Welcome to our new developer portal! Use the "Ask" button to chat with our AI Agent.
Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Card API

Create and order a physical card

post
/v2/issuers/{issuerId}/cards/physical

This request is used by the bank backend to create a physical card and trigger its production order. The card creation registers the card with the processor (CMS and D1 Card Manager). The production order is sent to the personalization center based on the distributionChannel:

  • THALES: Thales personalization center — requires shipment

  • INSTANT: Instant issuance in branch — requires persoStation, no shipment

  • CENTRAL: Bank or partner center — requires persoCenter and shipment

Authorizations
AuthorizationstringRequired

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Path parameters
issuerIdstring · min: 10 · max: 10Required

The unique identifier of the issuer.

Header parameters
x-correlation-idstring · min: 1 · max: 64Optional

Random identifier used to correlate API calls during a single use case.

x-user-idstring · min: 1 · max: 64Optional

Identifier of the user performing the operation.

Body
or
or
Responses
201

Successful physical card creation and production order submitted

application/json
cardIdstring · min: 1 · max: 48Required

The unique identifier of the created card.

Example: card0001
operationIdstringRequired

The unique identifier of the operation.

Example: op-123456
post/v2/issuers/{issuerId}/cards/physical
POST /banking/v2/issuers/{issuerId}/cards/physical HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 1153

{
  "distributionChannel": "THALES",
  "consumerId": "consumer-001",
  "cardProductId": "product-001",
  "state": "INACTIVE",
  "name": "JOHN SMITH",
  "secondName": "text",
  "statusReason": "IN",
  "accountList": [
    {
      "default": true,
      "type": "CHECKING",
      "number": "123456789",
      "name": "text",
      "currencyCode": "EUR"
    }
  ],
  "issuerRequestId": "01c5a05e-e197-11ec-8fea-0242ac120002",
  "services": {
    "priority": "P1",
    "delivery": "DHL",
    "packaging": "welcome_pack_red",
    "cardCarrier": "NO_CARRIER",
    "pinMailer": false,
    "alphaCard": false
  },
  "cardDesign": {
    "artworkId": "artwork-blue-001",
    "memberId": "123456789",
    "images": [
      "image_1"
    ],
    "customLines": [
      "Custom text 1"
    ]
  },
  "cardCarrierConfig": {
    "language": "EN",
    "images": [
      "image_1"
    ],
    "customLines": [
      "Custom text 1"
    ],
    "multiCardId": "cmp7m3zdf12qj",
    "multiCardOrder": "1"
  },
  "packagingConfig": {
    "inserts": [
      "promo_card",
      "manual_v2"
    ]
  },
  "shipment": {
    "type": "INDIVIDUAL",
    "deliveryAddress": {
      "title": "Mr.",
      "firstName": "John",
      "lastName": "Smith",
      "companyName": "Thales",
      "line1": "10 Downing Street",
      "line2": "text",
      "line3": "text",
      "city": "London",
      "state": "text",
      "zipCode": "WC2N 5DU",
      "countryCode": "GB",
      "mobilePhoneNumber": {
        "countryCode": "+44",
        "phoneNumber": "7911123456"
      },
      "email": "john.smith@example.com"
    }
  }
}
{
  "cardId": "card0001",
  "operationId": "op-123456"
}

Create

post
/v2/issuers/{issuerId}/cards

This request is used by the bank backend to request the creation of a card (virtual or physical) with the processor.

Authorizations
AuthorizationstringRequired

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Path parameters
issuerIdstring · min: 10 · max: 10Required

The id of the issuer

Header parameters
x-correlation-idstringOptional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$
x-user-idstringOptional

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$
Body
consumerIdstring · min: 1 · max: 64Required

Unique identifier of the consumer.

Pattern: ^[A-Za-z0-9_-]{1,64}$
cardProductIdstring · min: 1 · max: 48Required

Unique identifier of the type of card ( defined during the onboarding of D1)

Pattern: ^[A-Za-z0-9_-]{1,48}$
statestring · enumOptional

The state of the card
If not provided, the card is considered ACTIVE

Possible values:
namestring · max: 26Required

Name of the card holder as it will be printed/embossed on the card.
For virtual card this value will be used exclusively for card display.
Empty string supported.

Pattern: ^[a-zA-Z. -]{0,26}$
secondNamestring · max: 26Optional

Optional second card holder name as it will be printed/embossed on the card under the first card holder name.
Not used in case of virtual card.

