カード API

Create

post

https://api.d1.thalescloud.io/bankinghttps://api.d1-stg.thalescloud.io/banking

/v2/issuers/{issuerId}/cards

This request is used by the bank backend to request the creation of a card (virtual or physical) with the processor.

認可

bearerAuth

Authorizationstring必須

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

パスパラメータ

issuerIdstring · 最小: 10 · 最大: 10必須

The id of the issuer

ヘッダーパラメータ

x-correlation-idstringオプション

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$

x-user-idstringオプション

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$

本文

application/json

consumerIdstring · 最小: 1 · 最大: 64必須

Unique identifier of the consumer.

Pattern: ^[A-Za-z0-9_-]{1,64}$

cardProductIdstring · 最小: 1 · 最大: 48必須

Unique identifier of the type of card ( defined during the onboarding of D1)

Pattern: ^[A-Za-z0-9_-]{1,48}$

statestring · enumオプション

The state of the card
If not provided, the card is considered ACTIVE

可能な値:

namestring · 最大: 26必須

Name of the card holder as it will be printed/embossed on the card.
For virtual card this value will be used exclusively for card display.
Empty string supported.

Pattern: ^[a-zA-Z. -]{0,26}$

secondNamestring · 最大: 26オプション

Optional second card holder name as it will be printed/embossed on the card under the first card holder name.
Not used in case of virtual card.

Pattern: ^[a-zA-Z. -]{0,26}$

statusReasonstring · 最大: 2オプション

This indicates the state of the card once it's created

Default: INPattern: ^[a-zA-Z]{0,2}$

レスポンス

201

Successful card creation

application/json

Information related to the created card.

cardIdstring · 最小: 1 · 最大: 48必須

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$

400

Bad Request, Invalid request URI, header, paramters. The below table defines the possible 'Bad request' error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
FIELD_INVALID_FORMAT	Contains the field in error (first found)	no	JSON not well formatted or One field is not expected format as defined in this documentation
FIELD_INVALID_VALUE	Contains the field in error (first found)	no	One field value is not allowed for the given field

application/json

401

Unauthorized request, the provided Authorization header is missing or invalid. In the table below only the field "error" is provided.

errorCode	error	Retryable	Comments
AUTHORIZER_UNAUTHORIZED	Unauthorized message	no	Access token not valid

application/json

403

Forbidden action detected by WAF or the application.
The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
AUTHORIZER_FORBIDDEN	not authorized error message	no	User is not authorized to access this resource
CARD_CREATION_COUNT_EXCEEDED	-	no	The maximum number of cards for the consumer is reached. Creation of additional card is not possible.
OPERATION_NOT_ALLOWED	Name of the operation/field that is not allowed in this operation	no	Card creation is not allowed for this card product

application/json

404

Ressource not found, Unknown issuerId or consumerId or card id'. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
UNKNOWN_CONSUMER	-	no	Consumer does not exist

application/json

500

Internal Server Error. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	yes	No error details available
INTERNAL_ERROR	error details if any	no	The server has encountered an error when executing the request.

application/json

503

The service is temporarily unavailable. You may retry your request later.

post

/v2/issuers/{issuerId}/cards

HTTPcURLJavaScriptPython

POST /banking/v2/issuers/{issuerId}/cards HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 203

{
  "consumerId": "text",
  "cardProductId": "text",
  "state": "ACTIVE",
  "name": "text",
  "secondName": "text",
  "statusReason": "IN",
  "accountList": [
    {
      "default": true,
      "type": "CHECKING",
      "number": "text",
      "currencyCode": "EUR"
    }
  ]
}

{
  "cardId": "text"
}

Get card details

get

https://api.d1.thalescloud.io/bankinghttps://api.d1-stg.thalescloud.io/banking

/v2/issuers/{issuerId}/cards/{cardId}

This request is used by the bank backend to request card details.

認可

bearerAuth

Authorizationstring必須

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

パスパラメータ

issuerIdstring · 最小: 10 · 最大: 10必須

The id of the issuer

cardIdstring · 最小: 1 · 最大: 48必須

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$

ヘッダーパラメータ

x-correlation-idstringオプション

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$

x-user-idstringオプション

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$

レスポンス

200

Successful get card details

application/json

400

Bad Request, Invalid request URI, header, paramters. The below table defines the possible 'Bad request' error:

errorCode	error	Retryable	Comments
-	-	yes	No error details available
FIELD_INVALID_FORMAT	Contains the field in error (first found)	no	One field is not expected format as defined in this documentation

application/json

401

Unauthorized request, the provided Authorization header is missing or invalid. In the table below only the field "error" is provided.

errorCode	error	Retryable	Comments
AUTHORIZER_UNAUTHORIZED	Unauthorized message	no	Access token not valid

application/json

403

Forbidden action detected by WAF or the application.
The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
AUTHORIZER_FORBIDDEN	not authorized error message	no	User is not authorized to access this resource

application/json

404

Ressource not found, Unknown issuerId or consumerId or card id'. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
UNKNOWN_CARD	-	no	Unknown cardId

application/json

500

Internal Server Error. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	yes	No error details available
INTERNAL_ERROR	error details if any	no	The server has encountered an error when executing the request.

application/json

503

The service is temporarily unavailable. You may retry your request later.

get

/v2/issuers/{issuerId}/cards/{cardId}

HTTPcURLJavaScriptPython

GET /banking/v2/issuers/{issuerId}/cards/{cardId} HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

Register Card

put

https://api.d1.thalescloud.io/bankinghttps://api.d1-stg.thalescloud.io/banking

/v2/issuers/{issuerId}/cards/{cardId}

This request is used to register a card with corresponding cards credentials. This operation is applicable for card product supporting:

• No authorisation mode

• Light authorisation mode

The cardId used to register the card shall be unique. A cardId can be reused to register another card (having a different PAN) under several conditions:

• The cardId to be reused is linked with a DELETED or REPLACED card

• The cardId to be reused is not associated to a card issued by D1 (a card created using the CREATE card API).

