Skip to content
LCMIssuingGW

    LCM Auxiliary Scheme Tokenization

    Auxiliary Scheme Tokenization services provides scheme agnostic interface to help you with digital transformation for co-badged cards.

    URLs

    Authorization server Base URL - Production

    https://api-gateway2.nets.eu/

    Authorization server Base URL - Sandbox

    https://api-gateway-pp.nets.eu/

    Authentication

    Before you can use Auxiliary Scheme Tokenization API, you must go through on-boarding process.

    You will receive two keys, one set for Sandbox and another set for Production access, which are the pairs of unique identifier called "Client ID" and "Client Secret". The Client Secret should not be shared with anyone. The two keys will be needed to authenticate your application to the respective environments. The key for the sandbox environment is used for a test transaction, and that of the production environment for a live transaction.

    You need access tokens to invoke Auxiliary Scheme Tokenization API's resources. Access tokens are passed in the HTTP header when invoking the API. The Authorization server provides a Token Endpoint that you can use to generate or renew your access token. The response of the Token Endpoint is a JSON message. You extract the token for the JSON and pass it with an HTTP Authorization header to access the API.

    In case of theft or a security violation, you can revoke an access token by calling a Revoke Endpoint.

    OAuth 2.0

    OAuth 2.0 is the industry-standard protocol for authorization. Read more at The OAuth 2.0 Authorization Framework, https://tools.ietf.org/html/rfc6749.

    Auxiliary Scheme Tokenization API currently supports OAuth 2.0 Specification with confidential client type. A Confidential client is capable of maintaining the confidentiality of its credentials provided by an authorization server. OAuth 2.0 defines four roles:

    1. Resource owner: An entity capable of granting access to a protected resource.
    2. Resource server: The server hosting protected resources, capable of accepting and responding to protected resource requests using access tokens.
    3. Client: An application making protected resource requests on behalf of the resource owner and with its authorization.
    4. Authorization server: The server issuing access tokens to the client after successfully authenticating the resource owner obtaining authorization.

    At a very high-level, it is possible to break the full OAuth flow into two parts.

    1. Get a token from the authorization server.
    2. Use the token to access the resource server. OAuth 2.0 defines a concept called "authorization grant" which is a credential representing the resource owner's authorization (to access its protected resources) used by the client to obtain an access token. Auxiliary Scheme Tokenization API supports Client Credentials grant type.

    Authorization server

    Token Endpoint

    POST /token

    With the Client Credentials grant type, the client can request an access token using only its credentials when the client is requesting access to the protected resource under its control. Once the client makes this request to the authorization server, it will return an access token to the protected resource. The access token returned to the client for Auxiliary Scheme Tokenization API is Bearer type.

    The client should request access tokens with the minimal necessary scope and lifetime. The authorization server takes the client identity into account when choosing how to honour the requested scope and lifetime, and may issue an access token with less rights than requested.

    Generate access token using Client Credential grant type

    1. Obtain a valid client_id and Client_secret.
    2. Combine the pair in the format client_id:client_secret and encode the combined string
    3. using base64. See Encode to Base64 format, https://www.base64encode.org/
    4. Use the following sample curl command to obtain the access token.
      $ curl -k -d "grant_type=client_credentials" \
    -H "Authorization: Basic <Base64 encoded client_id:client_secret>" \
    -H 'Content-Type: application/x-www-form-urlencoded' \
     https://api-gateway2.nets.eu/token

    You receive a response similar to the following:

      {
    "token_type":"Bearer",
    "expires_in":2061,
    "access_token":"ca19a540f544777860e44e75f605d927"
  }

    Note that, according to OAuth2.0 Authorization Framework, the Client Credential grant type does not allow for the issuing the refresh tokens. See https://tools.ietf.org/html/rfc6749#section-4.4.3

    Revoke Endpoint

    POST /revoke

    Parameters

    • token (required)

      The token to be revoked

    • <Base64 encoded client_id:client_secret> (required)

      Combine the pair in the format client_id:client_secret and encode the combined string using base64.

    • token_type_hint (optional)

      If you do not specify this parameter, the authentication server will search in both key spaces (access_token and refresh_token) and if it finds a matching token then it will be revoked. Therefore, if this parameter is not specified, it will take longer to revoke the token. However, if you specify this parameter, the authentication server only searches in the respective token space. Hence, it is much faster to revoke the token. For the Client Credentials grant type, you have only the option of access_token.

