openapi: 3.1.0
info:
  title: Account Management
  description: Manages card account lifecycle operations
  version: '1.0'
x-method: searched
x-source: https://developer.barclays.com/api/apis/versions/a56c70ec-e909-4527-96f0-83ff0cedbddd.bdn/design?specification=oas31
x-harvested: '2026-09-04'
x-harvested-note: Verbatim OpenAPI 3.1 design export from the Barclays API Exchange registry (developer.barclays.com), fetched
  anonymously. The untouched export is in openapi/_original/barclays-account-management-openapi.json. The UK Open Banking
  documents carry OBIE (openbanking.org.uk) in info.contact/termsOfService because they are the OBIE standard contract as
  Barclays implements and publishes it — the API, the registry record and the host are Barclays'.
tags:
- name: Cards Activation
  description: API for activating cards and retrieving activation status based on account ID with eligibility and fraud verification.
paths:
  /cards/accounts/{accountId}/activation-status:
    summary: Get activation status for all cards in an account
    description: Retrieves the current activation status for all cards associated with the specified account
    get:
      tags:
      - Cards Activation
      summary: Retrieve activation status for all cards in the account
      description: "Returns the activation status for all cards associated with the specified account, \nincluding whether\
        \ each card is activated and the activation date if applicable.\n\n**Response includes:**\n- Card identifiers (external\
        \ customer ID and last 4 digits)\n- Customer role on the account (PRIMARY, AUTHORIZED_USER, etc.)\n- Activation status\
        \ (true/false)\n- Activation date (if card is activated)\n\n**Use Cases:**\n- Display card activation status in customer\
        \ portal\n- Verify card activation before allowing transactions\n- Support agent inquiry for card status"
      operationId: getCardActivationStatus
      parameters:
      - name: Correlation-ID
        in: header
        description: "Unique end-to-end trace ID. The initiating system (such as a Channel or \nBatch Job), must generate\
          \ this unique ID, then this must be passed \nthrough the API call stack. This is required to maintain compliance\
          \ with the current Barclays REST Standard."
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 36
          minLength: 36
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        example: 7d444840-9dc0-11d1-b245-5ffdce74fad2
      - name: accountId
        in: path
        description: A unique id (similar to UUID) created for each customer account.
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 36
          minLength: 36
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
        example: c8de699e-ff6d-11eb-9a03-0242ac130003
      - name: Authorization
        in: header
        description: TIAA-US External token
        required: true
        deprecated: false
        schema:
          type: string
        example: Bearer <token>
      responses:
        '200':
          $ref: '#/components/responses/ActivationStatusResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      deprecated: false
  /cards/accounts/{accountId}/activate:
    summary: Activate cards for an account
    description: Activates one or more cards for the specified account based on card identifiers, CVV, and expiry date with
      eligibility checks
    post:
      tags:
      - Cards Activation
      summary: Activate one or more cards for an account. This operation contains sensitive data. Request is expected to be
        sent in encrypted format.
      description: "Activates cards based on the provided account ID and card identifiers (external customer ID, \ncard last\
        \ 4 digits, CVV, and expiry date). Performs eligibility verification and fraud \nassessment before activation. Returns\
        \ activation status for each card in the request.\n\n**Business Flow:**\n1. Verifies card details (CVV, expiry date)\
        \ against card records\n2. Performs fraud assessment and risk evaluation\n3. Validates account eligibility for card\