• The cardId to be reused is not associated with a card product used for making transactions

• In any case, it is not possible to register a card PAN already deleted or replaced. Even by reusing a cardId. Reusing a cardId for another consumer is not recommanded. Since the cardId will disappear from the previous consumer cards list.

認可

bearerAuth

Authorizationstring必須

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

パスパラメータ

issuerIdstring · 最小: 10 · 最大: 10必須

The id of the issuer

cardIdstring · 最小: 1 · 最大: 48必須

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$

ヘッダーパラメータ

x-correlation-idstringオプション

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$

x-user-idstringオプション

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$

本文

application/json

consumerIdstring · 最小: 1 · 最大: 64必須

Unique identifier of the consumer.

Pattern: ^[A-Za-z0-9_-]{1,64}$

cardProductIdstring · 最小: 1 · 最大: 48必須

Unique identifier of the type of card ( defined during the onboarding of D1)

Pattern: ^[A-Za-z0-9_-]{1,48}$

statestring · enumオプション

The state of the card
If not provided, the card is considered ACTIVE

可能な値:

namestring · 最大: 26必須

Name of the card holder as it will be printed/embossed on the card.
For virtual card this value will be used exclusively for card display.
Empty string supported.

Pattern: ^[a-zA-Z. -]{0,26}$

secondNamestring · 最大: 26オプション

Optional second card holder name as it will be printed/embossed on the card under the first card holder name.
Not used in case of virtual card.

Pattern: ^[a-zA-Z. -]{0,26}$

encryptedDatastring · 最大: 8192必須

The encryptedData is the encrypted json (cf http://www.json.org/) representation of the Card information. This value is encrypted using the JWE encryption (please refer to the Encrypt sensitive data for more details)

Once deciphered, the plaintext contains a json structure with:

JSON field parameter name	description	MOC	Format
pan	The funding pan value.	M	string - up to 19 digits
exp	The expiry date of the card.	M	string - 4 digits, following the format MMYY
auxiliaryPan	The auxiliary funding pan value. It shall be provided when cobadge is supported and if the card has an auxiliary pan.	C	string - up to 19 digits
auxiliaryExp	The auxiliary expiry date of the card. It shall be provided when cobadge is supported and if the card has an auxiliary pan.	C	string - 4 digits, following the format MMYY

As D1 is able to compute the CVV2, the cvv parameter is not expected.

Pattern: ^(?:[\x20-\x2D\x2F-\x7F]*\.){4}(?:[\x20-\x2D\x2F-\x7F]*)$

レスポンス

204

Successful card registration

400

Bad Request, Invalid request URI, header, paramters. The below table defines the possible 'Bad request' error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
FIELD_INVALID_FORMAT	Contains the field in error (first found)	no	One field is not expected format as defined in this documentation
CRYPTO_ERROR	-	no	Not possible to decrypt the provided encrypted data
FIELD_INVALID_VALUE	-	no	One field value is not allowed for the given field
INVALID_PAN	-	no	PAN is invalid
INVALID_EXPIRY_DATE	Expiry date is invalid

application/json

401

Unauthorized request, the provided Authorization header is missing or invalid. In the table below only the field "error" is provided.

errorCode	error	Retryable	Comments
AUTHORIZER_UNAUTHORIZED	Unauthorized message	no	Access token not valid

application/json

403

Forbidden action detected by WAF or the application. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
AUTHORIZER_FORBIDDEN	not_authorized error message	no	User_is_not_authorized_to_access_this_resource
CARD_ALREADY_EXISTS	-	no	CardId already registered in the solution
CARD_INVALID_STATE	-	no	CardId already registered in the solution and has an invalid card state (REPLACED or DELETED)
CONSUMER_INVALID_STATE	-	no	Consumer exists with an invalid consumer state (DELETED)
OPERATION_NOT_ALLOWED	Name of the operation/field that is not allowed in this operation	no	Register is not allowed for this card product

application/json

404

Ressource not found, Unknown issuerId

application/json

500

Internal Server Error. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	yes	No error details available
INTERNAL_ERROR	error details if any	no	The server has encountered an error when executing the request.

application/json

503

The service is temporarily unavailable. You may retry your request later.

put

/v2/issuers/{issuerId}/cards/{cardId}

HTTPcURLJavaScriptPython

PUT /banking/v2/issuers/{issuerId}/cards/{cardId} HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 118

{
  "consumerId": "text",
  "cardProductId": "text",
  "state": "ACTIVE",
  "name": "text",
  "secondName": "text",
  "encryptedData": "text"
}

コンテンツなし

Get Card Credentials

get

https://api.d1.thalescloud.io/bankinghttps://api.d1-stg.thalescloud.io/banking

/v2/issuers/{issuerId}/cards/{cardId}/credentials

This request is used by the bank backend to retrieve the card credentials. If the card supports Dynamic CVV2 (DCVV2), a new DCVV2 is generated at each request and is provided in the encrypted card credentials using cvv parameter value. The Dynamic CVV2 support is defined in card product definition during onboarding.

認可

bearerAuth

Authorizationstring必須

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

パスパラメータ

issuerIdstring · 最小: 10 · 最大: 10必須

The id of the issuer

cardIdstring · 最小: 1 · 最大: 48必須

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$

ヘッダーパラメータ

x-correlation-idstringオプション

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$

x-user-idstringオプション

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$

レスポンス

200

Successful get card credentials

application/json

400

Bad Request, Invalid request URI, header, paramters. The below table defines the possible 'Bad request' error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
FIELD_INVALID_FORMAT	Contains the field in error (first found)	no	One field is not expected format as defined in this documentation

application/json

401

Unauthorized request, the provided Authorization header is missing or invalid. In the table below only the field "error" is provided.

