Welcome to our new developer portal! Use the "Ask" button to chat with our AI Agent.
For the complete documentation index, see llms.txt. This page is also available as Markdown.

API de aprovisionamiento y gestión de tokens

POST /tokens

post

This method is used by TSH to request the creation of a new token.

Parámetros de encabezado
x-request-idstring · mín: 1 · máx: 64Requerido

Unique request identifier use to trace function calls across system

Cuerpo
issuerIdstring · mín: 10 · máx: 10Requerido

Unique Identifier of Issuer

Example: ISSUER1234
cardRefIdstring · mín: 1 · máx: 64Requerido

A unique identifier of the issuer that aims to identify the funding card.
This parameter is provided by the TSH.
Upon configuration it corresponds either to issuerCardRefId or walletCardRefId (e.g. for ApplePay, it corresponds to the FPANID in such case)

walletProviderIdstring · mín: 1 · máx: 32Opcional

Wallet Provider identifier, defined by Thales
For:

  • Apple Pay, the value is 'APPLE_PAY'
  • Samsung Pay HCE/TEE, the value is 'SPAYHCE'
  • Android Pay, the value is 'ANDROID_PAY'
  • For other wallet (such as HCE Wallet), id is provided during on-boarding phase Value always provided except for ECOM.
cipheredCardInfostring · mín: 1 · máx: 8196Opcional

TSH sends card information as JSON encrypted using the PKCS#7 encryption scheme defined in RFC 2315/5652 using following encryption parameters:

  • The content encryption algorithm used is AES256/CBC/PKCS7Padding using a randomly generated AES key.
  • The key encryption algorithm is either RSAES-PKCS1-v1_5 (RSA/NONE/PKCS1Padding) or RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256), using the certificate provided during onboarding.
    The key encryption algorithm is defined during onboarding and is by default (if ommitted) the RSA/NONE/PKCS1Padding for legacy purpose.
    It is recommended to configure RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256) for new TSPs.
  • The encryption result is then encoded using base64.
  • The public key length in the certificate can be 2048-bit or 4096-bit.

Once deciphered, the card info contains the following information:

JSON field parameter namedescriptionMOCLength
fpanThe funding pan to digitizeMUp to 19
expThe expiry date in the format MMYYO4
cvvDepending of the OEM, this value is provided or notO3 or 4
additionalCardInfosOptional JSON Open format, in order to add additional card info - project dependentOUp to 8177

Note: If not provided, the TSP must rely on the cardRefId provided to find the funding card to digitize from its token vault.

publicKeyIdentifierstring · mín: 1 · máx: 32Opcional

Identifier of the key used to encrypt cipheredCardInfo.
Provided by TSP to Thales during onboarding.

tokenProductIdstring · mín: 1 · máx: 48Opcional

ID of the token product (Identify token domain).

As the token products are mapped to Issuer card products, the values shall be defined at the begining of the project with the TSP.

tokenRequestorIdstring · mín: 1 · máx: 48Requerido

ID of the token requestor in the format expected by the TSP

merchantGatewayIdstring · mín: 10 · máx: 10Opcional

Unique identifier of the merchant gateway.
Applicable to ECOM only.

Example: MGW_123456
tokenStorageIdstring · mín: 1 · máx: 64Opcional

Token storage unique identifier (also known as deviceId or applicationId).
Indicates the storage in which the token has been digitized.
For ApplePay, it corresponds to the device SEID.
Not applicable for ECOM.

reusedTokenIdstring · mín: 1 · máx: 48Opcional

The tokenId provided in case the Wallet Provider wants to re-use an existing token

initialStatestring · enumOpcional

Initial state of the token when created.
Default value is SUSPENDED

Example: SUSPENDEDValores posibles:
Respuestas
200

createToken response payload

application/json
tokenIdstring · mín: 1 · máx: 48Requerido

Unique Token Identifier

post/tokens

PUT /tokens/{tokenId}/cardInfo

put

This method is used by TSH to request the update of funding pan information of the token

Parámetros de ruta
tokenIdstring · mín: 1 · máx: 48Requerido

Identifier of the token

Parámetros de encabezado
x-request-idstring · mín: 1 · máx: 64Requerido

Unique request identifier use to trace function calls across system

Cuerpo
issuerIdstring · mín: 10 · máx: 10Requerido

Unique Identifier of Issuer

Example: ISSUER1234
newCipheredCardInfostring · mín: 1 · máx: 8196Requerido

TSH sends new card information as JSON encrypted using the PKCS#7 encryption scheme defined in RFC 2315/5652 using following encryption parameters:

  • The content encryption algorithm used is AES256/CBC/PKCS7Padding using a randomly generated AES key.
  • The key encryption algorithm is either RSAES-PKCS1-v1_5 (RSA/NONE/PKCS1Padding) or RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256), using the certificate provided during onboarding.
    The key encryption algorithm is defined during onboarding and is by default (if ommitted) the RSA/NONE/PKCS1Padding for legacy purpose.
    It is recommended to configure RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256) for new TSPs.
  • The encryption result is then encoded using base64.
  • The public key length in the certificate can be 2048-bit or 4096-bit.

