| Status name | Description | Authorisations rejected | Clearing transactions posting blocked |
|---|---|---|---|
| Card OK | Card is open and in normal status. Card has to be in this status in order for it to be renewed. | No | No |
| Card Blocked | Temporary block on the card that will prevent approval of authorisations. Can be used instead of account level temporary block if target is to block only a specific card. | Yes | No |
| Suspected Fraud | Temporary block on the card that will prevent approval of authorisations. Functionality the same as for "Card blocked", the different code allows to differentiate between the blocks. | Yes | No |
| Card No Renewal | Status set to prevent following card renewal. Does not affect card functionality in any way, only renewal. | No | No |
| Card Closed Due To Fraud | Used to close a card due to known fraud. | Yes | No |
| Card Lost | Used to close a card because it is lost. | Yes | No |
| Card Stolen | Used to close a card because it is stolen. | Yes | No |
| Card Closed | Used to close card by request from customer or bank, reason for closure is set with status update reason. Allows still clearing transaction posting. | Yes | No |
Endpoints for creating a card
- name: Update card description:Endpoints for updating a card
- name: Get card description: Endpoints for fetching a card - name: Get plastic description: Endpoints for fetching a plastic - name: Update plastic description:Endpoints for updating a plastic
- name: Get application description: Endpoints for fetching an application - name: Update application description:Endpoints for updating an application
paths: /v3/{id}/encryptcardpaymentinfo: post: tags: - Get card summary: Get Card Payment Info description: > This is a web service designed to give the card payment information needed for doing e-commerce payments, meaning full PAN, cvc2/cvv2, expiry date. The payload will be encrypted with an asymmetric public key, to enable end-to-end encryption to the card holder device. Only fields listed in the request 'fields' object will be returned. The caller is responsible of validating the integrity of the public key. ### PCI DSS compliance Processing payment information (PAN, expiry, CVC2/CVV2) is controlled with strict compliance regulations by the card schemes. There are multiple ways to access the card payment information in Enfuce's APIs depending on the client solution, and whether the client is a card schema member themselves and therefore responsible for compliance. The least complex way to take this functionality into use and keep your own systems outside the PCI DSS scope is to use the **Initiate card data retrieval** ( see /v4/card/{cardId}/controlToken below in this document). With that endpoint, the sensitive data is transported end-to-end between Enfuce's service and the card-holder device, which keeps the client's back-end systems outside of PCI DSS scope. The alternative shown here (Get Card Payment Info) relies on that the client is responsible for PCI DSS compliance themselves to the card schema. ### Example // ... import java.security.KeyFactory; import java.security.PrivateKey; import java.security.spec.PKCS8EncodedKeySpec; import java.util.Base64; import javax.crypto.Cipher; // ... // Example of how to decrypt an encrypted field private String decrypt(String data, String privKeyPEM) throws Exception { // Prepare the key String privKeyString = privKeyPEM.replaceAll("\\n", "").replace("-----BEGIN PRIVATE KEY-----", "").replace("-----END PRIVATE KEY-----", ""); byte[] encodedKey = Base64.getDecoder().decode(privKeyString); PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(encodedKey); KeyFactory kf = KeyFactory.getInstance("RSA"); PrivateKey privateKey = kf.generatePrivate(spec); // Prepare the decryption Cipher cipher = Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding"); cipher.init(Cipher.DECRYPT_MODE, privateKey); // Prepare the data byte[] cryptogram = Base64.getDecoder().decode(data); // Decrypt byte[] decryptedBytes = cipher.doFinal(cryptogram); return new String(decryptedBytes); } operationId: encryptCardPaymentInfoPOST parameters: - name: auditUser in: query description: The audit user to log the request required: true schema: type: string - name: id in: path description: The card id for given card required: true schema: type: string format: biginteger requestBody: $ref: '#/components/requestBodies/encryptCardPaymentInfoRequestBody' responses: '200': description: Successful lookup and encryption of the card payment info. content: application/json: schema: $ref: '#/components/schemas/encryptCardPaymentInfoResponseBody' '400': description: Encryption key error content: application/json: schema: $ref: '#/components/schemas/errorResponse' '401': $ref: '#/components/responses/error401' '403': $ref: '#/components/responses/error403' '404': description: Card does not exist content: application/json: schema: $ref: '#/components/schemas/errorResponse' '500': $ref: '#/components/responses/error500' deprecated: false components: requestBodies: encryptCardPaymentInfoRequestBody: content: application/json: schema: $ref: '#/components/schemas/encryptCardPaymentInfoRequestBody' description: Request information needed to encrypt the card payment info required: true schemas: encryptCardPaymentInfoResponseBody: type: object properties: fullCardNumber: type: string description: The enrypted full card number (PAN). Base64 encoded expirationDate: type: string description: The expiration date of the card, in format MMYY cvv2: type: string description: >- The encrypted CVV2 (if Visa), or CVC2 (if Mastercard) value. Base64 encoded title: encryptCardPaymentInfoResponseBody errorResponse: type: object properties: code: type: string description: An error code indicating what kind of error. I.e. HTTP error code message: type: string description: Error message in human-readable format id: type: string format: uuid description: Unique error identifier errorCode: type: string description: Enfuce code for a specific error type errorType: type: string description: Error type enum: - STATIC_VALIDATION_ERROR - DYNAMIC_VALIDATION_ERROR - INTEGRATION_ERROR - SECURITY_ERROR - UNEXPECTED_ERROR errorReason: type: string description: Free-form text explaining the error reason timestamp: type: string format: date-time description: Datetime when error occurred encryptCardPaymentInfoRequestBody: type: object properties: encryptionKey: type: string description: Public key used to encrypt the fields in the result. encryptionMethod: type: string enum: - RSA_ECB_OAEP_SHA256_MGF1_2048 description: > In this field the encryption method is selected. This is to prepare for future use since only one method is supported. * __RSA_ECB_OAEP_SHA256_MGF1_2048__ - RSA/ECB/OAEPWithSHA-256AndMGF1Padding. Public key length 2048. fields: type: array items: type: string enum: - fullCardNumber - expirationDate - cvv2 description: > In this field you can list which fields the service should encrypt and return. If a field is not listed, it will be left out from the response. Note that only fullCardNumber and cvv2 will be encrypted. * __fullCardNumber__ - PAN number (card number) for the card * __expirationDate__ - The expiration date of the card, in format MM/YY * __cvv2__ - The CVV2 (if Visa), or CVC2 (if Mastercard) value required: - encryptionKey title: encryptCardPaymentInfoRequestBody responses: error401: description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/errorResponse' error403: description: Forbidden content: application/json: schema: $ref: '#/components/schemas/errorResponse' error500: description: Internal server error content: application/json: schema: $ref: '#/components/schemas/errorResponse' ````