errorCode	error	Retryable	Comments
AUTHORIZER_UNAUTHORIZED	Unauthorized_message	no	Access token not valid

application/json

403

Forbidden action detected by WAF or the application.
The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
AUTHORIZER_FORBIDDEN	not_authorized error message	no	User is not authorized to access this resource
CARD_INVALID_STATE	-	no	Impossible to get card credentials as the card is DELETED, SUSPENDED or REPLACED.

application/json

404

Ressource not found, Unknown issuerId or consumerId or card id'. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
UNKNOWN_CARD	-	no	Unknown cardId

application/json

500

Internal Server Error. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	yes	No error details available
INTERNAL_ERROR	error details if any	no	The server has encountered an error when executing the request.
WRONG_CONFIGURATION	Missing key configuration for encryption	The server is not configured to performe the encryption of card information

application/json

503

The service is temporarily unavailable. You may retry your request later.

get

/v2/issuers/{issuerId}/cards/{cardId}/credentials

HTTPcURLJavaScriptPython

GET /banking/v2/issuers/{issuerId}/cards/{cardId}/credentials HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "encryptedData": "text"
}

Verify Card Credentials

post

https://api.d1.thalescloud.io/bankinghttps://api.d1-stg.thalescloud.io/banking

/v2/issuers/{issuerId}/cards/credentials

This request is used by the bank backend to verify the card credentials. The request is successful if all parameters from encrypted card details (pan, expiry date or cvv) are valid. If the cardId is provided, then D1 will first retreive the card credentials using the cardId and then compare with provided card credentials. If the card supports Dynamic CVV2 (DCVV2), the cvv parameter value from encrypted card credentials must equal an actvive DCVV2. A DCVV2 is active when a DCVV2 has been generated, not expired and not used for any type of transaction. The Dynamic CVV2 support is defined in the card product definition during onboarding.

認可

bearerAuth

Authorizationstring必須

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

パスパラメータ

issuerIdstring · 最小: 10 · 最大: 10必須

The id of the issuer

ヘッダーパラメータ

x-correlation-idstringオプション

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$

x-user-idstringオプション

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$

本文

application/json

cardIdstring · 最小: 1 · 最大: 48オプション

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$

encryptedDatastring · 最大: 8192必須

The encryptedData is the encrypted json (cf http://www.json.org/) representation of the Card information. This value is encrypted using the JWE encryption (please refer to the Encrypt sensitive data for more details)
Content

Once deciphered, the plaintext contains a json structure with:

JSON field parameter name	description	MOC	Format
pan	The pan value.	M	string - up to 19 digits
exp	The expiry date of the card.	M	string - 4 digits, following the format MMYY
cvv	The CVV2 or DCVV2 of the card.	M	string - 3 or 4 digits

Pattern: ^(?:[\x20-\x2D\x2F-\x7F]*\.){4}(?:[\x20-\x2D\x2F-\x7F]*)$

レスポンス

200

Successful card verification.

application/json

400

Bad Request, Invalid request URI, header, paramters. The below table defines the possible 'Bad request' error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
FIELD_INVALID_FORMAT	Contains the field in error (first found)	no	One field is not expected format as defined in this documentation
CRYPTO_ERROR	-	no	Not possible to decrypt the provided encrypted data
INVALID_PAN	pan value is not verified	no	The pan from encrypted card information is not matching the referenced card pan
INVALID_EXPIRY_DATE	exp value is not verified	no	The exp from encrypted card information is not matching the referenced card expiry date
INVALID_CVV2	cvv2 value is not verified	no	The cvv from encrypted card information is not matching the referenced card CVV2 or active DCVV2
NO_ACTIVE_DCVV2	cvv2/dcvv2 not provided from referenced card	no	The cvv from referenced card CVV2 or active DCVV2 is empty

application/json

401

Unauthorized request, the provided Authorization header is missing or invalid. In the table below only the field "error" is provided.

errorCode	error	Retryable	Comments
AUTHORIZER_UNAUTHORIZED	Unauthorized_message	no	Access token not valid

application/json

403

Forbidden action detected by WAF or the application.
The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
AUTHORIZER_FORBIDDEN	not_authorized error message	no	User is not authorized to access this resource
CARD_INVALID_STATE	-	no	Impossible to get card credentials as the card is DELETED, SUSPENDED or REPLACED.

application/json

404

Ressource not found, Unknown issuerId or consumerId or card id'. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
UNKNOWN_CARD	-	no	Unknown cardId

application/json

500

Internal Server Error. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	yes	No error details available
INTERNAL_ERROR	error details if any	no	The server has encountered an error when executing the request.

application/json

503

The service is temporarily unavailable. You may retry your request later.

post

/v2/issuers/{issuerId}/cards/credentials

HTTPcURLJavaScriptPython

POST /banking/v2/issuers/{issuerId}/cards/credentials HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 40

{
  "cardId": "text",
  "encryptedData": "text"
}

{
  "cardId": "text"
}

Get Card Settings

get

https://api.d1.thalescloud.io/bankinghttps://api.d1-stg.thalescloud.io/banking

/v2/issuers/{issuerId}/cards/{cardId}/settings

This request is used by the bank backend to retrieve card settings.

認可

bearerAuth

Authorizationstring必須

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

パスパラメータ

issuerIdstring · 最小: 10 · 最大: 10必須

The id of the issuer

cardIdstring · 最小: 1 · 最大: 48必須

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$

ヘッダーパラメータ

x-correlation-idstringオプション

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$

x-user-idstringオプション

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$

レスポンス

200

Successful get card settings

application/json

400

Bad Request, Invalid request URI, header, paramters. The below table defines the possible 'Bad request' error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
FIELD_INVALID_FORMAT	Contains the field in error (first found)	no	One field is not expected format as defined in this documentation

application/json

401

Unauthorized request, the provided Authorization header is missing or invalid. In the table below only the field "error" is provided.

errorCode	error	Retryable	Comments
AUTHORIZER_UNAUTHORIZED	Unauthorized message	no	Access token not valid

application/json

403

Forbidden action detected by WAF or the application.
The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
AUTHORIZER_FORBIDDEN	not authorized error message	no	User is not authorized to access this resource
CARD_INVALID_STATE	-	no	Impossible to get card settings as the card is DELETED.