Pattern: ^[a-zA-Z. -]{0,26}$
statusReasonstring · max: 2Optional

This indicates the state of the card once it's created

Default: INPattern: ^[a-zA-Z]{0,2}$
Responses
201

Successful card creation

application/json

Information related to the created card.

cardIdstring · min: 1 · max: 48Required

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
post/v2/issuers/{issuerId}/cards
POST /banking/v2/issuers/{issuerId}/cards HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 203

{
  "consumerId": "text",
  "cardProductId": "text",
  "state": "ACTIVE",
  "name": "text",
  "secondName": "text",
  "statusReason": "IN",
  "accountList": [
    {
      "default": true,
      "type": "CHECKING",
      "number": "text",
      "currencyCode": "EUR"
    }
  ]
}
{
  "cardId": "text"
}

Get card details

get
/v2/issuers/{issuerId}/cards/{cardId}

This request is used by the bank backend to request card details.

Authorizations
AuthorizationstringRequired

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Path parameters
issuerIdstring · min: 10 · max: 10Required

The id of the issuer

cardIdstring · min: 1 · max: 48Required

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
Header parameters
x-correlation-idstringOptional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$
x-user-idstringOptional

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$
Responses
200

Successful get card details

application/json
consumerIdstring · min: 1 · max: 64Required

Unique identifier of the consumer.

Pattern: ^[A-Za-z0-9_-]{1,64}$
cardIdstring · min: 1 · max: 48Required

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
newCardIdstring · min: 1 · max: 48Optional

Unique identifier of the new card. Provided in case the card is in REPLACED state.

Pattern: ^[A-Za-z0-9_-]{1,48}$
cardProductIdstring · min: 1 · max: 48Required

Unique identifier of the type of card ( defined during the onboarding of D1)

Pattern: ^[A-Za-z0-9_-]{1,48}$
threeDSsupportbooleanOptional

Determines if the card supports EMV 3-D Secure (3DS) flows.

schemestring · enumRequired

The card scheme

Possible values:
auxiliarySchemeundefined · enumOptional

The card auxiliary scheme

Possible values:
panSuffixstringRequired

Last 4 digits of the PAN

Example: 1234Pattern: ^\d{4}$
expstringRequired

Expiry date of the card in MMYY format

Example: 1024Pattern: ^(0[1-9]|1[0-2])\d{2}$
newExpstringOptional

New Expiry date of the card in MMYY format. Provided in case of ongoing RENEWAL operation.

Example: 0928Pattern: ^(0[1-9]|1[0-2])\d{2}$
statestring · enumRequired

the state of the card

Example: ACTIVEPossible values:
stateReasonstring · enumOptional

reason associated to the state

Possible values:
ongoingOperationstring · enumRequiredPossible values:
creationTimestring · min: 1 · max: 64Required

The time the resource has been created. Format ISO 8601 YYYY-MM-DDThh:mm:ssTZD

Example: 2022-02-16T06:28:02.492ZPattern: ^[0-9]{4}-((0[13578]|1[02])-(0[1-9]|[12][0-9]|3[01])|(0[469]|11)-(0[1-9]|[12][0-9]|30)|02-(0[1-9]|[12][0-9]))T([0-1][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](\.[0-9]{3}Z|\.[0-9]{2}([\+\-](0[1-9]|1[0-2])):00)$
lastUpdateTimestring · min: 1 · max: 64Optional

The time the resource has been last updated. Format ISO 8601 YYYY-MM-DDThh:mm:ssTZD

Example: 2022-07-16T06:28:02.492ZPattern: ^[0-9]{4}-((0[13578]|1[02])-(0[1-9]|[12][0-9]|3[01])|(0[469]|11)-(0[1-9]|[12][0-9]|30)|02-(0[1-9]|[12][0-9]))T([0-1][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](\.[0-9]{3}Z|\.[0-9]{2}([\+\-](0[1-9]|1[0-2])):00)$
get/v2/issuers/{issuerId}/cards/{cardId}
GET /banking/v2/issuers/{issuerId}/cards/{cardId} HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

Get Card Credentials

get
/v2/issuers/{issuerId}/cards/{cardId}/credentials

This request is used by the bank backend to retrieve the card credentials. If the card supports Dynamic CVV2 (DCVV2), a new DCVV2 is generated at each request and is provided in the encrypted card credentials using cvv parameter value. The Dynamic CVV2 support is defined in card product definition during onboarding.

