Inbound API (to D1)

Inbound APIs are called by your issuer backend to perform operations in the D1 backend.

Use these APIs to:

• Authenticate to D1 and obtain an access token.

• Request physical card production (including instant issuance).

Before you start

You need these integration building blocks in place:

• TLS mutual authentication (mTLS) between your issuer backend and the D1 backend.

• OAuth 2.0 access tokens to authorize calls to D1 APIs.

• JWE encryption for sensitive card data fields (for example, PAN).

Start here:

• Set up TLS mutual authentication

• Get OAuth2.0 access token

• Encrypt sensitive data

APIs in this section

API

OAuth2 API Get an OAuth 2.0 access token for D1 API calls.

Reference

OAuth2 API

API

Physical issuance API Request physical card production (for example, central issuance or instant issuance).

Reference

Physical Issuance API

Common call pattern

1. Call the OAuth2 API to obtain an access token.

2. Call the target D1 API with Authorization: Bearer <access_token>.

3. Reuse the token until it expires (15 minutes).

Inbound and outbound connectivity both require mTLS.

OAuth 2.0 access tokens apply to inbound calls only (issuer backend to D1 backend).