        \ activation\n4. Activates eligible cards via TSYS card management system\n5. Records activation in TSYS with memo\
        \ text\n6. Returns activation status for each card\n\n**Error Scenarios:**\n- 400: Invalid card details or request\
        \ format\n- 403: Account not eligible for activation\n- 404: Account or card not found\n- 428: Additional fraud verification\
        \ required"
      operationId: activateCard
      parameters:
      - name: Content-Type
        in: header
        description: Content-Type
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 35
          minLength: 16
          pattern: ^[a-z0-9A-Z\/ ]{16,35}$
        example: application/json
      - name: Correlation-ID
        in: header
        description: "Unique end-to-end trace ID. The initiating system (such as a Channel or \nBatch Job), must generate\
          \ this unique ID, then this must be passed \nthrough the API call stack. This is required to maintain compliance\
          \ with the current Barclays REST Standard."
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 36
          minLength: 36
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        example: 7d444840-9dc0-11d1-b245-5ffdce74fad2
      - name: accountId
        in: path
        description: A unique id (similar to UUID) created for each customer account.
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 36
          minLength: 36
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
        example: c8de699e-ff6d-11eb-9a03-0242ac130003
      - name: Authorization
        in: header
        description: TIAA-US External token
        required: true
        deprecated: false
        schema:
          type: string
        example: Bearer <token>
      requestBody:
        description: Card activation request containing one or more cards to activate with verification details
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActivateCardRequestData'
            examples:
              single-device:
                summary: Single card activation
                value:
                  data:
                    cardActivationRequests:
                    - cardIdentifiers:
                        externalCustomerId: 550e8400-e29b-41d4-a716-446655440000
                        cardLast4: '1234'
                      cvv: '123'
                      expiry: 12/25
                    memoText: Customer requested activation
              multiple-devices:
                summary: Multiple card activation
                value:
                  data:
                    cardActivationRequests:
                    - cardIdentifiers:
                        externalCustomerId: 550e8400-e29b-41d4-a716-446655440000
                        cardLast4: '1234'
                      cvv: '123'
                      expiry: 12/25
                    - cardIdentifiers:
                        externalCustomerId: 550e8400-e29b-41d4-a716-446655440000
                        cardLast4: '1234'
                      cvv: '123'
                      expiry: 12/25
                    - cardIdentifiers:
                        externalCustomerId: 550e8400-e29b-41d4-a716-446655440000
                        cardLast4: '1234'
                      cvv: '123'
                      expiry: 12/25
                    memoText: Batch activation request
        required: true
      responses:
        '200':
          $ref: '#/components/responses/ActivateCardResponse'
        '400':
          $ref: '#/components/responses/BadRequest_Activation'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '403':
          $ref: '#/components/responses/Forbidden_activation'
        '404':
          $ref: '#/components/responses/NotFound'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
        '428':
          $ref: '#/components/responses/FraudChallenge'
        '429':
          $ref: '#/components/responses/TooManyRequests_Activation'
      deprecated: false
components:
  schemas:
    ActivateCardRequestData:
      type: object
      additionalProperties: false
      deprecated: false
      description: 'Request data for activating one or more cards with verification details.


