Skip to content
LCMIssuingGW

    Issuer LCM Account services

    Issuer LCM Account services provide general account management services for your full card portfolio. Issuers can take full benefit the scheme agnostic interface that works consistently across the card schemes.

    URLs

    Authorization server Base URL - Production

    https://api-gateway2.nets.eu/

    Authorization server Base URL - Sandbox

    https://api-gateway-pp.nets.eu/

    Authentication

    Before you can use Account services API, you must go through on-boarding process.

    You will receive two keys, one set for Sandbox and another set for Production access, which are the pairs of unique identifier called "Client ID" and "Client Secret". The Client Secret should not be shared with anyone. The two keys will be needed to authenticate your application to the respective environments. The key for the sandbox environment is used for a test transaction, and that of the production environment for a live transaction.

    You need access tokens to invoke Account services API's resources. Access tokens are passed in the HTTP header when invoking the API. The Authorization server provides a Token Endpoint that you can use to generate or renew your access token. The response of the Token Endpoint is a JSON message. You extract the token for the JSON and pass it with an HTTP Authorization header to access the API.

    In case of theft or a security violation, you can revoke an access token by calling a Revoke Endpoint.

    OAuth 2.0

    OAuth 2.0 is the industry-standard protocol for authorization. Read more at The OAuth 2.0 Authorization Framework, https://tools.ietf.org/html/rfc6749.

    Account services API currently supports OAuth 2.0 Specification with confidential client type. A Confidential client is capable of maintaining the confidentiality of its credentials provided by an authorization server. OAuth 2.0 defines four roles:

    1. Resource owner: An entity capable of granting access to a protected resource.
    2. Resource server: The server hosting protected resources, capable of accepting and responding to protected resource requests using access tokens.
    3. Client: An application making protected resource requests on behalf of the resource owner and with its authorization.
    4. Authorization server: The server issuing access tokens to the client after successfully authenticating the resource owner obtaining authorization.

    At a very high-level, it is possible to break the full OAuth flow into two parts.

    1. Get a token from the authorization server.
    2. Use the token to access the resource server. OAuth 2.0 defines a concept called "authorization grant" which is a credential representing the resource owner's authorization (to access its protected resources) used by the client to obtain an access token. Account services API supports Client Credentials grant type.

    Authorization server

    Token Endpoint

    POST /token

    With the Client Credentials grant type, the client can request an access token using only its credentials when the client is requesting access to the protected resource under its control. Once the client makes this request to the authorization server, it will return an access token to the protected resource. The access token returned to the client for Account services API is Bearer type.

    The client should request access tokens with the minimal necessary scope and lifetime. The authorization server takes the client identity into account when choosing how to honour the requested scope and lifetime, and may issue an access token with less rights than requested.

    Generate access token using Client Credential grant type

    1. Obtain a valid client_id and Client_secret.
    2. Combine the pair in the format client_id:client_secret and encode the combined string
    3. using base64. See Encode to Base64 format, https://www.base64encode.org/
    4. Use the following sample curl command to obtain the access token.
      $ curl -k -d "grant_type=client_credentials" \
    -H "Authorization: Basic <Base64 encoded client_id:client_secret>" \
    -H 'Content-Type: application/x-www-form-urlencoded' \
     https://api-gateway2.nets.eu/token

    You receive a response similar to the following:

      {
    "token_type":"Bearer",
    "expires_in":2061,
    "access_token":"ca19a540f544777860e44e75f605d927"
  }

    Note that, according to OAuth2.0 Authorization Framework, the Client Credential grant type does not allow for the issuing the refresh tokens. See https://tools.ietf.org/html/rfc6749#section-4.4.3

    Revoke Endpoint

    POST /revoke

    Parameters

    • token (required)

      The token to be revoked

    • <Base64 encoded client_id:client_secret> (required)

      Combine the pair in the format client_id:client_secret and encode the combined string using base64.

    • token_type_hint (optional)

      If you do not specify this parameter, the authentication server will search in both key spaces (access_token and refresh_token) and if it finds a matching token then it will be revoked. Therefore, if this parameter is not specified, it will take longer to revoke the token. However, if you specify this parameter, the authentication server only searches in the respective token space. Hence, it is much faster to revoke the token. For the Client Credentials grant type, you have only the option of access_token.

    Example:

      $ curl -X POST \
    https://api-gateway2.nets.eu/revoke \
    -H 'Authorization: Basic <Base64 encoded client_id:client_secret>' \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -d 'token=<token_to_be_revoked>&token_type_hint=<access_token_or_refresh_token>'

    Responses

    • Valid token - HTTP Status 200 - OK

      You receive an empty response with the HTTP status as 200. The following HTTP headers are returned:

      Revokedaccesstoken: a0d210c7a3de7d548e03f1986e9a5c39
Authorizeduser: admin@carbon.super
Revokedrefreshtoken: 5e87a8235cd4d066e15c4c989f5ecf94
Content-Type: text/html
Pragma: no-cache
Cache-Control: no-store
Date: Tue, 23 Aug 2018 19:28:52 GMT
Transfer-Encoding: chunked

    • Invalid token - HTTP Status 200 - OK You still receive an empty response with the HTTP status as 200 but only the following HTTP headers are returned:

      Content-Type: text/html
Pragma: no-cache
Cache-Control: no-store
Date: Tue, 23 Aug 2018 19:31:45 GMT
Transfer-Encoding: chunked

      Because the authorization server cannot find the token in any key space, you will not see Revokedaccesstoken or Revokedrefreshtoken in the HTTP headers.