Authorizations
AuthorizationstringRequired

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Path parameters
issuerIdstring · min: 10 · max: 10Required

The id of the issuer

cardIdstring · min: 1 · max: 48Required

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
Header parameters
x-correlation-idstringOptional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$
x-user-idstringOptional

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$
Responses
200

Successful get card credentials

application/json
encryptedDatastring · max: 8192Required

The encryptedData is the encrypted json (cf http://www.json.org/) representation of the Card information. This value is encrypted using the JWE encryption (please refer to the Encrypt sensitive data for more details)

Content
Once deciphered, the plaintext contains a json structure with:

JSON field parameter namedescriptionMOCFormat
panThe pan value.Mstring - up to 19 digits
expThe expiry date of the card.Mstring - 4 digits, following the format MMYY
nameThe card holder name.Ostring - up to 26 characters
cvvThe CVV2 or DCVV2 value of the card
Mstring - 3 or 4 digits
Pattern: ^(?:[\x20-\x2D\x2F-\x7F]*\.){4}(?:[\x20-\x2D\x2F-\x7F]*)$
get/v2/issuers/{issuerId}/cards/{cardId}/credentials
GET /banking/v2/issuers/{issuerId}/cards/{cardId}/credentials HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "encryptedData": "text"
}

Verify Card Credentials

post
/v2/issuers/{issuerId}/cards/credentials

This request is used by the bank backend to verify the card credentials. The request is successful if all parameters from encrypted card details (pan, expiry date or cvv) are valid. If the cardId is provided, then D1 will first retreive the card credentials using the cardId and then compare with provided card credentials. If the card supports Dynamic CVV2 (DCVV2), the cvv parameter value from encrypted card credentials must equal an actvive DCVV2. A DCVV2 is active when a DCVV2 has been generated, not expired and not used for any type of transaction. The Dynamic CVV2 support is defined in the card product definition during onboarding.

Authorizations
AuthorizationstringRequired

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Path parameters
issuerIdstring · min: 10 · max: 10Required

The id of the issuer

Header parameters
x-correlation-idstringOptional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$
x-user-idstringOptional

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$
Body
cardIdstring · min: 1 · max: 48Optional

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
encryptedDatastring · max: 8192Required

The encryptedData is the encrypted json (cf http://www.json.org/) representation of the Card information. This value is encrypted using the JWE encryption (please refer to the Encrypt sensitive data for more details)
Content

Once deciphered, the plaintext contains a json structure with:

JSON field parameter namedescriptionMOCFormat
panThe pan value.Mstring - up to 19 digits
expThe expiry date of the card.Mstring - 4 digits, following the format MMYY
cvvThe CVV2 or DCVV2 of the card.Mstring - 3 or 4 digits
Pattern: ^(?:[\x20-\x2D\x2F-\x7F]*\.){4}(?:[\x20-\x2D\x2F-\x7F]*)$
Responses
200

Successful card verification.

application/json

The cardId of the card that has been successfully verified.

cardIdstring · min: 1 · max: 48Required

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
post/v2/issuers/{issuerId}/cards/credentials
POST /banking/v2/issuers/{issuerId}/cards/credentials HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 40

{
  "cardId": "text",
  "encryptedData": "text"
}
{
  "cardId": "text"
}

Get Card Settings

get
/v2/issuers/{issuerId}/cards/{cardId}/settings

This request is used by the bank backend to retrieve card settings.

Authorizations
AuthorizationstringRequired

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Path parameters
issuerIdstring · min: 10 · max: 10Required

The id of the issuer

cardIdstring · min: 1 · max: 48Required

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
Header parameters
x-correlation-idstringOptional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$
x-user-idstringOptional

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$
Responses
200

Successful get card settings

application/json
get/v2/issuers/{issuerId}/cards/{cardId}/settings
GET /banking/v2/issuers/{issuerId}/cards/{cardId}/settings HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

Update Card Controls

patch
/v2/issuers/{issuerId}/cards/{cardId}/controls

This request is used by the bank backend to update card domain controls.