    Example:

      $ curl -X POST \
    https://api-gateway2.nets.eu/revoke \
    -H 'Authorization: Basic <Base64 encoded client_id:client_secret>' \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -d 'token=<token_to_be_revoked>&token_type_hint=<access_token_or_refresh_token>'

    Responses

    • Valid token - HTTP Status 200 - OK

      You receive an empty response with the HTTP status as 200. The following HTTP headers are returned:

      Revokedaccesstoken: a0d210c7a3de7d548e03f1986e9a5c39
Authorizeduser: admin@carbon.super
Revokedrefreshtoken: 5e87a8235cd4d066e15c4c989f5ecf94
Content-Type: text/html
Pragma: no-cache
Cache-Control: no-store
Date: Tue, 23 Aug 2018 19:28:52 GMT
Transfer-Encoding: chunked

    • Invalid token - HTTP Status 200 - OK You still receive an empty response with the HTTP status as 200 but only the following HTTP headers are returned:

      Content-Type: text/html
Pragma: no-cache
Cache-Control: no-store
Date: Tue, 23 Aug 2018 19:31:45 GMT
Transfer-Encoding: chunked

      Because the authorization server cannot find the token in any key space, you will not see Revokedaccesstoken or Revokedrefreshtoken in the HTTP headers.

    API Specification

    Headers and payload

    Request data must be in JSON format. The Content-Type header value must be application/json.

    Response will be in JSON format. The Accept header value must be application/json.

    Reason codes and account actions

    Account actionReason codeService APIDescription
    0000Create/register accountAdd new account
    REPLACE0002Update Account Number orExpiry DateUpdate account info due to replacement
    REPLACE0003Update Account Number orExpiry DateUpdate account info due to brand flip
    0004Update IDVUpdate contact information
    0005Change the state of an accountDelete account due to fraud
    0006Change the state of an accountDelete account as card is lost
    0007Change the state of an accountDelete account as card is stolen
    0008Change the state of an accountDelete account due to expiry and no renewal
    0009Change the state of an accountDelete account as per customer request
    0010Change the state of an accountBlock the existing account
    0011Change the state of an accountResume the blocked account
    0012Update Services NeededServices needed for the account is updated
    REPLACE0013Update Account Number orExpiry DateUpdate account info due to portfolio flip
    0100Change the state of a virtual accountDelete virtual account
    0105Change the state of a virtual accountDelete virtual account due to confirmed fraud
    0106Change the state of a virtual accountDelete virtual account as devices is confirmed lost
    0107Change the state of a virtual accountDelete virtual account as device is confirmed stolen
    0108Change the state of a virtual accountDelete virtual account due to expiry and no renewal
    0200Change the state of a virtual accountSuspend virtual account
    0205Change the state of a virtual accountSuspend virtual account due to fraud
    0206Change the state of a virtual accountSuspend virtual account as devices is lost
    0207Change the state of a virtual accountSuspend virtual account as device is stolen
    0300Change the state of a virtual accountResume the virtual account
    0311Change the state of a virtual accountResume the virtual account as device is recovered
    0314Change the state of a virtual accountResume the virtual account as no fraudulent transaction is reported
    0400Change the state of a virtual accountActivate virtual account
    0401Change the state of a virtual accountActivate virtual account as cardholder is pre-authenticated
    0402Change the state of a virtual accountActivate virtual account upon request from cardholder
    0501Change profileCard product change
    0502Change profileTerms and conditions change
    0503Change profileCard art change
    0504Change profileCard credentials change
    2000Get Encrypted PayloadPush provisioning to Google Pay
    2001Get Encrypted PayloadPush provisioning to Apple Pay

    Error codes

    Error codeDescription
    LCM-1011Invalid Account ID
    LCM-1012Invalid PAN ID or Card ID
    LCM-1013Invalid PAN
    LCM-1014Input Data Invalid
    LCM-1015Internal Server Error
    LCM-1016Invalid Virtual Account
    LCM-1018Client error related to virtual card presentation
    LCM-1019Server error related to virtual card presentation
    LCM-1021PAR service — client error
    LCM-1022PAR service — server error
    LCM-1025Internal communication error
    LCM-1026External communication error
    LCM-1027Invalid Encrypted Data

    Scroll down for code samples, example requests and responses.
    Select a language for code samples from the tabs or the mobile navigation menu.