application/json

404

Ressource not found, Unknown issuerId or consumerId or card id'. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	yes	No error details available
UNKNOWN_CARD	-	no	Unknown cardId

application/json

500

Internal Server Error. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
INTERNAL_ERROR	error details if any	no	The server has encountered an error when executing the request.

application/json

503

The service is temporarily unavailable. You may retry your request later.

get

/v2/issuers/{issuerId}/cards/{cardId}/settings

HTTPcURLJavaScriptPython

GET /banking/v2/issuers/{issuerId}/cards/{cardId}/settings HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

Update Card Controls

patch

https://api.d1.thalescloud.io/bankinghttps://api.d1-stg.thalescloud.io/banking

/v2/issuers/{issuerId}/cards/{cardId}/controls

This request is used by the bank backend to update card domain controls.

認可

bearerAuth

Authorizationstring必須

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

パスパラメータ

issuerIdstring · 最小: 10 · 最大: 10必須

The id of the issuer

cardIdstring · 最小: 1 · 最大: 48必須

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$

ヘッダーパラメータ

x-correlation-idstringオプション

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$

x-user-idstringオプション

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$

本文

application/json

レスポンス

200

Successful card setting update

400

Bad Request, Invalid request URI, header, paramters. The below table defines the possible 'Bad request' error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
FIELD_INVALID_FORMAT	Contains the field in error (first found)	no	JSON not well formatted or One field is not expected format as defined in this documentation
FIELD_INVALID_VALUE	Contains the field in error (first found)	no	One field value is not allowed for the given field

application/json

401

Unauthorized request, the provided Authorization header is missing or invalid. In the table below only the field "error" is provided.

errorCode	error	Retryable	Comments
AUTHORIZER_UNAUTHORIZED	Unauthorized message	no	Access token not valid

application/json

403

Forbidden action detected by WAF or the application. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
AUTHORIZER_FORBIDDEN	not_authorized error message	no	User_is_not_authorized_to_access_this_resource
CARD_INVALID_STATE	-	no	CardId already registered in the solution and has an invalid card state (REPLACED or DELETED)
OPERATION_NOT_ALLOWED	Name of the operation/field that is not allowed in this operation	no	Try to update a control not defined at card product

application/json

404

Ressource not found, Unknown issuerId or consumerId or card id'. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
UNKNOWN_CARD	-	no	Unknown cardId

application/json

500

Internal Server Error. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	yes	No error details available
INTERNAL_ERROR	error details if any	no	The server has encountered an error when executing the request.

503

The service is temporarily unavailable. You may retry your request later.

patch

/v2/issuers/{issuerId}/cards/{cardId}/controls

HTTPcURLJavaScriptPython

PATCH /banking/v2/issuers/{issuerId}/cards/{cardId}/controls HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 254

{
  "controls": {
    "onlinePayment": true,
    "contactless": true,
    "magstripe": true,
    "withdrawal": true,
    "abroadPayment": true,
    "deniedCurrencies": [
      "EUR"
    ],
    "geography": {
      "regions": [
        "SCHENGEN_AREA"
      ],
      "countries": [
        "CZ"
      ]
    },
    "merchants": {
      "gambling": true,
      "adult": true,
      "risky": true
    }
  }
}

コンテンツなし

Update Card Limits

patch

https://api.d1.thalescloud.io/bankinghttps://api.d1-stg.thalescloud.io/banking

/v2/issuers/{issuerId}/cards/{cardId}/limits

This request is used by the bank backend to update card settings.

認可

bearerAuth

Authorizationstring必須

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

パスパラメータ

issuerIdstring · 最小: 10 · 最大: 10必須

The id of the issuer

cardIdstring · 最小: 1 · 最大: 48必須

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$

ヘッダーパラメータ

x-correlation-idstringオプション

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$

x-user-idstringオプション

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$

本文

application/json

レスポンス

200

Successful card setting update

400

Bad Request, Invalid request URI, header, paramters. The below table defines the possible 'Bad request' error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
FIELD_INVALID_FORMAT	Contains the field in error (first found)	no	JSON not well formatted or One field is not expected format as defined in this documentation
FIELD_INVALID_VALUE	Contains the field in error (first found)	no	One field value is not allowed for the given field

application/json

401

Unauthorized request, the provided Authorization header is missing or invalid. In the table below only the field "error" is provided.

errorCode	error	Retryable	Comments
AUTHORIZER_UNAUTHORIZED	Unauthorized message	no	Access token not valid

application/json

403

Forbidden action detected by WAF or the application. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
AUTHORIZER_FORBIDDEN	not_authorized error message	no	User_is_not_authorized_to_access_this_resource
CARD_INVALID_STATE	-	no	CardId already registered in the solution and has an invalid card state (REPLACED or DELETED)
OPERATION_NOT_ALLOWED	Name of the operation/field that is not allowed in this operation	no	Try to update a control not defined at card product

404

Ressource not found, Unknown issuerId or consumerId or card id'. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
UNKNOWN_CARD	-	no	Unknown cardId

application/json

500

Internal Server Error. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	yes	No error details available
INTERNAL_ERROR	error details if any	no	The server has encountered an error when executing the request.

