Token Provisioning and Management API
Unique request identifier use to trace function calls across system
Unique Identifier of Issuer
ISSUER1234A unique identifier of the issuer that aims to identify the funding card.
This parameter is provided by the TSH.
Upon configuration it corresponds either to issuerCardRefId or walletCardRefId (e.g. for ApplePay, it corresponds to the FPANID in such case)
Wallet Provider identifier, defined by Thales
For:
- Apple Pay, the value is 'APPLE_PAY'
- Samsung Pay HCE/TEE, the value is 'SPAYHCE'
- Android Pay, the value is 'ANDROID_PAY'
- For other wallet (such as HCE Wallet), id is provided during on-boarding phase Value always provided except for ECOM.
TSH sends card information as JSON encrypted using the PKCS#7 encryption scheme defined in RFC 2315/5652 using following encryption parameters:
- The content encryption algorithm used is AES256/CBC/PKCS7Padding using a randomly generated AES key.
- The key encryption algorithm is either RSAES-PKCS1-v1_5 (RSA/NONE/PKCS1Padding) or RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256), using the certificate provided during onboarding.
The key encryption algorithm is defined during onboarding and is by default (if ommitted) the RSA/NONE/PKCS1Padding for legacy purpose.
It is recommended to configure RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256) for new TSPs. - The encryption result is then encoded using base64.
- The public key length in the certificate can be 2048-bit or 4096-bit.
Once deciphered, the card info contains the following information:
| JSON field parameter name | description | MOC | Length |
|---|---|---|---|
| fpan | The funding pan to digitize | M | Up to 19 |
| exp | The expiry date in the format MMYY | O | 4 |
| cvv | Depending of the OEM, this value is provided or not | O | 3 or 4 |
| additionalCardInfos | Optional JSON Open format, in order to add additional card info - project dependent | O | Up to 8177 |
Note: If not provided, the TSP must rely on the cardRefId provided to find the funding card to digitize from its token vault.
Identifier of the key used to encrypt cipheredCardInfo.
Provided by TSP to Thales during onboarding.
ID of the token product (Identify token domain).
As the token products are mapped to Issuer card products, the values shall be defined at the begining of the project with the TSP.
ID of the token requestor in the format expected by the TSP
Unique identifier of the merchant gateway.
Applicable to ECOM only.
MGW_123456Token storage unique identifier (also known as deviceId or applicationId).
Indicates the storage in which the token has been digitized.
For ApplePay, it corresponds to the device SEID.
Not applicable for ECOM.
The tokenId provided in case the Wallet Provider wants to re-use an existing token
Initial state of the token when created.
Default value is SUSPENDED
SUSPENDEDPossible values: createToken response payload
Unique Token Identifier
Bad Request, Invalid request URI or header, or unsupported nonstandard parameter.
Possible error codes are 111, 112, 113, 115, 163, 164, 166, 167, 911, 921
Internal Server Error Retry possible
Service Unavailable Retry possible
Identifier of the token
Unique request identifier use to trace function calls across system
Unique Identifier of Issuer
ISSUER1234TSH sends new card information as JSON encrypted using the PKCS#7 encryption scheme defined in RFC 2315/5652 using following encryption parameters:
- The content encryption algorithm used is AES256/CBC/PKCS7Padding using a randomly generated AES key.
- The key encryption algorithm is either RSAES-PKCS1-v1_5 (RSA/NONE/PKCS1Padding) or RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256), using the certificate provided during onboarding.
The key encryption algorithm is defined during onboarding and is by default (if ommitted) the RSA/NONE/PKCS1Padding for legacy purpose.
It is recommended to configure RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256) for new TSPs. - The encryption result is then encoded using base64.
- The public key length in the certificate can be 2048-bit or 4096-bit.
Once deciphered, the card info contains the following information:
| JSON field parameter name | description | MOC | Length |
|---|---|---|---|
| newFpan | The new funding pan value to update | O | Up to 19 |
| newExp | The new expiry date in the format MMYY | O | 4 |
| newAdditionalCardInfos | Optional JSON Open format, in order add/update/delete additional card info - project dependent | O | Up to 8177 |
Note: At least one of the three JSON fields needs to be provided.
Identifier of the key used to encrypt newCipheredCardInfo.
Provided by TSP to Thales during onboarding.
A unique identifier of the issuer that aims to identify the funding card.
This parameter is provided by the TSH.
