUER_DECISION"
}

{
  "operationId": "text",
  "status": "SUCCESSFUL"
}

Suspend

post

https://api.d1.thalescloud.io/banking/v1https://api.d1-stg.thalescloud.io/banking/v1

/issuers/{issuerId}/cards/{cardId}/operations:suspend

This request is used by the issuer backend to request the deactivation of a card that has been lost for instance.

For registered cards that are managed directly by the issuer, the issuer has the responsability to call the processor first then D1 to make sure the states are always synched.

Autorizaciones

bearerAuth

AuthorizationstringRequerido

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Parámetros de ruta

issuerIdstring · mín: 10 · máx: 10Requerido

The id of the issuer

cardIdstring · mín: 1 · máx: 48Requerido

Unique identifier of the card.

Pattern: [A-Za-z0-9_-]{1,48}

Parámetros de encabezado

x-correlation-idstring · mín: 1 · máx: 64Opcional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for purposes other than logging and troubleshooting.

Pattern: [a-zA-Z0-9_\-\. ]{1,64}

Cuerpo

application/json

reasonstringOpcional

The reason why the action is performed.

This a free text field in case the Issuer wants to send details, that will be returned in the operations list.

Example: customer was contacted on June 28Pattern: ^[a-zA-Z0-9 ]{1,64}$

reasonCodestring · enumOpcional

The reason why the action has been performed. If not provided, default reason code is ISSUER_DECISION.

Valores posibles:

Respuestas

200

Card was suspended successfully

application/json

Operation result information.

operationIdstring · mín: 1 · máx: 64Opcional

Unique identifier of the operation

Pattern: [A-Za-z0-9_-]{1,64}

statusstring · enumOpcional

Status of the operation

Valores posibles:

400

Bad Request, Invalid request URI or header, or unsupported nonstandard parameter

application/json

401

The provided Authorization header is missing or invalid

application/json

403

After a migration done from D1 V1 APIs to D1 V2 APIs a 403 may be returned if

• The reasonCode provided is not allowed. Check the card status, or set the reason code to ISSUER_DECISION

application/json

404

Card not found.

application/json

500

Internal Server Error

application/json

post

/issuers/{issuerId}/cards/{cardId}/operations:suspend

HTTPcURLJavaScriptPython

POST /banking/v1/issuers/{issuerId}/cards/{cardId}/operations:suspend HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 77

{
  "reason": "customer was contacted on June 28",
  "reasonCode": "ISSUER_DECISION"
}

{
  "operationId": "text",
  "status": "SUCCESSFUL"
}

Delete

post

https://api.d1.thalescloud.io/banking/v1https://api.d1-stg.thalescloud.io/banking/v1

/issuers/{issuerId}/cards/{cardId}/operations:delete

This request is used by the issuer backend to request the deletion of a card.

Note: The deletion of the card cannot be reversed. In the case of lost cards, consider using the Suspend operation first.

Autorizaciones

bearerAuth

AuthorizationstringRequerido

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Parámetros de ruta

issuerIdstring · mín: 10 · máx: 10Requerido

The id of the issuer

cardIdstring · mín: 1 · máx: 48Requerido

Unique identifier of the card.

Pattern: [A-Za-z0-9_-]{1,48}

Parámetros de encabezado

x-correlation-idstring · mín: 1 · máx: 64Opcional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for purposes other than logging and troubleshooting.

Pattern: [a-zA-Z0-9_\-\. ]{1,64}

Cuerpo

application/json

reasonstringOpcional

The reason why the action is performed.

This a free text field in case the Issuer wants to send details, that will be returned in the operations list.

Example: customer was contacted on June 28Pattern: ^[a-zA-Z0-9 ]{1,64}$

reasonCodestring · enumOpcional

The reason why the action has been performed. If not provided, default reason code is ISSUER_DECISION.

Valores posibles:

Respuestas

200

Card was deleted successfully

application/json

Operation result information.

operationIdstring · mín: 1 · máx: 64Opcional

Unique identifier of the operation

Pattern: [A-Za-z0-9_-]{1,64}

statusstring · enumOpcional

Status of the operation

Valores posibles:

400

Bad Request, Invalid request URI or header, or unsupported nonstandard parameter

application/json

401

The provided Authorization header is missing or invalid

application/json

403

After a migration done from D1 V1 APIs to D1 V2 APIs a 403 may be returned if

• The reasonCode provided is not allowed. Check the card status, or set the reason code to ISSUER_DECISION

404

Resource not found, Unknown issuerId or consumerId or accountId

application/json

500

Internal Server Error

application/json

post

/issuers/{issuerId}/cards/{cardId}/operations:delete

HTTPcURLJavaScriptPython

POST /banking/v1/issuers/{issuerId}/cards/{cardId}/operations:delete HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 77

{
  "reason": "customer was contacted on June 28",
  "reasonCode": "ISSUER_DECISION"
}

{
  "operationId": "text",
  "status": "SUCCESSFUL"
}

Renew

post

https://api.d1.thalescloud.io/banking/v1https://api.d1-stg.thalescloud.io/banking/v1

/issuers/{issuerId}/cards/{cardId}/operations:renew

This request is used by the issuer backend to renew/replace an existing card after card expiration or card loss.

