openapi: 3.1.0 info: title: 'debiX Auth Provider API: Provider-to-SIX 3DS Card Management API' version: 2.1.9 description: Callback API used by the Authentication Provider and implemented by SIX / debiX servers: - url: https://api.six-group.com/api/debix-auth/provider-auth/v2 description: PROD - Internet - url: https://api-preprod.np.six-group.com/api/debix-auth/provider-auth/v2 description: TEST - Internet - url: https://api.six.ssfn.ch/api/debix-auth/provider-auth/v2 description: PROD - SSFN - url: https://api-preprod.np.six.ssfn.ch/api/debix-auth/provider-auth/v2 description: TEST - SSFN - url: https://api.p2p.six-group.com/api/debix-auth/provider-auth/v2 description: PROD - P2P - url: https://api-preprod.np.p2p.six-group.com/api/debix-auth/provider-auth/v2 description: TEST - P2P tags: - name: Card Management description: Allows card lifecycle, PIN management, retrieval of sensitive card data. paths: /cards: post: tags: - Card Management summary: Orders a new card. description: "Orders a new virtual or physical card optionally with a reference to an existing parent card.\n\nIn case the feature toggle values are not specified in the request, either directly, or by referencing a parentCard with the takeoverFeatureToggles set to true, the \nfeature toggles will receive the following default values:\n| Feature Flag | Default Value |\n|------------------------------|--------------------------|\n| eCommerceAllowed | true |\n| trxOnlyAsChipAndPin | false |\n| magStripePaymentAllowed | true |\n| automaticBilling | true |\n| purchaseWithCashBackAllowed | true |\n| merchantInitiatedTrxAllowed | true |\n| atmAllowed | true |\n| posAllowed | true |\n| motoAllowed | true |\n| bypassGeoblocking | true |\n| moneySendReceiveAllowance | RECEIVE_AND_SEND_ALLOWED |\n| reservationAllowed | true |\n| transactionPushEnabled | true |\n| gamblingAndBettingAllowance | ALLOWED |\n| blockedMerchantCategoryCodes | (empty List) |\n| contactlessActivationStatus | ACTIVATED_CONFIRMED | \n\nIn addition to standard application error codes, the following codes can be returned:\n* 4432 - BANK_CLEARING_NUMBER_NOT_CONFIGURED\n* 4443 - UNKNOWN_PARENT_CARD\n* 4444 - VIRTUAL_CARD_EQUALS_PARENT_CARD\n* 4445 - CARD_ALREADY_EXISTING\n* 4446 - DELIVERY_INFORMATION_FOR_OTRC_MISSING\n* 4451 - INVALID_JWS_SIGNATURE\n* 4452 - START_SET_PIN_NOT_CALLED\n* 4462 - DELIVERY_INFORMATION_FOR_CARD_OR_PIN_MISSING\n* 4463 - CARD_EXPRESS_CODE_MISSING\n* 4464 - PIN_EXPRESS_CODE_MISSING\n* 4465 - PRODUCER_CODE_MISSING\n* 4466 - CARDLINE1_MISSING\n* 4469 - PIN_DELIVERY_NOT_ALLOWED_FOR_VIRTUAL_CARD\n* 4476 - DATAMAILER_DELIVERY_DESTINATION_DIFFERENCE_NOT_ALLOWED\n* 4477 - DATAMAILER_EXPRESS_CODE_DIFFERENCE_NOT_ALLOWED\n* 4478 - OTRC_EXPRESS_CODE_MISSING\n* 4480 - BANK_CARD_CAN_NOT_BE_ORDERED_AS_VIRTUAL_CARD\n* 4481 - PARAMETER_ONLY_ALLOWED_FOR_BANK_CARD\n* 4482 - BANK_DATA_TRACK_2_MISSING\n* 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER\n" operationId: orderCard parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' requestBody: description: Configuration specifying the new card to be ordered. content: application/json: schema: $ref: '#/components/schemas/CardOrderRequest' required: true responses: '202': description: 'Accepted. The request to order a new card has been successfully received and processed. The new card is ready for immediate use in subsequent card-related operations. ' content: application/json: schema: $ref: '#/components/schemas/CardOrderResponse' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' put: tags: - Card Management summary: Modifies the data of a card. description: 'Deprecated, use `PUT /debix/bank/cardtoken/v2/cards/{cardToken}` instead. Allows the modification of certain data fields belonging to a card. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4436 - CARD_INACTIVE * 4447 - NO_CARD_DETAILS_AVAILABLE * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: mutateCardDetails parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' requestBody: description: Fields to modify. Not all fields are mandatory. content: application/json: schema: $ref: '#/components/schemas/CardMutationRequest_2' required: true responses: '202': description: Successful '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/{cardToken}/reverse-order: post: tags: - Card Management summary: Reverses a card order. description: 'Reverses a previously ordered card. The reversal is only possible while the card order of a physical card is still in a cancellable state: for card renewals before 7:55 am on the same day as the card order request and for new card orders before 18:25 on the same day as the card order request. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4470 - CARD_ORDER_REVERSAL_NOT_POSSIBLE * 4471 - CARD_ORDER_REVERSAL_FOR_VIRTUAL_CARD_NOT_ALLOWED * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: reverseCardOrder parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' - in: path name: cardToken description: Card token required: true schema: $ref: '#/components/schemas/CardToken' requestBody: description: Identifier of the card whose order should be reversed. required: true content: application/json: schema: $ref: '#/components/schemas/CardOrderReversalRequest' responses: '202': description: Successful '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/{cardToken}: post: tags: - Card Management summary: Returns the card's details. description: 'Returns the status and the details of the given card. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4447 - NO_CARD_DETAILS_AVAILABLE * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: getCardDetails parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' - in: path name: cardToken description: Card token required: true schema: $ref: '#/components/schemas/CardToken' requestBody: description: Identifier of the card for which to return the details. content: application/json: schema: $ref: '#/components/schemas/CardDetailsRequest' required: true responses: '200': description: Successful content: application/json: schema: $ref: '#/components/schemas/CardDetailsResponse' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' put: tags: - Card Management summary: Modifies the data of a card. description: 'Allows the modification of certain data fields belonging to a card. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4436 - CARD_INACTIVE * 4447 - NO_CARD_DETAILS_AVAILABLE * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: mutateCardDetails parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' - in: path name: cardToken description: Card token required: true schema: $ref: '#/components/schemas/CardToken' requestBody: description: Fields to modify. Not all fields are mandatory. content: application/json: schema: $ref: '#/components/schemas/CardMutationRequest' required: true responses: '202': description: Successful '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/{cardToken}/status: put: tags: - Card Management summary: Modifies the status of a card. description: 'Modifies the status of the specified card. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4438 - CARD_STATUS_UPDATE_NOT_ALLOWED * 4439 - CARD_HAS_PENDING_STATUS * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: updateCardStatus parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' - in: path name: cardToken description: Card token required: true schema: $ref: '#/components/schemas/CardToken' requestBody: description: Contains the new status to be set on the card. In case of a blocking action, contains also the block reason. content: application/json: schema: $ref: '#/components/schemas/UpdateCardStatusRequest' required: true responses: '202': description: Accepted '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/{cardToken}/credentials: post: tags: - Card Management summary: Gets card credentials. description: 'Get credentials (PAN, CVV) of the specified card. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4450 - NO_CERTIFICATE_FOUND * 4451 - INVALID_JWS_SIGNATURE * 4483 - OPERATION_NOT_ALLOWED_FOR_BANK_CARD ' operationId: getCardCredentials parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' - in: path name: cardToken description: Card token required: true schema: $ref: '#/components/schemas/CardToken' requestBody: description: Signed request for the credentials, containing card identifiers and encryption parameters. content: text/plain: schema: $ref: '#/components/schemas/CardCredentialsRequest' examples: JWS Header (decoded): value: alg: ES256 (example) typ: JWT x5t#S256: 0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEp JWS Payload (decoded): value: cardToken: CTK-85AB2A9FE2374A188A039F03F88E6EE1 cardTokenExtension: cardSequenceNumber: 1 cardExpiry: month: 6 year: 23 clientEphPubKey: SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c required: true responses: '200': description: Successful content: text/plain: schema: $ref: '#/components/schemas/CardCredentialsResponse' examples: JWS Header (decoded): value: alg: none typ: JWT JWS Payload (decoded): value: serverEphPubKey: QbTKxwRJSMeKKF2Q_T4fwpMeJf36POk6yJVadQssZi9 encryptedData: TG9yZW0gaXBzdW0gZG9sciBzaXI= Card Credentials (decrypted): value: fpan: 1234567812345678 cvv: 123 '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/{cardToken}/pin: post: tags: - Card Management summary: Gets the PIN for the given card. description: 'Get PIN of the given card. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4450 - NO_CERTIFICATE_FOUND * 4451 - INVALID_JWS_SIGNATURE * 4458 - RETRIEVE_PIN_NOT_ALLOWED_FOR_DELETED_CARD * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: getPin parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' - in: path name: cardToken description: Card token required: true schema: $ref: '#/components/schemas/CardToken' requestBody: description: Signed request for the PIN, containing card identifiers and encryption parameters. content: text/plain: schema: $ref: '#/components/schemas/GetPinRequest' examples: JWS Header (decoded): value: alg: ES256 (example) typ: JWT x5t#S256: 0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEp JWS Payload (decoded): value: cardToken: CTK-85AB2A9FE2374A188A039F03F88E6EE1 cardTokenExtension: cardSequenceNumber: 1 cardExpiry: month: 6 year: 23 clientEphPubKey: SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c required: true responses: '200': description: Successful content: text/plain: schema: $ref: '#/components/schemas/GetPinResponse' examples: JWS Header (decoded): value: alg: ES256 (example) typ: JWT JWS Payload (decoded): value: serverEphPubKey: QbTKxwRJSMeKKF2Q_T4fwpMeJf36POk6yJVadQssZi9 encryptedData: TG9yZW0gaXBzdW0gZG9sciBzaXI= PIN (decrypted): value: pin: 123456 '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/{cardToken}/start-set-pin: post: tags: - Card Management summary: Starts a PIN set operation. description: 'First call to be able to set the PIN for the specified card. debiX returns an ephemeral public key to encrypt the PIN on the issuer''s side for the ''/set-pin'' call. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4440 - SET_PIN_NOT_ALLOWED_FOR_BLOCKED_OR_DELETED_CARD * 4442 - PIN_PREVIOUSLY_PASSED_TO_NEWER_CARD * 4450 - NO_CERTIFICATE_FOUND * 4451 - INVALID_JWS_SIGNATURE * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: startSetPin parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' - in: path name: cardToken description: Card token required: true schema: $ref: '#/components/schemas/CardToken' requestBody: description: Signed request to get debiX's ephemeral public key, it contains card identifiers. content: text/plain: schema: $ref: '#/components/schemas/StartSetPinRequest' examples: JWS Header (decoded): value: alg: ES256 (example) typ: JWT x5t#S256: 0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEp JWS Payload (decoded): value: cardToken: CTK-85AB2A9FE2374A188A039F03F88E6EE1 cardTokenExtension: cardSequenceNumber: 1 cardExpiry: month: 6 year: 23 required: true responses: '200': description: Successful content: text/plain: schema: $ref: '#/components/schemas/StartSetPinResponse' examples: JWS Header (decoded): value: alg: ES256 (example) typ: JWT JWS Payload (decoded): value: serverEphPubKey: QbTKxwRJSMeKKF2Q_T4fwpMeJf36POk6yJVadQssZi9 '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/start-set-pin: post: tags: - Card Management summary: Starts a PIN set operation. description: 'First call to be able to set the PIN for the specified card. debiX returns an ephemeral public key to encrypt the PIN on the issuer''s side for the ''/set-pin'' call. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4440 - SET_PIN_NOT_ALLOWED_FOR_BLOCKED_OR_DELETED_CARD * 4442 - PIN_PREVIOUSLY_PASSED_TO_NEWER_CARD * 4450 - NO_CERTIFICATE_FOUND * 4451 - INVALID_JWS_SIGNATURE * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: startSetPinByCardId parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' requestBody: description: Signed request to get debiX's ephemeral public key, it contains a card identifier. content: text/plain: schema: $ref: '#/components/schemas/StartSetPinByCardIdRequest' examples: JWS Header (decoded): value: alg: ES256 (example) typ: JWT x5t#S256: 0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEp JWS Payload (decoded): value: cardId: bankClearingNumber: 5000 cardNumber: 123456 cardType: 1 cardSequenceNumber: 1 cardExpiry: month: 6 year: 23 required: true responses: '200': description: Successful content: text/plain: schema: $ref: '#/components/schemas/StartSetPinResponse' examples: JWS Header (decoded): value: alg: ES256 (example) typ: JWT JWS Payload (decoded): value: serverEphPubKey: QbTKxwRJSMeKKF2Q_T4fwpMeJf36POk6yJVadQssZi9 '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/{cardToken}/set-pin: post: tags: - Card Management summary: Sets the PIN for the given card. description: "Sets the PIN for the given card. The PIN is encrypted with the shared key derived from debiX's ephemeral public key from the '/start-set-pin' request \nand the issuer's ephemeral private key corresponding to the issuer's ephemeral public key in this request (clientEphPubKey). \n\nIn addition to standard application error codes, the following codes can be returned:\n* 4430 - UNKNOWN_CARD\n* 4440 - SET_PIN_NOT_ALLOWED_FOR_BLOCKED_OR_DELETED_CARD\n* 4442 - PIN_PREVIOUSLY_PASSED_TO_NEWER_CARD\n* 4450 - NO_CERTIFICATE_FOUND\n* 4451 - INVALID_JWS_SIGNATURE\n* 4452 - START_SET_PIN_NOT_CALLED\n* 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER\n" operationId: setPin parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' - in: path name: cardToken description: Card token required: true schema: $ref: '#/components/schemas/CardToken' requestBody: description: Signed request for the PIN set operation, containing card identifiers, encryption parameters and encrypted PIN. content: text/plain: schema: $ref: '#/components/schemas/SetPinRequest' examples: JWS Header (decoded): value: alg: ES256 (example) typ: JWT x5t#S256: 0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEp JWS Payload (decoded): value: cardToken: CTK-85AB2A9FE2374A188A039F03F88E6EE1 cardTokenExtension: cardSequenceNumber: 1 cardExpiry: month: 6 year: 23 clientEphPubKey: SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c encryptedData: TG9yZW0gaXBzdW0gZG9sciBzaXI= required: true responses: '204': description: Set PIN was successful. '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/{cardToken}/pin-datamailer: post: tags: - Card Management summary: Orders a PIN datamailer for the specified card. description: 'PIN datamailer orders are only possible for physical cards. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4469 - PIN_DELIVERY_NOT_ALLOWED_FOR_VIRTUAL_CARD * 4472 - MULTIPLE_PIN_DATAMAILER_ORDERS_PER_DAY * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: orderPinDatamailer parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' - in: path name: cardToken description: Card token required: true schema: $ref: '#/components/schemas/CardToken' requestBody: description: Details of the PIN datamailer order. content: application/json: schema: $ref: '#/components/schemas/PinDatamailerOrderRequest' required: true responses: '202': description: Accepted '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/{cardToken}/reset-pin-try-counter: post: tags: - Card Management summary: Resets the PIN try counter for the given card. description: "Requests the reset of PIN try counter for the given card. After the reset at the card processor, the cardholder has three PIN attempts again.\n\n In addition to standard application error codes, the following codes can be returned:\n * 4430 - UNKNOWN_CARD\n * 4474 - RESET_PIN_TRY_COUNTER_NOT_ALLOWED_FOR_BLOCKED_OR_DELETED_CARD\n * 4475 - RESET_PIN_TRY_COUNTER_DAILY_LIMIT_EXCEEDED\n * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER\n" operationId: resetPinTryCounter parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' - in: path name: cardToken description: Card token required: true schema: $ref: '#/components/schemas/CardToken' requestBody: description: Request to reset the PIN try counter containing the card identifiers. content: application/json: schema: $ref: '#/components/schemas/ResetPinTryCounterRequest' required: true responses: '202': description: Accepted '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/card-token: post: tags: - Card Management summary: Returns the card token. description: 'Returns the unique card token of the specified card. In addition to standard application error codes, following codes can be returned: * 4430 - UNKNOWN_CARD * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: getCardToken parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' requestBody: description: Identifier of the card for which to return the card token. content: application/json: schema: $ref: '#/components/schemas/CardTokenRequest' required: true responses: '200': description: Successful content: application/json: schema: $ref: '#/components/schemas/CardTokenResponse' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/{cardToken}/card-instance-token: post: tags: - Card Management summary: Returns the card instance token. description: 'Returns the unique card instance token of the specified card. In addition to standard application error codes, following codes can be returned: * 4430 - UNKNOWN_CARD * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: getCardInstanceToken parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' - in: path name: cardToken description: Card token required: true schema: $ref: '#/components/schemas/CardToken' requestBody: description: Identifier of the card for which to return the card instance token. content: application/json: schema: $ref: '#/components/schemas/CardInstanceTokenRequest' required: true responses: '200': description: Successful content: application/json: schema: $ref: '#/components/schemas/CardInstanceTokenResponse' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/card-instance-token: post: tags: - Card Management summary: Returns the card instance token. description: 'Returns the unique card instance token of the specified card. In addition to standard application error codes, following codes can be returned: * 4430 - UNKNOWN_CARD * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: getCardInstanceTokenByCardId parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' requestBody: description: Identifier of the card for which to return the card instance token. content: application/json: schema: $ref: '#/components/schemas/CardInstanceTokenByCardIdRequest' required: true responses: '200': description: Successful content: application/json: schema: $ref: '#/components/schemas/CardInstanceTokenResponse' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/{cardToken}/short-card-id: get: tags: - Card Management summary: Returns the card identifier. description: 'Returns the card identifier, i.e. short card id, of the given card. In addition to standard application error codes, following codes can be returned: * 4430 - UNKNOWN_CARD * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: getCardIdentifier parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' - in: path name: cardToken description: Card token required: true schema: $ref: '#/components/schemas/CardToken' responses: '200': description: Successful content: application/json: schema: $ref: '#/components/schemas/ShortCardIdResponse' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/reverse-order: post: tags: - Card Management summary: Reverses a card order. description: 'Deprecated, use `POST /debix/bank/cardtoken/v2/cards/{cardToken}/reverse-order` instead. Reverses a previously ordered card. The reversal is only possible while the card order of a physical card is still in a cancellable state: for card renewals before 7:55 am on the same day as the card order request and for new card orders before 18:25 on the same day as the card order request. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4470 - CARD_ORDER_REVERSAL_NOT_POSSIBLE * 4471 - CARD_ORDER_REVERSAL_FOR_VIRTUAL_CARD_NOT_ALLOWED * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: reverseCardOrder parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' requestBody: description: Identifier of the card whose order should be reversed. required: true content: application/json: schema: $ref: '#/components/schemas/CardOrderReversalRequest_2' responses: '202': description: Successful '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/status: put: tags: - Card Management summary: Modifies the status of a card. description: 'Deprecated, use `PUT /debix/bank/cardtoken/v2/cards/{cardToken}/status` instead. Modifies the status of the specified card. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4438 - CARD_STATUS_UPDATE_NOT_ALLOWED * 4439 - CARD_HAS_PENDING_STATUS * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: updateCardStatus parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' requestBody: description: Contains the new status to be set on the card. In case of a blocking action, contains also the block reason. content: application/json: schema: $ref: '#/components/schemas/UpdateCardStatusRequest_2' required: true responses: '202': description: Accepted '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/details: post: tags: - Card Management summary: Returns the card's details. description: 'Deprecated, use `POST /debix/bank/cardtoken/v2/cards/{cardToken}` instead. Returns the status and the details of the specified card. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4447 - NO_CARD_DETAILS_AVAILABLE * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: getCardDetails parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' requestBody: description: Identifier of the card for which to return the details. content: application/json: schema: $ref: '#/components/schemas/CardDetailsRequest_2' required: true responses: '200': description: Successful content: application/json: schema: $ref: '#/components/schemas/CardDetailsResponse_2' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/credentials: post: tags: - Card Management summary: Gets card credentials. description: 'Deprecated, use `POST /debix/bank/cardtoken/v2/cards/{cardToken}/credentials instead`. Get credentials (PAN, CVV) of the specified card. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4450 - NO_CERTIFICATE_FOUND * 4451 - INVALID_JWS_SIGNATURE * 4483 - OPERATION_NOT_ALLOWED_FOR_BANK_CARD ' operationId: getCardCredentials parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' requestBody: description: Signed request for the credentials, containing card identifier and encryption parameters. content: text/plain: schema: $ref: '#/components/schemas/CardCredentialsRequest' examples: JWS Header (decoded): value: alg: ES256 (example) typ: JWT x5t#S256: 0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEp JWS Payload (decoded): value: cardId: bankClearingNumber: 5000 cardNumber: 123456 cardType: 1 cardSeqNumber: 1 cardExpiry: month: 6 year: 23 clientEphPubKey: SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c required: true responses: '200': description: Successful content: text/plain: schema: $ref: '#/components/schemas/CardCredentialsResponse' examples: JWS Header (decoded): value: alg: none typ: JWT JWS Payload (decoded): value: serverEphPubKey: QbTKxwRJSMeKKF2Q_T4fwpMeJf36POk6yJVadQssZi9 encryptedData: TG9yZW0gaXBzdW0gZG9sciBzaXI= Card Credentials (decrypted): value: fpan: 1234567812345678 cvv: 123 '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/pin: post: tags: - Card Management summary: Gets the PIN for the specified card. description: 'Deprecated, use `POST /debix/bank/cardtoken/v2/cards/{cardToken}/pin` instead. Get PIN of the specified card. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4450 - NO_CERTIFICATE_FOUND * 4451 - INVALID_JWS_SIGNATURE * 4458 - RETRIEVE_PIN_NOT_ALLOWED_FOR_DELETED_CARD * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: getPin parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' requestBody: description: Signed request for the PIN, containing card identifier and encryption parameters. content: text/plain: schema: $ref: '#/components/schemas/GetPinRequest' examples: JWS Header (decoded): value: alg: ES256 (example) typ: JWT x5t#S256: 0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEp JWS Payload (decoded): value: cardId: bankClearingNumber: 5000 cardNumber: 123456 cardType: 1 cardSeqNumber: 1 cardExpiry: month: 6 year: 23 clientEphPubKey: SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c required: true responses: '200': description: Successful content: text/plain: schema: $ref: '#/components/schemas/GetPinResponse' examples: JWS Header (decoded): value: alg: ES256 (example) typ: JWT JWS Payload (decoded): value: serverEphPubKey: QbTKxwRJSMeKKF2Q_T4fwpMeJf36POk6yJVadQssZi9 encryptedData: TG9yZW0gaXBzdW0gZG9sciBzaXI= PIN (decrypted): value: pin: 123456 '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/set-pin: post: tags: - Card Management summary: Sets the PIN for the specified card. description: "Deprecated, use `POST /debix/bank/cardtoken/v2/cards/{cardToken}/set-pin` instead.\n\nSets the PIN for the specified card. The PIN is encrypted with the shared key derived from debiX's ephemeral public key from the '/start-set-pin' request \nand the issuer's ephemeral private key corresponding to the issuer's ephemeral public key in this request (clientEphPubKey). \n\nIn addition to standard application error codes, the following codes can be returned:\n* 4430 - UNKNOWN_CARD\n* 4440 - SET_PIN_NOT_ALLOWED_FOR_BLOCKED_OR_DELETED_CARD\n* 4442 - PIN_PREVIOUSLY_PASSED_TO_NEWER_CARD\n* 4450 - NO_CERTIFICATE_FOUND\n* 4451 - INVALID_JWS_SIGNATURE\n* 4452 - START_SET_PIN_NOT_CALLED\n* 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER\n" operationId: setPin parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' requestBody: description: Signed request for the PIN set operation, containing card identifier, encryption parameters and encrypted PIN. content: text/plain: schema: $ref: '#/components/schemas/SetPinRequest' examples: JWS Header (decoded): value: alg: ES256 (example) typ: JWT x5t#S256: 0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEp JWS Payload (decoded): value: cardId: bankClearingNumber: 5000 cardNumber: 123456 cardType: 1 cardSeqNumber: 1 cardExpiry: month: 6 year: 23 clientEphPubKey: SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c encryptedData: TG9yZW0gaXBzdW0gZG9sciBzaXI= required: true responses: '204': description: Set PIN was successful. '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/pin-datamailer: post: tags: - Card Management summary: Orders a PIN datamailer for the specified card. description: 'Deprecated, use `POST /debix/bank/cardtoken/v2/cards/{cardToken}/pin-datamailer` instead. PIN datamailer orders are only possible for physical cards. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4469 - PIN_DELIVERY_NOT_ALLOWED_FOR_VIRTUAL_CARD * 4472 - MULTIPLE_PIN_DATAMAILER_ORDERS_PER_DAY * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: orderPinDatamailer parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' requestBody: description: Details of the PIN datamailer order. required: true content: application/json: schema: $ref: '#/components/schemas/PinDatamailerOrderRequest_2' responses: '202': description: Accepted '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' /cards/reset-pin-try-counter: post: tags: - Card Management summary: Resets the PIN try counter for the specified card. description: 'Deprecated, use `POST /debix/bank/cardtoken/v2/cards/{cardToken}/reset-pin-try-counter` instead. Requests the reset of PIN try counter for the given card. After the reset at the card processor, the cardholder has three PIN attempts again. In addition to standard application error codes, the following codes can be returned: * 4430 - UNKNOWN_CARD * 4474 - RESET_PIN_TRY_COUNTER_NOT_ALLOWED_FOR_BLOCKED_OR_DELETED_CARD * 4475 - RESET_PIN_TRY_COUNTER_DAILY_LIMIT_EXCEEDED * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER ' operationId: resetPinTryCounter parameters: - $ref: '#/components/parameters/RequestIdHeader' - $ref: '#/components/parameters/IssuerTraceIdHeader' requestBody: description: Request to reset the PIN try counter containing the card identifiers. required: true content: application/json: schema: $ref: '#/components/schemas/ResetPinTryCounterRequest_2' responses: '202': description: Accepted '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/BankApiError' '404': description: Not found or card is deleted content: application/json: schema: $ref: '#/components/schemas/BankApiError' default: description: Unexpected error content: application/json: schema: $ref: '#/components/schemas/BankApiError' components: schemas: VisaC2PCustomerId: description: Unique identifier for the customer. type: string format: uuid VisaADAliasId: description: The UUID generated by Alias Directory which identifies the alias. type: string minLength: 36 maxLength: 36 examples: - e336c8c8-2945-4be3-af3e-951ec2d01219 BankClearingNumber: description: Unique number used to identify each bank agency or branch in the bank directory. type: integer format: int32 minimum: 100 maximum: 99999 examples: - 50000 CardStatusUpdateReason: description: The reason for the status update of the card. type: string enum: - ISSUER_DECISION - USER_DECISION examples: - USER_DECISION BlockedCardReplacement: description: Indicates the need of a card replacement when the card has been blocked. This is only an indicator and does not trigger the actual card replacement. type: string enum: - NO_REPLACEMENT - CARD - CARD_WITH_PIN_MAILER - CARD_WITH_PIN_AND_OTRC_MAILER - CARD_WITH_OTRC_MAILER - CARD_WITH_UNKNOWN_MAILER BccData: description: Information about the cardholder from the bank card central. type: object required: - salutation - firstName - familyName - street - city - postalCode - country properties: salutation: $ref: '#/components/schemas/Salutation' firstName: $ref: '#/components/schemas/FirstName' familyName: $ref: '#/components/schemas/FamilyName' street: description: Street name. type: string maxLength: 25 examples: - Bahnhofstrasse streetNo: description: Street number. type: string maxLength: 5 examples: - '1' city: description: Location city. type: string maxLength: 25 examples: - Zürich postalCode: description: Postal code. type: string maxLength: 10 examples: - '8001' country: $ref: '#/components/schemas/Country' phoneNumber: $ref: '#/components/schemas/PhoneNumber' birthdate: description: Birthdate to identify the customer. type: string format: date examples: - '2000-12-31' emailAddress: description: Email address to identify the customer. type: string examples: - peter.schweizer@mailbox.org customerRelationshipOpeningDate: description: Date when the customer relationship was opened; used to identify the customer. type: string format: date examples: - '2021-12-31' accountOpeningDate: description: Date when the account was opened; used to identify the customer. type: string format: date examples: - '2021-12-31' accountAuthorities: type: array minItems: 0 maxItems: 4 items: $ref: '#/components/schemas/AccountAuthority' individualIdentificationTag: description: Individual tag to identify the customer. type: string maxLength: 80 examples: - Owner of a sailing boat ebankingContractNo: description: Ebanking contract number to identify the customer. type: string maxLength: 15 examples: - ABC-56789012345 BankCardLine: description: Bank card specific field. The content of this field has to be agreed with the card producer and will not be checked by SIX. type: string CardDetailsRequest: description: Contains identifiers of the card for which to return the details. type: object required: - cardTokenExtension properties: cardTokenExtension: $ref: '#/components/schemas/CardTokenExtension' EmvProfile: description: Information about the EMV-Profile. Must be set for a physical card order. type: object required: - emvCurrency properties: emvCurrency: $ref: '#/components/schemas/Currency' emvProfileId: description: The identifier of an EMV-Profile. Must correspond to the field ChipApplication. type: integer examples: - 4 DatamailerDeliveryDestination: description: Specifies the delivery destination for OTRC, PIN, and card datamailer. type: string enum: - DELIVER_TO_BANK - DELIVER_TO_CARDHOLDER CardId: description: Complex object representing a card consisting of bank clearing number, card number, card type, card sequence number and card expiry. type: object required: - bankClearingNumber - cardNumber - cardType - cardSequenceNumber - cardExpiry properties: bankClearingNumber: $ref: '#/components/schemas/BankClearingNumber' cardNumber: $ref: '#/components/schemas/CardNumber' cardType: $ref: '#/components/schemas/CardType' cardSequenceNumber: $ref: '#/components/schemas/CardSequenceNumber' cardExpiry: $ref: '#/components/schemas/YearMonth' ParentCardReference: description: Reference to a card from which settings can be inherited. type: object required: - cardToken - cardTokenExtension - shareLimits - deleteAfterFirstUse - takeoverPin - takeoverContactlessActivationStatus - takeoverFeatureToggles - takeoverBillingUpdater properties: cardToken: $ref: '#/components/schemas/CardToken' cardTokenExtension: $ref: '#/components/schemas/CardTokenExtension' shareLimits: description: Indicates if the limits should be shared with the parent card. type: boolean deleteAfterFirstUse: description: Indicates if the parent card shall be deleted after first use of new card. type: boolean takeoverPin: description: Indicates if the PIN shall be taken over from the parent card. type: boolean takeoverContactlessActivationStatus: description: Indicates if the contactless activation status shall be taken over from the parent card. type: boolean takeoverFeatureToggles: description: Indicates if the feature toggles shall be taken over from the parent card. type: boolean takeoverBillingUpdater: type: boolean description: Indicates if the new card shall be linked to the account of the parent card within the Mastercard automated billing updater (ABU) resp. the VISA Account Updater (VAU). CardBlockInformation: description: Contains information about blocked cards. type: object properties: blockReason: $ref: '#/components/schemas/CardBlockReason' blockOrigin: $ref: '#/components/schemas/CardBlockOrigin' blockInterface: $ref: '#/components/schemas/CardBlockInterface' blockedCardReplacement: $ref: '#/components/schemas/BlockedCardReplacement' unblockCardByCardholderAllowed: description: 'Defines if the cardholder is allowed to unblock the card. ' type: boolean examples: - true CardMailerText: description: Text which will be printed on the letter onto which the card is attached. type: string minLength: 1 maxLength: 60 CardInstanceToken: description: Unique card instance token of the card. type: string pattern: ^CITK-[0-9a-fA-F]{32}$ minLength: 37 maxLength: 37 examples: - CITK-1744BC4B31C945A1942F4CCF65EC8D99 MerchantCategoryCode: description: The merchant category code. In a whitelist, the presence of 0 signifies that all merchant category codes are allowed. type: integer format: int32 minimum: 0 maximum: 9999 examples: - 7995 StartSetPinRequest: type: string description: "JSON Web Token signed by the issuer to get an ephemeral public key from debiX for the given card. \n* The algorithm of the JWS signature can be one of RS256/384/512, PS256/384/512, ES256/384/512 or EdDsa/Ed25519. ES256 is recommended.\n* The JOSE header must contain a 'x5t#S256' parameter with the X.509 certificate SHA-256 thumbprint of the key used to sign the token. (https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.8)\n" examples: - see "#/components/schemas/StartSetPinRequestJwsPayload" CardMutationRequest: description: Fields to modify. Fields that are set will be modified. Others will be ignored. type: object required: - cardTokenExtension properties: cardTokenExtension: $ref: '#/components/schemas/CardTokenExtension' bccData: $ref: '#/components/schemas/CardMutationBccData' fraudConfiguration: $ref: '#/components/schemas/CardMutationFraudConfiguration' cardApplication: $ref: '#/components/schemas/CardMutationCardApplication' contactlessActivationStatus: $ref: '#/components/schemas/CardMutationContactlessActivationStatus' featureToggles: $ref: '#/components/schemas/CardMutationFeatureToggles' CardPlasticCode: description: Plastic code of the card. type: string minLength: 2 maxLength: 2 examples: - F0 UnstructuredAddress: description: Unstructured address of simple address lines. type: array minItems: 1 maxItems: 6 items: type: string maxLength: 35 examples: - - Peter Schweizer - Bahnhofstrasse 1 - 8000 Zürich UseBankCardWithPin: type: boolean description: Bank card specific field. Indicator of whether the bank card is used with or without PIN. ShortCardId: description: Complex object representing a card consisting of bank clearing number, card number and card type. type: object required: - bankClearingNumber - cardNumber - cardType properties: bankClearingNumber: $ref: '#/components/schemas/BankClearingNumber' cardNumber: $ref: '#/components/schemas/CardNumber' cardType: $ref: '#/components/schemas/CardType' Region: description: Region from where an authorization is requested. type: string enum: - SWITZERLAND_AND_LIECHTENSTEIN - EUROPE - EASTERN_EUROPE_AND_CENTRAL_ASIA - AFRICA - CANADA - USA_AND_MEXICO - LATIN_AMERICA_AND_CARIBBEAN - MIDDLE_EAST_ASIA_PACIFIC_AUSTRALIA FeatureToggles: description: Contains the values of the feature toggles for the card. In card order requests, the contactlessActivationStatus will be ignored. Will be ignored in card order requests for bank cards. type: object required: - eCommerceAllowed - trxOnlyAsChipAndPin - magStripePaymentAllowed - automaticBilling - purchaseWithCashBackAllowed - merchantInitiatedTrxAllowed - atmAllowed - posAllowed - motoAllowed - bypassGeoblocking - moneySendReceiveAllowance - reservationAllowed - transactionPushEnabled - gamblingAndBettingAllowance properties: eCommerceAllowed: description: Indicates if the use of ecommerce is allowed. type: boolean trxOnlyAsChipAndPin: description: Indicates if cvm is active, i.e. card