    API Specification

    Headers and payload

    Request headers are case-sensitive.

    Request data must be sent as JSON message. The Content-Type header value must be application/json.

    Responses are sent as JSON messages. The Accept header value must be application/json.

    Reason codes and account actions

    Account actionReason codeService APIDescription
    0000Create/register accountAdd new account
    RENEW0001Update Account Number orExpiry DateRenewed for new expiry date
    REPLACE0002Update Account Number orExpiry DateUpdate account info due to replacement
    REPLACE0003Update Account Number orExpiry DateUpdate account info due to brand flip
    0004Update IDVUpdate contact information
    0005Change the state of an accountDelete account due to fraud
    0006Change the state of an accountDelete account as card is lost
    0007Change the state of an accountDelete account as card is stolen
    0008Change the state of an accountDelete account due to expiry and no renewal
    0009Change the state of an accountDelete account as per customer request
    0010Change the state of an accountBlock the existing account
    0011Change the state of an accountResume the blocked account
    0012Update Services NeededServices needed for the account is updated
    REPLACE0013Update Account Number orExpiry DateUpdate account info due to portfolio flip
    0100Change the state of a virtual accountDelete virtual account
    0105Change the state of a virtual accountDelete virtual account due to confirmed fraud
    0106Change the state of a virtual accountDelete virtual account as devices is confirmed lost
    0107Change the state of a virtual accountDelete virtual account as device is confirmed stolen
    0108Change the state of a virtual accountDelete virtual account due to expiry and no renewal
    0200Change the state of a virtual accountSuspend virtual account
    0205Change the state of a virtual accountSuspend virtual account due to fraud
    0206Change the state of a virtual accountSuspend virtual account as devices is lost
    0207Change the state of a virtual accountSuspend virtual account as device is stolen
    0300Change the state of a virtual accountResume the virtual account
    0311Change the state of a virtual accountResume the virtual account as device is recovered
    0314Change the state of a virtual accountResume the virtual account as no fraudulent transaction is reported
    0400Change the state of a virtual accountActivate virtual account
    0401Change the state of a virtual accountActivate virtual account as cardholder is pre-authenticated
    0402Change the state of a virtual accountActivate virtual account upon request from cardholder
    0501Change profileCard product change
    0502Change profileTerms and conditions change
    0503Change profileCard art change
    0504Change profileCard credentials change
    2000Get Encrypted PayloadPush provisioning to Google Pay
    2001Get Encrypted PayloadPush provisioning to Apple Pay

    Error codes

    Error codeDescription
    LCM-1011Invalid Account ID
    LCM-1012Invalid PAN ID or Card ID
    LCM-1013Invalid PAN
    LCM-1014Input Data Invalid
    LCM-1015Internal Server Error
    LCM-1016Invalid Virtual Account
    LCM-1018Client error related to virtual card presentation
    LCM-1019Server error related to virtual card presentation
    LCM-1021PAR service — client error
    LCM-1022PAR service — server error
    LCM-1025Internal communication error
    LCM-1026External communication error
    LCM-1027Invalid Encrypted Data

    Scroll down for code samples, example requests and responses.
    Select a language for code samples from the tabs or the mobile navigation menu.

    Health Check

    This operation provides health check of the API

    Health check

    GET /ping

    This operation provides health check of the API

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired

    Health check

    var client = new RestClient("https://api-gateway2.nets.eu/lcm/v1/ping");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
IRestResponse response = client.Execute(request);

    Responses

    • 200OKoptional
      • messagestringoptional

        status message of Service

      • statusstringoptional

        status code

    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    200

    {
    "message": "string",
    "status": "string"
}

    Account services - Inbound

    Inbound API from issuer backend to LCM

    Create an account in LCM. The account must already exist in a backend Card Management System. This request only creates a corresponding account entity in LCM. During TSP and VCARD flows, accounts are created on-the-fly. This request allows the Issuer to create an account even before a token is created (or before the first virtual card image is generated). The account can be created using the account reference IDs (CARDID, PANID, PANREF) without providing the card's PAN.

    POST /accounts

    Create an account in LCM. The account must already exist in a backend Card Management System. This request only creates a corresponding account entity in LCM. During TSP and VCARD flows, accounts are created on-the-fly. This request allows the Issuer to create an account even before a token is created (or before the first virtual card image is generated). The account can be created using the account reference IDs (CARDID, PANID, PANREF) without providing the card's PAN.