        **Purpose:**

        - Activate cards by providing card identifiers, CVV, and expiry date

        - Support batch activation of up to 100 cards in a single request

        - Record activation reason via memo text for audit trail


        **Validation:**

        - All card identifiers must be valid and associated with the account

        - CVV and expiry must match card records

        - Account must be eligible for card activation

        - Fraud verification may be required based on risk assessment

        '
      properties:
        data:
          $ref: '#/components/schemas/ActivateCardRequestDataItem'
      required:
      - data
      nullable: false
    ActivationStatusDetailType:
      type: object
      additionalProperties: false
      description: Activation status details for a single card
      properties:
        cardIdentifiers:
          $ref: '#/components/schemas/CardIdentifier'
        customerRole:
          type: string
          description: Customer's role on the account (e.g., PRIMARY, AUTHORIZED_USER)
          example: PRIMARY
          maxLength: 50
          minLength: 1
          pattern: ^[a-zA-Z_]{1,50}$
        isActivated:
          type: boolean
          description: Indicates if the card is currently activated
          example: true
        activationDate:
          type: string
          format: date
          description: Date when the card was activated (YYYY-MM-DD format)
          example: '2024-12-01'
    CardIdentifier:
      type: object
      additionalProperties: false
      description: Unique card identifier using external customer ID and last 4 digits
      properties:
        externalCustomerId:
          type: string
          description: External customer identifier in UUID format
          example: 550e8400-e29b-41d4-a716-446655440000
          maxLength: 36
          minLength: 36
          pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
        cardLast4:
          type: string
          description: Last 4 digits of the card number
          example: '1234'
          maxLength: 4
          minLength: 4
          pattern: ^[0-9]{4}$
      required:
      - cardLast4
      - externalCustomerId
    ActivateCardResponseDataItem:
      type: object
      additionalProperties: false
      deprecated: false
      description: Response containing activation results for each requested card
      properties:
        activationStatusList:
          $ref: '#/components/schemas/ActivateCardDetailList'
      nullable: false
    ActivateCardDetailType:
      type: object
      additionalProperties: false
      description: Activation result details for a single card
      properties:
        cardIdentifiers:
          $ref: '#/components/schemas/CardIdentifier'
        customerRole:
          type: string
          description: Customer's role on the account (e.g., PRIMARY, AUTHORIZED_USER)
          example: PRIMARY
          maxLength: 50
          minLength: 1
          pattern: ^[a-zA-Z_]{1,50}$
        isActivated:
          type: boolean
          description: Indicates if the card is now activated (true for SUCCESS and ALREADY_ACTIVATED)
          example: true
        activationDate:
          type: string
          format: date
          description: Date when the card was activated (YYYY-MM-DD format), present only if activated
          example: '2024-12-01'
    ErrorResponseType:
      type: object
      additionalProperties: false
      deprecated: false
      description: 'An API error response.

        '
      properties:
        meta:
          type: object
          additionalProperties: true
          description: Contains Non-standard meta information
        errors:
          type: array
          description: 'Contains one or more error messages and is mutually exclusive with the data item.

            This will not be returned in success scenarios.

            '
          items:
            $ref: '#/components/schemas/ErrorType'
          maxItems: 50
          minItems: 0
      nullable: false
    ActivationStatusResponseDataItem:
      type: object
      additionalProperties: false
      deprecated: false
      description: Response containing activation status for all cards in the account
      properties:
        activationStatusList:
          $ref: '#/components/schemas/ActivationStatusDetailList'
      nullable: false
    ActivateCardResponseData:
      type: object
      additionalProperties: false
      deprecated: false
      description: 'Response data containing activation results for each requested card.


        **Response Structure:**

        - Returns activation status for each card in the request

        - Includes card identifiers to match request to response

        - Shows customer role on the account (PRIMARY, AUTHORIZED_USER, etc.)

        - Indicates activation result (success, in-progress, or failure reason)

        - Provides activation date for successfully activated cards


        **Use Cases:**

        - Confirm which cards were successfully activated

        - Display activation confirmation or error messages to customer

        - Update UI to reflect new card status

        '
      properties:
        data:
          $ref: '#/components/schemas/ActivateCardResponseDataItem'
      nullable: false
    ActivateCardDetailList:
      type: array
      description: List of activation results for each card in the request
      items:
        $ref: '#/components/schemas/ActivateCardDetailType'
      maxItems: 100
      minItems: 0
    ErrorType:
      type: object
      additionalProperties: true
      description: Message details - additional operation execution information.
      properties:
        id:
          type: string
          description: Generated message identifier for particular request, helping to locate server logs.
          example: 9709-4675-2456-7801
          maxLength: 50
          minLength: 1
          pattern: ^[a-zA-Z0-9\-]{1,50}$
        code:
          type: string
          description: Machine readable, unique code of the message related to particular case within operation execution.
          example: ACCOUNT_NUMBER_NOT_FOUND
          maxLength: 100
          minLength: 1
          pattern: ^[a-zA-Z0-9_]{1,100}$
        title:
          type: string
          description: Short description of the error. Not for displaying purposes.
          example: The authorization credentials required for this request are invalid.
          maxLength: 250
          minLength: 1
          pattern: ^[a-zA-Z0-9\s"=,.']{1,250}$
        detail:
          type: string
          description: Provides additional low-level details about the error to assist with troubleshooting. Not for displaying
            purposes.
          maxLength: 250
          minLength: 1
          pattern: ^[a-zA-Z0-9\s"=,.']{1,250}$
        meta:
          type: object
          additionalProperties: true
          description: Object containing non-standard meta-information about the error.
      required:
      - code
      - id
      - title
    CardActivationRequests:
      type: object
      additionalProperties: false
      description: Individual card activation request with verification details
      properties:
        cardIdentifiers:
          $ref: '#/components/schemas/CardIdentifier'
        cvv:
          type: string
          description: Three-digit card verification value (CVV/CVC)
          example: '123'
          maxLength: 3
          minLength: 3
          pattern: ^[0-9]{3,3}$
        expiry:
          type: string
          description: Card expiration date in MM/YY format
          example: 12/25
          maxLength: 5
          minLength: 5
          pattern: ^(0[1-9]|1[0-2])\/([0-9]{2})$
    ActivationStatusResponseData:
      type: object
      additionalProperties: false
      deprecated: false
      description: 'Response data containing activation status for all cards in the account.


