swagger: '2.0'
info:
title: Mastercard Bill Payment Validator Account Opening Access API
description: This service is provided on behalf of the Mastercard Remote Payment and Presentment (RPPS) Bill Payment Processing Network, which supports consumer to business "push" bill payments (i.e. those which are not funded by debit/credit card transactions) in the U.S.
version: '1.0'
x-artifactId: billpay-api
contact:
name: Bill Pay Development Support
email: Bill_Pay_Development_Support@mastercard.com
host: sandbox.api.mastercard.com
basePath: /billpayAPI/v1
schemes:
- https
consumes:
- application/json
produces:
- application/json
tags:
- name: Access
paths:
/widgets/access-tokens:
get:
tags:
- Access
description: Generate a new access token for the vendor site.
summary: Generate Access Token
operationId: generateBenefitsAccessToken
responses:
'200':
$ref: '#/components/responses/AccessToken'
'401':
$ref: '#/components/responses/UnauthorizedError'
/multi-access-tokens:
post:
tags:
- Access
responses:
'200':
$ref: '#/components/responses/AccessTokensResponse'
'400':
$ref: '#/components/responses/BadRequestError'
description: "Returns a `SDK Token` used for multiple document enrollment to be passed\nto the `MIDS verification SDK` module. \n**This API is mandatory.**\n"
summary: Add and Validate a Document - Request a token to enroll an additional document.
operationId: getMultiAccessToken
parameters:
- $ref: '#/components/parameters/XUserIdentityParameter'
- $ref: '#/components/parameters/XEncryptedPayload'
requestBody:
$ref: '#/components/requestBodies/MultiAccessTokensRequest'
/access-tokens:
post:
tags:
- Access
responses:
'200':
$ref: '#/components/responses/AccessTokensResponse'
'400':
$ref: '#/components/responses/BadRequestError'
description: "Returns a `SDK Token` token to be passed to the MIDS verification SDK\nmodule. \n**This API is mandatory.**\n"
summary: Request a token to enroll an identity.
operationId: getAccessToken
parameters:
- $ref: '#/components/parameters/XEncryptedPayload'
requestBody:
$ref: '#/components/requestBodies/AccessTokensRequest'
/data-extractions/access-tokens:
post:
x-mastercard-api-encrypted: true
tags:
- Access
responses:
'200':
$ref: '#/components/responses/AccessTokenSuccessResponse'
'400':
$ref: '#/components/responses/BadRequestError_2'
description: Return a provider token to be passed to the MIDS Liveness SDK module.
summary: The provider token is retrieved by country code and SDK version
operationId: retrieveDataExtractionAccessToken
requestBody:
$ref: '#/components/requestBodies/AccessTokenRequest'
parameters:
- $ref: '#/components/parameters/EncryptedPayloadParameter'
components:
responses:
UnauthorizedError:
description: Unauthorized - Access Not Granted
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorWrapper'
examples:
UnauthorizedExample:
$ref: '#/components/examples/UnauthorizedExample'
AccessToken:
description: Returns Token for cardholder
content:
application/json:
schema:
$ref: '#/components/schemas/BenefitsAccessToken'
AccessTokensResponse:
description: Success.
headers:
X-Transaction-ID:
schema:
type: string
description: A random 128-bit UUID represents the transaction.
content:
application/json:
schema:
$ref: '#/components/schemas/AccessToken'
examples:
AccessTokensUnencryptedResponse:
$ref: '#/components/examples/AccessTokenExample'
AccessTokensEncryptedResponse:
$ref: '#/components/examples/EncryptedPayloadNoPDSExample'
BadRequestError:
description: Something was wrong with the request.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
UserProfileDeletedErrorExample:
$ref: '#/components/examples/UserProfileDeletedErrorExample'
AccessTokenSuccessResponse:
description: Success.
headers:
X-Transaction-ID:
$ref: '#/components/headers/X-Transaction-ID'
content:
application/json:
schema:
$ref: '#/components/schemas/AccessToken_2'
examples:
AccessTokensResponsePayload:
$ref: '#/components/examples/AccessTokensResponsePayload'
EncryptedPayloadExample:
$ref: '#/components/examples/EncryptedPayloadExample'
BadRequestError_2:
description: Something was wrong with the request.
