Transaction Limit Inquiry - Device

post

https://uatmea-iss-apigw.creditpluspinelabs.com/deviceapi/apis/transaction-limits/devices/searches

This API is used to retrieve transaction type wise limits configured at various levels like device, device plan, based on the search criteria such as device identifier, device number, packID or device number alias; at least one ofthe referenced search request parametersis mandatory. The device.alias parameter is applicable if the device number alias functionality is enabled for the institution or bank. In case alias uniqueness is not found, then productType, planCode, or programCode parameters must be used to refine the search further, else, the UNIQUE_RECORD_NOT_FOUND error is returned. Both API request and response are encrypted and the method is same for both request and response attributes. Refer to Message Level Security - AES Encryption section in the CR+ REST API Security Requirements attachment document for detailed information on encryption of JSON payload. Also refer to Transaction Limit Inquiry API - Device Encryption Parameters table under the Request Format of thissection forspecifications of the encryption parameters. This API is applicable for prepaid, credit, and debit products.

HTTP Status and Response Status Matrix

HTTP Code: This is the response status code issued by a server in response to a client's request made to the server.
Error Code: This is the error code returned by Credit+ Issuing application in the ‘code’ field of the response message indicating if the request was processed successfully or failed.
Reason: This is the description of the error code returned by Credit+ Issuing application.

HTTP Code	Error Code	Reason
200	OK	The server successfully processed the request.
400	MISSING_REQUIRED_FIELD	Error example: Missing Required Field 'productType'.
400	INVALID_FIELD_VALUE	'productType' field value 'pre-paid' is invalid.
400	RECORD_NOT_FOUND	Device record not found based on the given input.
400	UNIQUE_RECORD_NOT_FOUND	Multiple records found for given search criteria.
401	UNAUTHORIZED	We couldn't recognize you.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

publicKeyFingerprint

string

required

length ≤ 64

^[0-9a-fA-F]{64}$

Hex-encoded SHA-256 digest of the recipient's RSA public key used for encryption, which serves as an identifier for the key.

encryptedKey

string

required

^[0-9a-fA-F]+$

One-time use AES key encrypted by the Pine Labs public key (as identified by publicKeyFingerprint) using the PKCS#1 v1.5 scheme. It must be hex-encoded.

oaepPaddingDigestAlgorithm

string

enum

Indicates the digest algorithm used with the RSA-OAEP scheme. The valid value is: NONE.

Allowed:

string

length between 32 and 32

^[0-9a-fA-F]{32}$

The initialization vector used when encrypting data using the one-time use AES key. Must be exactly 16 bytes (32-character hex string) to match the block size. If not present, an IV of zero is assumed.

encryptedValue

string

required

^[0-9a-fA-F]+$

CDM request data to be encrypted by the ephemeral AES key using CBC mode (IV as provided in 'iv', or zero if none provided) and PKCS#7 padding. It must be hex-encoded.

filter

object

Meta information that provides control over output result set.

device

Device identification details. At least one of identifier, packId, alias, or number is mandatory.

dataValidUntilTimestamp

string

required

length ≤ 29

^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?([+-]\d{2}:\d{2}|Z)$

The date and time after which this encrypted data object is considered invalid. Expressed in ISO-8601 extended format. Must be either YYYY-MM-DDThh:mm:ss[.sss]Z or YYYY-MM-DDThh:mm:ss[.sss]±hh:mm where [.sss] is optional and can be 1 to 3 digits.

Headers

X-MC-Correlation-ID

string

^[a-zA-Z0-9-]{1,100}$

API consumer can share X-MC-Correlation-ID in HTTP header for API requests. If it is not shared then the system generates a unique value for each request. X-MC-Correlation-ID must be unique for each request, Maximum supported length – 100 alphanumeric characters.

X-MC-Source

string

API consumer can share X-MC-Source (optional field) in HTTP header for API requests. For the list of Source values, see the Pre-conditions for HTTP Header of REST API topic in the Pre-requisite for Rest API section.

X-MC-Channel

string

enum

API consumer can share X-MC-Channel (optional field) in HTTP header for API requests. It is the network or channel through which request is routed. The only available value for Channel is API.

Allowed:

X-MC-Client-Application-User-ID

string

length ≤ 50

API consumer can share X-MC-Client-Application-User-ID in HTTP header for API requests. This is a unique identifier to track actual user performing action at the client's end. This field is used only for logging purpose. The maximum length is 50.

Response

200Successful response with transaction limit details