        **Response Structure:**

        - Returns status for all cards associated with the account

        - Includes both activated and non-activated cards

        - Shows card identifiers (external customer ID and last 4 digits)

        - Indicates customer role for each card

        - Provides activation date for activated cards


        **Use Cases:**

        - Display all cards and their activation status in customer portal

        - Verify card activation before allowing transactions

        - Support agent inquiry for account card status

        - Determine which cards need activation

        - Audit trail for card activation history

        '
      properties:
        data:
          $ref: '#/components/schemas/ActivationStatusResponseDataItem'
      nullable: false
    ActivationStatusDetailList:
      type: array
      description: List of activation status for each card in the account
      items:
        $ref: '#/components/schemas/ActivationStatusDetailType'
      maxItems: 100
      minItems: 0
    ActivateCardRequestDataItem:
      type: object
      additionalProperties: false
      deprecated: false
      description: Card activation request payload containing one or more cards to activate
      properties:
        cardActivationRequests:
          type: array
          description: List of cards to activate with verification details (external customer ID, card last 4, CVV, expiry)
          items:
            $ref: '#/components/schemas/CardActivationRequests'
          maxItems: 100
          minItems: 1
        memoText:
          type: string
          description: Optional memo text for audit trail (e.g., activation reason or context)
          maxLength: 200
          minLength: 1
          pattern: ^[a-zA-Z0-9 ]{1,200}$
      nullable: false
  responses:
    BadRequest:
      description: "The request could not be understood by the server due to malformed \nsyntax. The client SHOULD NOT repeat\
        \ the request without \nmodifications.\n"
      headers:
        Cache-Control:
          $ref: '#/components/headers/Cache-Control'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseType'
          examples:
            example-error-400-bad-request:
              $ref: '#/components/examples/example-error-400-bad-request'
    TooManyRequests_Activation:
      description: "When a server is under attack or just receiving a very \nlarge number of requests from a single party,\
        \ responding \nto each with a 429 status code will consume resources. \nTherefore, servers may drop connections or\
        \ take other steps\ninstead of responding with the 429 status code, when limiting\nresource usage.\n"
      headers:
        Cache-Control:
          $ref: '#/components/headers/Cache-Control'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseType'
          examples:
            example-error-429:
              $ref: '#/components/examples/example-error-429'
            example-error-4291:
              $ref: '#/components/examples/example-error-4291-throttled'
    BadRequest_Activation:
      description: "The request could not be understood by the server due to malformed \nsyntax. The client SHOULD NOT repeat\
        \ the request without \nmodifications.\n"
      headers:
        Cache-Control:
          $ref: '#/components/headers/Cache-Control'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseType'
          examples:
            example-error-400-bad-request:
              $ref: '#/components/examples/example-error-400-bad-request'
            example-error-4001-invalid-request:
              $ref: '#/components/examples/example-error-4001-invalid-request'
            example-error-4002-invalid-cvv:
              $ref: '#/components/examples/example-error-4002-invalid-cvv'
            example-error-4003-invalid-expiry:
              $ref: '#/components/examples/example-error-4003-invalid-expiry'
            example-error-4004-invalid-expiryDateFormat:
              $ref: '#/components/examples/example-error-4004-invalid-expiryDateFormat'
            example-error-4005-invalid-cardLast4:
              $ref: '#/components/examples/example-error-4005-invalid-cardLast4'
            example-error-4006-missingHeader:
              $ref: '#/components/examples/example-error-4006-missingHeader'
    Forbidden_activation:
      description: 'The user is not permitted to access the requested operation and it cannot be completed.