Authorizations
AuthorizationstringRequired

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Path parameters
issuerIdstring · min: 10 · max: 10Required

The id of the issuer

cardIdstring · min: 1 · max: 48Required

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
Header parameters
x-correlation-idstringOptional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$
x-user-idstringOptional

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$
Body
Responses
200

Successful card setting update

No content
patch/v2/issuers/{issuerId}/cards/{cardId}/controls
PATCH /banking/v2/issuers/{issuerId}/cards/{cardId}/controls HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 254

{
  "controls": {
    "onlinePayment": true,
    "contactless": true,
    "magstripe": true,
    "withdrawal": true,
    "abroadPayment": true,
    "deniedCurrencies": [
      "EUR"
    ],
    "geography": {
      "regions": [
        "SCHENGEN_AREA"
      ],
      "countries": [
        "CZ"
      ]
    },
    "merchants": {
      "gambling": true,
      "adult": true,
      "risky": true
    }
  }
}
No content

Update Card Limits

patch
/v2/issuers/{issuerId}/cards/{cardId}/limits

This request is used by the bank backend to update card settings.

Authorizations
AuthorizationstringRequired

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Path parameters
issuerIdstring · min: 10 · max: 10Required

The id of the issuer

cardIdstring · min: 1 · max: 48Required

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
Header parameters
x-correlation-idstringOptional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$
x-user-idstringOptional

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$
Body
Responses
200

Successful card setting update

No content
patch/v2/issuers/{issuerId}/cards/{cardId}/limits
PATCH /banking/v2/issuers/{issuerId}/cards/{cardId}/limits HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 312

{
  "limits": {
    "purchase": {
      "daily": {
        "limit": 1,
        "maxLimit": 1
      },
      "weekly": {
        "limit": 1,
        "maxLimit": 1
      },
      "monthly": {
        "limit": 1,
        "maxLimit": 1
      },
      "yearly": {
        "limit": 1,
        "maxLimit": 1
      }
    },
    "withdrawal": {
      "daily": {
        "limit": 1,
        "maxLimit": 1
      },
      "weekly": {
        "limit": 1,
        "maxLimit": 1
      },
      "monthly": {
        "limit": 1,
        "maxLimit": 1
      },
      "yearly": {
        "limit": 1,
        "maxLimit": 1
      }
    }
  }
}
No content

Resume

post
/v2/issuers/{issuerId}/cards/{cardId}/operations:resume

This request is used by the bank backend to request the reactivation of a card that has been suspended. The card could have been suspended

  • by the bank's backend

  • by customer agent

  • by end user using the mobile banking application

  • or automatically by authorisation system when a payment validation failure retry counter has been exceeded (PIN locked, CVV2 locked or expiry date locked)

If the card is locked (PIN locked, CVV2 locked or expiry date), D1 will unlock the card whatever the reason.

Note: It cannot be used to activate a physical card for the really first time. Please refer to activatePhysicalCard

Authorizations
AuthorizationstringRequired

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Path parameters
issuerIdstring · min: 10 · max: 10Required

The id of the issuer

cardIdstring · min: 1 · max: 48Required

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
Header parameters
x-correlation-idstringOptional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$
x-user-idstringOptional

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$
Body
reasonstringOptional

The reason why the action is performed.

This a free text field in case the bank wants to send details, that will be returned in the operations list.

Example: customer was contacted on June 28Pattern: ^[a-zA-Z0-9 ]{1,64}$
stateReasonstring · enumOptional

The reason why the action has been performed. If not provided, default reason code is ISSUER_DECISION.

Possible values:
Responses
200

Card resumed Successfully

application/json
operationIdstring · min: 1 · max: 64Optional

Unique identifier of the operation

Pattern: ^[A-Za-z0-9_-]{1,64}$
post/v2/issuers/{issuerId}/cards/{cardId}/operations:resume
POST /banking/v2/issuers/{issuerId}/cards/{cardId}/operations:resume HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 78

{
  "reason": "customer was contacted on June 28",
  "stateReason": "ISSUER_DECISION"
}
{
  "operationId": "text"
}

Suspend

post
/v2/issuers/{issuerId}/cards/{cardId}/operations:suspend

This request is used by the bank backend to request the suspention of a card. When a card is suspended:

  • authorization will be declined by the system.

  • end user will not be alble to digitize the card.

  • But authorization with digital card will be still approved by the system.