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired

    Create an account in LCM. The account must already exist in a backend Card Management System. This request only creates a corresponding account entity in LCM. During TSP and VCARD flows, accounts are created on-the-fly. This request allows the Issuer to create an account even before a token is created (or before the first virtual card image is generated). The account can be created using the account reference IDs (CARDID, PANID, PANREF) without providing the card's PAN. 

    var client = new RestClient("https://api-gateway2.nets.eu/lcm/v1/accounts");
var request = new RestRequest(Method.POST);
request.AddHeader("content-type", "application/json");
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
request.AddParameter("application/json", "{\"REPLACE_REQUEST_BODY\":\"REPLACE_REQUEST_BODY\"}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

    Request body

    • accountInfoobjectoptional
      • accountstringoptional

        Plain text value of account reference, if accountType is one of: CARDID, PANID, PANREF. Otherwise, the account parameter is sent inside the encryptedData.

        example: 95645644466699990
      • accountTypestringoptional

        One of PAN, CARDID, PANID, PANREF.

        example: CARDID
      • accountExpirystringoptional

        Account expiry in the MMYYYY format. Only necessary if accounType is PAN and when it is sent, it is inside the encryptedData.

        example: 062029
      • encryptedDatastringoptional

        A field containing the encrypted JSON object with account and accountExpiry fields inside. In this case the value of the account field will be the PAN. Only to be sent in the request when accountType is PAN.

        example: encrypted_data
      • profileIDstringoptional

        Profile ID known to the scheme

        example: 3bf7159c-ec9b-484d-922b-2c18d1c7bf9d
      • reasonCodestringoptional

        Reason code for account creation is 0000

        example: 0000
      • servicesNeededobjectoptional
        • servicearrayoptional

          List of services to be subscribed for this account.

    • idvMethodsobjectoptional
      • idvMethodarrayoptional
        • idvChannelstringoptionalexample: SMS
        • idvContactInfostringoptionalexample: +48551534591
    • additionalParametersarrayoptional

      Additional parameters to be passed to LCM. This is an array of name-value pairs and their meaning depends on the backend Card Management System in use for a particular Issuer.

      • namestringoptionalexample: CardholderFName
      • valuestringoptionalexample: John

    Request body

    {
    "accountInfo": {
        "account": "95645644466699990",
        "accountType": "CARDID",
        "accountExpiry": "062029",
        "encryptedData": "encrypted_data",
        "profileID": "3bf7159c-ec9b-484d-922b-2c18d1c7bf9d",
        "reasonCode": "0000",
        "servicesNeeded": {
            "service": [
                "TSP",
                "VCARD"
            ]
        }
    },
    "idvMethods": {
        "idvMethod": [
            {
                "idvChannel": "SMS",
                "idvContactInfo": "+4529482200"
            },
            {
                "idvChannel": "EMAIL",
                "idvContactInfo": "mark@domain.com"
            }
        ]
    },
    "additionalParameters": [
        {
            "name": "CardholderFName",
            "value": "John"
        }
    ]
}

    Responses

    • 201Createdoptional
      • accountIDstringoptional

        LCM account ID

        example: 12937509823948934803453222
      • accountStatestringoptional

        One of ACTIVE | SUSPENDED

        example: ACTIVE
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    201

    {
    "accountID": "12937509823948934803453222",
    "accountState": "ACTIVE"
}

    This endpoints returns the LCM account id, based on the information provided by the caller in the request body. It can be used by the Issuer to learn the LCM account ID and use it in other API calls where it is required.

    POST /accounts/accountid

    This endpoints returns the LCM account id, based on the information provided by the caller in the request body. It can be used by the Issuer to learn the LCM account ID and use it in other API calls where it is required.

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired

    This endpoints returns the LCM account id, based on the information provided by the caller in the request body. It can be used by the Issuer to learn the LCM account ID and use it in other API calls where it is required. 

    var client = new RestClient("https://api-gateway2.nets.eu/lcm/v1/accounts/accountid");
var request = new RestRequest(Method.POST);
request.AddHeader("content-type", "application/json");
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
request.AddParameter("application/json", "{\"REPLACE_REQUEST_BODY\":\"REPLACE_REQUEST_BODY\"}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

    Request body

    • accountInfoobjectoptional
      • accountstringoptional

        Plain text value of account reference, if accountType is one of: CARDID, PANID, PANREF. Otherwise, the account parameter is sent inside the encryptedData.

        example: 95645644466699990
      • accountTypestringoptional

        One of PAN, CARDID, PANID, PANREF.

        example: CARDID
      • accountExpirystringoptional

        Account expiry in the MMYYYY format. Only necessary if accounType is PAN and when it is sent, it is inside the encryptedData.

        example: 062029
      • encryptedDatastringoptional

        A field containing the encrypted JSON object with account and accountExpiry fields inside. In this case the value of the account field will be the PAN. Only to be sent in the request when accountType is PAN.

        example: encrypted_data

    Request body

    {
    "accountInfo": {
        "account": "95645644466699990",
        "accountType": "CARDID",
        "accountExpiry": "062029",
        "encryptedData": "encrypted_data"
    }
}

    Responses

    • 200OKoptional
      • accountIDstringoptional

        LCM Account ID of the account identified in the request

        example: 16286581557435413369899891
    • 400Bad Requestoptional
      • errorCodestringrequired

