Integrate Card Design Purge

What is the Card Design Purge API?

The Card Design Purge API is used as a way for issuers to delete end-user content from the Thales database, for example in response to a GDPR request for the end-user's content to be deleted. The API purges the image associated to a specific CardImageID as requested by the issuer.

Integrating the Card Design Purge API

The primary method to purge a specific CardImageID is using the SetImageToPurge method.

How it Works

The SetImageToPurge method is used to mark an image for purge as confirmed by the issuer. The request will receive a unique identifier for an image. This ID identifies the image that should be marked for purge.

In addition to the unique identifier, other parameters are required for the web service request to correctly identify the issuer, subscriber and maybe the specific card product. These will be random, unique strings so that the bureau cannot request images from issuers, subscribers or even products it should not have access to. This parameter is called the Image Purge Key.

URLs

URLs for the web service will be provided by your Thales contact during onboarding.

Request Parameters

• CardImageID (string): The unique identifier for the image being requested. This is generated by the Designer Website and passed to the Subscriber during the Handback procedure.

• ImagePurgeKey (GUID string): This value identifies the caller and is matched to the Service Aggregator. This guarantees that the caller should have access to the requested CardImageID. Thales will provide the Aggregator with the value for this parameter. Also note that a different value will be used on each environment.

Response Parameters

The response parameter is an integer value which specifies following:

• -2 (Authentication error): An internal error occurred. This indicates that the caller is not allowed to make a request due to IP transparency check.

• -1 (Unexpected system error): An internal error occurred. The caller should attempt to call the method again. If a high number of such errors are encountered, the problem should be escalated to manual operators at Thales.

• 0 (Success): The method call was successful.

• 1 (CardImageID is invalid): The CardImageID isn’t a valid identifier.

• 2 (ImagePurgeKey is invalid or doesn’t match CardImageId): The CardImageID and ImagePurgeKey don’t match. This error will usually occur when an invalid or incorrect ImagePurgeKey is used.

IP Transparency Check

The IP transparency check is for allowing service requests only to the intended requesters. The legitimacy of a requester is configured by making a setting entry into either financial institute or partner or product setting table. The setting key is AAM_Purge_WS_IP_Restrict. The value of the settings will be a semi-colon delimited (";") string of IPs.

Product setting has the highest priority then the partner and then financial institute setting table. The IP transparency check only comes into effect if any of the setting table (product, partner or financial institute) has an entry against key AAM_Purge_WS_IP_Restrict.