Debit Card Registration for Existing Client API

post

https://uatmea-iss-apigw.creditpluspinelabs.com/deviceapi/apis/devices/clients

This API is used to register non-personalized debit cards for existing customers. The system allocates pre-generated cardsto existing customers as a new primary, supplementary or add-on card. The API request is encrypted. Refer to Message Level Security - AES Encryption section in the CR+ REST API Security Requirements attachment document for detailed information on encryption of JSON payload. Also refer to Debit Card Registration for Existing Client Encryption Parameters table under the Request Format of this section for specifications of the encryption parameters.

HTTP Status and Response Status Matrix

HTTP Code: This is the response status code issued by a server in response to a client's request made to the server.
Error Code: This is the error code returned by Credit+ Issuing application in the ‘code’ field of the response message indicating if the request was processed successfully or failed.
Reason: This is the description of the error code returned by Credit+ Issuing application.

HTTP Code	Error Code	Reason
201	OK	The request has been fulfilled and resulted in a new resource being created.
400	MISSING_REQUIRED_FIELD	Error example: Missing Required Field 'baseCurrency'.
400	INVALID_FIELD_VALUE	'productType' field value 'pre-paid' is invalid.
400	INVALID_FIELD_FORMAT	Invalid Field Format Base Currency.
400	INVALID_FIELD_LENGTH	Program Code Size must be between 2 and 10.
400	INVALID_PROGRAM_CODE	Program code 'XYZ' must be part of multi-currency program.
400	APPUP00103	Device Promotion Plan does not exist.
400	997	Device Plan Promo Code field should only contain [A-Z 0-9] and underscore and must start and end with alphanumeric character.
400	997	devicePlanPromoCode field value must have max length 10.
400	997	Onboarding is not allowed on Device Plan: [Device plan code related to the device].
403	PERMISSION_DENIED	It seems you don't have permission to access this API.
409	CONFLICT	The requested operation failed because it tried to create a resource that already exists.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

publicKeyFingerprint

string

required

length ≤ 64

This is the hex-encoded SHA-256 digest of the recipient's RSA public key used for encryption, which serves as an identifier for the key.

encryptedKey

string

required

One-time use AES key encrypted by the Pinelabs public key (as identified by publicKeyFingerprint) using the PKCS#1 v1.5 scheme. It must be hex-encoded.

oaepPaddingDigestAlgorithm

string

Indicates the digest algorithm used with the RSA-OAEP scheme. The valid value is: NONE.

string

The initialization vector used when encrypting data using the one-time use AES key. Must be exactly 16 bytes (32-character hex string) to match the block size. If not present, an IV of zero is assumed.

encryptedValue

string

CDM request data to be encrypted by the ephemeral AES key using CBC mode (IV as provided in 'iv', or zero if none provided) and PKCS#7 padding. It must be hex-encoded.

application

object

required

client

object

required

device

object

required

cbsAccount

object

dataValidUntilTimestamp

date-time

length between 20 and 29

The date and time after which this encrypted data object is considered invalid. Expressed in ISO-8601 extended format. Must be either YYYY-MM-DDThh:mm:ss[.sss]Z or YYYY-MM-DDThh:mm:ss[.sss]±hh:mm, where [.sss] is optional and can be 1 to 3 digits.

Headers

X-MC-Correlation-ID

string

^[a-zA-Z0-9-]{1,36}$

API consumer can share unique X-MC-Correlation-ID in HTTP header for each API request. It is recommended to generate UUID (maximum length: 36) that is compliant with RFC 4122. If it is not shared, then the system generates a unique value for each request. X-MC-Correlation-ID must be unique for each request, Maximum supported length – 36 alphanumeric characters.

X-MC-Source

string

API consumer can share X-MC-Source (optional field) in HTTP header for API requests. For the list of Source values, see the Pre-conditions for HTTP Header of REST API topic in the Pre-requisite for Rest API section.

X-MC-Channel

string

enum

API consumer can share X-MC-Channel in HTTP header for API requests. It is the network or channel through which request is routed. The only available value for Channel is API.

Allowed:

X-MC-Client-Client-Application-User-ID

string

length ≤ 50

API consumer can share X-MC-Client-Client-Application-User-ID in HTTP header for API requests. This parameter is a unique identifier to track actual user performing action at the client's end. This field is used only for logging purpose. The maximum length is 50.

X-MC-Idempotency-Key

string

required

^[a-zA-Z0-9-]{1,36}$

API consumer must share X-MC-Idempotency-Key in HTTP header for API requests. It is a unique value that is generated by a client and sent to an API along with a request. If a request fails partway through, the client retries with the same idempotency key value, and the server uses it to look up the state of request and continue from where it left off. It is recommended to generate UUID (maximum length: 36) that is compliant with RFC 4122.

Response

201Successful registration of a debit card.