The 'newCardId' is used by D1 to fetch the new PAN and/or new expiry date to be updated from the CMS if those information are not provided in encryptedData parameter.

Limitation: Card product update is currently not supported.

Autorizaciones

bearerAuth

AuthorizationstringRequerido

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Parámetros de ruta

issuerIdstring · mín: 10 · máx: 10Requerido

The id of the issuer

cardIdstring · mín: 1 · máx: 48Requerido

Unique identifier of the card.

Pattern: [A-Za-z0-9_-]{1,48}

Parámetros de encabezado

x-correlation-idstring · mín: 1 · máx: 64Opcional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for purposes other than logging and troubleshooting.

Pattern: [a-zA-Z0-9_\-\. ]{1,64}

Cuerpo

application/json

newCardIdstring · mín: 1 · máx: 48Requerido

Unique identifier of the card.

Pattern: [A-Za-z0-9_-]{1,48}

newCardProductIdstring · mín: 1 · máx: 48Opcional

Reserved for future use; card product update is currently not supported.

Pattern: [A-Za-z0-9_-]{1,48}

newCardStatestring · enumRequerido

New state of the card after renew

Valores posibles:

encryptedDatastring · máx: 8192Opcional

The encryptedData is the encrypted json (cf http://www.json.org/ ) representation of the new card information.
This field is mandatory for AMEX cards and optional information for all the other schemes, if not provided Thales will call get card credentials API to retrieve the data.
This value is encrypted using the JWE encryption (please refer to the Encrypt sensitive data for more details)

Content

Once deciphered, the plaintext contains a json structure with:

JSON field parameter name	description	MOC	Format
pan	The funding pan value.	M	string - from 10 to 19 digits
exp	The expiry date of the card.	M	string - 4 digits, following the format MMYY
psn	PAN Sequence number.	O	string - 2 digits (only applicable to AMEX scheme)
auxiliaryPan	The auxiliary funding pan value. It shall be provided when cobadge is supported and if the card has an auxiliary pan.	C	string - up to 19 digits
auxiliaryExp	The auxiliary expiry date of the card. It shall be provided when cobadge is supported and if the card has an auxiliary pan.	C	string - 4 digits, following the format MMYY

Example: encryptedData with card pan and card expPattern: ^(?:[\x20-\x2D\x2F-\x7F]*\.){4}(?:[\x20-\x2D\x2F-\x7F]*)$

reasonstringOpcional

The reason why the action is performed.

This a free text field in case the Issuer wants to send details, that will be returned in the operations list.

Example: customer was contacted on June 28Pattern: ^[a-zA-Z0-9 ]{1,64}$

reasonCodestring · enumOpcional

The reason why the action has been performed. If not provided, default reason code is ISSUER_DECISION.

Valores posibles:

Respuestas

200

Card was renewed successfully

application/json

Operation result information.

operationIdstring · mín: 1 · máx: 64Opcional

Unique identifier of the operation

Pattern: [A-Za-z0-9_-]{1,64}

statusstring · enumOpcional

Status of the operation

Valores posibles:

400

Bad Request, Invalid request URI or header, or unsupported nonstandard parameter

application/json

401

The provided Authorization header is missing or invalid

application/json

403

Forbidden action, that can be blocked for different reasons:

• end user (consumer) state shall be active,
• in case the new card was already registered, check that the 2 cards belong to the same end user (consumer),
• in case the new card was already registered, check that the new and old cards are linked to the same CardProductId.