        Stable, machine-readable error identifier.

        example: LCM-1011
      • messagestringrequired

        Human-readable error message.

        example: Invalid Account ID
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional
    {
    "accountID": "16286581557435413369899891"
}

    Get account information based on accountID

    GET /accounts/{accountID}

    Get account information based on accountID

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired
    • accountIDstringrequired

      accountID

    • excludeInactivebooleanoptional

      excludeInactive

    Get account information based on accountID

    var client = new RestClient("https://api-gateway2.nets.eu/lcm/v1/accounts/12345678901234567890123456?excludeInactive=SOME_BOOLEAN_VALUE");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
IRestResponse response = client.Execute(request);

    Responses

    • 200OKoptional
      • accountInfoobjectoptional
        • issuerIdstringoptional

          Issuer ID assigned by LCM

          example: PB-11223344556
        • issuerNamestringoptional

          Issuer name

          example: New Bank UE
        • cardSchemestringoptional

          One of VISA | MasterCard

          example: VISA
        • accountTypestringoptional

          Static value - PAN

          example: PAN
        • accountExpirystringoptional

          Account expiry in the MMYYYY format

          example: 022025
        • accountCreationDatestringoptional

          Date and time of account creation in the yyyy-MM-ddTHH:mm:ssZ format

          example: 2024-08-19T16:56:22Z
        • accountSuffixstringoptional

          Last 4 digits of account PAN

          example: 5690
        • servicesNeededobjectoptional
          • servicearrayoptional

            List of services to be subscribed for this account.

      • idvMethodsobjectoptional
        • idvMethodarrayoptional
          • idvChannelstringoptionalexample: SMS
          • idvContactInfostringoptionalexample: +48551534591
      • accountStatestringoptional

        State of the account, one of ACTIVE | SUSPENDED | DELETED | BLOCKED | LOCKED

        example: ACTIVE
      • stateTimeStampstringoptional

        The timestamp of the last account state change in the yyyy-MM-ddTHH:mm:ssZ format

        example: 2024-03-22T07:33:12Z
      • virtualAccountsobjectoptional
        • virtualAccountIDarrayoptional

          An array of virtual account IDs. If the request parameter excludeInactive is set to true, the list will not contain the IDs whose tokens have not been created by the scheme yet. This gives the caller a possibility to exclude the cases where the tokenization was not completed yet or abandonded by the cardholder. This is an optional parameter and the default value is false.

    • 400Bad Requestoptional
      • errorCodestringrequired

        Stable, machine-readable error identifier.

        example: LCM-1011
      • messagestringrequired

        Human-readable error message.

        example: Invalid Account ID
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional
    {
    "accountInfo": {
        "issuerId": "PB-11223344556",
        "issuerName": "New Bank UE",
        "cardScheme": "VISA",
        "accountType": "PAN",
        "accountExpiry": "022025",
        "accountCreationDate": "2024-08-19T16:56:22Z",
        "accountSuffix": "5690",
        "servicesNeeded": {
            "service": [
                "TSP",
                "VCARD"
            ]
        }
    },
    "idvMethods": {
        "idvMethod": [
            {
                "idvChannel": "SMS",
                "idvContactInfo": "+4529482200"
            },
            {
                "idvChannel": "EMAIL",
                "idvContactInfo": "mark@domain.com"
            }
        ]
    },
    "accountState": "ACTIVE",
    "stateTimeStamp": "2024-03-22T07:33:12Z",
    "virtualAccounts": {
        "virtualAccountID": [
            "17110918517574127108316617",
            "17110927928114877464144012"
        ]
    }
}

    Update account number or expiry date

    PUT /accounts/{accountID}/accountinfo

    Update account number or expiry date

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired
    • accountIDstringrequired

      accountID

    Update account number or expiry date

    var client = new RestClient("https://api-gateway2.nets.eu/lcm/v1/accounts/12345678901234567890123456/accountinfo");
var request = new RestRequest(Method.PUT);
request.AddHeader("content-type", "application/json");
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
request.AddParameter("application/json", "{\"REPLACE_REQUEST_BODY\":\"REPLACE_REQUEST_BODY\"}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

    Request body

    • accountActionstringoptional

      One of RENEW | REPLACE

      example: RENEW
    • accountInfoobjectoptional
      • accountstringoptional

        The account PAN. Required only if the accountAction is REPLACE.