Upon configuration it corresponds either to issuerCardRefId or walletCardRefId (e.g. for ApplePay, it corresponds to the FPANID in such case)
successful
Bad Request, Invalid request URI or header, or unsupported nonstandard parameter.
Possible error codes are 111, 112, 113, 119, 163, 166, 432, 911, 921
Internal Server Error Retry possible
Service Unavailable Retry possible
No content
Identifier of the token
Unique request identifier use to trace function calls across system
Unique Identifier of Issuer
ISSUER1234state of the token
The reason of the state update
Possible values are:
| reason code | description |
|---|---|
| 11001 | Activation from user interaction |
| 21001 | Activation initiated by the issuer |
| 21002 | Deletion initiated by the issuer |
| 11002 | Deletion initiated by the user |
| 21003 | Suspension initiated by the issuer |
| 11003 | Suspension initiated by the user |
| 21004 | Resumption initiated by the issuer |
| 11004 | Resumption initiated by the user |
successful
Bad Request, Invalid request URI or header, or unsupported nonstandard parameter.
Possible error codes are 111, 112, 113, 119, 432, 911, 921
Internal Server Error Retry possible
Service Unavailable Retry possible
No content
Identifier of the issuer
Identifier of the token
Unique request identifier use to trace function calls across system
getTokenCredentials response payload
The token credentials data encrypted with JWE format (https://datatracker.ietf.org/doc/html/rfc7516) using following encryption parameters:
- JWE base64url encoded string
- "alg" (Algorithm) header parameter: ECDH-ES
- "enc" (Encryption Algorithm) header parameter: A256GCM
- "kid" (Key ID) header parameter: Key identifier corresponding to EC public key of the recipient
- EC curve: P-256 The JSON object that is encrypted is defined as follows:
| JSON field parameter name | description | MOC | Length |
|---|---|---|---|
| dpan | The token PAN value | M | Up to 19 |
| exp | The token expiry date in the format MMYY | M | 4 |
| fpan | The funding PAN value | M | Up to 19 |
| fpanExp | The funding PAN expiry date in the format MMYY | M | 4 |
| paymentAccountReference | The payment account reference | O | 29 |
| serviceCode | The service code used in track2 data | O | 3 |
| psn | The token PAN sequence number | O | 2 |
Example: {"dpan:"9580981500100002", "exp":"1232", "fpan":"9680981500100003", "fpanExp":"1230", "paymentAccountReference":"23R0PAYMENTACCOUNTREFERENCEXX", "serviceCode":"123", "psn":"01"} |
Bad Request, Invalid request URI or header, or unsupported nonstandard parameter.
Possible error codes are 111, 112, 113, 115, 163, 164, 166, 167, 911, 921
Internal Server Error Retry possible
Service Unavailable Retry possible
Identifier of the token
Unique request identifier use to trace function calls across system
Unique Identifier of Issuer
ISSUER1234Value of the application transaction counter that will be used in the next payment transaction. The ATC is encoded as an hexa string on 4 digits.
Value of the replenishment counter for the last replenishment.
Transaction records for the last transactions as specified by the payment scheme. The transaction records data is encoded in base 64.
Signature of the transaction records computed according to the scheme specifications and encoded in hexa.
requestReplenishment response payload
Value of the replenishment counter for the last replenishment.
Bad Request, Invalid request URI or header, or unsupported nonstandard parameter.
Possible error codes are 111, 112, 119, 432, 911, 921
Internal Server Error Retry possible
Service Unavailable Retry possible
Identifier of the token
Unique request identifier use to trace function calls across system
Unique Identifier of Issuer
ISSUER1234Value of the replenishment counter for the last replenishment.
Payment credential diversifier:
- For an SUK, this is an ATC which is a string of 4 hexa digits.
- For an LUK, this is an "YHHHHCC" Visa CBP diversifier which is a string of 7 digits.
successful
Bad Request, Invalid request URI or header, or unsupported nonstandard parameter.
Possible error codes are 111, 112, 119, 432, 911, 921
Internal Server Error Retry possible
Service Unavailable Retry possible
No content
Identifier of the token
Unique request identifier use to trace function calls across system
Unique Identifier of Issuer
ISSUER1234successful
Bad Request, Invalid request URI or header, or unsupported nonstandard parameter.
Possible error codes are 111, 112, 113, 119, 911, 921
Internal Server Error Retry possible
Service Unavailable Retry possible
No content
Unique request identifier use to trace function calls across system
successful
Bad Request, Invalid request URI or header, or unsupported nonstandard parameter.
Possible error codes are 111, 112, 911, 921
Internal Server Error Retry possible
Service Unavailable Retry possible
No content
Identifier of the token
Unique request identifier use to trace function calls across system
Unique Identifier of Issuer
ISSUER1234ID of the token product (Identify token domain).
As the token products are mapped to Issuer card products, the values shall be defined at the begining of the project with the TSP.
successful
Bad Request, Invalid request URI or header, or unsupported nonstandard parameter.
Possible error codes are 111, 112, 113, 119, 321, 432, 911, 921
Internal Server Error Retry possible
Service Unavailable Retry possible
No content
Unique request identifier use to trace function calls across system
Unique Identifier of Issuer
ISSUER1234TSH sends card information as JSON encrypted using the PKCS#7 encryption scheme defined in RFC 2315/5652 using following encryption parameters:
- The content encryption algorithm used is AES256/CBC/PKCS7Padding using a randomly generated AES key.
- The key encryption algorithm is either RSAES-PKCS1-v1_5 (RSA/NONE/PKCS1Padding) or RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256), using the certificate provided during onboarding.
The key encryption algorithm is defined during onboarding and is by default (if ommitted) the RSA/NONE/PKCS1Padding for legacy purpose.
It is recommended to configure RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256) for new TSPs. - The encryption result is then encoded using base64.
- The public key length in the certificate can be 2048-bit or 4096-bit.
Once deciphered, the card info contains the following information:
| JSON field parameter name | description | MOC | Length |
|---|---|---|---|
| fpan | The funding pan | M | Up to 19 |
TSH sends token information as JSON encrypted using the PKCS#7 encryption scheme defined in RFC 2315/5652 using following encryption parameters:
- The content encryption algorithm used is AES256/CBC/PKCS7Padding using a randomly generated AES key.
- The key encryption algorithm is either RSAES-PKCS1-v1_5 (RSA/NONE/PKCS1Padding) or RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256), using the certificate provided during onboarding.
The key encryption algorithm is defined during onboarding and is by default (if ommitted) the RSA/NONE/PKCS1Padding for legacy purpose.
It is recommended to configure RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256) for new TSPs. - The encryption result is then encoded using base64.
- The public key length in the certificate can be 2048-bit or 4096-bit.
Once deciphered, the card info contains the following information:
| JSON field parameter name | description | MOC | Length |
|---|---|---|---|
| dpan | The token PAN | M | Up to 19 |
A unique identifier of the issuer that aims to identify the funding card.
This parameter is provided by the TSH.
Upon configuration it corresponds either to issuerCardRefId or walletCardRefId (e.g. for ApplePay, it corresponds to the FPANID in such case)
Identifier of the key used to encrypt cipheredCardInfo.
Provided by TSP to Thales during onboarding.
listTokens response payload
Bad Request, Invalid request URI or header, or unsupported nonstandard parameter.
Possible error codes are 111, 112, 113, 166, 911, 921
Internal Server Error Retry possible
Service Unavailable Retry possible
Identifier of the token
Unique request identifier use to trace function calls across system
Unique Identifier of Issuer
ISSUER1234replenishToken response payload
Label of the key used to encrypt paymentKeys
KCV of the Key Encryption Key
String representation of JSON array of objects containing payment keys
as defined in Data Preparation section
Bad Request, Invalid request URI or header, or unsupported nonstandard parameter.
Possible error codes are 111, 112, 113, 119, 321, 432, 911, 921
Internal Server Error Retry possible
Service Unavailable Retry possible
Identifier of the token
Unique request identifier use to trace function calls across system
Unique Identifier of Issuer
ISSUER1234successful
Bad Request, Invalid request URI or header, or unsupported nonstandard parameter.
Possible error codes are 111, 112, 113, 119, 911, 921
Internal Server Error Retry possible
Service Unavailable Retry possible
No content
Identifier of the merchant gateway
Unique request identifier use to trace function calls across system
An unique merchant name that is end user friendly.
My MerchantPattern: ^[A-Za-z0-9-_. ]+$createMerchant response payload
Merchant ID generated by TSP.
It is computed as per EMVCo TRID format.
10610027312Bad Request, Invalid request URI or header, or unsupported nonstandard parameter.
Possible error codes are 111, 112, 113, 115, 163, 164, 166, 167, 911, 921
Internal Server Error Retry possible
Service Unavailable Retry possible
Last updated
Was this helpful?