After a migration done from D1 V1 APIs to D1 V2 APIs a 403 may be returned if

• The newCardId provided in the payload is equal to the cardId but the card PAN has been updated. When PAN needs to be updated, the V2 replace API should be called.
• The newCardId provided in the payload is not equal to the cardId but the card PAN is still the same. When a card expiry date update without PAN update is required, the V2 renew API should be called.
• The newCardId provided in the payload is not equal to the cardId but the state passed is INACTIVE. When a state INACTIVE is required, the V2 suspend API should be called after a renew v1 with ACTIVE.
• The reasonCode provided in the payload is not allowed. Check the card status, or set the reason code to ISSUER_DECISION

application/json

404

Card not found.

application/json

500

Internal Server Error

application/json

post

/issuers/{issuerId}/cards/{cardId}/operations:renew

HTTPcURLJavaScriptPython

POST /banking/v1/issuers/{issuerId}/cards/{cardId}/operations:renew HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 205

{
  "newCardId": "text",
  "newCardProductId": "text",
  "newCardState": "ACTIVE",
  "encryptedData": "encryptedData with card pan and card exp",
  "reason": "customer was contacted on June 28",
  "reasonCode": "ISSUER_DECISION"
}

{
  "operationId": "text",
  "status": "SUCCESSFUL"
}

Get all operations

get

https://api.d1.thalescloud.io/banking/v1https://api.d1-stg.thalescloud.io/banking/v1

/issuers/{issuerId}/cards/{cardId}/operations

This request is used by the issuer backend to retrieve all operations related to a card. The API specifies the starting point (offset) and the number of operations (limit) to be retrieved. Offset 0 (the default) corresponds to the most recent operation. For example a limit of 5 and an offset of 2 would return the five most recent operations before the most recent two”.

If no operations are available for the given cardId, an empty list is returned.

Operations that are older than 3 months are removed.

Autorizaciones

bearerAuth

AuthorizationstringRequerido

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Parámetros de ruta

issuerIdstring · mín: 10 · máx: 10Requerido

The id of the issuer

cardIdstring · mín: 1 · máx: 48Requerido

Unique identifier of the card.

Pattern: [A-Za-z0-9_-]{1,48}

Parámetros de consulta

offsetintegerOpcional

Index from which the query starts returning operations – Offset 0 (the default) corresponds to the most recent operation.

limitinteger · mín: 1 · máx: 50Opcional

Number of operations to be returned

Default: 10

Parámetros de encabezado

x-correlation-idstring · mín: 1 · máx: 64Opcional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for purposes other than logging and troubleshooting.

Pattern: [a-zA-Z0-9_\-\. ]{1,64}

Respuestas

200

OK

application/json

remainingOperationsintegerOpcional

400

Bad Request, Invalid request URI or header, or unsupported non-standard parameter

application/json

401

The provided Authorization header is missing or invalid

application/json

404

Ressource not found, Unknown issuerId or consumerId or card id'. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
UNKNOWN_CARD	-	no	Unknown cardId

application/json

500

Internal Server Error

application/json

get

/issuers/{issuerId}/cards/{cardId}/operations

HTTPcURLJavaScriptPython

GET /banking/v1/issuers/{issuerId}/cards/{cardId}/operations HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "operations": [
    {
      "operationId": "text",
      "operation": "ACTIVATE",
      "status": "SUCCESSFUL",
      "startTime": "2022-06-16T06:28:02.492Z",
      "endTime": "2022-06-16T06:28:32.492Z",
      "requestorType": "ISSUER",
      "requestorId": "text",
      "reason": "customer was contacted on June 28",
      "reasonCode": "USER_DECISION",
      "details": {
        "sdkType": "APP"
      },
      "errorCode": "text",
      "error": "text"
    }
  ],
  "remainingOperations": 1
}

Get operation

get

https://api.d1.thalescloud.io/banking/v1https://api.d1-stg.thalescloud.io/banking/v1

/issuers/{issuerId}/cards/{cardId}/operations/{operationId}

This request is used by the issuer backend to retrieve the information related to an operation on a card.

Operations older than 3 months are removed.

Autorizaciones

bearerAuth

AuthorizationstringRequerido

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Parámetros de ruta

issuerIdstring · mín: 10 · máx: 10Requerido

The id of the issuer

cardIdstring · mín: 1 · máx: 48Requerido

Unique identifier of the card.

Pattern: [A-Za-z0-9_-]{1,48}

operationIdstring · mín: 1 · máx: 64Requerido

Unique identifier of the operation

Pattern: [A-Za-z0-9_-]{1,64}

Parámetros de consulta

digitalCardInfobooleanOpcional

Flag indicating whether digital card details (including the device data used to digitize and the requestor data) should be provided in the response. Only applicable to DIGITIZE Operations

Default: false

Parámetros de encabezado

x-correlation-idstring · mín: 1 · máx: 64Opcional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for purposes other than logging and troubleshooting.

Pattern: [a-zA-Z0-9_\-\. ]{1,64}

Respuestas

200

OK

application/json

Operation details related to a specific operationId in GetCardOperation API

operationIdstring · mín: 1 · máx: 64Requerido

Unique identifier of the operation

Pattern: [A-Za-z0-9_-]{1,64}

operationstring · enumRequerido

The operation type.