Once deciphered, the card info contains the following information:

JSON field parameter namedescriptionMOCLength
newFpanThe new funding pan value to updateOUp to 19
newExpThe new expiry date in the format MMYYO4
newAdditionalCardInfosOptional JSON Open format, in order add/update/delete additional card info - project dependentOUp to 8177

Note: At least one of the three JSON fields needs to be provided.

publicKeyIdentifierstring · mín: 1 · máx: 32Opcional

Identifier of the key used to encrypt newCipheredCardInfo.
Provided by TSP to Thales during onboarding.

newCardRefIdstring · mín: 1 · máx: 64Opcional

A unique identifier of the issuer that aims to identify the funding card.
This parameter is provided by the TSH.
Upon configuration it corresponds either to issuerCardRefId or walletCardRefId (e.g. for ApplePay, it corresponds to the FPANID in such case)

Respuestas
204

successful

Sin contenido

put/tokens/{tokenId}/cardInfo

Sin contenido

PUT /tokens/{tokenId}/state

put

This method is used by TSH to request the update of token state

Parámetros de ruta
tokenIdstring · mín: 1 · máx: 48Requerido

Identifier of the token

Parámetros de encabezado
x-request-idstring · mín: 1 · máx: 64Requerido

Unique request identifier use to trace function calls across system

Cuerpo
issuerIdstring · mín: 10 · máx: 10Requerido

Unique Identifier of Issuer

Example: ISSUER1234
newStatestring · enumRequerido

state of the token

Valores posibles:
reasonstring · mín: 1 · máx: 16Opcional

The reason of the state update

Possible values are:

reason codedescription
11001Activation from user interaction
21001Activation initiated by the issuer
21002Deletion initiated by the issuer
11002Deletion initiated by the user
21003Suspension initiated by the issuer
11003Suspension initiated by the user
21004Resumption initiated by the issuer
11004Resumption initiated by the user
Respuestas
204

successful

Sin contenido

put/tokens/{tokenId}/state

Sin contenido

GET /issuers/{issuerId}/tokens/{tokenId}/credentials

get

This method is used by TSH to request the credentials of an existing token.

Parámetros de ruta
issuerIdstring · mín: 10 · máx: 10Requerido

Identifier of the issuer

tokenIdstring · mín: 1 · máx: 48Requerido

Identifier of the token

Parámetros de encabezado
x-request-idstring · mín: 1 · máx: 64Requerido

Unique request identifier use to trace function calls across system

Respuestas
200

getTokenCredentials response payload

application/json
encryptedDatastringRequerido

The token credentials data encrypted with JWE format (https://datatracker.ietf.org/doc/html/rfc7516) using following encryption parameters:

  • JWE base64url encoded string
  • "alg" (Algorithm) header parameter: ECDH-ES
  • "enc" (Encryption Algorithm) header parameter: A256GCM
  • "kid" (Key ID) header parameter: Key identifier corresponding to EC public key of the recipient
  • EC curve: P-256 The JSON object that is encrypted is defined as follows:
JSON field parameter namedescriptionMOCLength
dpanThe token PAN valueMUp to 19
expThe token expiry date in the format MMYYM4
fpanThe funding PAN valueMUp to 19
fpanExpThe funding PAN expiry date in the format MMYYM4
paymentAccountReferenceThe payment account referenceO29
serviceCodeThe service code used in track2 dataO3
psnThe token PAN sequence numberO2
Example: {"dpan:"9580981500100002", "exp":"1232", "fpan":"9680981500100003", "fpanExp":"1230", "paymentAccountReference":"23R0PAYMENTACCOUNTREFERENCEXX", "serviceCode":"123", "psn":"01"}
get/issuers/{issuerId}/tokens/{tokenId}/credentials

POST /tokens/{tokenId}/replenishment

post

This method is used by TSH, in case of HCE, to request replenishment of payment credentials in the mobile wallet. This API only applies to TSH Pay solution (Issuer HCE wallet).