    Health Check

    This operation provides health check of the API

    GET /ping

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired
    var client = new RestClient("https://api-gateway2.nets.eu/lcmauxiliary/v1/ping");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
IRestResponse response = client.Execute(request);

    Responses

    • 200OKoptional
      • messagestringoptional
      • statusstringoptional
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    200

    {
    "message": "string",
    "status": "string"
}

    LCM Auxiliary Scheme Tokenization - Inbound

    Inbound API from issuers backend to LCM Auxiliary Scheme Tokenization - Inbound

    Get account information

    GET /accounts/{accountID}

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired
    • accountIDstringrequired

      accountID

    Get account information

    var client = new RestClient("https://api-gateway2.nets.eu/lcmauxiliary/v1/accounts/{accountID}");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
IRestResponse response = client.Execute(request);

    Responses

    • 200OKoptional
      • accountInfoobjectoptional
        • issuerIdstringoptional

          Issuer ID assigned by LCM

          example: PB-11223344556
        • accountTypestringoptional

          Static value - PAN

          example: PAN
        • accountSuffixstringoptional

          Last 4 digits of account PAN

          example: 5690
        • accountCreationDatestringoptional

          Date and time of account creation in the yyyy-MM-ddTHH:mm:ssZ format

          example: 2024-08-19T16:56:22Z
      • accountStatestringoptional

        State of the account, one of ACTIVE | SUSPENDED | DELETED | BLOCKED | LOCKED

        example: ACTIVE
      • stateTimeStampstringoptional

        The timestamp of the last account state change in the yyyy-MM-ddTHH:mm:ssZ format

        example: 2024-03-22T07:33:12Z
      • virtualAccountsobjectoptional
        • virtualAccountIDarrayoptional

          An array of virtual account IDs

    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    200

    {
    "accountInfo": {
        "issuerId": "PB-11223344556",
        "accountType": "PAN",
        "accountSuffix": 5690,
        "accountCreationDate": "2024-08-19T16:56:22Z"
    },
    "accountState": "ACTIVE",
    "stateTimeStamp": "2024-03-22T07:33:12Z",
    "virtualAccounts": {
        "virtualAccountID": [
            "17110918517574127108316617",
            "17110927928114877464144012"
        ]
    }
}

    Update account number or expiry date

    PUT /accounts/{accountID}/accountinfo

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired
    • accountIDstringrequired

      accountID

    Update account number or expiry date

    var client = new RestClient("https://api-gateway2.nets.eu/lcmauxiliary/v1/accounts/{accountID}/accountinfo");
var request = new RestRequest(Method.PUT);
request.AddHeader("content-type", "application/json");
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
request.AddParameter("application/json", "{\"REPLACE_REQUEST_BODY\":\"REPLACE_REQUEST_BODY\"}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

    Request body

    • accountActionstringoptional

      REPLACE

      example: REPLACE
    • accountInfoobjectoptional
      • accountTypestringoptional

        Required only if the accountAction is REPLACE. The value cab be either PAN or PANID. If it is PAN, the account and accountExpiry fields are sent in the encryptedData. If it is PANID, then the PANID value is sent in the account field and accountExpiry is not needed.

        example: PANID
      • accountstringoptional

        Required only if the accountAction is REPLACE. The value is the PANID value, if the accountType is PANID. Otherwise the account information is sent inside the encryptedData field.