Valores posibles:

statusstring · enumRequerido

Status of the operation

Valores posibles:

startTimestring · mín: 1 · máx: 64Requerido

The time the request has been processed. Format ISO 8601 YYYY-MM-DDThh:mm:ssTZD

Example: 2022-06-16T06:28:02.492Z

endTimestring · mín: 1 · máx: 64Opcional

The time the operation has been completed. Format ISO 8601 YYYY-MM-DDThh:mm:ssTZD note: This is an optional field and might not be returned for synchronous operations.

Example: 2022-06-16T06:28:32.492Z

requestorTypestring · enumRequeridoValores posibles:

requestorIdstringRequerido

Identifier of the principal who initiates the operation

• consumerId if requestorType is USER
• issuerId if requestorType is ISSUER
• cci user id if requestorType is CCI
• D1 if it's an operation automatically triggered by D1 (can be card suspended due to several authorisation with invalid cvv)

reasonstringOpcional

The reason why the action is performed.

This a free text field in case the Issuer wants to send details, that will be returned in the operations list.

Example: customer was contacted on June 28Pattern: ^[a-zA-Z0-9 ]{1,64}$

reasonCodestring · enumOpcionalValores posibles:

detailsone ofOpcional

o

o

o

o

o

o

o

o

o

o

errorCodestringOpcional

External error code

errorstring · máx: 256Opcional

Human readable string representing the error, only present in case of operation failure

400

Bad Request, Invalid request URI or header, or unsupported non-standard parameter

application/json

401

The provided Authorization header is missing or invalid

application/json

404

Ressource not found, Unknown issuerId or consumerId or card id'. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
UNKNOWN_CARD	-	no	Unknown cardId
UNKNOWN_OPERATION	-	no	Unknown operationId

application/json

500

Internal Server Error

application/json

get

/issuers/{issuerId}/cards/{cardId}/operations/{operationId}

HTTPcURLJavaScriptPython

GET /banking/v1/issuers/{issuerId}/cards/{cardId}/operations/{operationId} HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "operationId": "string",
  "operation": "REGISTER",
  "status": "SUCCESSFUL",
  "startTime": "2022-06-16T06:28:02.492Z",
  "endTime": "2022-06-16T06:28:32.492Z",
  "requestorType": "ISSUER",
  "requestorId": "string",
  "reason": "customer was contacted on June 28",
  "reasonCode": "USER_DECISION",
  "error": "string",
  "details": {
    "eligibilityInformation": {
      "cardBIN": "string",
      "eligible": true,
      "cardProduct": {
        "id": "string",
        "name": "string"
      }
    },
    "digitizationInformation": {
      "digitizationChecks": {
        "issuerVerifications": {
          "cardIsExpired": {
            "result": "YES"
          },
          "cardIsLostOrStolen": {
            "result": "YES"
          },
          "wrongCVV": {
            "result": "YES"
          },
          "fraudSuspect": {
            "result": "YES"
          },
          "cardIsInvalid": {
            "result": "YES"
          }
        },
        "decisionEngineVerifications": {
          "tooManyDigitizationRequests": {
            "result": "YES"
          },
          "tooManyCVVVerificationFailed": {
            "result": "YES"
          },
          "walletPhoneNumberNotMatchingConsumerPhoneNumber": {
            "result": "YES"
          },
          "digitizationCountExceededOnSameFPAN": {
            "result": "YES"
          },
          "digitizationCountExceededOnSameDevice": {
            "result": "YES"
          },
          "cardIsExpired": {
            "result": "YES"
          },
          "cardIsInvalid": {
            "result": "YES"
          },
          "wrongCVV": {
            "result": "YES"
          },
          "CVVNotProvided": {
            "incompatibleWithCaptureMethod": {
              "result": "YES"
            },
            "incompatibleWithDigitalCardType": {
              "result": "YES"
            }
          }
        },
        "digitalCardRequestorAssessment": {
          "averageScore": "3",
          "deviceScore": "2",
          "recommendation": "YELLOW",
          "reasonCodesRecommendation": "07,05",
          "reasonCodesRecommendationDescription": [
            {
              "07": "Suspended cards in the secure element"
            },
            {
              "05": "Suspicious transactions linked to this account"
            }
          ]
        }
      },
      "digitizationResult": {
        "flow": "YELLOW",
        "score": "2",
        "idAndVMethods": {
          "supported": [
            "OTP_BY_SMS",
            "OTP_BY_EMAIL"
          ],
          "selected": "OTP_BY_SMS"
        },
        "digitizationDecisionTimestamp": "string"
      }
    },
    "digitalCardId": "string",
    "oldState": "ACTIVE",
    "newState": "ACTIVE",
    "consumerState": "ACTIVE"
  }
}