      • accountTypestringoptional

        Required only if the accountAction is REPLACE and in that case the value is PAN.

        example: PAN
      • accountExpirystringoptional

        Account expiry in the MMYYYY format.

        example: 062029
      • reasonCodestringoptionalexample: 0002

    Request body

    {
    "accountAction": "RENEW",
    "accountInfo": {
        "account": "string",
        "accountType": "PAN",
        "accountExpiry": "062029",
        "reasonCode": "0002"
    }
}

    Responses

    • 200OKoptional
      • accountIDstringoptional

        LCM account ID

        example: 17056528320153433915168198
      • accountStatestringoptional

        After a successful operation the value of this field is set to UPDATED

        example: UPDATED
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    200

    {
    "accountID": "17056528320153433915168198",
    "accountState": "UPDATED"
}

    Change the state of an account

    PUT /accounts/{accountID}/accountstate

    Change the state of an account

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired
    • accountIDstringrequired

      accountID

    Change the state of an account

    var client = new RestClient("https://api-gateway2.nets.eu/lcm/v1/accounts/12345678901234567890123456/accountstate");
var request = new RestRequest(Method.PUT);
request.AddHeader("content-type", "application/json");
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
request.AddParameter("application/json", "{\"REPLACE_REQUEST_BODY\":\"REPLACE_REQUEST_BODY\"}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

    Request body

    • accountStatestringoptional

      One of SUSPEND | RESUME

      example: SUSPEND
    • accountInfoobjectoptional
      • reasonCodestringoptional

        Use reason code:

        example: 0010

    Request body

    {
    "accountState": "SUSPEND",
    "accountInfo": {
        "reasonCode": "0010"
    }
}

    Responses

    • 200OKoptional
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    Update IDV information. The IDV methods will be overwritten with methods passed in in the request.

    PUT /accounts/{accountID}/idv

    Update IDV information. The IDV methods will be overwritten with methods passed in in the request.

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired
    • accountIDstringrequired

      accountID

    Update IDV information. The IDV methods will be overwritten with methods passed in in the request.

    var client = new RestClient("https://api-gateway2.nets.eu/lcm/v1/accounts/12345678901234567890123456/idv");
var request = new RestRequest(Method.PUT);
request.AddHeader("content-type", "application/json");
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
request.AddParameter("application/json", "{\"REPLACE_REQUEST_BODY\":\"REPLACE_REQUEST_BODY\"}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

    Request body

    • idvMethodsobjectoptional
      • idvMethodarrayoptional
        • idvChannelstringoptionalexample: SMS
        • idvContactInfostringoptionalexample: +48551534591
    • accountInfoobjectoptional
      • reasonCodestringoptional

        Use reason code:

        example: 0010

    Request body

    {
    "idvMethods": {
        "idvMethod": [
            {
                "idvChannel": "SMS",
                "idvContactInfo": "+4529482200"
            },
            {
                "idvChannel": "EMAIL",
                "idvContactInfo": "mark@domain.com"
            }
        ]
    },
    "accountInfo": {
        "reasonCode": "0010"
    }
}

    Responses

    • 200OKoptional
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    Update services for the account

    PUT /accounts/{accountID}/servicesneeded

    Update services for the account

    Parameters

    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired
    • accountIDstringrequired

      accountID

    Update services for the account

    var client = new RestClient("https://api-gateway2.nets.eu/lcm/v1/accounts/12345678901234567890123456/servicesneeded");
var request = new RestRequest(Method.PUT);
request.AddHeader("content-type", "application/json");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
request.AddParameter("application/json", "{\"REPLACE_REQUEST_BODY\":\"REPLACE_REQUEST_BODY\"}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

    Request body

    • accountActionstringoptional

      One of ADD | REMOVE

      example: ADD
    • accountInfoobjectoptional
      • reasonCodestringoptional

        Reason code for service update is 0012

        example: 0012
      • servicesNeededobjectoptional
        • servicearrayoptional

          List of services to be subscribed for this account.

    Request body

    {
    "accountAction": "ADD",
    "accountInfo": {
        "reasonCode": "0012",
        "servicesNeeded": {
            "service": [
                "TSP",
                "VCARD"
            ]
        }
    }
}

    Responses

    • 200OKoptional
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    VISA - specific and used along with VISA Transaction Control only. Get account reference based on VISA Transaction Control ID.

    POST /accountref

    VISA - specific and used along with VISA Transaction Control only. Get account reference based on VISA Transaction Control ID.

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired
    • accountRefTypestringrequired

    VISA - specific and used along with VISA Transaction Control only. Get account reference based on VISA Transaction Control ID. 

    var client = new RestClient("https://api-gateway2.nets.eu/lcm/v1/accountref?accountRefType=CARDID");
var request = new RestRequest(Method.POST);
request.AddHeader("content-type", "application/json");
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
request.AddParameter("application/json", "{\"REPLACE_REQUEST_BODY\":\"REPLACE_REQUEST_BODY\"}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

    Request body

    • accountstringoptional

      VISA Transaction Control ID

    • accountTypestringoptional

      VTCID is the only possible value

      example: VTCID

    Request body

    {
    "account": "string",
    "accountType": "VTCID"
}

    Responses

    • 200OKoptional
      • accountRefTypestringoptional

        Account reference type. One of CARDID | PANREF.

        example: CARDID
      • accountRefstringoptional

        Account reference value

        example: 940300994437660
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    200

    {
    "accountRefType": "CARDID",
    "accountRef": "940300994437660"
}

    Account services - Outbound

    Outbound API from LCM to issuer backend

    Get IDV methods from Issuer's backend. This is a POST request with empty body.

    POST /accounts/{accountID}/idv

    Get IDV methods from Issuer's backend. This is a POST request with empty body.