      • accountExpirystringoptional

        Account expiry in the MMYYYY format.

        example: 062029
      • encryptedDatastringoptional

        A field containing the encrypted JSON object with account and accountExpiry fields inside. In this case the value of the account field will be the PAN. Only to be sent in the request when accountType is PAN.

        example: encrypted_data
      • reasonCodestringoptionalexample: 0002

    Request body

    {
    "accountAction": "REPLACE",
    "accountInfo": {
        "accountType": "PANID",
        "account": "string",
        "accountExpiry": "062029",
        "encryptedData": "encrypted_data",
        "reasonCode": "0002"
    }
}

    Responses

    • 204No contentoptional
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    Get virtual account information

    GET /accounts/{accountID}/virtualaccounts/{virtualAccountID}

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired
    • accountIDstringrequired

      accountID

    • virtualAccountIDstringrequired

      virtualAccountID

    • realTimeDatabooleanrequired

      realTimeData

    Get virtual account information

    var client = new RestClient("https://api-gateway2.nets.eu/lcmauxiliary/v1/accounts/{accountID}/virtualaccounts/%7BvirtualAccountID%7D?realTimeData=SOME_BOOLEAN_VALUE");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
IRestResponse response = client.Execute(request);

    Responses

    • 200OKoptional
      • virtualAccountInfoobjectrequired
        • virtualAccountIDstringoptional

          The virtual account ID

          example: 17346067048865654076869019
        • virtualAccountStatestringoptional

          One of One of INACTIVE | ACTIVE | SUSPENDED | DELETED

          example: ACTIVE
        • vitualAccountCreationDatestringoptional

          Date and time of virtual account creation in the yyyy-MM-ddTHH:mm:ssZ format

          example: 2024-08-19T16:56:22Z
        • virtualAccountUpdateDatestringoptional

          Date and time of the last virtual account update in the yyyy-MM-ddTHH:mm:ssZ format

          example: 2024-08-19T16:56:22Z
        • virtualAccountUpdateBystringoptional

          The name of the entity that performed the last virtual account update

          example: LCM
      • tokenInfoobjectrequired
        • tokenstringoptional

          Token(digitised substituted value) associated the PAN(account)

          example: 4124XXXXXXXX4555
        • tokenExpirystringoptional

          Expiration date of primary token in MMYYYY format

          example: MMYYYY
        • tokenRequestorIDstringoptional

          Reference to token requestor

          example: 1341242341234
        • tokenStatusstringoptional

          One of INACTIVE | ACTIVE | SUSPENDED | DELETED

          example: ACTIVE
      • deviceInfoobjectoptional
        • deviceNamestringoptionalexample: my phone
        • deviceProductstringoptional

          Manufacturer of product, e.g. Apple, Samsung

          example: Apple
        • deviceModelstringoptional

          Device model, e.g. iPhone7, Galaxy

          example: iPhone 7
        • deviceOSNamestringoptional

          Phone OS i.e. iOS, Android

          example: iOS
        • deviceOSVersionstringoptional

          Version of OS running on the device

          example: 11.4
        • deviceIMEIstringoptional

          IMEI number of the device

          example: 440725462341524345643456
        • deviceIDstringoptional

          Device ID assigned by the card scheme

          example: 192834712983471298347190
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    200

    {
    "virtualAccountInfo": {
        "virtualAccountID": "17346067048865654076869019",
        "virtualAccountState": "ACTIVE",
        "vitualAccountCreationDate": "2024-08-19T16:56:22Z",
        "virtualAccountUpdateDate": "2024-08-19T16:56:22Z",
        "virtualAccountUpdateBy": "LCM"
    },
    "tokenInfo": {
        "token": "4124XXXXXXXX4555",
        "tokenExpiry": "MMYYYY",
        "tokenRequestorID": "1341242341234",
        "tokenStatus": "ACTIVE"
    },
    "deviceInfo": {
        "deviceName": "my phone",
        "deviceProduct": "Apple",
        "deviceModel": "iPhone 7",
        "deviceOSName": "iOS",
        "deviceOSVersion": "11.4",
        "deviceIMEI": "440725462341524345643456",
        "deviceID": "192834712983471298347190"
    }
}

    Primary token create notification

    POST /accounts

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired

    Primary token create notification

    var client = new RestClient("https://api-gateway2.nets.eu/lcmauxiliary/v1/accounts");
var request = new RestRequest(Method.POST);
request.AddHeader("content-type", "application/json");
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
request.AddParameter("application/json", "{\"REPLACE_REQUEST_BODY\":\"REPLACE_REQUEST_BODY\"}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

    Request body

    • dateTimeOfEventstringoptional

      Timestamp of primary token creation in the yyyy-MM-ddTHH:mm:ssZ format.