can do transaction only as Chip and PIN. type: boolean magStripePaymentAllowed: description: Defines if magnetic stripe payments are allowed. type: boolean automaticBilling: description: Indicates if the cardholder participates to the automatic billing update. type: boolean purchaseWithCashBackAllowed: description: Defines if purchase with cash back is allowed. type: boolean blockedMerchantCategoryCodes: description: List of blocked merchant category codes. type: array minItems: 1 maxItems: 10 items: $ref: '#/components/schemas/MerchantCategoryCode' merchantInitiatedTrxAllowed: description: Indicates if merchant initiated transactions - such as Recurring, Installment, Unscheduled - are allowed. type: boolean atmAllowed: description: Defines if withdrawals are allowed at ATMs. type: boolean posAllowed: description: Defines if payments are allowed at POS terminals. type: boolean motoAllowed: description: Defines if mail or phone orders are allowed. type: boolean bypassGeoblocking: description: Defines if geo blocking is ignored for the card. type: boolean moneySendReceiveAllowance: $ref: '#/components/schemas/MoneySendReceiveAllowance' reservationAllowed: description: Defines if reservation transactions are allowed. type: boolean transactionPushEnabled: description: Defines if transactions are pushed to debiX. type: boolean gamblingAndBettingAllowance: $ref: '#/components/schemas/GamblingAndBettingAllowance' contactlessActivationStatus: $ref: '#/components/schemas/ContactlessActivationStatus' AccountAuthority: description: Indicates who has the right to draw on the account. type: object properties: firstName: $ref: '#/components/schemas/FirstName' familyName: $ref: '#/components/schemas/FamilyName' birthdate: $ref: '#/components/schemas/Birthdate' CardCredentialsRequest: type: string description: "JSON Web Token signed by the issuer, containing all parameters for securely retrieving sensitive card credentials. \n* The algorithm of the JWS signature can be one of RS256/384/512, PS256/384/512, ES256/384/512 or EdDsa/Ed25519. ES256 is recommended.\n* The JOSE header must contain a 'x5t#S256' parameter with the X.509 certificate SHA-256 thumbprint of the key used to sign the token. (https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.8)\n" examples: - see "#/components/schemas/CardCredentialsRequestJwsPayload" RestrictedCountries: description: 'A list of countries from which authorizations will be declined. Country code values are expected in ISO 3166-1 alpha-2 format. The option to define a restriction for individual countries is only available on request; please contact SIX if you are interested.' type: array minItems: 1 maxItems: 300 items: $ref: '#/components/schemas/Country' CardBlockOrigin: description: Initiator and channel of the card blocking. type: string enum: - ONLINE_BANKING_BY_CARDHOLDER - MOBILE_BANKING_BY_CARDHOLDER - THREE_DS_CARDMANAGEMENT_APP_BY_CARDHOLDER - BACKEND_OF_BANK_BY_BANK - BACKEND_OF_BANK_BY_CARDHOLDER - BANK_DEBIT_ONLINE_WEB_BY_BANK - BANK_DEBIT_ONLINE_WEB_BY_CALL_CARDHOLDER - SIX_CALLCENTER_BY_CALL_CARDHOLDER - SIX_CALLCENTER_DEBIT_ONLINE_WEB_VIA_BLOCKING_MASK_BY_CALL_CARDHOLDER - SIX_BY_THIRD_PARTY_ORDER - SIX_DEBIT_ONLINE_WEB_VIA_BLOCKING_MASK_BY_THIRD_PARTY_ORDER - SIX_DEBIT_ONLINE_WEB_VIA_CARD_MASK_BY_THIRD_PARTY_ORDER - SIX_FRAUD_BY_RISKSHIELD_MANUAL - SIX_FRAUD_BY_RISKSHIELD_AUTOMATIC - SIX_FRAUD_BY_DEBIX - SIX_BY_BLOCKING_APPLICATION FamilyName: description: Family name type: string maxLength: 25 examples: - Schweizer CardMutationFeatureToggles: description: Feature Toggles to mutate. type: object properties: eCommerceAllowed: description: Indicates if the use of ecommerce is allowed. type: boolean trxOnlyAsChipAndPin: description: Indicates if cvm is active, i.e. card can do transaction only as Chip and PIN. type: boolean magStripePaymentAllowed: description: Defines if magnetic stripe payments are allowed. type: boolean automaticBilling: description: Indicates if the cardholder participates to the automatic billing update. type: boolean purchaseWithCashBackAllowed: description: Defines if purchase with cash back is allowed. type: boolean blockedMerchantCategoryCodes: description: List of blocked merchant category codes. type: array minItems: 1 maxItems: 10 items: $ref: '#/components/schemas/MerchantCategoryCode' merchantInitiatedTrxAllowed: description: Indicates if merchant initiated transactions - such as Recurring, Installment, Unscheduled - are allowed. type: boolean atmAllowed: description: Defines if withdrawals are allowed at ATMs. type: boolean posAllowed: description: Defines if payments are allowed at POS terminals. type: boolean motoAllowed: description: Defines if mail or phone orders are allowed. type: boolean bypassGeoblocking: description: Defines if geo blocking is ignored for the card. type: boolean moneySendReceiveAllowance: $ref: '#/components/schemas/MoneySendReceiveAllowance' reservationAllowed: description: Defines if reservation transactions are allowed. type: boolean transactionPushEnabled: description: Defines if transactions are pushed to debiX. type: boolean gamblingAndBettingAllowance: $ref: '#/components/schemas/GamblingAndBettingAllowance' ContactlessActivationMode: description: Describes the contactless activation mode used during card ordering. type: string enum: - ACCORDING_TO_EMV - IMMEDIATE - AUTOMATIC - DEFERRED CardTokenRequest: description: Contains the identifier of the card for which to return the card token. type: object required: - shortCardId properties: shortCardId: $ref: '#/components/schemas/ShortCardId' ProducerInfo: description: Information for the producer of the card. E.g. to print the EUR-label on the card. type: string GamblingAndBettingAllowance: description: Defines condition when gambling and betting transactions are allowed. type: string enum: - ALLOWED - NOT_ALLOWED - CARD_NOT_PRESENT_NOT_ALLOWED - CARD_PRESENT_NOT_ALLOWED CardOrderData: description: Card data needed to order the card. Online limits are required if they should not be taken over from the parent card. EMV-Profile must be set for a physical card order. type: object required: - cardId - accountNumber - onlineLimits - iban - cardMaterial - language - transactionAuthorizer - cardPlasticCode properties: cardId: $ref: '#/components/schemas/CardId' accountNumber: $ref: '#/components/schemas/AccountNumber' iban: $ref: '#/components/schemas/Iban' cardMaterial: $ref: '#/components/schemas/CardMaterial' language: $ref: '#/components/schemas/Language' chipApplication: $ref: '#/components/schemas/ChipApplication' branchNumber: $ref: '#/components/schemas/BranchNumber' transactionAuthorizer: $ref: '#/components/schemas/TransactionAuthorizer' cardDelivery: description: The destination of the card delivery. Must be set for a physical card order. $ref: '#/components/schemas/DatamailerDeliveryDestination' cardExpressCode: $ref: '#/components/schemas/CardExpressCode' cardMailerText: $ref: '#/components/schemas/CardMailerText' subCardType: $ref: '#/components/schemas/SubCardType' onlineLimits: $ref: '#/components/schemas/OnlineLimits' featureToggles: $ref: '#/components/schemas/FeatureToggles' cardPlasticCode: $ref: '#/components/schemas/CardPlasticCode' cardOrderReason: $ref: '#/components/schemas/CardOrderReason' otrcDelivery: $ref: '#/components/schemas/OtrcDelivery' otrcDatamailerDelivery: description: Delivery destination of OTRC datamailer. In bank card orders, this field will be ignored. $ref: '#/components/schemas/DatamailerDeliveryDestination' otrcDatamailerExpressCode: description: Defines the express code of the OTRC datamailer delivery. In bank card orders, this field will be ignored. $ref: '#/components/schemas/DatamailerExpressCode' deliveryInformation: description: Delivery address of card, PIN and OTRC; only required when OTRC, PIN, or card is delivered to cardholder. $ref: '#/components/schemas/DeliveryInformation' pinDatamailerDelivery: description: Delivery destination of the PIN. Only used for physical cards. If pinData is provided, this field will be ignored. $ref: '#/components/schemas/DatamailerDeliveryDestination' pinDatamailerExpressCode: description: The quickness of the PIN delivery. Only used for physical cards. If pinData is provided, this field will be ignored. $ref: '#/components/schemas/DatamailerExpressCode' pinData: $ref: '#/components/schemas/CardOrderPinData' pinMailerTextCode: description: Reference to a predefined text container that will be printed on the PIN datamailer. If pinData is provided, this field will be ignored. $ref: '#/components/schemas/MailerTextCode' producerCode: $ref: '#/components/schemas/ProducerCode' producerInfo: $ref: '#/components/schemas/ProducerInfo' emvProfile: $ref: '#/components/schemas/EmvProfile' cardholderDataTrack: $ref: '#/components/schemas/CardholderDataTrack' cardLine1: $ref: '#/components/schemas/CardLine' cardLine2: $ref: '#/components/schemas/CardLine' cardLine3: $ref: '#/components/schemas/BankCardLine' cardLine4: $ref: '#/components/schemas/BankCardLine' bankDataTrack2: description: Bank card specific field which indicates the data for track2. It is mandatory for bank cards. The content of this field has to be agreed with the card producer and will not be checked by SIX. type: integer format: int32 minimum: 0 maximum: 999999 bankDataTrack3: description: Bank card specific field which indicates the data for track3. The content of this field has to be agreed with the card producer and will not be checked by SIX. type: integer format: int64 minimum: 0 maximum: 999999999999 useBankCardWithPin: $ref: '#/components/schemas/UseBankCardWithPin' contactlessActivationMode: $ref: '#/components/schemas/ContactlessActivationMode' ChipApplication: description: Indicates what chip will be applied to the card. If no chipApplication is provided, EMVI20 will be applied in the order. type: string enum: - EMVI20 - EMVI24 CardId_2: description: Complex object representing a card consisting of bank clearing number, card number, card type, card sequence number and card expiry. type: object required: - bankClearingNumber - cardNumber - cardType - cardSeqNumber - cardExpiry properties: bankClearingNumber: $ref: '#/components/schemas/BankClearingNumber' cardNumber: $ref: '#/components/schemas/CardNumber' cardType: $ref: '#/components/schemas/CardType' cardSeqNumber: $ref: '#/components/schemas/CardSeqNumber' cardExpiry: $ref: '#/components/schemas/YearMonth' YearMonth: type: object required: - month - year properties: month: description: The two digit number of the month starting at 01 for January. type: string examples: - '01' year: description: The last two digits of the year. type: string examples: - '21' CardType: description: 'A single digit that distinguishes the card types of the schemes. - 1: Debit mastercard - 3: Visa debit - 6: Bank card' type: integer format: int32 minimum: 1 maximum: 6 GetPinResponse: type: string description: "JSON Web Token signed by debiX containing the encrypted PIN and an ephemeral public key to complete the Diffie-Hellman key exchange. \n* The algorithm of the JWS signature can be one of RS256/384/512, PS256/384/512, ES256/384/512 or EdDsa/Ed25519.\n* The JOSE header contains a 'x5t#S256' parameter with the X.509 certificate SHA-256 thumbprint of the key used to sign the token. (https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.8)\n" examples: - see encrypted object at "#/components/schemas/GetPinResponseJwsPayload". CardStatus: description: The status of the card. type: string enum: - ACTIVE - SUSPENDED - DELETED - SUSPENSION_PENDING - RESUMPTION_PENDING - DELETE_PENDING CardLine: description: This line will be printed on the front side of the card. At least the first card line is required for a physical card order. type: string TransactionAuthorizer: type: string description: Authorizer for retail and ATM transactions. enum: - ALWAYS_SIX - ISSUER_WITH_FALLBACK_SIX - SIX_WITH_FALLBACK_ISSUER - ISSUER_WITH_FALLBACK_SIX_AND_OTHER_LIMITS CardSeqNumber: description: Sequence number of the card. type: integer format: int32 minimum: 0 maximum: 9 examples: - 2 UpdateCardStatusAction: description: Distinguishes the type of the card update. type: string enum: - BLOCK - UNBLOCK - DELETE_IMMEDIATELY - DELETE_AT_END_OF_NEXT_MONTH CardMaterial: description: Distinguishes physical from virtual cards. VIRTUAL not allowed for bank cards. type: string enum: - PHYSICAL - VIRTUAL ResetPinTryCounterRequest_2: description: Contains the identifier of the card for which to request the reset of the PIN try counter. type: object required: - cardId properties: cardId: $ref: '#/components/schemas/CardId_2' CardMutationCardApplication: description: Controls card application settings for the EMV-Profile, online limits and transaction authorizer. type: object properties: emvProfile: $ref: '#/components/schemas/EmvProfile' onlineLimits: $ref: '#/components/schemas/OnlineLimits' transactionAuthorizer: $ref: '#/components/schemas/TransactionAuthorizer' CardInstanceTokenByCardIdRequest: description: Contains the identifier of the card for which to return the card instance token. type: object required: - cardId properties: cardId: $ref: '#/components/schemas/CardId' CardOrderResponse: description: 'Contains the card token and the card instance token for the newly created card. These tokens can be used immediately to perform subsequent card-related operations. ' type: object required: - cardToken - cardInstanceToken properties: cardToken: $ref: '#/components/schemas/CardToken' cardInstanceToken: $ref: '#/components/schemas/CardInstanceToken' Language: description: Correspondence language. type: string enum: - DE - FR - IT - EN OnlineLimits: description: The monthly and daily retail and cash transactions limits. type: object required: - totalLimitPerMonth - cashLimitPerMonth - totalLimitPerDay - cashLimitPerDay properties: totalLimitPerMonth: description: Total limit per month for retail and money in cash transactions in whole Swiss Francs. type: integer format: int32 maximum: 99999999 examples: - 20000 cashLimitPerMonth: description: Limit per month for money in cash transactions in whole Swiss Francs. type: integer format: int32 maximum: 99999999 examples: - 10000 totalLimitPerDay: description: Total limit per day for retail and money in cash transactions in whole Swiss Francs. type: integer format: int32 maximum: 99999999 examples: - 5000 cashLimitPerDay: description: Limit per day for money in cash transactions in whole Swiss Francs. type: integer format: int32 maximum: 99999999 examples: - 1000 OtrcDelivery: description: Deprecated and will be ignored. Delivery type of OTRC. type: string enum: - NONE - DATAMAILER - ONLINE default: NONE CardOrderReason: description: This setting determines the priority in which a physical card is ordered. Daily business orders are processed with higher priority and sent to the producer after 18:30. Card renewal orders due to card expiration are processed with lower priority and sent to the producer after 08:00. type: string enum: - DAILY_BUSINESS - CARD_RENEWAL default: DAILY_BUSINESS UpdateCardStatusRequest: description: Contains the request to update the status of the card. The card block reason is required when blocking the card. Only when blocking a card, the information in card block reason, card block origin and blocked card replacement are taken into account; in other cases, they are ignored. type: object required: - action - cardTokenExtension - cardStatusUpdateReason properties: action: $ref: '#/components/schemas/UpdateCardStatusAction' cardTokenExtension: $ref: '#/components/schemas/CardTokenExtension' cardStatusUpdateReason: $ref: '#/components/schemas/CardStatusUpdateReason' cardBlockReason: $ref: '#/components/schemas/CardBlockReason' description: 'The reason why the card was blocked. Note: cardBlockReason is a mandatory parameter which must be provided when action = BLOCK.' cardBlockOrigin: $ref: '#/components/schemas/CardBlockOriginViaBank' blockedCardReplacement: $ref: '#/components/schemas/BlockedCardReplacement' FirstName: description: First name type: string maxLength: 25 examples: - Peter PaymentAuthenticationMethods: description: Container for the available authentication methods. type: object required: - oob - ta - otp - password properties: oob: description: Details of the Out Of Band (OOB) authentication method. type: object required: - status properties: status: $ref: '#/components/schemas/AuthenticationMethodStatus' id: description: OOB id. type: string maxLength: 36 ta: description: Details of the Trusted Authentication via separate app (TA) authentication method. type: object required: - status properties: status: $ref: '#/components/schemas/AuthenticationMethodStatus' id: description: TA user id. type: string maxLength: 36 otp: type: object description: Details of the One Time Password (OTP) authentication method. required: - status properties: status: $ref: '#/components/schemas/AuthenticationMethodStatus' password: type: object description: Details about the password authentication method. required: - status properties: status: $ref: '#/components/schemas/AuthenticationMethodStatus' Salutation: description: Salutation code of a cardholder. type: string enum: - NOT_SET - MR - MS - FIRM SetPinRequest: type: string description: 'JSON Web Token signed by the issuer to set the PIN for the given card. * The algorithm of the JWS signature can be one of RS256/384/512, PS256/384/512, ES256/384/512 or EdDsa/Ed25519. ES256 is recommended. * The JOSE header must contain a ''x5t#S256'' parameter with the X.509 certificate SHA-256 thumbprint of the key used to sign the token. (https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.8) ' examples: - see '#/components/schemas/SetPinRequestJwsPayload' DeliveryInformation: description: Delivery address of card, PIN and OTRC. type: object required: - address - country properties: address: $ref: '#/components/schemas/UnstructuredAddress' country: $ref: '#/components/schemas/Country' salutationText: description: Salutation text for the delivery. type: string maxLength: 50 CardDetailsResponse_2: description: Contains detailed information about the card. type: object required: - commonCardInformation - threeDsInformation - cardToken - cardInstanceToken properties: aliasId: $ref: '#/components/schemas/VisaADAliasId_2' commonCardInformation: $ref: '#/components/schemas/CommonCardInformation' customerId: $ref: '#/components/schemas/VisaC2PCustomerId' bccData: $ref: '#/components/schemas/BccData' fraudConfiguration: $ref: '#/components/schemas/FraudConfiguration' featureToggles: $ref: '#/components/schemas/FeatureToggles' onlineLimits: $ref: '#/components/schemas/OnlineLimits' threeDsInformation: $ref: '#/components/schemas/ThreeDsInformation' cardToken: $ref: '#/components/schemas/CardToken' cardInstanceToken: $ref: '#/components/schemas/CardInstanceToken' ThreeDsInformation: description: Contains 3DS data provided by Worldline. type: object required: - paymentAuthenticationMethods properties: paymentAuthenticationMethods: $ref: '#/components/schemas/PaymentAuthenticationMethods' mobilePhoneNumber: $ref: '#/components/schemas/PhoneNumber' ErrorDetail: type: object required: - errorCode properties: errorCode: description: Code describing the error. type: integer format: int32 examples: - 42 description: description: The message describing the error. type: string examples: - The answer to the great question of Life, the Universe and Everything. CardDetailsResponse: description: Contains detailed information about the card. type: object required: - commonCardInformation - threeDsInformation - cardInstanceToken properties: aliasId: $ref: '#/components/schemas/VisaADAliasId' commonCardInformation: $ref: '#/components/schemas/CommonCardInformation' customerId: $ref: '#/components/schemas/VisaC2PCustomerId' bccData: $ref: '#/components/schemas/BccData' fraudConfiguration: $ref: '#/components/schemas/FraudConfiguration' featureToggles: $ref: '#/components/schemas/FeatureToggles' onlineLimits: $ref: '#/components/schemas/OnlineLimits' threeDsInformation: $ref: '#/components/schemas/ThreeDsInformation' cardInstanceToken: $ref: '#/components/schemas/CardInstanceToken' RestrictedRegions: description: A list of regions from which authorizations will be declined. type: array minItems: 1 maxItems: 10 items: $ref: '#/components/schemas/Region' CardMutationFraudConfiguration: description: Controls the fraud configuration of a card. type: object required: - restrictedRegions properties: restrictedRegions: $ref: '#/components/schemas/RestrictedRegions' restrictedCountries: $ref: '#/components/schemas/RestrictedCountries' PinDatamailerOrderRequest_2: description: Details of the PIN datamailer order request. The referenced card must be a physical card. type: object required: - cardId - deliveryDestination - expressCode properties: cardId: $ref: '#/components/schemas/CardId_2' deliveryDestination: description: Delivery destination of PIN. $ref: '#/components/schemas/DatamailerDeliveryDestination' expressCode: description: The quickness of the PIN delivery. $ref: '#/components/schemas/DatamailerExpressCode' deliveryInformation: description: The delivery information must be set if the PIN is delivered to the cardholder. $ref: '#/components/schemas/DeliveryInformation' mailerText: description: Selects the individual text container for printing onto the datamailer. Can be set if the PIN is delivered to the cardholder. $ref: '#/components/schemas/MailerTextCode' AuthenticationMethodStatus: description: Status of an authentication method. type: string enum: - ENABLED - DISABLED - BLOCKED ProducerCode: description: Defines the producer of the ordered card. Must only be set for a physical card order. type: string enum: - THALES - EXCEET_GERMANY - EXCEET_SWITZERLAND - NID BankApiError: description: Information about an error on API requests. type: object required: - applicationError - errorCode properties: applicationError: description: The name of the application error. type: string examples: - OPERATION_FAILED errorCode: description: Code describing the error. type: integer format: int32 examples: - 5001 description: description: A human readable explanation specific to this occurrence of the problem. type: string examples: - The requested operation failed. errors: description: List of error details. type: array minItems: 1 items: $ref: '#/components/schemas/ErrorDetail' errorToken: description: A generated error token referencing the actual error and logged on the server. type: string examples: - 618503aa-7beb-4d3d-986e-36f1fdbd0e13 ResetPinTryCounterRequest: description: Contains the cardTokenExtension used together with the cardToken path parameter for card identification. type: object required: - cardTokenExtension properties: cardTokenExtension: $ref: '#/components/schemas/CardTokenExtension' GetPinRequest: type: string description: "JSON Web Token signed by the issuer, containing all parameters for securely retrieving the PIN. \n* The algorithm of the JWS signature can be one of RS256/384/512, PS256/384/512, ES256/384/512 or EdDsa/Ed25519. ES256 is recommended.\n* The JOSE header must contain a 'x5t#S256' parameter with the X.509 certificate SHA-256 thumbprint of the key used to sign the token. (https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.8)\n" examples: - see "#/components/schemas/GetPinRequestJwsPayload" CardInstanceTokenRequest: description: Contains the identifier of the card for which to return the card instance token. type: object required: - cardTokenExtension properties: cardTokenExtension: $ref: '#/components/schemas/CardTokenExtension' StartSetPinResponse: type: string description: "JSON Web Token signed by debiX containing an ephemeral public key to complete the Diffie-Hellman key exchange, used to encrypt the new PIN to be set for this card. \n* The algorithm of the JWS signature can be one of RS256/384/512, PS256/384/512, ES256/384/512 or EdDsa/Ed25519.\n* The JOSE header contains a 'x5t#S256' parameter with the X.509 certificate SHA-256 thumbprint of the key used to sign the token. (https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.8)\n" examples: - see unencrypted object at "#/components/schemas/StartSetPinResponseJwsPayload" MoneySendReceiveAllowance: description: Defines conditions if money send to and receive from another cardholder is allowed. type: string enum: - NOT_ALLOWED - RECEIVE_ALLOWED - SEND_ALLOWED - RECEIVE_AND_SEND_ALLOWED CommonCardInformation: description: Common information about the card. type: object required: - accountNumber - iban - cardMaterial - markedAsDelayedDelete - transactionAuthorizer properties: accountNumber: $ref: '#/components/schemas/AccountNumber' iban: $ref: '#/components/schemas/Iban' cardMaterial: $ref: '#/components/schemas/CardMaterial' plasticCode: $ref: '#/components/schemas/CardPlasticCode' subCardType: $ref: '#/components/schemas/SubCardType' language: $ref: '#/components/schemas/Language' status: $ref: '#/components/schemas/CardStatus' cardStatusUpdateReason: $ref: '#/components/schemas/CardStatusUpdateReason' blockInformation: $ref: '#/components/schemas/CardBlockInformation' pinRemainingRetries: description: The number of remaining PIN retries. type: integer format: int32 minimum: 0 maximum: 3 examples: - 2 pinRecoveryStatus: $ref: '#/components/schemas/PinRecoveryStatus' markedAsDelayedDelete: description: Flag indicating card is scheduled for delayed deletion. type: boolean transactionAuthorizer: $ref: '#/components/schemas/TransactionAuthorizer' cardOrderDateTime: description: Datetime when the card was ordered. type: string format: date-time examples: - '2024-04-13T08:30:00Z' CardOrderRequest: description: Configuration specifying the new card to be ordered. type: object required: - cardOrderData properties: cardOrderData: $ref: '#/components/schemas/CardOrderData' parentCardReference: $ref: '#/components/schemas/ParentCardReference' bccData: $ref: '#/components/schemas/BccData' fraudConfiguration: $ref: '#/components/schemas/FraudConfiguration' isBlocked: description: Defines if the card is ordered blocked. type: boolean examples: - false PhoneNumber: description: 'Mobile or landline phone number. Note: phoneNumber is a mandatory parameter which must be provided to register a card with authentication method SMS_ONLY, PIN, BIOMETRIC or BIOMETRIC_WITH_PIN_FALLBACK. Furthermore, phoneNumber must also be provided in case the issuer desires to register a card for DELEGATED as primary authentication method, with additionally SMS as fallback (as secondary authentication method). For issuers with special regulations (e.g. PSD2), please refer to the additional indications provided under the “password” field.' type: string pattern: ^([+]|00)[1-9][0-9]{8,18}$ examples: - '+41797778899' CardMutationBccData: description: Information about the cardholder to mutate. type: object required: - salutation - firstName - familyName - street - city - postalCode - country properties: salutation: $ref: '#/components/schemas/Salutation' firstName: $ref: '#/components/schemas/FirstName' familyName: $ref: '#/components/schemas/FamilyName' street: description: Street name. type: string maxLength: 25 examples: - Bahnhofstrasse streetNo: description: Street number. type: string maxLength: 5 examples: - '1' city: description: Location city. type: string maxLength: 25 examples: - Zürich postalCode: description: Postal code. type: string maxLength: 10 examples: - '8001' country: $ref: '#/components/schemas/Country' phoneNumber: $ref: '#/components/schemas/PhoneNumber' birthdate: description: Birthdate to identify the customer. type: string format: date examples: - '2000-12-31' emailAddress: description: Email address to identify the customer. type: string examples: - peter.schweizer@mailbox.org customerRelationshipOpeningDate: description: Date when the customer relationship was opened; used to identify the customer. type: string format: date examples: - '2021-12-31' accountOpeningDate: description: Date when the account was opened; used to identify the customer. type: string format: date examples: - '2021-12-31' accountAuthorities: type: array minItems: 0 maxItems: 4 items: $ref: '#/components/schemas/AccountAuthority' individualIdentificationTag: description: Individual tag to identify the customer. type: string maxLength: 80 examples: - Owner of a sailing boat ebankingContractNo: description: Ebanking contract number to identify the customer. type: string maxLength: 15 examples: - ABC-56789012345 PinDatamailerOrderRequest: description: Details of the PIN datamailer order request. The referenced card must be a physical card. type: object required: - cardTokenExtension - deliveryDestination - expressCode properties: cardTokenExtension: $ref: '#/components/schemas/CardTokenExtension' deliveryDestination: description: Delivery destination of PIN. $ref: '#/components/schemas/DatamailerDeliveryDestination' expressCode: description: The quickness of the PIN delivery. $ref: '#/components/schemas/DatamailerExpressCode' deliveryInformation: description: The delivery information must be set if the PIN is delivered to the cardholder. $ref: '#/components/schemas/DeliveryInformation' mailerText: description: Selects the individual text container for printing onto the datamailer. Can be set if the PIN is delivered to the cardholder. $ref: '#/components/schemas/MailerTextCode' CardMutationRequest_2: description: Fields to modify. Fields that are set will be modified. Others will be ignored. type: object required: - cardId properties: cardId: $ref: '#/components/schemas/CardId_2' bccData: $ref: '#/components/schemas/CardMutationBccData' fraudConfiguration: $ref: '#/components/schemas/CardMutationFraudConfiguration' cardApplication: $ref: '#/components/schemas/CardMutationCardApplication' contactlessActivationStatus: $ref: '#/components/schemas/CardMutationContactlessActivationStatus' featureToggles: $ref: '#/components/schemas/CardMutationFeatureToggles' AccountNumber: description: Unique number identifying a bank account. type: string minLength: 1 maxLength: 16 examples: - AB-4567890123456 ShortCardIdResponse: description: Contains the identifier of the card that corresponds to the given card token. type: object required: - shortCardId properties: shortCardId: $ref: '#/components/schemas/ShortCardId' CardBlockOriginViaBank: description: Initiator and channel of the card blocking when the card is blocked via the bank. type: string enum: - ONLINE_BANKING_BY_CARDHOLDER - MOBILE_BANKING_BY_CARDHOLDER - THREE_DS_CARDMANAGEMENT_APP_BY_CARDHOLDER - BACKEND_OF_BANK_BY_BANK - BACKEND_OF_BANK_BY_CARDHOLDER CardTokenExtension: description: Extension to card token to identify a card. type: object required: - cardExpiry - cardSequenceNumber properties: cardExpiry: $ref: '#/components/schemas/YearMonth' cardSequenceNumber: $ref: '#/components/schemas/CardSequenceNumber' CardInstanceTokenResponse: description: Contains the card instance token of the card. type: object required: - cardInstanceToken properties: cardInstanceToken: $ref: '#/components/schemas/CardInstanceToken' BranchNumber: description: Branch number of the site where the account was initially created. type: integer format: int32 minimum: 0 maximum: 9999 examples: - 1 CardSequenceNumber: description: Sequence number of the card. type: integer format: int32 minimum: 0 maximum: 9 examples: - 2 MailerTextCode: description: Reference to a predefined text container that will be printed on the datamailer. type: integer format: int32 RiskShieldList: description: '- "EXCLUSION_LIST": General whitelist, i.e. all rules that lead to RiskShield declines and automatic blockings are overridden. - "GREY_LIST_CNP": The non-secure card not present transactions are declined. - "GREY_LIST_F2F": Card present transactions are declined. - "INTERNAL_DECLINE_LIST": General blacklist, i.e. the transactions are declined. - "MONITORED_CARDS_LIST": For card present transactions an alert is generated. - "RULE_WHITE_CARD_LIST": Certain rules for cards are disabled, i.e. no transactions are declined and no alerts generated.' type: string CardOrderPinData: type: string description: 'JSON Web Token signed by the issuer to set the PIN for the ordered card. * The algorithm of the JWS signature can be one of RS256/384/512, PS256/384/512, ES256/384/512 or EdDsa/Ed25519. ES256 is recommended. * The JOSE header must contain a ''x5t#S256'' parameter with the X.509 certificate SHA-256 thumbprint of the key used to sign the token. (https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.8) ' examples: - see '#/components/schemas/CardOrderPinDataJwsPayload' UpdateCardStatusRequest_2: description: Contains the request to update the status of the card. The card block reason is required when blocking the card. Only when blocking a card, the information in card block reason, card block origin and blocked card replacement are taken into account; in other cases, they are ignored. type: object required: - action - cardId - cardStatusUpdateReason properties: action: $ref: '#/components/schemas/UpdateCardStatusAction' cardId: $ref: '#/components/schemas/CardId_2' cardStatusUpdateReason: $ref: '#/components/schemas/CardStatusUpdateReason' cardBlockReason: $ref: '#/components/schemas/CardBlockReason' description: 'The reason why the card was blocked. Note: cardBlockReason is a mandatory parameter which must be provided when action = BLOCK.' cardBlockOrigin: $ref: '#/components/schemas/CardBlockOriginViaBank' blockedCardReplacement: $ref: '#/components/schemas/BlockedCardReplacement' CardBlockReason: description: The reason why the card was blocked. type: string enum: - NO_INFORMATION - CARD_LOST_WITHOUT_PIN - CARD_STOLEN_WITHOUT_PIN - FRAUD - CREDIT_STANDING - TOO_MANY_INVALID_PIN_ATTEMPTS - CARD_LOST_WITH_PIN - CARD_STOLEN_WITH_PIN - PICK_UP_BM_TM - CARD_DID_NOT_ARRIVE - PIN_DID_NOT_ARRIVE - FRAUD_SUSPECTED_ANALYSIS - FRAUD_SUSPECTED_CARDHOLDER_FEEDBACK_REQUIRED - TECHNICAL_REASON - DEFECTIVE_CARD - CARD_TEMPORARILY_BLOCKED CardBlockInterface: description: The interface used for blocking the card. type: string enum: - DEBIX_API - DEBIX_APP - DEBIX_PORTAL - DEBIT_ONLINE_WEB - DEBIT_ONLINE_XML - BLOCKING_APPLICATION_GENERATED_BY_SIX CardOrderReversalRequest: type: object required: - cardTokenExtension properties: cardTokenExtension: $ref: '#/components/schemas/CardTokenExtension' CardOrderReversalRequest_2: type: object required: - cardId properties: cardId: $ref: '#/components/schemas/CardId_2' CardMutationContactlessActivationStatus: description: Controls whether contactless is enabled. type: boolean DatamailerExpressCode: description: Defines the express code of OTRC and PIN datamailer delivery. type: string enum: - A_POST - B_POST - REGISTERED default: A_POST CardDetailsRequest_2: description: Contains the identifier of the card for which to return the details. type: object required: - cardId properties: cardId: $ref: '#/components/schemas/CardId_2' CardNumber: description: Card number of the card. type: integer format: int32 minimum: 1 maximum: 99999999 examples: - 12345678 Birthdate: description: Date of birth. type: string format: date examples: - '2000-12-31' FraudConfiguration: description: The fraud configuration, containing restrictions for countries and regions. Authorizations from a country will be declined if the country itself, or the region it belongs to, is restricted. type: object properties: restrictedRegions: $ref: '#/components/schemas/RestrictedRegions' restrictedCountries: $ref: '#/components/schemas/RestrictedCountries' riskShieldListing: description: A list of monitoring lists in RiskShield on which a card can be listed. Deprecated and ignored in card order requests. type: array minItems: 1 maxItems: 100 items: $ref: '#/components/schemas/RiskShieldList' SubCardType: description: Sub card type that is linked to a dedicated BIN range and specifies a product like 'Platinum', 'EUR' or 'Student'. It must be configured in bank master data, otherwise field can not be used. type: string minLength: 2 maxLength: 2 examples: - A1 VisaADAliasId_2: description: The UUID generated by Alias Directory which identifies the alias type: string minLength: 36 maxLength: 36 examples: - e336c8c8-2945-4be3-af3e-951ec2d01219 CardholderDataTrack: description: "A formatted combination of family name, name and title. Must only be set for a Mastercard physical card order.\nValid formats include:\n - FAMILYNAME/\n - FAMILYNAME/NAME\n - FAMILYNAME/NAME.DR\n - FAMILYNAME/.DR\n" type: string maxLength: 26 minLength: 2 examples: - SCHWEIZER/PETER CardToken: description: Unique card token of a card. type: string pattern: ^CTK-[0-9a-fA-F]{32}$ minLength: 36 maxLength: 36 examples: - CTK-54716A6080B14CF19CEA3C170F85B1DD Currency: description: The currency according to ISO 4217. type: string maxLength: 3 examples: - CHF ContactlessActivationStatus: description: Describes the contactless activation status of the card. type: string enum: - UNKNOWN - ACTIVATED_CONFIRMED - CARD_WITHOUT_CONTACTLESS - DEACTIVATED_UNCONFIRMED - DEACTIVATED_CONFIRMED - DEACTIVATION_PENDING - ACTIVATED_UNCONFIRMED - ACTIVATION_PENDING - NEVER_ACTIVATED CardExpressCode: description: Defines the express code of the card delivery. Must be set for a physical card order and CardDelivery is DELIVER_TO_CARDHOLDER. type: string enum: - A_POST - B_POST - REGISTERED - COURIER Country: description: Country code in format ISO 3166-1 alpha 2. type: string pattern: '[A-Z]{2}' examples: - CH CardTokenResponse: description: Contains the card token of the card. type: object required: - cardToken properties: cardToken: $ref: '#/components/schemas/CardToken' StartSetPinByCardIdRequest: type: string description: "JSON Web Token signed by the issuer to get an ephemeral public key from debiX for the given cardId. \n* The algorithm of the JWS signature can be one of RS256/384/512, PS256/384/512, ES256/384/512 or EdDsa/Ed25519. ES256 is recommended.\n* The JOSE header must contain a 'x5t#S256' parameter with the X.509 certificate SHA-256 thumbprint of the key used to sign the token. (https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.8)\n" examples: - see "#/components/schemas/StartSetPinByCardIdRequestJwsPayload" CardCredentialsResponse: type: string description: "JSON Web Token containing the encrypted card credentials and an ephemeral public key to complete the Diffie-Hellman key exchange. \n* The algorithm of the JWS signature is 'none'.\n" examples: - see unencrypted object at "#/components/schemas/CardCredentialsResponseJwsPayload". Iban: description: IBAN of the bank account for which the card was issued. type: string minLength: 21 maxLength: 21 examples: - CH3456789012345678901 PinRecoveryStatus: description: The status of the PIN recovery. type: string enum: - NO_PIN_ORDERED - NEW_PIN_ORDERED_PIN_CHANGE_REQUIRED - NEW_PIN_ORDERED_RECOVERY_PROCESSED - NEW_PIN_ORDERED_RECOVERY_CONFIRMED - NEW_PIN_ORDERED_RECOVERY_NOK parameters: RequestIdHeader: in: header name: x-request-id description: A unique identifier for a request and response pair. schema: type: string IssuerTraceIdHeader: in: header name: issuer-trace-id description: A issuer‑provided unique trace identifier to correlate the complete flow started by this request. schema: type: string minLength: 1 maxLength: 26