        '
      headers:
        Cache-Control:
          $ref: '#/components/headers/Cache-Control'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseType'
          examples:
            Forbidden:
              $ref: '#/components/examples/example-error-403'
            FraudDeclined:
              $ref: '#/components/examples/example-error-403_FRAUD_DECLINED'
            example-error-4031-AccessForbidden:
              $ref: '#/components/examples/example-error-4031-AccessForbidden'
            example-error-4032-InvalidStatus:
              $ref: '#/components/examples/example-error-4032-InvalidStatus'
    Unauthorized:
      description: 'The user could not be authenticated for this request.

        '
      headers:
        Cache-Control:
          $ref: '#/components/headers/Cache-Control'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseType'
          examples:
            example-error-401:
              $ref: '#/components/examples/example-error-401'
    Forbidden:
      description: 'The user is not permitted to access the requested operation and it cannot be completed.

        '
      headers:
        Cache-Control:
          $ref: '#/components/headers/Cache-Control'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseType'
          examples:
            example-error-403:
              $ref: '#/components/examples/example-error-403'
    ServiceUnavailable:
      description: "temporary maintenance of service, try again later. The implication \nis that this is a temporary condition\
        \ which will be alleviated \nafter some delay. If known, the length of the delay will be \nindicated in a Retry-After\
        \ header. If no Retry-After is given, \nthe client SHOULD handle the response as it would for a 500 response. \nNote:\
        \ The existence of the 503 status code does not imply that a \nserver will use it when becoming overloaded. Servers\
        \ may simply \nrefuse the connection.\n"
      headers:
        Cache-Control:
          $ref: '#/components/headers/Cache-Control'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseType'
          examples:
            example-error-503:
              $ref: '#/components/examples/example-error-503'
    ActivateCardResponse:
      description: Successful card activation response
      headers:
        Correlation-ID:
          $ref: '#/components/headers/Correlation-ID-ResHeader'
        Cache-Control:
          $ref: '#/components/headers/Cache-Control'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ActivateCardResponseData'
          examples:
            successful-activation:
              summary: Successful activation
              value:
                data:
                  activationStatusList:
                  - cardIdentifiers:
                      externalCustomerId: 550e8400-e29b-41d4-a716-446655440000
                      cardLast4: '1234'
                    customerRole: PRIMARY
                    isActivated: true
                    activationDate: '2024-12-01'
    InternalServerError:
      description: "Server encountered an error processing request. This should not \nhappen normally, but it is a generic\
        \ error message, given when \nno more specific message is suitable.\n"
      headers:
        Cache-Control:
          $ref: '#/components/headers/Cache-Control'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseType'
          examples:
            example-error-500:
              $ref: '#/components/examples/example-error-500'
            example-error-5001:
              $ref: '#/components/examples/example-error-5001'
    NotFound:
      description: "Server has not found a resource with that URI. This may be \ntemporary and permanent condition. This status\
        \ code is \ncommonly used when the server does not wish to reveal \nexactly why the request has been refused, or when\
        \ no other \nresponse is applicable.\n"
      headers:
        Cache-Control:
          $ref: '#/components/headers/Cache-Control'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseType'
          examples:
            example-error-404:
              $ref: '#/components/examples/example-error-404'
            example-error-4041-ResourceNotFound:
              $ref: '#/components/examples/example-error-4041-ResourceNotFound'
    FraudChallenge:
      description: 'Fraud challenge required