      example: 2024-06-18T10:15:30.00Z
    • messageReasonCodestringoptional

      Reason for notification provided by primary tokenisation service.

      example: TOKEN_CREATED
    • accountInfoobjectoptional
      • accountstringoptional

        Plain text value of account reference, if accountType is PANID. Otherwise, the account parameter is sent inside the encryptedData.

        example: 956456
      • accountTypestringoptional

        PAN or PANID.

        example: PANID
      • accountExpirystringoptional

        Account expiry in the MMYYYY format. Only necessary if accounType is PAN and when it is sent, it is inside the encryptedData.

        example: 062029
      • encryptedDatastringoptional

        A field containing the encrypted JSON object with account and accountExpiry fields inside. In this case the value of the account field will be the PAN. Only to be sent in the request when accountType is PAN.

        example: encrypted_data
      • reasonCodestringoptional

        Reason code for account creation (always 0000)

        example: 0000
    • deviceInfoobjectoptional
      • deviceNamestringoptionalexample: my phone
      • deviceProductstringoptional

        Manufacturer of product, e.g. Apple, Samsung

        example: Apple
      • deviceModelstringoptional

        Device model, e.g. iPhone7, Galaxy

        example: iPhone 7
      • deviceOSNamestringoptional

        Phone OS i.e. iOS, Android

        example: iOS
      • deviceOSVersionstringoptional

        Version of OS running on the device

        example: 11.4
      • deviceIMEIstringoptional

        IMEI number of the device

        example: 440725462341524345643456
      • deviceIDstringoptional

        Device ID assigned by the card scheme

        example: 192834712983471298347190
    • tokenInfoobjectoptional
      • tokenstringoptional

        Token (digitised substituted value) associated the PAN (account). NOTE: V1 of this API does not support token encryption. Please use V2 endpoint to send encrypted token information.

        example: 4124XXXXXXXX4555
      • tokenExpirystringoptional

        Token expiry date

        example: MMYYYY
      • tokenRequestorIDstringoptional

        Token requestor identifier

        example: 1341242341234
      • tokenStatusstringoptional

        One of INACTIVE | ACTIVE | SUSPENDED | DELETED

        example: ACTIVE
      • tokenIDstringoptional

        Token identifier also called DPAN ID (device pan identifier)

        example: DNIH487394827392873492834

    Request body

    {
    "dateTimeOfEvent": "2024-06-18T10:15:30.00Z",
    "messageReasonCode": "TOKEN_CREATED",
    "accountInfo": {
        "account": "956456",
        "accountType": "PANID",
        "accountExpiry": "062029",
        "encryptedData": "encrypted_data",
        "reasonCode": "0000"
    },
    "deviceInfo": {
        "deviceName": "my phone",
        "deviceProduct": "Apple",
        "deviceModel": "iPhone 7",
        "deviceOSName": "iOS",
        "deviceOSVersion": "11.4",
        "deviceIMEI": "440725462341524345643456",
        "deviceID": "192834712983471298347190"
    },
    "tokenInfo": {
        "token": "4124XXXXXXXX4555",
        "tokenExpiry": "MMYYYY",
        "tokenRequestorID": "1341242341234",
        "tokenStatus": "ACTIVE",
        "tokenID": "DNIH487394827392873492834"
    }
}

    Responses

    • 200OKoptional
      • accountIDstringoptional
      • accountStatestringoptional
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    200

    {
    "accountID": "string",
    "accountState": "string"
}

    Primary token create notification version 2

    POST /accounts/v2

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired

    Primary token create notification version 2

    var client = new RestClient("https://api-gateway2.nets.eu/lcmauxiliary/v1/accounts/v2");
var request = new RestRequest(Method.POST);
request.AddHeader("content-type", "application/json");
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
request.AddParameter("application/json", "{\"REPLACE_REQUEST_BODY\":\"REPLACE_REQUEST_BODY\"}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

    Request body

    • dateTimeOfEventstringoptional

      Timestamp of primary token creation in the yyyy-MM-ddTHH:mm:ssZ format.

      example: 2024-06-18T10:15:30.00Z
    • messageReasonCodestringoptional

      Reason for notification provided by primary tokenisation service.

      example: TOKEN_CREATED
    • accountInfoobjectoptional
      • accountstringoptional