Authorizations
AuthorizationstringRequired

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Path parameters
issuerIdstring · min: 10 · max: 10Required

The id of the issuer

cardIdstring · min: 1 · max: 48Required

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
Header parameters
x-correlation-idstringOptional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$
x-user-idstringOptional

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$
Body
reasonstringOptional

The reason why the action is performed.

This a free text field in case the bank wants to send details, that will be returned in the operations list.

Example: customer was contacted on June 28Pattern: ^[a-zA-Z0-9 ]{1,64}$
stateReasonstring · enumOptional

The reason why the action has been performed. If not provided, default reason code is ISSUER_DECISION.

Possible values:
Responses
200

Card was suspended Successfully

application/json
operationIdstring · min: 1 · max: 64Optional

Unique identifier of the operation

Pattern: ^[A-Za-z0-9_-]{1,64}$
post/v2/issuers/{issuerId}/cards/{cardId}/operations:suspend
POST /banking/v2/issuers/{issuerId}/cards/{cardId}/operations:suspend HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 72

{
  "reason": "customer was contacted on June 28",
  "stateReason": "CARD_LOST"
}
{
  "operationId": "text"
}

Delete

post
/v2/issuers/{issuerId}/cards/{cardId}/operations:delete

This request is used by the bank backend to request the deletion of a card.

For cards managed by D1 (in oposition to legacy cards that are managed by the issuer), D1 will propagate the deletion/revocation to the processor.

Note: The deletion of the card cannot be reverted. In case of card lost consider using the suspend operation first.

Authorizations
AuthorizationstringRequired

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Path parameters
issuerIdstring · min: 10 · max: 10Required

The id of the issuer

cardIdstring · min: 1 · max: 48Required

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
Header parameters
x-correlation-idstringOptional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$
x-user-idstringOptional

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$
Body
reasonstringOptional

The reason why the action is performed.

This a free text field in case the bank wants to send details, that will be returned in the operations list.

Example: customer was contacted on June 28Pattern: ^[a-zA-Z0-9 ]{1,64}$
stateReasonstring · enumOptional

The reason why the action has been performed. If not provided, default reason code is ISSUER_DECISION.

Possible values:
Responses
200

Card was deleted Successfully

application/json
operationIdstring · min: 1 · max: 64Optional

Unique identifier of the operation

Pattern: ^[A-Za-z0-9_-]{1,64}$
post/v2/issuers/{issuerId}/cards/{cardId}/operations:delete
POST /banking/v2/issuers/{issuerId}/cards/{cardId}/operations:delete HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 77

{
  "reason": "customer was contacted on June 28",
  "stateReason": "CLOSED_ACCOUNT"
}
{
  "operationId": "text"
}

Replace

post
/v2/issuers/{issuerId}/cards/{cardId}/operations:replace

End user can request the bank a replacement of an existing card because the card has been lost or damaged. The replaced card is blocked until the new card is activated. The new card has a new cardId and a new card credentials (PAN and expiry date). In the particular case of Virtual Card, the new Virtual Card is automaticaly activated.

D1 manages to re-link automatically digital card from the old card to the new card upon activation.

For card registered in D1, the bank backend shall provide new cardId and new card credentials when calling the API. The new cardId used to replace the card shall be unique. The new cardId can be reused from another card (having a different PAN) under several conditions :

  • The cardId to be reused is linked with a DELETED or REPLACED card (thus it's not possible to use the current cardId as newCardID when doing a replace)

  • The cardId to be reused is not associated to a card issued by D1 (a card created using the CREATE card API).

  • The cardId to be reused is not associated with a card product used for making transactions

  • In any case, it is not possible to use a card PAN already deleted or replaced. Even by reusing a cardId. Reusing a cardId for another consumer is not recommanded. Since the cardId will disappear from the previous consumer cards list.

For card created by D1, D1 will generate a new cardId and new card credentials. Thus the newCardId shall not be provided by the issuer when calling this API.

Authorizations
AuthorizationstringRequired

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Path parameters
issuerIdstring · min: 10 · max: 10Required

The id of the issuer

cardIdstring · min: 1 · max: 48Required

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
Header parameters
x-correlation-idstringOptional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$
x-user-idstringOptional

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$
Body
newCardIdstring · min: 1 · max: 48Optional

Unique identifier of the new card. Provided in case the card is in REPLACED state.