content:
application/json:
schema:
$ref: '#/components/schemas/ApiError'
examples:
BadRequestExampleUserConsent:
$ref: '#/components/examples/BadRequestExampleUserConsent'
BadRequestExampleCountryCode:
$ref: '#/components/examples/BadRequestExampleCountryCode'
BadRequestExamplePhoneNumber:
$ref: '#/components/examples/BadRequestExamplePhoneNumber'
BadRequestExampleIVPConnectionTimeout:
$ref: '#/components/examples/BadRequestExampleIVPConnectionTimeout'
BadRequestExampleIVPSystemError:
$ref: '#/components/examples/BadRequestExampleIVPSystemError'
BadRequestExampleMedicareExpireDate:
$ref: '#/components/examples/BadRequestExampleMedicareExpireDate'
BadRequestExampleMedicareName:
$ref: '#/components/examples/BadRequestExampleMedicareName'
BadRequestExampleMedicareIndividualReferenceNo:
$ref: '#/components/examples/BadRequestExampleMedicareIndividualReferenceNo'
BadRequestExampleMedicareMedicareNumber:
$ref: '#/components/examples/BadRequestExampleMedicareMedicareNumber'
BadRequestExampleMedicareCountryCode:
$ref: '#/components/examples/BadRequestExampleMedicareCountryCode'
BadRequestExampleMedicareUserConsent:
$ref: '#/components/examples/BadRequestExampleMedicareUserConsent'
BadRequestExampleDocumentMismatch:
$ref: '#/components/examples/BadRequestExampleDocumentMismatch'
schemas:
Errors:
description: Object that contains the list of errors
type: object
required:
- Error
properties:
Error:
$ref: '#/components/schemas/ErrorList'
ErrorWrapper:
description: A top level object for errors
type: object
required:
- Errors
properties:
Errors:
$ref: '#/components/schemas/Errors'
ErrorList:
description: The list of errors
type: array
minItems: 1
items:
$ref: '#/components/schemas/Error'
BenefitsAccessToken:
type: object
properties:
accessToken:
description: The String (text) representation of Benefits Access Token
type: string
example: hereeyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIyMDIzMTIxMjA5MjMzNC1zdGFnZS1iZW5lZml0cy1hY2Nlc3MtbWFzdGVyY2FyZC1jb20iLCJ0ZXN0IjoidGVzdCIsImV4cCI6MTcwNTkxNjUzNiwiaWF0IjoxNzA1OTEyOTM2fQ.6NGFRgiy_7TayB366Eupz-xmro6Sb9kpwLY35IHoQDs
Error:
description: A single error
type: object
properties:
Source:
type: string
minLength: 0
maxLength: 200
description: Information about where the error happened
example: ELIGIBILITY_BENEFITS_API
ReasonCode:
type: string
minLength: 0
maxLength: 200
description: An error code
example: BAD_REQUEST
Description:
type: string
minLength: 0
maxLength: 10000
description: A description of the error
example: We couldn't handle your request
Recoverable:
type: boolean
description: Indicates if the request can be presented again for processing
example: false
Details:
type: string
minLength: 0
maxLength: 10000
description: More details about the error
example: Invalid JSON payload
TpAuditMetadata:
required:
- sessionId
- transactionGroupId
type: object
description: Object containing metadata related to the request.
properties:
sessionId:
type: string
description: UUID which uniquely identifies a set of transactions being executed within the same authentication session.
pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
minLength: 36
maxLength: 36
example: be3ad617-04ad-43e1-a438-79425b6511b6
transactionGroupId:
type: string
description: UUID which uniquely identifies a set of transactions being executed within a single use-case.
pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
minLength: 36
maxLength: 36
example: be3ad617-04ad-43e1-a438-79425b6511b6
PDS:
type: string
description: Encrypted Personal Device Storage (PDS) which hosts the users identity attributes. The PDS can be retrieved from the MIDS Core SDK, please refer to the SDK guide for details on how to retrieve this.
pattern: ^(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?$
minLength: 1
example: ZGZnZGVmZ2RnZGVnZXJnZXJncmRnZXJ5aGdld3J0eWJld3J5dHdleXd5d3l3cmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
AccessToken:
required:
- apiDataCenter
- sdkToken
- transactionId
type: object
properties:
transactionId:
type: string
description: A random 128-bit UUID represents the transaction.
minLength: 36
maxLength: 36
example: 1ec14310-e85c-11ea-adc1-0242ac120002
sdkToken:
type: string
description: Passed into the MIDS verification SDK for authentication.