        Plain text value of account reference, if accountType is PANID. Otherwise, the account parameter is sent inside the encryptedData.

        example: 956456
      • accountTypestringoptional

        PAN or PANID.

        example: PANID
      • accountExpirystringoptional

        Account expiry in the MMYYYY format. Only necessary if accounType is PAN and when it is sent, it is inside the encryptedData.

        example: 062029
      • encryptedDatastringoptional

        A field containing the encrypted JSON object with account and accountExpiry fields inside. In this case the value of the account field will be the PAN. Only to be sent in the request when accountType is PAN.

        example: encrypted_data
      • reasonCodestringoptional

        Reason code for account creation (always 0000)

        example: 0000
    • deviceInfoobjectoptional
      • deviceNamestringoptionalexample: my phone
      • deviceProductstringoptional

        Manufacturer of product, e.g. Apple, Samsung

        example: Apple
      • deviceModelstringoptional

        Device model, e.g. iPhone7, Galaxy

        example: iPhone 7
      • deviceOSNamestringoptional

        Phone OS i.e. iOS, Android

        example: iOS
      • deviceOSVersionstringoptional

        Version of OS running on the device

        example: 11.4
      • deviceIMEIstringoptional

        IMEI number of the device

        example: 440725462341524345643456
      • deviceIDstringoptional

        Device ID assigned by the card scheme

        example: 192834712983471298347190
    • tokenInfoobjectoptional
      • encryptedDatastringoptional

        The encryptedData field is a JSON object with token and tokenExpiry fields inside. The token field is the token value and the tokenExpiry is the token expiry date in the MMYYYY format.

        example: encrypted_data
      • tokenIDstringoptional

        Token identifier also called DPAN ID (device pan identifier)

        example: DNIH487394827392873492834
      • tokenRequestorIDstringoptional

        Token requestor identifier

        example: 1341242341234
      • tokenStatusstringoptional

        One of INACTIVE | ACTIVE | SUSPENDED | DELETED

        example: ACTIVE

    Request body

    {
    "dateTimeOfEvent": "2024-06-18T10:15:30.00Z",
    "messageReasonCode": "TOKEN_CREATED",
    "accountInfo": {
        "account": "956456",
        "accountType": "PANID",
        "accountExpiry": "062029",
        "encryptedData": "encrypted_data",
        "reasonCode": "0000"
    },
    "deviceInfo": {
        "deviceName": "my phone",
        "deviceProduct": "Apple",
        "deviceModel": "iPhone 7",
        "deviceOSName": "iOS",
        "deviceOSVersion": "11.4",
        "deviceIMEI": "440725462341524345643456",
        "deviceID": "192834712983471298347190"
    },
    "tokenInfo": {
        "encryptedData": "encrypted_data",
        "tokenID": "DNIH487394827392873492834",
        "tokenRequestorID": "1341242341234",
        "tokenStatus": "ACTIVE"
    }
}

    Responses

    • 200OKoptional
      • accountIDstringoptional
      • accountStatestringoptional
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    200

    {
    "accountID": "string",
    "accountState": "string"
}

    Scheme Tokenization - Outbound

    Outbound API from LCM to issuer backend

    DEPRECATED - Virtual account status notification

    POST /v1/accounts/{accountID}/virtualaccount

    DEPRECATED: this is a legacy version of virtual account status notification. It must not to be used for any new issuer integrations.

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired
    • accountIDstringrequired

      26-digit account ID uniquely identifying the account in LCM

    DEPRECATED - Virtual account status notification

    var client = new RestClient("https://api-gateway2.nets.eu/lcmauxiliary/v1/v1/accounts/12345678901234567890123456/virtualaccount");
var request = new RestRequest(Method.POST);
request.AddHeader("content-type", "application/json");
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
request.AddParameter("application/json", "{\"REPLACE_REQUEST_BODY\":\"REPLACE_REQUEST_BODY\"}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

    Request body

    • virtualAccountIDstringoptional

      LCM ID of the virtual account

      example: 17278634608426073445672258
    • virtualAccountStatusstringoptional

      One of INACTIVE | ACTIVE | SUSPENDED | DELETED

      example: ACTIVE
    • reasonstringoptional

      The reason for sending the notification

      example: DIGITIZATION
    • tokenRequestorIDstringoptional

      The ID of the token requestor

      example: 40010030273
    • deviceInfoobjectoptional
      • deviceNamestringoptionalexample: my phone
      • deviceProductstringoptional