Pattern: ^[A-Za-z0-9_-]{1,48}$
encryptedDatastring · max: 8192Optional

The encryptedData has to be provided in case of card registered in D1. It is not needed for card created by D1.
The encryptedData is the encrypted json (cf http://www.json.org/) representation of the Card information. This value is encrypted using the JWE encryption (please refer to the Encrypt sensitive data for more details)

Once deciphered, the plaintext contains a json structure with:

JSON field parameter namedescriptionMOCFormat
panThe funding pan value.Mstring - up to 19 digits
expThe expiry date of the card.Mstring - 4 digits, following the format MMYY
auxiliaryPanThe auxiliary funding pan value. It shall be provided when cobadge is supported and if the card has an auxiliary pan.Cstring - up to 19 digits
auxiliaryExpThe auxiliary expiry date of the card. It shall be provided when cobadge is supported and if the card has an auxiliary pan.Cstring - 4 digits, following the format MMYY


Pattern: ^(?:[\x20-\x2D\x2F-\x7F]*\.){4}(?:[\x20-\x2D\x2F-\x7F]*)$
reasonstringRequired

The reason why the action is performed.

This a free text field in case the bank wants to send details, that will be returned in the operations list.

Example: customer was contacted on June 28Pattern: ^[a-zA-Z0-9 ]{1,64}$
stateReasonstring · enumRequired

The reason why the action has been performed. If not provided, default reason code is ISSUER_DECISION.

Possible values:
Responses
200

Card was replaced Successfully

application/json
operationIdstring · min: 1 · max: 64Optional

Unique identifier of the operation

Pattern: ^[A-Za-z0-9_-]{1,64}$
newCardIdstring · min: 1 · max: 48Required

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
post/v2/issuers/{issuerId}/cards/{cardId}/operations:replace
POST /banking/v2/issuers/{issuerId}/cards/{cardId}/operations:replace HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 114

{
  "newCardId": "text",
  "encryptedData": "text",
  "reason": "customer was contacted on June 28",
  "stateReason": "CARD_LOST"
}
{
  "operationId": "text",
  "newCardId": "text"
}

Renew

post
/v2/issuers/{issuerId}/cards/{cardId}/operations:renew

Card renewal is the process where a new card is provided to end-user. The new card has new expiry date, but cardId and PAN are remaining the same.

For card registered in D1, this request is used by the bank backend to inform that card has been renewed. In such case the new expiry date shall be provided. Moreover, the auxiliary expiry date of the card shall also be provided for cobadged cards that have an auxiliary pan.

For card created by D1, this request is used by the bank backend to manualy request the renewal of an existing card (a new expiry date will be generated by D1).

In the particular case of the Virtual Card, the Virtual Card is automaticaly activated. For Physical Card, the renewed card will remain active until:

  • an explicit activation perfomed using the activation operation using the same cardId as the renew card

  • an implicit activation following a valid card present transaction (if card product is configured as such)

Authorizations
AuthorizationstringRequired

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Path parameters
issuerIdstring · min: 10 · max: 10Required

The id of the issuer

cardIdstring · min: 1 · max: 48Required

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
Header parameters
x-correlation-idstringOptional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$
x-user-idstringOptional

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$
Body
newExpstringOptional

Expiry date of the card in MMYY format

Example: 1024Pattern: ^(0[1-9]|1[0-2])\d{2}$
newAuxiliaryExpstringOptional

Expiry date of the card in MMYY format

Example: 1024Pattern: ^(0[1-9]|1[0-2])\d{2}$
reasonstringOptional

The reason why the action is performed.

This a free text field in case the bank wants to send details, that will be returned in the operations list.

Example: customer was contacted on June 28Pattern: ^[a-zA-Z0-9 ]{1,64}$
stateReasonstring · enumOptional

The reason why the action has been performed. If not provided, default reason code is ISSUER_DECISION.

Possible values:
Responses
200

Card was renewed Successfully

application/json
operationIdstring · min: 1 · max: 64Optional

Unique identifier of the operation

Pattern: ^[A-Za-z0-9_-]{1,64}$
post/v2/issuers/{issuerId}/cards/{cardId}/operations:renew
POST /banking/v2/issuers/{issuerId}/cards/{cardId}/operations:renew HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 119

{
  "newExp": "1024",
  "newAuxiliaryExp": "1024",
  "reason": "customer was contacted on June 28",
  "stateReason": "ISSUER_DECISION"
}
{
  "operationId": "text"
}

Get All Card Authorisation Operations

get
/v2/issuers/{issuerId}/cards/{cardId}/authorisations/operations

This request is used by the core banking system to retrieve all the authorisations related to a card and its linked digital card. The API specifies the starting point (offset) and the number of authorization (limit) to be retrieved:

  • Offset 0 (the default) corresponds to the most recent operation.