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired
    • accountIDstringrequired

      accountID

    Get IDV methods from Issuer's backend. This is a POST request with empty body.

    var client = new RestClient("https://api-gateway2.nets.eu/lcm/v1/accounts/12345678901234567890123456/idv");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
IRestResponse response = client.Execute(request);

    Responses

    • 200OKoptional
      • idvMethodsobjectoptional
        • idvMethodarrayoptional
          • idvChannelstringoptionalexample: SMS
          • idvContactInfostringoptionalexample: +48551534591
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    200

    {
    "idvMethods": {
        "idvMethod": [
            {
                "idvChannel": "SMS",
                "idvContactInfo": "+4529482200"
            },
            {
                "idvChannel": "EMAIL",
                "idvContactInfo": "mark@domain.com"
            }
        ]
    }
}

    Get account state from Issuer's backend

    POST /accounts/accountstate

    Get account state from Issuer's backend

    Parameters

    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired

    Get account state from Issuer's backend

    var client = new RestClient("https://api-gateway2.nets.eu/lcm/v1/accounts/accountstate");
var request = new RestRequest(Method.POST);
request.AddHeader("content-type", "application/json");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
request.AddParameter("application/json", "{\"REPLACE_REQUEST_BODY\":\"REPLACE_REQUEST_BODY\"}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

    Request body

    • accountInfoobjectoptional
      • accountstringoptional

        Plain text value of account reference, if accountType is one of: CARDID, PANID, PANREF. Otherwise, the account parameter is sent inside the encryptedData.

        example: 95645644466699990
      • accountTypestringoptional

        One of PAN, CARDID, PANID, PANREF.

        example: CARDID
      • accountExpirystringoptional

        Account expiry in the MMYYYY format. Only necessary if accounType is PAN and when it is sent, it is inside the encryptedData.

        example: 062029
      • encryptedDatastringoptional

        A field containing the encrypted JSON object with account and accountExpiry fields inside. In this case the value of the account field will be the PAN. Only to be sent in the request when accountType is PAN.

        example: encrypted_data

    Request body

    {
    "accountInfo": {
        "account": "95645644466699990",
        "accountType": "CARDID",
        "accountExpiry": "062029",
        "encryptedData": "encrypted_data"
    }
}

    Responses

    • 200OKoptional
      • accountInfoobjectoptional
        • accountTypestringoptional

          Account reference type. One of CARDID | PANID | PANREF.

          example: CARDID
        • accountstringoptional

          Account reference value

          example: 940300994437660
      • accountStatestringoptional

        State of the account

        example: ACTIVE
      • idvMethodsobjectoptional
        • idvMethodarrayoptional
          • idvChannelstringoptionalexample: SMS
          • idvContactInfostringoptionalexample: +48551534591
      • additionalParametersarrayoptional
        • namestringoptionalexample: CardholderFName
        • valuestringoptionalexample: John
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    200

    {
    "accountInfo": {
        "accountType": "CARDID",
        "account": "940300994437660"
    },
    "accountState": "ACTIVE",
    "idvMethods": {
        "idvMethod": [
            {
                "idvChannel": "SMS",
                "idvContactInfo": "+4529482200"
            },
            {
                "idvChannel": "EMAIL",
                "idvContactInfo": "mark@domain.com"
            }
        ]
    },
    "additionalParameters": [
        {
            "name": "CardholderFName",
            "value": "John"
        }
    ]
}

    Get account details from Issuer's backend based on account reference

    GET /accounts/{accountRef}

    Get account details from Issuer's backend based on account reference

    Parameters

    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired
    • accountRefstringrequired

      Account reference value

    Get account details from Issuer's backend based on account reference

    var client = new RestClient("https://api-gateway2.nets.eu/lcm/v1/accounts/940300994437660");
var request = new RestRequest(Method.GET);
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
IRestResponse response = client.Execute(request);

    Responses

    • 200OKoptional
      • accountInfoobjectoptional
        • accountstringoptional

          Plain text value of account reference, if accountType is one of: CARDID, PANID, PANREF. Otherwise, the account parameter is sent inside the encryptedData.

          example: 95645644466699990
        • accountTypestringoptional

          One of PAN, CARDID, PANID, PANREF.

          example: CARDID
        • accountExpirystringoptional

          Account expiry in the MMYYYY format. Only necessary if accounType is PAN and when it is sent, it is inside the encryptedData.

          example: 062029
        • encryptedDatastringoptional

          A field containing the encrypted JSON object with account and accountExpiry fields inside. In this case the value of the account field will be the PAN. Only to be sent in the request when accountType is PAN.

          example: encrypted_data
      • accountStatestringoptional
      • idvMethodsobjectoptional
        • idvMethodarrayoptional
          • idvChannelstringoptionalexample: SMS
          • idvContactInfostringoptionalexample: +48551534591
      • additionalParametersarrayoptional
        • namestringoptionalexample: CardholderFName
        • valuestringoptionalexample: John
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    200