503

The service is temporarily unavailable. You may retry your request later.

patch

/v2/issuers/{issuerId}/cards/{cardId}/limits

HTTPcURLJavaScriptPython

PATCH /banking/v2/issuers/{issuerId}/cards/{cardId}/limits HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 312

{
  "limits": {
    "purchase": {
      "daily": {
        "limit": 1,
        "maxLimit": 1
      },
      "weekly": {
        "limit": 1,
        "maxLimit": 1
      },
      "monthly": {
        "limit": 1,
        "maxLimit": 1
      },
      "yearly": {
        "limit": 1,
        "maxLimit": 1
      }
    },
    "withdrawal": {
      "daily": {
        "limit": 1,
        "maxLimit": 1
      },
      "weekly": {
        "limit": 1,
        "maxLimit": 1
      },
      "monthly": {
        "limit": 1,
        "maxLimit": 1
      },
      "yearly": {
        "limit": 1,
        "maxLimit": 1
      }
    }
  }
}

コンテンツなし

Resume

post

https://api.d1.thalescloud.io/bankinghttps://api.d1-stg.thalescloud.io/banking

/v2/issuers/{issuerId}/cards/{cardId}/operations:resume

This request is used by the bank backend to request the reactivation of a card that has been suspended. The card could have been suspended

• by the bank's backend

• by customer agent

• by end user using the mobile banking application

• or automatically by authorisation system when a payment validation failure retry counter has been exceeded (PIN locked, CVV2 locked or expiry date locked)

If the card is locked (PIN locked, CVV2 locked or expiry date), D1 will unlock the card whatever the reason.

Note: It cannot be used to activate a physical card for the really first time. Please refer to activatePhysicalCard

認可

bearerAuth

Authorizationstring必須

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

パスパラメータ

issuerIdstring · 最小: 10 · 最大: 10必須

The id of the issuer

cardIdstring · 最小: 1 · 最大: 48必須

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$

ヘッダーパラメータ

x-correlation-idstringオプション

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$

x-user-idstringオプション

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$

本文

application/json

reasonstringオプション

The reason why the action is performed.

This a free text field in case the bank wants to send details, that will be returned in the operations list.

Example: customer was contacted on June 28Pattern: ^[a-zA-Z0-9 ]{1,64}$

stateReasonstring · enumオプション

The reason why the action has been performed. If not provided, default reason code is ISSUER_DECISION.

可能な値:

レスポンス

200

Card resumed Successfully

application/json

400

Bad Request, Invalid request URI, header, paramters. The below table defines the possible 'Bad request' error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
FIELD_INVALID_FORMAT	Contains the field in error (first found)	no	JSON not well formatted or One field is not expected format as defined in this documentation

application/json

401

Unauthorized request, the provided Authorization header is missing or invalid. In the table below only the field "error" is provided.

errorCode	error	Retryable	Comments
AUTHORIZER_UNAUTHORIZED	Unauthorized message	no	Access token not valid

application/json

403

Forbidden action detected by WAF or the application.
The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
AUTHORIZER_FORBIDDEN	not authorized error message	no	User is not authorized to access this resource
CARD_INVALID_STATE	-	no	Resume with this state reason is not allowed

404

Ressource not found, Unknown issuerId or consumerId or card id'. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
UNKNOWN_CARD	-	no	Unknown cardId

application/json

500

Internal Server Error. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	yes	No error details available
INTERNAL_ERROR	error details if any	no	The server has encountered an error when executing the request.

application/json

503

The service is temporarily unavailable. You may retry your request later.

post

/v2/issuers/{issuerId}/cards/{cardId}/operations:resume

HTTPcURLJavaScriptPython

POST /banking/v2/issuers/{issuerId}/cards/{cardId}/operations:resume HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 78

{
  "reason": "customer was contacted on June 28",
  "stateReason": "ISSUER_DECISION"
}

{
  "operationId": "text"
}

Suspend

post

https://api.d1.thalescloud.io/bankinghttps://api.d1-stg.thalescloud.io/banking

/v2/issuers/{issuerId}/cards/{cardId}/operations:suspend

This request is used by the bank backend to request the suspention of a card. When a card is suspended:

• authorization will be declined by the system.

• end user will not be alble to digitize the card.

• But authorization with digital card will be still approved by the system.

認可

bearerAuth

Authorizationstring必須

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

パスパラメータ

issuerIdstring · 最小: 10 · 最大: 10必須

The id of the issuer

cardIdstring · 最小: 1 · 最大: 48必須

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$

ヘッダーパラメータ

x-correlation-idstringオプション

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$

x-user-idstringオプション

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$

本文

application/json

reasonstringオプション

The reason why the action is performed.

This a free text field in case the bank wants to send details, that will be returned in the operations list.

Example: customer was contacted on June 28Pattern: ^[a-zA-Z0-9 ]{1,64}$

stateReasonstring · enumオプション

The reason why the action has been performed. If not provided, default reason code is ISSUER_DECISION.

可能な値:

レスポンス

200

Card was suspended Successfully

application/json

400

Bad Request, Invalid request URI, header, paramters. The below table defines the possible 'Bad request' error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
FIELD_INVALID_FORMAT	Contains the field in error (first found)	no	JSON not well formatted or One field is not expected format as defined in this documentation

application/json

401

Unauthorized request, the provided Authorization header is missing or invalid. In the table below only the field "error" is provided.

errorCode	error	Retryable	Comments
AUTHORIZER_UNAUTHORIZED	Unauthorized message	no	Access token not valid

application/json

403

Forbidden action detected by WAF or the application. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
AUTHORIZER_FORBIDDEN	not authorized error message	no	User is not authorized to access this resource
CARD_INVALID_STATE	-	no	Suspension with this state reason is not allowed

application/json

404

Ressource not found, Unknown issuerId or consumerId or card id'. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
UNKNOWN_CARD	-	no	Unknown cardId

application/json

500

Internal Server Error. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	yes	No error details available
INTERNAL_ERROR	error details if any	no	The server has encountered an error when executing the request.

application/json

503

The service is temporarily unavailable. You may retry your request later.

post

/v2/issuers/{issuerId}/cards/{cardId}/operations:suspend

HTTPcURLJavaScriptPython

POST /banking/v2/issuers/{issuerId}/cards/{cardId}/operations:suspend HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 72

{
  "reason": "customer was contacted on June 28",
  "stateReason": "CARD_LOST"
}

{
  "operationId": "text"
}

Delete

post

https://api.d1.thalescloud.io/bankinghttps://api.d1-stg.thalescloud.io/banking

/v2/issuers/{issuerId}/cards/{cardId}/operations:delete

This request is used by the bank backend to request the deletion of a card.