minLength: 1
maxLength: 400
example: eyJhbGciOiJIUzUxMiIsInppcCI6IkdaSVAifQ.H4sIAAAAAAAAAB3NQQpCMQwE0Lt0baBJ0yZ159KtN0jTBgTBjYgg3t3__3KGN8w3rc_llc4JG6KUhrmoYjolc7_OvWfPKJ2hUzNgagE2hcC5hsYIUeOdH7gStVr6AtElwNUcrBNDFppYMjqxb9hvKzb9fNzfa4_HVkORomdoggsYp8HgPqAWF43VtsOcfn_stx4UsAAAAA.tDRVowYYcpQ03Vlt7D3MiovleiyRFQMv4qzXb7Lf_6CarphRrlWXan8-jE-YesNiAiT8tk0b-i8TKHGrcgT1VQ
apiDataCenter:
type: string
description: API Data Centre specifying the region.
minLength: 1
maxLength: 2
example: SG
ErrorResponse:
required:
- Errors
type: object
description: The error response model used by all the API endpoints.
properties:
Errors:
required:
- Error
type: object
description: The error response model used by all the API endpoints.
properties:
Error:
type: array
description: A list of Error objects.
minItems: 1
items:
type: object
properties:
Source:
type: string
description: The source of the problem. That is where the error occurred.
example: mids
ReasonCode:
type: string
description: A code defining the error, as defined in documentation.
example: USER_PROFILE_ID_NOT_FOUND
Description:
type: string
description: A description of this specific occurrence of the Reason code.
example: The provided user profile ID does not exist.
Recoverable:
type: boolean
description: Whether or not retrying this request could result in a successful response.
example: false
Details:
type: string
description: More details of this specific error. This is an optional field and is sometimes used to give a more comprehensive description of the error that has occurred, when required.
example: User X was not found
redirectUri:
type: string
description: TP will use this URI to redirect to RP.
pattern: ^(https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]+\.[^\s]{2,}|www\.[a-zA-Z0-9]+\.[^\s]{2,})$
example: https://sample-rp-redirect-uri.com/?error=invalid_scope&state=AJahbadinvjbdvdnvljkdnvdfhsrbghrtiu4w&ARID=1234&error_description=claim_not_satisfied
AuditEventsItem:
type: object
properties:
dateTime:
type: string
description: Date and time at which the event is created.
minLength: 1
maxLength: 29
example: '2020-01-28T13:16:01.714-05:00'
softwareVersion:
type: string
description: Software version.
minLength: 1
maxLength: 30
example: 1.0.0
userProfileId:
type: string
description: UUID identifying the user, which the TP App generates using the MIDS Core SDK.
pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
example: df52649e-4096-456a-bca0-751ee470009f
sessionId:
type: string
description: UUID which uniquely identifies a set of transactions being executed within the same authentication session.
pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
minLength: 36
maxLength: 36
example: 123ae1aa-6744-433e-879d-7da48d631234
transactionGroupId:
type: string
description: UUID which uniquely identifies a set of transactions being executed within a single use-case.
pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
minLength: 36
maxLength: 36
example: 28eae1aa-6744-433e-879d-7da48d63e89a
logRequestFlow:
type: string
description: Log Request Flow.
minLength: 1
maxLength: 255
example: CoreSDK-TP
logEvent:
type: string
description: Log Event.
minLength: 0
maxLength: 255
example: ID Enrollment
logEventType:
type: string
description: Log Event Type.
minLength: 1
maxLength: 255
example: User Profile Creation
osVersion:
type: string
description: OS version.
minLength: 1
maxLength: 255
example: Android 5.0
deviceMake:
type: string
description: Device make.
minLength: 1
maxLength: 255
example: Samsung S10
type:
type: string
description: Type of the event.
minLength: 1
maxLength: 255
example: audit
audit:
type: object
description: Represents the audit event.
properties:
privacyPolicy:
type: string
description: Version user confirmed.
minLength: 1
maxLength: 20
example: 1.0.0
userBiometricConsent:
type: string
description: User consent to capture details.
enum:
- 'TRUE'
- 'FALSE'
- NA
minLength: 4
maxLength: 5
example: 'TRUE'
event:
type: string
description: Event.
minLength: 1
maxLength: 255
example: Document Scan
eventType:
type: string
description: EventType.
minLength: 1
maxLength: 255
example: Enrollment
result:
type: string
description: API Call result.
enum:
- 'TRUE'
- 'FALSE'
- FAIL
minLength: 4
maxLength: 5
example: 'TRUE'
eventGeneratedSource:
type: string
description: Event generated source.