        '
      headers:
        Cache-Control:
          $ref: '#/components/headers/Cache-Control'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponseType'
          examples:
            FraudChallenge:
              $ref: '#/components/examples/example-error-428_FRAUD_CHALLENGE'
    ActivationStatusResponse:
      description: Successful activation status response
      headers:
        Correlation-ID:
          $ref: '#/components/headers/Correlation-ID-ResHeader'
        Cache-Control:
          $ref: '#/components/headers/Cache-Control'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ActivationStatusResponseData'
          examples:
            successful-status:
              summary: Successful status retrieval
              value:
                data:
                  activationStatusList:
                  - cardIdentifiers:
                      externalCustomerId: 550e8400-e29b-41d4-a716-446655440000
                      cardLast4: '1234'
                    customerRole: PRIMARY
                    isActivated: true
                    activationDate: '2024-12-01'
                  - cardIdentifiers:
                      externalCustomerId: 550e8400-e29b-41d4-a716-446655440000
                      cardLast4: '1234'
                    customerRole: AUTHORIZED_USER
                    isActivated: false
  parameters:
    Authorization:
      name: Authorization
      in: header
      description: Bearer Token
      required: true
      deprecated: false
      allowEmptyValue: false
      schema:
        type: string
        maxLength: 2048
        minLength: 32
        pattern: ^[A-Za-z0-9\-_\.\ ]{32,2048}$
      example: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IlE4SkRobnd0ODU4eDNlbTRwVVkzd0R2Q3RsRSIsInBpLmF0bSI6IjUybWUifQ.eyJjbGllbnRfaWQiOiJVU0NCSU5UQ0xJRU5UIiwiaXNzIjoiVElBQS1VUyIsImF1ZCI6IlVTQ0IiLCJzdWIiOiJzeXNUSUFBVVNBUFBMWVQiLCJhZGdyb3VwcyI6WyJDTj1mR0xCQ3VzdFByb2R1Y3RITlAsT1U9R3JvdXBzLE9VPUdMQixEQz1JTlRSQU5FVCxEQz1CQVJDQVBJTlQsREM9Y29tIiwiQ049ZkdMQkNycHRQY3NHYXBRQSxPVT1Hcm91cHMsT1U9R0xCLERDPUlOVFJBTkVULERDPUJBUkNBUElOVCxEQz1jb20iLCJDTj1mR0xCQWNjdE1nbXROUCxPVT1Hcm91cHMsT1U9R0xCLERDPUlOVFJBTkVULERDPUJBUkNBUElOVCxEQz1jb20iLCJDTj1mR0xCVElBQVVTQ0JJbnRyUyxPVT1Hcm91cHMsT1U9R0xCLERDPUlOVFJBTkVULERDPUJBUkNBUElOVCxEQz1jb20iXSwiZXhwIjoxNjgzMjYyNzk3fQ.JDw6udt7pegvyz2tD_W0gUR_FXr7XnZIMnb0GeXLGFC7Zcg5yq6vI2bTMaee9pNhtCEJlIbLa5aKvP6xdt1xBfusE74g85Tohb5c-4MF7QNsC3vBCNOlTpnXMPkHR2_aNfXzf_Duvf81ZotsD_KwUF7w8f63BHgpI4itiFSduGEFGzAKlV2OJwcgIIlhDfhstbDtREL931QlFI8v_sj7JjXWOqivrFSOhiuen-rM5SRvFrnm50P9mZvyhs4-228cZ-xv36c5NAsbO9whQCHE5N0rDOhMgCKl65rnCdUr8rktOCe3fMQTWxV-qQqnr4hscgFtcJt9gU07pwP8zvf4xQ
    Correlation-ID:
      name: Correlation-ID
      in: header
      description: "Unique end-to-end trace ID. The initiating system (such as a Channel or \nBatch Job), must generate this\
        \ unique ID, then this must be passed \nthrough the API call stack. This is required to maintain compliance with the\
        \ current Barclays REST Standard.\n"
      required: true
      deprecated: false
      allowEmptyValue: false
      schema:
        type: string
        maxLength: 36
        minLength: 36
        pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
      example: 7d444840-9dc0-11d1-b245-5ffdce74fad2
    X-Party-Id:
      name: X-Party-Id
      in: header
      description: 'Party ID of customer associated to an account Id

        '
      required: true
      deprecated: false
      schema:
        type: string
        maxLength: 20
        minLength: 1
        pattern: ^[0-9]{1,20}$
      example: '100145000'
    X-Channel-Id:
      name: X-Channel-Id
      in: header
      description: 'The channel that initiated the call. Must be passed through the API stack.