For cards managed by D1 (in oposition to legacy cards that are managed by the issuer), D1 will propagate the deletion/revocation to the processor.

Note: The deletion of the card cannot be reverted. In case of card lost consider using the suspend operation first.

認可

bearerAuth

Authorizationstring必須

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

パスパラメータ

issuerIdstring · 最小: 10 · 最大: 10必須

The id of the issuer

cardIdstring · 最小: 1 · 最大: 48必須

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$

ヘッダーパラメータ

x-correlation-idstringオプション

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$

x-user-idstringオプション

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$

本文

application/json

reasonstringオプション

The reason why the action is performed.

This a free text field in case the bank wants to send details, that will be returned in the operations list.

Example: customer was contacted on June 28Pattern: ^[a-zA-Z0-9 ]{1,64}$

stateReasonstring · enumオプション

The reason why the action has been performed. If not provided, default reason code is ISSUER_DECISION.

可能な値:

レスポンス

200

Card was deleted Successfully

application/json

400

Bad Request, Invalid request URI, header, paramters. The below table defines the possible 'Bad request' error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
FIELD_INVALID_FORMAT	Contains the field in error (first found)	no	JSON not well formatted or One field is not expected format as defined in this documentation

application/json

401

Unauthorized request, the provided Authorization header is missing or invalid. In the table below only the field "error" is provided.

errorCode	error	Retryable	Comments
AUTHORIZER_UNAUTHORIZED	Unauthorized message	no	Access token not valid

application/json

403

Forbidden action detected by WAF or the application.
The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
AUTHORIZER_FORBIDDEN	not authorized error message	no	User is not authorized to access this resource
CARD_INVALID_STATE	-	no	Possible error is card already deleted with an other reason

404

Ressource not found, Unknown issuerId or consumerId or card id'. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
UNKNOWN_CARD	-	no	Unknown cardId

application/json

500

Internal Server Error. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	yes	No error details available
INTERNAL_ERROR	error details if any	no	The server has encountered an error when executing the request.

application/json

503

The service is temporarily unavailable. You may retry your request later.

post

/v2/issuers/{issuerId}/cards/{cardId}/operations:delete

HTTPcURLJavaScriptPython

POST /banking/v2/issuers/{issuerId}/cards/{cardId}/operations:delete HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 77

{
  "reason": "customer was contacted on June 28",
  "stateReason": "CLOSED_ACCOUNT"
}

{
  "operationId": "text"
}

Replace

post

https://api.d1.thalescloud.io/bankinghttps://api.d1-stg.thalescloud.io/banking

/v2/issuers/{issuerId}/cards/{cardId}/operations:replace

End user can request the bank a replacement of an existing card because the card has been lost or damaged. The replaced card is blocked until the new card is activated. The new card has a new cardId and a new card credentials (PAN and expiry date). In the particular case of Virtual Card, the new Virtual Card is automaticaly activated.

D1 manages to re-link automatically digital card from the old card to the new card upon activation.

For card registered in D1, the bank backend shall provide new cardId and new card credentials when calling the API. The new cardId used to replace the card shall be unique. The new cardId can be reused from another card (having a different PAN) under several conditions :

• The cardId to be reused is linked with a DELETED or REPLACED card (thus it's not possible to use the current cardId as newCardID when doing a replace)

• The cardId to be reused is not associated to a card issued by D1 (a card created using the CREATE card API).

• The cardId to be reused is not associated with a card product used for making transactions

• In any case, it is not possible to use a card PAN already deleted or replaced. Even by reusing a cardId. Reusing a cardId for another consumer is not recommanded. Since the cardId will disappear from the previous consumer cards list.

For card created by D1, D1 will generate a new cardId and new card credentials. Thus the newCardId shall not be provided by the issuer when calling this API.

認可

bearerAuth

Authorizationstring必須

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

パスパラメータ

issuerIdstring · 最小: 10 · 最大: 10必須

The id of the issuer

cardIdstring · 最小: 1 · 最大: 48必須

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$

ヘッダーパラメータ

x-correlation-idstringオプション

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$

x-user-idstringオプション

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$

本文

application/json

newCardIdstring · 最小: 1 · 最大: 48オプション

Unique identifier of the new card. Provided in case the card is in REPLACED state.

Pattern: ^[A-Za-z0-9_-]{1,48}$

encryptedDatastring · 最大: 8192オプション

The encryptedData has to be provided in case of card registered in D1. It is not needed for card created by D1.
The encryptedData is the encrypted json (cf http://www.json.org/) representation of the Card information. This value is encrypted using the JWE encryption (please refer to the Encrypt sensitive data for more details)

Once deciphered, the plaintext contains a json structure with:

JSON field parameter name	description	MOC	Format
pan	The funding pan value.	M	string - up to 19 digits
exp	The expiry date of the card.	M	string - 4 digits, following the format MMYY
auxiliaryPan	The auxiliary funding pan value. It shall be provided when cobadge is supported and if the card has an auxiliary pan.	C	string - up to 19 digits
auxiliaryExp	The auxiliary expiry date of the card. It shall be provided when cobadge is supported and if the card has an auxiliary pan.	C	string - 4 digits, following the format MMYY

Pattern: ^(?:[\x20-\x2D\x2F-\x7F]*\.){4}(?:[\x20-\x2D\x2F-\x7F]*)$

reasonstring必須

The reason why the action is performed.

This a free text field in case the bank wants to send details, that will be returned in the operations list.

Example: customer was contacted on June 28Pattern: ^[a-zA-Z0-9 ]{1,64}$

stateReasonstring · enum必須

The reason why the action has been performed. If not provided, default reason code is ISSUER_DECISION.

可能な値:

レスポンス

200

Card was replaced Successfully

application/json

400

Bad Request, Invalid request URI, header, paramters. The below table defines the possible 'Bad request' error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
FIELD_INVALID_FORMAT	Contains the field in error (first found)	no	JSON not well formatted or One field is not expected format as defined in this documentation
FIELD_INVALID_VALUE	Contains the field in error (first found)	no	One field value is not allowed for the given field
CRYPTO_ERROR	-	no	Not possible to decrypt the provided encrypted data
INVALID_PAN	-	no	PAN is invalid
INVALID_EXPIRY_DATE	Expiry date is invalid

application/json

401

Unauthorized request, the provided Authorization header is missing or invalid. In the table below only the field "error" is provided.

errorCode	error	Retryable	Comments
AUTHORIZER_UNAUTHORIZED	Unauthorized message	no	Access token not valid

application/json

403

Forbidden action detected by WAF or the application. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
AUTHORIZER_FORBIDDEN	not authorized error message	no	User is not authorized to access this resource
CARD_INVALID_STATE	-	no	The card to replace is in invalid state (DELETED, REPLACED)
CARD_ALREADY_EXISTS	-	no	The new card referenced by newCardId or new PAN already exists in the solution

application/json

404

Ressource not found, Unknown issuerId or consumerId or card id'. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
UNKNOWN_CARD	-	no	Unknown cardId

application/json

500

Internal Server Error. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	yes	No error details available
INTERNAL_ERROR	error details if any	no	The server has encountered an error when executing the request.

application/json

503

The service is temporarily unavailable. You may retry your request later.

post

/v2/issuers/{issuerId}/cards/{cardId}/operations:replace

HTTPcURLJavaScriptPython

POST /banking/v2/issuers/{issuerId}/cards/{cardId}/operations:replace HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 114

{
  "newCardId": "text",
  "encryptedData": "text",
  "reason": "customer was contacted on June 28",
  "stateReason": "CARD_LOST"
}

{
  "operationId": "text",
  "newCardId": "text"
}

Renew

post

https://api.d1.thalescloud.io/bankinghttps://api.d1-stg.thalescloud.io/banking

/v2/issuers/{issuerId}/cards/{cardId}/operations:renew

Card renewal is the process where a new card is provided to end-user. The new card has new expiry date, but cardId and PAN are remaining the same.

For card registered in D1, this request is used by the bank backend to inform that card has been renewed. In such case the new expiry date shall be provided. Moreover, the auxiliary expiry date of the card shall also be provided for cobadged cards that have an auxiliary pan.

For card created by D1, this request is used by the bank backend to manualy request the renewal of an existing card (a new expiry date will be generated by D1).

In the particular case of the Virtual Card, the Virtual Card is automaticaly activated. For Physical Card, the renewed card will remain active until:

• an explicit activation perfomed using the activation operation using the same cardId as the renew card

• an implicit activation following a valid card present transaction (if card product is configured as such)

認可

bearerAuth

Authorizationstring必須

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

パスパラメータ

issuerIdstring · 最小: 10 · 最大: 10必須

The id of the issuer

cardIdstring · 最小: 1 · 最大: 48必須

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$

ヘッダーパラメータ

x-correlation-idstringオプション

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$

x-user-idstringオプション

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$

本文

application/json

newExpstringオプション

Expiry date of the card in MMYY format

Example: 1024Pattern: ^(0[1-9]|1[0-2])\d{2}$

newAuxiliaryExpstringオプション

Expiry date of the card in MMYY format

Example: 1024Pattern: ^(0[1-9]|1[0-2])\d{2}$

reasonstringオプション

The reason why the action is performed.

This a free text field in case the bank wants to send details, that will be returned in the operations list.

Example: customer was contacted on June 28Pattern: ^[a-zA-Z0-9 ]{1,64}$

stateReasonstring · enumオプション

The reason why the action has been performed. If not provided, default reason code is ISSUER_DECISION.

可能な値:

レスポンス

200

Card was renewed Successfully

application/json

400

Bad Request, Invalid request URI, header, paramters. The below table defines the possible 'Bad request' error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
FIELD_INVALID_FORMAT	Contains the field in error (first found)	no	JSON not well formatted or One field is not expected format as defined in this documentation
FIELD_INVALID_VALUE	Contains the field in error (first found)	no	One field is

application/json

401

Unauthorized request, the provided Authorization header is missing or invalid. In the table below only the field "error" is provided.

errorCode	error	Retryable	Comments
AUTHORIZER_UNAUTHORIZED	Unauthorized message	no	Access token not valid

application/json

403

Forbidden action detected by WAF or the application. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
AUTHORIZER_FORBIDDEN	not authorized error message	no	User is not authorized to access this resource
CARD_INVALID_STATE	-	no	Renewal with this state reason is not allowed

application/json

404

Ressource not found, Unknown issuerId or consumerId or card id'. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
UNKNOWN_CARD	-	no	Unknown cardId

application/json

500

Internal Server Error. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	yes	No error details available
INTERNAL_ERROR	error details if any	no	The server has encountered an error when executing the request.

application/json

503

The service is temporarily unavailable. You may retry your request later.

post

/v2/issuers/{issuerId}/cards/{cardId}/operations:renew

HTTPcURLJavaScriptPython

POST /banking/v2/issuers/{issuerId}/cards/{cardId}/operations:renew HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 119

{
  "newExp": "1024",
  "newAuxiliaryExp": "1024",
  "reason": "customer was contacted on June 28",
  "stateReason": "ISSUER_DECISION"
}

{
  "operationId": "text"
}

Get All Card Authorisation Operations

get

https://api.d1.thalescloud.io/bankinghttps://api.d1-stg.thalescloud.io/banking

/v2/issuers/{issuerId}/cards/{cardId}/authorisations/operations

This request is used by the core banking system to retrieve all the authorisations related to a card and its linked digital card. The API specifies the starting point (offset) and the number of authorization (limit) to be retrieved:

• Offset 0 (the default) corresponds to the most recent operation.