minLength: 1
maxLength: 50
example: CoreSDK
owner:
type: string
description: Owner.
minLength: 2
maxLength: 4
example: TP
requestDetails:
type: object
description: Request Details.
example: Request URL
responseDetails:
type: object
description: Response Details.
example: Response Data
SdkVersion:
type: string
description: Mastercard SDK version integrated with TP App, it is a constant extracted from MIDS SDK Configurations (generated while bundling SDK artifacts). If the TP app supports split PDS, this attribute MUST be specified.
pattern: ^[0-9]{1,5}\.[0-9]{1,5}\.[0-9]{1,5}$
minLength: 5
maxLength: 255
example: 2.3.0
MultiRetrieveAccessToken:
required:
- countryCode
- sdkVersion
- channelType
- userProfileId
- pds
allOf:
- type: object
properties:
pds:
$ref: '#/components/schemas/PDS'
- $ref: '#/components/schemas/AccessTokenCommonFields'
RetrieveAccessToken:
required:
- countryCode
- sdkVersion
- channelType
- userProfileId
allOf:
- type: object
properties:
enrollmentOrigin:
type: string
description: A free text field which the TP can use to differentiate between different scenarios which may influence the outcome of the enrollment, e.g. In store, Online, etc.
minLength: 1
maxLength: 20
example: RETAIL
- $ref: '#/components/schemas/AccessTokenCommonFields'
AccessTokenCommonFields:
required:
- countryCode
- sdkVersion
- channelType
- userProfileId
type: object
properties:
countryCode:
$ref: '#/components/schemas/CountryCode'
sdkVersion:
$ref: '#/components/schemas/SdkVersion'
channelType:
type: string
description: The platform from where the request is originating Web/SDK.
enum:
- WEB
- SDK
minLength: 3
maxLength: 3
example: WEB
userProfileId:
type: string
description: UUID identifying the user, which the TP App generates using the MIDS Core SDK.
pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
example: df52649e-4096-456a-bca0-751ee470009f
sdkAuditEvents:
type: array
description: Array of objects containing a record of any auditable steps occurring between the App and the SDK. A call must be made by the TP App from the MIDS Audit SDK prior to all API calls, with any audit events included in the subsequent call.
items:
$ref: '#/components/schemas/AuditEventsItem'
tpAuditMetadata:
$ref: '#/components/schemas/TpAuditMetadata'
arid:
$ref: '#/components/schemas/ARID'
ARID:
type: string
description: A unique identifier for any activity being executed arising out of a Claim Share request. This value is passed as a parameter in the URL redirecting a User to the TP Flow during a Claim Share.
format: uuid
pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
minLength: 36
maxLength: 36
example: a15fa6de-b199-11eb-8529-0242ac130003
CountryCode:
type: string
description: The country code of the country where the transaction originates from.
pattern: ^[a-zA-Z]{2}$
example: US
ApiError:
required:
- Errors
type: object
properties:
Errors:
$ref: '#/components/schemas/Errors_2'
AccessToken_2:
required:
- apiDataCenter
- sdkToken
- transactionId
type: object
properties:
transactionId:
description: The transaction ID provided in the API response must be logged by the Relying Party. The Relying Party is required to provide the transaction ID when contacting the Mastercard customer support team.
type: string
example: 1ec14310-e85c-11ea-adc1-0242ac120002
minLength: 36
maxLength: 36
accountId:
description: The accountId is an identifier for the client's account on the identity verification provider used by ID Verification.
type: string
example: 14c01794-926a-426f-ad72-c45f8fbf78a4
minLength: 36
maxLength: 36
workflowId:
description: The workflowId is the identifier for the scan on the identity verification provider used by ID Verification.
type: string
example: 5226539e-78e7-45ac-a924-072d1301c24c
minLength: 36
maxLength: 36
sdkToken:
description: Token to initialize the SDK.
type: string
example: eyJhbGciOiJIUzUxMiIsInppcCI6IkdaSVAifQ.H4sIAAAAAAAAAB3NQQpCMQwE0Lt0baBJ0yZ159KtN0jTBgTBjYgg3t3__3KGN8w3rc_llc4JG6KUhrmoYjolc7_OvWfPKJ2hUzNgagE2hcC5hsYIUeOdH7gStVr6AtElwNUcrBNDFppYMjqxb9hvKzb9fNzfa4_HVkORomdoggsYp8HgPqAWF43VtsOcfn_stx4UsAAAAA.tDRVowYYcpQ03Vlt7D3MiovleiyRFQMv4qzXb7Lf_6CarphRrlWXan8-jE-YesNiAiT8tk0b-i8TKHGrcgT1VQ
minLength: 1
maxLength: 328
apiDataCenter:
description: API Data Center. The accepted values are US, EU or SG.