Parámetros de ruta
tokenIdstring · mín: 1 · máx: 48Requerido

Identifier of the token

Parámetros de encabezado
x-request-idstring · mín: 1 · máx: 64Requerido

Unique request identifier use to trace function calls across system

Cuerpo
issuerIdstring · mín: 10 · máx: 10Requerido

Unique Identifier of Issuer

Example: ISSUER1234
atcstring · mín: 4 · máx: 4Requerido

Value of the application transaction counter that will be used in the next payment transaction. The ATC is encoded as an hexa string on 4 digits.

lastRepCounterstring · máx: 5Requerido

Value of the replenishment counter for the last replenishment.

schemeTranRecordsstring · máx: 2000Opcional

Transaction records for the last transactions as specified by the payment scheme. The transaction records data is encoded in base 64.

schemeTranRecSigstring · máx: 200Opcional

Signature of the transaction records computed according to the scheme specifications and encoded in hexa.

Respuestas
200

requestReplenishment response payload

application/json
repCounterstring · máx: 5Requerido

Value of the replenishment counter for the last replenishment.

post/tokens/{tokenId}/replenishment

PUT /tokens/{tokenId}/replenishment/status

put

This method is used by TSH, in case of HCE, to notify the TSP the replenishment of payment credentials has been completed in the mobile wallet. This API only applies to TSH Pay solution (Issuer HCE wallet).

Parámetros de ruta
tokenIdstring · mín: 1 · máx: 48Requerido

Identifier of the token

Parámetros de encabezado
x-request-idstring · mín: 1 · máx: 64Requerido

Unique request identifier use to trace function calls across system

Cuerpo
issuerIdstring · mín: 10 · máx: 10Requerido

Unique Identifier of Issuer

Example: ISSUER1234
repCounterstring · máx: 5Requerido

Value of the replenishment counter for the last replenishment.

diversifiersstring[]Opcional

Payment credential diversifier:

  • For an SUK, this is an ATC which is a string of 4 hexa digits.
  • For an LUK, this is an "YHHHHCC" Visa CBP diversifier which is a string of 7 digits.
Respuestas
204

successful

Sin contenido

put/tokens/{tokenId}/replenishment/status

Sin contenido

PUT /tokens/{tokenId}/newData/status

put

This method is used by TSH to inform the TSP about the token re-personalization result in case of token renewal.

Parámetros de ruta
tokenIdstring · mín: 1 · máx: 48Requerido

Identifier of the token

Parámetros de encabezado
x-request-idstring · mín: 1 · máx: 64Requerido

Unique request identifier use to trace function calls across system

Cuerpo
issuerIdstring · mín: 10 · máx: 10Requerido

Unique Identifier of Issuer

Example: ISSUER1234
statusstring · enumRequeridoValores posibles:
Respuestas
204

successful

Sin contenido

put/tokens/{tokenId}/newData/status

Sin contenido

GET /healthCheck

get

This method is used by TSH to monitor TSP health. It should be used every 30 seconds in production environment.

Parámetros de encabezado
x-request-idstring · mín: 1 · máx: 64Requerido

Unique request identifier use to trace function calls across system

Respuestas
204

successful

Sin contenido

get/healthCheck

Sin contenido

POST /tokens/{tokenId}/reperso

post

This request is triggered when TSH has to repersonalize a token and requires all the data elements associated.

After this request, TSP shall recover all the existing elements and submit it to the TSH through Submit New Token Data.

TSH will callback TSP through the Notify Token Reperso Result to notify the profile has been pushed to the device with success. At this moment, TSP shall set the ATC to zero to sync with the ATC personalized in the device.

Parámetros de ruta
tokenIdstring · mín: 1 · máx: 48Requerido

Identifier of the token

Parámetros de encabezado
x-request-idstring · mín: 1 · máx: 48Requerido

Unique request identifier use to trace function calls across system

Cuerpo
issuerIdstring · mín: 10 · máx: 10Opcional

Unique Identifier of Issuer

Example: ISSUER1234
newTokenProductIdstring · mín: 1 · máx: 48Opcional

ID of the token product (Identify token domain).

As the token products are mapped to Issuer card products, the values shall be defined at the begining of the project with the TSP.

Respuestas
204

successful

Sin contenido

post/tokens/{tokenId}/reperso

Sin contenido

POST /listTokens

post

This method is used by TSH to request the list of tokens associated to either a funding PAN, a card reference ID or a token PAN. In case of a search by token PAN, the list returned by TSP shall contain 1 element at most.