  • Use a stricly positive number and multipe of limit number to get older operations. Attention D1 will reject the reqest if offset is not a mulitpe of limit. For example in case of limit of 10:

  • Use offset of 0 to get the last 10 most recents operations (0 to 10)

  • Use offset of 10 to get the next 10 operations (10 to 20)

  • Use offset of 20 to get the next 10 operations (20 to 30)

  • If you use 9 or 11 as offset, the request will be rejected by D1.

Optionally, the request can filter operations for a given period using startDate and endDate parameters.

Search authorisations by operation id is also possible.

Authorizations
AuthorizationstringRequired

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

Path parameters
issuerIdstring · min: 10 · max: 10Required

The id of the issuer

cardIdstring · min: 1 · max: 48Required

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$
Query parameters
limitinteger · min: 1 · max: 50Optional

Upper limit of the query

Default: 10
offsetintegerOptional

Index from which the query starts returning operations (default value: 0)

startDatestring · min: 1 · max: 64Optional

Start date for the search criteria

Example: 2022-02-16T06:28:02.492ZPattern: ^[0-9]{4}-((0[13578]|1[02])-(0[1-9]|[12][0-9]|3[01])|(0[469]|11)-(0[1-9]|[12][0-9]|30)|02-(0[1-9]|[12][0-9]))T([0-1][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](\.[0-9]{3}Z|\.[0-9]{2}([\+\-](0[1-9]|1[0-2])):00)$
endDatestring · min: 1 · max: 64Optional

End date for the search criteria

Example: 2022-02-16T06:28:02.492ZPattern: ^[0-9]{4}-((0[13578]|1[02])-(0[1-9]|[12][0-9]|3[01])|(0[469]|11)-(0[1-9]|[12][0-9]|30)|02-(0[1-9]|[12][0-9]))T([0-1][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](\.[0-9]{3}Z|\.[0-9]{2}([\+\-](0[1-9]|1[0-2])):00)$
operationIdstring · min: 1 · max: 12Optional

Id corresponding to Retrieval Reference Number (ISO-8583 SID / Field No 37).

Header parameters
x-user-idstringOptional

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$
x-correlation-idstringOptional

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$
Responses
200

OK

application/json
get/v2/issuers/{issuerId}/cards/{cardId}/authorisations/operations
GET /banking/v2/issuers/{issuerId}/cards/{cardId}/authorisations/operations HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "operations": [
    {
      "operationId": "text",
      "operation": "PURCHASE",
      "status": "APPROVED",
      "startTime": "2022-06-16T06:28:02.492Z",
      "errorCode": "INVALID_CARD_STATE",
      "details": {
        "isoMessageType": "1100",
        "transactionDate": "2022-06-16T06:28:02.492Z",
        "transmissionDate": "2022-06-16T06:28:02.492Z",
        "retrievalReferenceNumber": "230710891451",
        "stan": "891451",
        "internalStan": "980588",
        "actionCode": "000",
        "declinedReason": "INVALID_CARD_STATE",
        "declinedDetails": "INVALID_CVV2",
        "amount": 2100,
        "currencyCode": "EUR",
        "billingAmount": 2100,
        "billingCurrencyCode": "EUR",
        "conversionRate": 1.092479,
        "replacementAmount": 2100,
        "replacementCurrencyCode": "EUR",
        "accountNumber": "text",
        "standInProcessing": false,
        "functionCode": "100",
        "messageReasonCode": "1002",
        "cardPresent": false,
        "cardDataInputMode": "1",
        "initiatingParty": "CARDHOLDER",
        "acquirerCountryCode": "FR",
        "merchant": {
          "merchantId": "text",
          "merchantNameAddress": "text",
          "merchantName": "text",
          "city": "text",
          "countryCode": "FR",
          "merchantType": "5542"
        },
        "digitalCard": {
          "digitalCardId": "text",
          "digitalCardRequestorId": "text"
        }
      }
    }
  ]
}
PreviousConsumer APINextOutbound API (from D1)

Last updated

Was this helpful?