• Use a stricly positive number and multipe of limit number to get older operations. Attention D1 will reject the reqest if offset is not a mulitpe of limit. For example in case of limit of 10:

• Use offset of 0 to get the last 10 most recents operations (0 to 10)

• Use offset of 10 to get the next 10 operations (10 to 20)

• Use offset of 20 to get the next 10 operations (20 to 30)

• If you use 9 or 11 as offset, the request will be rejected by D1.

Optionally, the request can filter operations for a given period using startDate and endDate parameters.

Search authorisations by operation id is also possible.

認可

bearerAuth

Authorizationstring必須

A JWT generated by the Get Authorization Token API.
The server checks the validity of the provided token to control access to this protected resource. Please refer to Get OAuth 2.0 access token for more details on the flow and on how to get this JWT.

パスパラメータ

issuerIdstring · 最小: 10 · 最大: 10必須

The id of the issuer

cardIdstring · 最小: 1 · 最大: 48必須

Unique identifier of the card.

Pattern: ^[A-Za-z0-9_-]{1,48}$

クエリパラメータ

limitinteger · 最小: 1 · 最大: 50オプション

Upper limit of the query

Default: 10

offsetintegerオプション

Index from which the query starts returning operations (default value: 0)

startDatestring · 最小: 1 · 最大: 64オプション

Start date for the search criteria

Example: 2022-02-16T06:28:02.492ZPattern: ^[0-9]{4}-((0[13578]|1[02])-(0[1-9]|[12][0-9]|3[01])|(0[469]|11)-(0[1-9]|[12][0-9]|30)|02-(0[1-9]|[12][0-9]))T([0-1][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](\.[0-9]{3}Z|\.[0-9]{2}([\+\-](0[1-9]|1[0-2])):00)$

endDatestring · 最小: 1 · 最大: 64オプション

End date for the search criteria

Example: 2022-02-16T06:28:02.492ZPattern: ^[0-9]{4}-((0[13578]|1[02])-(0[1-9]|[12][0-9]|3[01])|(0[469]|11)-(0[1-9]|[12][0-9]|30)|02-(0[1-9]|[12][0-9]))T([0-1][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](\.[0-9]{3}Z|\.[0-9]{2}([\+\-](0[1-9]|1[0-2])):00)$

operationIdstring · 最小: 1 · 最大: 12オプション

Id corresponding to Retrieval Reference Number (ISO-8583 SID / Field No 37).

ヘッダーパラメータ

x-user-idstringオプション

Identifier of the user that requests the operation on D1 API. This value is provided for information purpose, D1 doesn't do any verification based on this identifier.
D1 manages to propagate the information to a subsequent internal system for tracking purpose.
This identifier is not mandatory.

Pattern: ^[A-Za-z0-9_-]{1,15}$

x-correlation-idstringオプション

Random identifier which can be used to correlate the different API calls done as part of a single use-case. This identifier will be the one primarily used for troubleshooting.

Warning: This identifier should not be derived from sensitive personal data, as its value will be logged in clear.

There is no strong guarantee of the uniqueness of this identifier, so please refrain from using it for other purpose than logging and troubleshooting.

Pattern: ^[A-Za-z0-9_-]{1,64}$

レスポンス

200

OK

application/json

400

Bad Request, Invalid request URI, header, paramters. The below table defines the possible 'Bad request' error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
FIELD_INVALID_VALUE	Contains the field in error (first found)	no	One field is not expected format as defined in this documentation

application/json

401

Unauthorized request, the provided Authorization header is missing or invalid. In the table below only the field "error" is provided.

errorCode	error	Retryable	Comments
AUTHORIZER_UNAUTHORIZED	Unauthorized message	no	Access token not valid

application/json

403

Forbidden action detected by WAF or the application. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
AUTHORIZER_FORBIDDEN	not authorized error message	no	User is not authorized to access this resource

application/json

404

Ressource not found, Unknown issuerId or consumerId or card id'. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	no	No error details available
UNKNOWN_CARD	-	no	Unknown cardId

application/json

500

Internal Server Error. The below table defines the possible error:

errorCode	error	Retryable	Comments
-	-	yes	No error details available
INTERNAL_ERROR	error details if any	no	The server has encountered an error when executing the request.

application/json

503

The service is temporarily unavailable. You may retry your request later.

get

/v2/issuers/{issuerId}/cards/{cardId}/authorisations/operations

HTTPcURLJavaScriptPython

GET /banking/v2/issuers/{issuerId}/cards/{cardId}/authorisations/operations HTTP/1.1
Host: api.d1.thalescloud.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "operations": [
    {
      "operationId": "text",
      "operation": "PURCHASE",
      "status": "APPROVED",
      "startTime": "2022-06-16T06:28:02.492Z",
      "errorCode": "INVALID_CARD_STATE",
      "details": {
        "isoMessageType": "1100",
        "transactionDate": "2022-06-16T06:28:02.492Z",
        "transmissionDate": "2022-06-16T06:28:02.492Z",
        "retrievalReferenceNumber": "230710891451",
        "stan": "891451",
        "internalStan": "980588",
        "actionCode": "000",
        "declinedReason": "INVALID_CARD_STATE",
        "declinedDetails": "INVALID_CVV2",
        "amount": 2100,
        "currencyCode": "EUR",
        "billingAmount": 2100,
        "billingCurrencyCode": "EUR",
        "conversionRate": 1.092479,
        "replacementAmount": 2100,
        "replacementCurrencyCode": "EUR",
        "accountNumber": "text",
        "standInProcessing": false,
        "functionCode": "100",
        "messageReasonCode": "1002",
        "cardPresent": false,
        "cardDataInputMode": "1",
        "initiatingParty": "CARDHOLDER",
        "acquirerCountryCode": "FR",
        "merchant": {
          "merchantId": "text",
          "merchantNameAddress": "text",
          "merchantName": "text",
          "city": "text",
          "countryCode": "FR",
          "merchantType": "5542"
        },
        "digitalCard": {
          "digitalCardId": "text",
          "digitalCardRequestorId": "text"
        }
      }
    }
  ]
}