        '
      required: true
      deprecated: false
      schema:
        type: string
        maxLength: 20
        minLength: 3
        pattern: ^[A-Za-z0-9\-_]{3,20}$
      example: ccd
    ExternalAccountIdPath:
      name: accountId
      in: path
      description: A unique id (similar to UUID) created for each customer account.
      required: true
      deprecated: false
      allowEmptyValue: false
      schema:
        type: string
        maxLength: 36
        minLength: 36
        pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
      example: c8de699e-ff6d-11eb-9a03-0242ac130003
    OauthClient-ID:
      name: oauth_clientid
      in: header
      description: 'To be set by Akana ND. It will be removed when published on Akana,

        '
      required: true
      deprecated: false
      allowEmptyValue: false
      schema:
        type: string
        maxLength: 256
        minLength: 1
        pattern: ^[a-zA-Z0-9.\-]{1,256}$
      example: bdn-68EwxNCdDi65Y2FV6wxupfsoD3ilveYxDqok0LD5
    X-Auth-Type:
      name: X-Auth-Type
      in: header
      description: 'X-AuthType injected by AKANA ND.

        Denotes how the token was issued - client-creds/auth-grant

        '
      required: true
      deprecated: false
      allowEmptyValue: false
      schema:
        type: string
        description: Denotes how the token was issued - client-creds/auth-grant
        enum:
        - auth-grant
        - client-creds
      example: auth-grant
    X-IDVSessionID:
      name: X-IDVSessionID
      in: header
      description: 'X-IDVSessionID injected by AKANA ND. Used for Fraud detection.

        This is passed on as access-token to fraud-decision api.

        '
      required: true
      deprecated: false
      allowEmptyValue: false
      schema:
        type: string
        maxLength: 36
        minLength: 36
        pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
      example: 6c9b83bc-5c94-45c8-a594-5ea890409b62
    Content-Type:
      name: Content-Type
      in: header
      description: Content-Type
      required: true
      deprecated: false
      allowEmptyValue: false
      schema:
        type: string
        maxLength: 35
        minLength: 16
        pattern: ^[a-z0-9A-Z\/ ]{16,35}$
      example: application/json
  examples:
    example-error-404:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: RESOURCE_NOT_FOUND
          title: The requested operation failed because a resource associated with the request could not be found.
          detail: The requested operation failed because a resource associated with the request could not be found.
    example-error-503:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: SERVICE_UNAVAILABLE
          title: The server is currently unavailable
          detail: The server is currently unavailable
    example-error-403_FRAUD_DECLINED:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: CAM_ERR_4033
          title: Fraud Declined
          detail: Fraud Declined
    example-error-429:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: TOO_MANY_REQUESTS
          title: Too many requests
          detail: The client sent too many requests and server is not able to serve them all at the moment
    example-error-4003-invalid-expiry:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: CAM_ERR_4003
          title: Invalid expiry date
          detail: Invalid expiry date
    example-error-5001:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: CAM_ERR_5001
          title: Internal processing error, contact Barclay's API support with CorrelationID
          detail: Internal processing error, contact Barclay's API support with CorrelationID
    example-error-400-bad-request:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: BAD_REQUEST
          title: The request is invalid or not properly formed.
          detail: The request is invalid or not properly formed.
    example-error-4002-invalid-cvv:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: CAM_ERR_4002
          title: Invalid CVV
          detail: Invalid CVV
    example-error-4004-invalid-expiryDateFormat:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: CAM_ERR_4004
          title: Invalid expiry date format
          detail: Invalid expiry date format
    example-error-4005-invalid-cardLast4:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: CAM_ERR_4005
          title: Invalid card last4
          detail: Invalid card last4
    example-error-4001-invalid-request:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: CAM_ERR_4001
          title: The request is invalid or not properly formed.
          detail: The request is invalid or not properly formed.
    example-error-4006-missingHeader:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: CAM_ERR_4006
          title: Missing required request header
          detail: Missing required request header
    example-error-4291-throttled:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: CAM_ERR_4291
          title: Card activation throttled, too many requests
          detail: Card activation throttled, too many requests
    example-error-428_FRAUD_CHALLENGE:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: CAM_ERR_4281
          title: Fraud challenge required
          detail: Fraud challenge required
        meta:
          verificationContextId: A22DFEC1-C5E7-4DD7-99FD-716528EB1FE3
    example-error-4031-AccessForbidden:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: CAM_ERR_4031
          title: The user is not permitted to access the requested operation.
          detail: The user is not permitted to access the requested operation.
    example-error-401:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: AUTHENTICATION_ERROR
          title: The user could not be authenticated for this request.
          detail: The user could not be authenticated for this request.
    example-error-500:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: INTERNAL_SERVER_ERROR
          title: The request failed due to an internal error.
          detail: The request failed due to an internal error.
    example-error-403:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: ACCESS_FORBIDDEN
          title: The user is not permitted to access the requested operation and it cannot be completed.
          detail: The user is not permitted to access the requested operation and it cannot be completed.
    example-error-4032-InvalidStatus:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: CAM_ERR_4032
          title: Account status is invalid for activation
          detail: Account status is invalid for activation
    example-error-4041-ResourceNotFound:
      value:
        errors:
        - id: 1c4717c4-e3f3-4071-8b86-b868908763ff
          code: CAM_ERR_4041
          title: The requested operation failed because a resource associated with the request could not be found.
          detail: The requested operation failed because a resource associated with the request could not be found.
  requestBodies:
    ActivateCardRequest:
      description: Card activation request containing one or more cards to activate with verification details
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ActivateCardRequestData'
          examples:
            single-device:
              summary: Single card activation
              value:
                data:
                  cardActivationRequests:
                  - cardIdentifiers:
                      externalCustomerId: 550e8400-e29b-41d4-a716-446655440000
                      cardLast4: '1234'
                    cvv: '123'
                    expiry: 12/25
                  memoText: Customer requested activation
            multiple-devices:
              summary: Multiple card activation
              value:
                data:
                  cardActivationRequests:
                  - cardIdentifiers:
                      externalCustomerId: 550e8400-e29b-41d4-a716-446655440000
                      cardLast4: '1234'
                    cvv: '123'
                    expiry: 12/25
                  - cardIdentifiers:
                      externalCustomerId: 550e8400-e29b-41d4-a716-446655440000
                      cardLast4: '1234'
                    cvv: '123'
                    expiry: 12/25
                  - cardIdentifiers:
                      externalCustomerId: 550e8400-e29b-41d4-a716-446655440000
                      cardLast4: '1234'
                    cvv: '123'
                    expiry: 12/25
                  memoText: Batch activation request
      required: true
  headers:
    Cache-Control:
      description: GIS mandatory response header. This is added by the Cognac sidecar.
      schema:
        type: string
        default: no-cache, no-store, must-revalidate
        deprecated: false
        example: no-cache, no-store, must-revalidate
        maxLength: 35
        minLength: 35
        pattern: ^no-cache, no-store, must-revalidate$
        nullable: false
    Correlation-ID-ResHeader:
      description: 'Unique end-to-end trace ID. The initiating system (such as a Channel or

        Batch Job), must generate this unique ID, then this must be passed

        through the API call stack. This is required to maintain compliance with the current Barclays REST Standard.

        '
      required: true
      schema:
        type: string
        deprecated: false
        maxLength: 36
        minLength: 36
        pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        nullable: false
      example: 7d444840-9dc0-11d1-b245-5ffdce74fad2
  securitySchemes:
    ExternalTiaaUsCCAuth:
      type: oauth2
      description: OAuth2.0 Client Credentials Grant authentication using TIAA-US for external APIs
      flows:
        clientCredentials:
          tokenUrl: https://token.tiaa-dev.us.barclays.intranet:8443/as/token.oauth2
          scopes:
            read: read only
            write: write only