    {
    "accountInfo": {
        "account": "95645644466699990",
        "accountType": "CARDID",
        "accountExpiry": "062029",
        "encryptedData": "encrypted_data"
    },
    "accountState": "string",
    "idvMethods": {
        "idvMethod": [
            {
                "idvChannel": "SMS",
                "idvContactInfo": "+4529482200"
            },
            {
                "idvChannel": "EMAIL",
                "idvContactInfo": "mark@domain.com"
            }
        ]
    },
    "additionalParameters": [
        {
            "name": "CardholderFName",
            "value": "John"
        }
    ]
}

    Get account reference from Issuer's backend based on account PAN

    POST /accounts/accountref

    Get account reference from Issuer's backend based on account PAN

    Parameters

    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired

    Get account reference from Issuer's backend based on account PAN

    var client = new RestClient("https://api-gateway2.nets.eu/lcm/v1/accounts/accountref");
var request = new RestRequest(Method.POST);
request.AddHeader("content-type", "application/json");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
request.AddParameter("application/json", "{\"REPLACE_REQUEST_BODY\":\"REPLACE_REQUEST_BODY\"}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

    Request body

    • accountstringoptional

      Plain text value of account reference, if accountType is one of: CARDID, PANID, PANREF. Otherwise, the account parameter is sent inside the encryptedData.

      example: 95645644466699990
    • accountTypestringoptional

      One of PAN, CARDID, PANID, PANREF.

      example: CARDID
    • accountExpirystringoptional

      Account expiry in the MMYYYY format. Only necessary if accounType is PAN and when it is sent, it is inside the encryptedData.

      example: 062029
    • encryptedDatastringoptional

      A field containing the encrypted JSON object with account and accountExpiry fields inside. In this case the value of the account field will be the PAN. Only to be sent in the request when accountType is PAN.

      example: encrypted_data

    Request body

    {
    "account": "95645644466699990",
    "accountType": "CARDID",
    "accountExpiry": "062029",
    "encryptedData": "encrypted_data"
}

    Responses

    • 200OKoptional
      • accountTypestringoptional

        Account reference type. One of CARDID | PANID | PANREF.

        example: CARDID
      • accountstringoptional

        Account reference value

        example: 940300994437660
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    200

    {
    "accountType": "CARDID",
    "account": "940300994437660"
}

    Issuer Controller V1

    Issuer LCM controller endpoints for token and card data operations

    Resolve account info and token info from token reference

    GET /accounts/tokenreference/{tokenReferenceID}

    Resolve account info and token info from token reference

    Parameters

    • tokenReferenceIDstringrequired

    Resolve account info and token info from token reference

    var client = new RestClient("https://api-gateway2.nets.eu/lcm/v1/accounts/tokenreference/{tokenReferenceID}");
var request = new RestRequest(Method.GET);
IRestResponse response = client.Execute(request);

    Responses

    • 200OKoptional
      • accountInfoobjectoptional
        • accountIdstringoptional
        • accountstringoptional
        • accountTypestringoptional

          CARDID, PANID, PANREF, NULL

      • tokenInfoobjectoptional
        • tokenRequestorIDstringoptional
      • virtualAccountobjectoptional
        • virtualAccountIDstringoptional
    • 400Bad Requestoptional
      • errorCodestringrequired

        Stable, machine-readable error identifier.

        example: LCM-1011
      • messagestringrequired

        Human-readable error message.

        example: Invalid Account ID
    • 404Not Foundoptional
      • errorCodestringrequired

        Stable, machine-readable error identifier.

        example: LCM-1011
      • messagestringrequired

        Human-readable error message.

        example: Invalid Account ID
    • 406Not Acceptableoptional
      • errorCodestringrequired

        Stable, machine-readable error identifier.

        example: LCM-1011
      • messagestringrequired

        Human-readable error message.

        example: Invalid Account ID
    • 500Internal Server Erroroptional
      • errorCodestringrequired

        Stable, machine-readable error identifier.

        example: LCM-1011
      • messagestringrequired

        Human-readable error message.

        example: Invalid Account ID
    {
    "accountInfo": {
        "accountId": "string",
        "account": "string",
        "accountType": "CARDID"
    },
    "tokenInfo": {
        "tokenRequestorID": "string"
    },
    "virtualAccount": {
        "virtualAccountID": "string"
    }
}

    Retrieve card data encrypted for the caller based on account identifier

    POST /accounts/card-data

    Returns sensitive card data encrypted using a hybrid encryption scheme.

    Encryption process

    1. LCM validates caller's public key (X.509 format, RSAPublicKey type check, exact 2048-bit enforcement)
    2. LCM generates a fresh random symmetric content-encryption key (e.g., AES-256) for this response.
    3. LCM encrypts the sensitive payload using an AEAD algorithm (e.g., AES-GCM), producing an encrypted blob (ciphertext).
    4. LCM encrypts the CEK using the caller's public key (e.g., RSA-OAEP with SHA-256 + MGF1-SHA-256).
    5. The API returns:
      • encryptedData: the encrypted payload blob - Base64( [12-byte nonce] [ciphertext + 128-bit GCM auth tag] )
      • encryptedSymmetricKey: the CEK encrypted with the provided public key (Base64)

    Client responsibility

    • Decrypt encryptedSymmetricKey with the corresponding private key to recover the CEK.
    • Use the CEK to decrypt encryptedData and verify integrity (AEAD tag).

