Reward Redemption API

This API can be used to redeem available reward points against available merchandise (gift catalogue) or as a cash credit to the cardholder's account. It can be consumed through various channels such as online banking or mobile banking. The request for available reward point redemption can be used for one purpose at a time; that is, for either cash credit or merchandise. Both options can not be present in the same request. The Credit+ Issuing system receives, validates, and processesthe request. If the request is successful and adheres to business rules, then number of points coming in the request are redeemed from the account's loyalty point bucket. The system logs a service request (SR) as per the redemption type and sends the SR details in the response message. If the request fails, the system returns the corresponding error code in the response and the SR is not logged. The respective SRs are: • Reward Redemption (Merchandise) - Service Code: 512 • Reward Redemption (Cash Credit) - Service Code: 513 Both API request and response are encrypted and the method is same for both request and response attributes. Refer to Message Level Security - AES Encryption section in the CR+ REST API Security Requirements attachment document for detailed information on encryption of JSON payload. Also refer to Reward Redemption API Encryption Header Parameters table under the Request Format of this section for specifications of the encryption header parameters. This API is applicable for prepaid, credit and debit products issued on Pine Labs platform.

NOTE: This API is applicable for general purpose reloadable programs only in case of prepaid products. Further, the device status must not be blocked, cancelled or upgraded and the unpaid status must be normal (0).

HTTP Status and Response Status Matrix

  • HTTP Code: This is the response status code issued by a server in response to a client's request made to the server.
  • Error Code: This is the error code returned by Credit+ Issuing application in the ‘code’ field of the response message indicating if the request was processed successfully or failed.
  • Reason: This is the description of the error code returned by Credit+ Issuing application.
HTTP CodeError CodeReason
200OKThe server has successfully processed your request.
400MISSING_REQUIRED_FIELDMissing Required Field '
400INVALID_FIELD_VALUE'
400INVALID_FIELD_FORMAT'
400INVALID_FIELD_LENGTH'
500RECORD_NOT_FOUNDRecord not found for given search criteria(s) - <Field Name 1>,<Field Name 2>. Error example: Record not found for given search criteria(s) - P_ISD_CODE,P_MOBILE_NUMBER.
400CRYPTOGRAPHY_ERRORError occurred while decryption of the encrypted request payload.
403PERMISSION_DENIEDIt seems you don't have permission to access this API.
409CONFLICTThe requested operation failed because it tried to create a resource that already exists.
500956Available reward points are not sufficient for redemption.
500956Co-Brand Partner is not Configured/Available.
500957Minimum Redemption Points/ Amount criteria not met.
500957Account Unpaid Status is not Normal.
500957Loyalty plan is not configured.
500957Redeem amount less than the minimum amount set on the loyalty plan.
Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Body Params
string
required
length ≤ 64

This is the hex-encoded SHA-256 digest of the recipient's RSA public key used for encryption, which serves as an identifier for the key.

string
required

One-time use AES key encrypted by the Pinelabs public key (as identified by publicKeyFingerprint) using the PKCS#1 v1.5 scheme. It must be hex-encoded.

string

Indicates the digest algorithm used with the RSA-OAEP scheme. The valid value is: NONE.

string

The initialization vector used when encrypting data using the one-time use AES key. Must be exactly 16 bytes (32-character hex string) to match the block size. If not present, an IV of zero is assumed.

string

CDM request data to be encrypted by the ephemeral AES key using CBC mode (IV as provided in 'iv', or zero if none provided) and PKCS#7 padding. It must be hex-encoded.

device
object
required
mobile
object
redemption
object
required
string
length between 1 and 10

Any free text that the requestor wants to send for logging purpose.

date-time
required
length between 20 and 29

The date and time after which this encrypted data object is considered invalid. Expressed in ISO-8601 extended format. This timestamp value is converted into institution timezone and compared against institution date-time. If the institution current date-time is greater than this timestamp, then the request is considered as expired and returned. Must be either YYYY-MM-DDThh:mm:ss[.sss]Z or YYYY-MM-DDThh:mm:ss[.sss]±hh:mm, where [.sss] is optional and can be 1 to 3 digits.

Headers
string
^[a-zA-Z0-9-]{1,36}$

API consumer can share unique X-MC-Correlation-ID in HTTP header for each API request. It is recommended to generate UUID (maximum length: 36) that is compliant with RFC 4122. If it is not shared, then the system generates a unique value for each request. X-MC-Correlation-ID must be unique for each request, Maximum supported length – 36 alphanumeric characters.

string

API consumer can share X-MC-Source (optional field) in HTTP header for API requests. For the list of Source values, see the Pre-conditions for HTTP Header of REST API topic in the Pre-requisite for Rest API section.

string
enum

API consumer can share X-MC-Channel in HTTP header for API requests. It is the network or channel through which request is routed. The only available value is API.

Allowed:
string
length ≤ 50

API consumer can share X-MC-Client-Client-Application-User-ID in HTTP header for API requests. This parameter is a unique identifier to track actual user performing action at the client's end. This field is used only for logging purpose. The maximum length is 50.

Response

Language
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json