Parámetros de encabezado
x-request-idstring · mín: 1 · máx: 64Requerido

Unique request identifier use to trace function calls across system

Cuerpo
issuerIdstring · mín: 10 · máx: 10Requerido

Unique Identifier of Issuer

Example: ISSUER1234
cipheredCardInfostring · mín: 1 · máx: 8196Opcional

TSH sends card information as JSON encrypted using the PKCS#7 encryption scheme defined in RFC 2315/5652 using following encryption parameters:

  • The content encryption algorithm used is AES256/CBC/PKCS7Padding using a randomly generated AES key.
  • The key encryption algorithm is either RSAES-PKCS1-v1_5 (RSA/NONE/PKCS1Padding) or RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256), using the certificate provided during onboarding.
    The key encryption algorithm is defined during onboarding and is by default (if ommitted) the RSA/NONE/PKCS1Padding for legacy purpose.
    It is recommended to configure RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256) for new TSPs.
  • The encryption result is then encoded using base64.
  • The public key length in the certificate can be 2048-bit or 4096-bit.

Once deciphered, the card info contains the following information:

JSON field parameter namedescriptionMOCLength
fpanThe funding panMUp to 19
cipheredTokenInfostring · mín: 1 · máx: 8196Opcional

TSH sends token information as JSON encrypted using the PKCS#7 encryption scheme defined in RFC 2315/5652 using following encryption parameters:

  • The content encryption algorithm used is AES256/CBC/PKCS7Padding using a randomly generated AES key.
  • The key encryption algorithm is either RSAES-PKCS1-v1_5 (RSA/NONE/PKCS1Padding) or RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256), using the certificate provided during onboarding.
    The key encryption algorithm is defined during onboarding and is by default (if ommitted) the RSA/NONE/PKCS1Padding for legacy purpose.
    It is recommended to configure RSA/NONE/OAEPWithSHA256AndMGF1Padding (with MGF1 using SHA-256) for new TSPs.
  • The encryption result is then encoded using base64.
  • The public key length in the certificate can be 2048-bit or 4096-bit.

Once deciphered, the card info contains the following information:

JSON field parameter namedescriptionMOCLength
dpanThe token PANMUp to 19
cardRefIdstring · mín: 1 · máx: 64Opcional

A unique identifier of the issuer that aims to identify the funding card.
This parameter is provided by the TSH.
Upon configuration it corresponds either to issuerCardRefId or walletCardRefId (e.g. for ApplePay, it corresponds to the FPANID in such case)

publicKeyIdentifierstring · mín: 1 · máx: 32Opcional

Identifier of the key used to encrypt cipheredCardInfo.
Provided by TSP to Thales during onboarding.

Respuestas
200

listTokens response payload

application/json
post/listTokens

POST /tokens/{tokenId}/replenish

post

This request is triggered when TSH has to replenish a token. This API only applies to Google Pay solution.

Parámetros de ruta
tokenIdstring · mín: 1 · máx: 48Requerido

Identifier of the token

Parámetros de encabezado
x-request-idstring · mín: 1 · máx: 48Requerido

Unique request identifier use to trace function calls across system

Cuerpo
issuerIdstring · mín: 10 · máx: 10Opcional

Unique Identifier of Issuer

Example: ISSUER1234
Respuestas
200

replenishToken response payload

application/json
kekLabelstringOpcional

Label of the key used to encrypt paymentKeys

kekKcvstringOpcional

KCV of the Key Encryption Key

paymentKeysstringOpcional

String representation of JSON array of objects containing payment keys
as defined in Data Preparation section

post/tokens/{tokenId}/replenish

PUT /tokens/{tokenId}/replenish/done

put

This method is used by TSH to inform the TSP that the token replenishment has been done. This API only applies to Google Pay solution.

Parámetros de ruta
tokenIdstring · mín: 1 · máx: 48Requerido

Identifier of the token

Parámetros de encabezado
x-request-idstring · mín: 1 · máx: 64Requerido

Unique request identifier use to trace function calls across system

Cuerpo
issuerIdstring · mín: 10 · máx: 10Requerido

Unique Identifier of Issuer

Example: ISSUER1234
Respuestas
204

successful

Sin contenido

put/tokens/{tokenId}/replenish/done

Sin contenido

POST /merchant-gateways/{merchantGatewayId}/merchants

post

This method is used by TSH to request the creation of a new merchant.

Parámetros de ruta
merchantGatewayIdstring · mín: 10 · máx: 10Requerido

Identifier of the merchant gateway

Parámetros de encabezado
x-request-idstring · mín: 1 · máx: 64Requerido

Unique request identifier use to trace function calls across system

Cuerpo
merchantNamestring · mín: 1 · máx: 64Requerido

An unique merchant name that is end user friendly.

Example: My MerchantPattern: ^[A-Za-z0-9-_. ]+$
Respuestas
200

createMerchant response payload

application/json
merchantIdstring · mín: 11 · máx: 11Requerido

Merchant ID generated by TSP.
It is computed as per EMVCo TRID format.

Example: 10610027312
post/merchant-gateways/{merchantGatewayId}/merchants

Última actualización

¿Te fue útil?