    This operation is read-only and does not change server state.

    Parameters

    • X-Issuer-IDstringrequired

      Issuer identifier assigned by LCM.

    • X-Request-IDstring (uuid)required

      Correlation identifier for end-to-end request tracing.

    • X-Provider-IDstringrequired

      Identifier of the upstream provider / CMS integration.

    Retrieve card data encrypted for the caller based on account identifier

    var client = new RestClient("https://api-gateway2.nets.eu/lcm/v1/accounts/card-data");
var request = new RestRequest(Method.POST);
request.AddHeader("content-type", "application/json");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
request.AddParameter("application/json", "{\"REPLACE_REQUEST_BODY\":\"REPLACE_REQUEST_BODY\"}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

    Request body

    • cardDataobjectrequired
      • accountstringrequired

        Account reference value (format depends on accountType).

        example: 4111xxxxxxxx1111
      • accountTypestringrequired

        Type of account reference provided in account. Only CARDID is supported at the moment.

        PAN, CARDID, PANID, PANREF

        example: CARDID
    • publicKeystring (byte)required

      Base64-encoded caller public key used to encrypt the symmetric CEK for this response.Recommended encoding: X.509 format, RSAPublicKey, 2048-bit

      example: MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4f5wg5l2hKsTeNem/V41fGnJm6gOdrj8ym3rFkEU/wT8RDtn4ubWK7wBZNw6ldt+OzV6uYPN2FDZeXKNZKWpXsvCHu8aHhxrEE2dFvN8E5Z79VJAM5lFaELaMXnI/v0JV4j6LW5aeL2vNkFj6wOPCOu1V/P7HNwXkf2Z/WrCRXhKt6yMEQWP2dJNWZHvx4jh7i+j5SvXcXL6H4S/FjV1P5d+yB+PHhBLb8c/DlkjNNlU/tGlxVLOQrEuF0fUCXvccMDN/AZ0HxJTb7cDhcBAJhZDo8uQhJlPVAZ7M4ZYI8gakJb3eO75KL2ypn0YL1Bw3CiMZB7v2yJaExZNDTWkYB+I0HH3BEL1MQIDAQAB

    Request body

    {
    "cardData": {
        "account": "4111xxxxxxxx1111",
        "accountType": "CARDID"
    },
    "publicKey": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4f5wg5l2hKsTeNem/V41fGnJm6gOdrj8ym3rFkEU/wT8RDtn4ubWK7wBZNw6ldt+OzV6uYPN2FDZeXKNZKWpXsvCHu8aHhxrEE2dFvN8E5Z79VJAM5lFaELaMXnI/v0JV4j6LW5aeL2vNkFj6wOPCOu1V/P7HNwXkf2Z/WrCRXhKt6yMEQWP2dJNWZHvx4jh7i+j5SvXcXL6H4S/FjV1P5d+yB+PHhBLb8c/DlkjNNlU/tGlxVLOQrEuF0fUCXvccMDN/AZ0HxJTb7cDhcBAJhZDo8uQhJlPVAZ7M4ZYI8gakJb3eO75KL2ypn0YL1Bw3CiMZB7v2yJaExZNDTWkYB+I0HH3BEL1MQIDAQAB"
}

    Responses

    • 200Encrypted card data successfully returned.optional
      • encryptedDatastring (byte)required

        Base64-encoded nonce + encrypted payload (ciphertext) produced using a freshly generated symmetric CEK.The decrypted payload structure is documented separately and is not returned in plaintext.

        example: VGhpcy1pcy1qdXN0LWFuLWV4YW1wbGU=
      • encryptedSymmetricKeystring (byte)required

        Base64-encoded symmetric CEK encrypted with the caller's public key.The client decrypts this value using its private key to recover the CEK required to decrypt encryptedData.

        example: c2FtcGxlLWVuY3J5cHRlZC1rZXk=
    • 400Invalid request (e.g., missing/invalid fields).optional
      • errorCodestringrequired

        Stable, machine-readable error identifier.

        example: LCM-1011
      • messagestringrequired

        Human-readable error message.

        example: Invalid Account ID
    • 401Missing or invalid access token.optional
      • errorCodestringrequired

        Stable, machine-readable error identifier.

        example: LCM-1011
      • messagestringrequired

        Human-readable error message.

        example: Invalid Account ID
    • 403optional
      Authenticated but not permitted (insufficient scope/entitlement).
      • errorCodestringrequired

        Stable, machine-readable error identifier.

        example: LCM-1011
      • messagestringrequired

        Human-readable error message.

        example: Invalid Account ID
    • 404Account reference not found.optional
      • errorCodestringrequired

        Stable, machine-readable error identifier.

        example: LCM-1011
      • messagestringrequired

        Human-readable error message.

        example: Invalid Account ID
    {
    "encryptedData": "VGhpcy1pcy1qdXN0LWFuLWV4YW1wbGU=",
    "encryptedSymmetricKey": "c2FtcGxlLWVuY3J5cHRlZC1rZXk="
}