type: string
example: US
minLength: 1
maxLength: 2
documentVerificationUrl:
description: Web url to display in iframe.
type: string
example: https://mastercard.web.apac-1.jumio.link/web/v4/app?authorizationToken=eyJhbGciOiJIUzUxMiIsInppcCI6IkdaSVAifQ.H4sIAAAAAAAAAJXOQQ5CIQxF0b0wtkmBFqgzh07_Dkp_iWM10cS4d0FX4PTm5OW9gj9P93AMsaRaS845CVM4BDU776sLi5JGiM06UGGDLiUCRaLa0rDR6uJf7FH6mBwYtUyCBcSywBznbmMfGdPEj-H_cNt8TL35zfVql1V-12o0SZ3AGysQ1wKNFCGbsjlyUsTw_gANOZ5b4gAAAA.2bo6KfOvGIswNRNTXv6QtoGvHyNYp_j3LwHia9DtuWna3y_LLI1VgPZle46Q5cFHuuMJB7g7y4wHbtogBX2HfQ&locale=en-US
RetrieveAccessToken_2:
required:
- countryCode
- channelType
type: object
properties:
countryCode:
type: string
example: US
pattern: ^[a-zA-Z]{2}$
description: The ISO 3166-1 alpha2 code which corresponds to the country from where the request to ID is originating from.
channelType:
type: string
example: WEB
description: The platform where the request is generated from.
enum:
- WEB
- SDK
minLength: 3
maxLength: 3
sdkVersion:
type: string
example: 1.0.0
pattern: ^[0-9]{1,5}\.[0-9]{1,5}\.[0-9]{1,5}$
description: The SDK's version that the application is using. Required if the channelType is `SDK`.
livenessType:
type: string
example: GPA
description: The preferred liveness type to be applied; Liveness Assurance (LA) or Genuine Presence Assurance (GPA), where GPA provides LA capability and also additional checks that ensure the user is genuinely present.
enum:
- GPA
- LA
minLength: 2
maxLength: 3
successUrl:
type: string
example: https://www.rp.com/success
description: The URL to be redirected to if the token request is successful. Must be present if the channelType is WEB.
pattern: ^((https):\/\/)([-\w.])+(:[0-9]+)?\/?(\/[-.\w]*)*((\?|\&)([^=]+)\=([^&]*))*$
errorUrl:
type: string
example: https://www.rp.com/error
description: The URL to be redirected to if the token request is not successful. Must be present if the channelType is WEB.
pattern: ^((https):\/\/)([-\w.])+(:[0-9]+)?\/?(\/[-.\w]*)*((\?|\&)([^=]+)\=([^&]*))*$
locale:
description: The IETF BCP 47 value which determines the language variant to be applied in the subsequent scanning dialogs accessed via the token.
type: string
default: en-US
example: en-GB
pattern: ^[a-z]{2}-[a-zA-Z]{2}$
document:
type: object
description: An optional object which allows the Relying Party to limit the country and type of document which can be submitted, by not displaying a document selection screen within the user journey. If only one of the document type or issuing country fields is populated, then the associated dialog option on the document selection screen will continue be displayed.
properties:
issuingCountry:
type: string
example: USA
pattern: ^[A-Z]{3}$
description: Element used to restrict the issuing country of the document that can be uploaded by the user. Inclusion of a value for this element will result in the issuing country option being removed from the Document Selection screen. If a value is also included for the documentType element, then the Document Selection screen will not be displayed at all. The value submitted needs to comply to the ISO 3166-1 Alpha 3 standard.
documentType:
type: string
example: DRIVING_LICENSE
description: Element used to restrict the type of document that can be uploaded by the user. Inclusion of a value for this element will result in the document type option being removed from the Document Selection screen. If a value is also included for the issuingCountry element, then the Document Selection screen will not be displayed at all. The value submitted must be one of the following enum values.
enum:
- DRIVING_LICENSE
- ID_CARD
- PASSPORT
workflowDefinition:
type: String
example: DOCUMENT_EXTRACTION_FACEMATCH_LIVENESS
description: 'Value which indicates the capabilities which are to be executed within the flow: