Authentications Challenges API

post

https://uatmea-iss-apigw.creditpluspinelabs.com/deviceapi/apis/authentications/challenges

The Authentications Challenges API is used by the Credit+ Issuing system to send challenge or one-time password (OTP) to a client or customer. This API offers the ability to send OTP to a client or customer. Identity of a client is confirmed before sending the OTP. At least one of the form factors, such as device number, packID, alias, client code, or wallet or account number is provided to confirm the identity of a client. If this API is consumed by platform-specific vendors (such as ACS or SMS providers), then the device.number parameter is mandatory in the request. The device.alias parameter must be used only if device alias functionality is enabled for the institution or bank. In case, alias uniqueness is not defined at institution level, then the productType, planCode, or programCode parameters must be used to confirm identity of a client. If input form factor(s) failsto resolve to single client (that is, if multiple clients are found), then UNIQUE_RECORD_NOT_FOUND error is returned. In case ofsuccess, the API returns 200 as HTTP status code with no body. This API is applicable for prepaid, credit, and debit products.

HTTP Status and Response Status Matrix

HTTP Code: This is the response status code issued by a server in response to a client's request made to the server.
Error Code: This is the error code returned by Credit+ Issuing application in the ‘code’ field of the response message indicating if the request was processed successfully or failed.
Reason: This is the description of the error code returned by Credit+ Issuing application.

HTTP Code	Error Code	Reason
201	000	Successful.
400		Input request JSON format is not valid.
400		Missing Required Field - {fieldName}.
400		Invalid Field Format - {fieldName}.
400		{FieldName} size must be between
400		Invalid Field Value - {fieldname}.
400		Alias functionality not supported for this institution.
400		Aliases uniqueness is not defined at institution level and records corresponding to multiple clients found for given alias.
400		Cryptography error.
400		Missing required messaging tag - <TAG Name 1>.
400		System rejected the payload as given timestamp is in the past.
401		The user is not authorized to make the request.
403		The request was valid, but the server is refusing action. The user might not have the necessary permissions for a resource.
404		The requested resource could not be found but may be available in the future. Subsequent requests by the client are permissible.
500		The server encountered an internal error and was unable to complete your request. Please try again after some time or contact customer care.
500		Server failed to deliver SMS to recipient.
500		Server failed to deliver email to recipient.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

publicKeyFingerprint

string

required

length ≤ 64

Hex-encoded SHA-256 digest of the recipient's RSA public key used for encryption, which serves as an identifier for the key.

encryptedKey

string

required

One-time use AES key encrypted by the Pine Labs public key (as identified by publicKeyFingerprint) using the PKCS#1 v1.5 scheme, must be hex-encoded.

oaepPaddingDigestAlgorithm

string

enum

Indicates the digest algorithm used with the RSA-OAEP scheme, valid value is: NONE.

Allowed:

string

length between 32 and 32

Initialization vector used when encrypting data using the one-time use AES key, must be exactly 16 bytes (32-character hex string) to match the block size, if not present, an IV of zero is assumed.

encryptedData

string

required

CDM request data to be encrypted by the ephemeral AES key using CBC mode (IV as provided in 'iv', or zero if none provided) and PKCS#7 padding, must be hex-encoded.

device

object

client

object

wallet

object

recipient

object

messagingTags

array of objects

Messaging tags are mandatory in case of ACS vendor.

messagingTags

dataValidUntilTimestamp

string

length ≤ 29

Date and time after which this encrypted data object is considered invalid, expressed in ISO-8601 extended format, must be either YYYY-MM-DDThh:mm:ss[.sss]Z or YYYY-MM-DDThh:mm:ss[.sss]±hh:mm where [.sss] is optional and can be 1 to 3 digits.

otp

string

length ≤ 10

One-time password.

Headers

Correlation-ID

string

^[a-zA-Z0-9-]{1,50}$

API consumer can share Correlation-ID in HTTP header for API requests. The Correlation-ID must be unique for each request. It is recommended to generate universally unique identifier (UUID) of length 32 or 36 that is compliant with RFC 4122. The maximum supported length is 50 alphanumeric characters. For example, ac97d177-9345-4934-8343-0f91a7a02836. If the Correlation-ID is not received in the incoming request, the system generates the UUID dynamically and assigns it to the request.

Source

string

API consumer can share Source (optional field) in HTTP header for API requests. For the list of Source values, see the Pre-conditions for HTTP Header of REST API topic in the Pre-requisite for Rest API section.

Channel

string

enum

API consumer can share Channel (optional field) in HTTP header for API requests. It is the network or channel through which request is routed. The only available value for Channel is API.

Allowed:

Response

200Successful operation