        Manufacturer of product, e.g. Apple, Samsung

        example: Apple
      • deviceModelstringoptional

        Device model, e.g. iPhone7, Galaxy

        example: iPhone 7
      • deviceOSNamestringoptional

        Phone OS i.e. iOS, Android

        example: iOS
      • deviceOSVersionstringoptional

        Version of OS running on the device

        example: 11.4
      • deviceIMEIstringoptional

        IMEI number of the device

        example: 440725462341524345643456
      • cardSchemeDeviceIdstringoptional

        Device ID received from the scheme

        example: 192834712983471298347190
    • actorIDstringoptional

      The entity that triggered the action.

      example: CARDHOLDER
    • tokenReferenceIDstringoptional

      Token reference ID provided by the scheme that uniquely identifies the token

      example: DNIH487394827392873492834
    • walletIDstringoptionalexample: PPKSarajJ6VttrqlJw11nbvmCQ262626

    Request body

    {
    "virtualAccountID": "17278634608426073445672258",
    "virtualAccountStatus": "ACTIVE",
    "reason": "DIGITIZATION",
    "tokenRequestorID": "40010030273",
    "deviceInfo": {
        "deviceName": "my phone",
        "deviceProduct": "Apple",
        "deviceModel": "iPhone 7",
        "deviceOSName": "iOS",
        "deviceOSVersion": "11.4",
        "deviceIMEI": "440725462341524345643456",
        "cardSchemeDeviceId": "192834712983471298347190"
    },
    "actorID": "CARDHOLDER",
    "tokenReferenceID": "DNIH487394827392873492834",
    "walletID": "PPKSarajJ6VttrqlJw11nbvmCQ262626"
}

    Responses

    • 200OKoptional
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional

    Virtual account status notification, version 2

    POST /v2/accounts/{accountID}/virtualaccount

    Parameters

    • Authorizationstringrequired
    • X-Issuer-IDstringrequired
    • X-Request-IDstringrequired
    • X-Provider-IDstringrequired
    • accountIDstringrequired

      26-digit account ID uniquely identifying the account in LCM

    Virtual account status notification, version 2

    var client = new RestClient("https://api-gateway2.nets.eu/lcmauxiliary/v1/v2/accounts/12345678901234567890123456/virtualaccount");
var request = new RestRequest(Method.POST);
request.AddHeader("content-type", "application/json");
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("X-Issuer-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Request-ID", "SOME_STRING_VALUE");
request.AddHeader("X-Provider-ID", "SOME_STRING_VALUE");
request.AddParameter("application/json", "{\"REPLACE_REQUEST_BODY\":\"REPLACE_REQUEST_BODY\"}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

    Request body

    • virtualAccountIDstringoptional

      LCM ID of the virtual account

      example: 17278634608426073445672258
    • actorIDstringoptional

      The entity that triggered the action.

      example: CARDHOLDER
    • primaryTokenReferenceIDstringoptional

      Only applicable for VISA/Dankort use case. Token reference ID of the primary side of the card.

      example: DNIH487394827392873492834
    • accountInfoobjectoptional
      • accountstringoptional

        The account value set based on the accountType:

        example: CARDID
      • accountTypestringrequired

        One of PAN | CARDID | PANID | PANREF

        example: CARDID
      • accountExpirystringoptional

        Only applicable if accountType = PAN and in this case accountExpiry will be sent inside the encryptedData field, along with PAN value.

        example: 062028
      • encryptedDatastringoptional

        This field is present only if accountType = PAN and then the field is an encrypted JSON object with account and accountExpiry fields inside. Please refer EncryptedDataAccountInfoNotification for the decrypted content.

        example: encrypted_data
      • accountMaskedstringrequired

        Masked PAN, sent only if accountType = PAN.

        example: 447065xxxxxx8729
      • acccountSchemeReferenceIDstringoptional

        PAN reference ID received from the scheme

        example: V-4200000000000000000090
      • accountSourcestringoptional

        PAN source received from the scheme

        example: KEY_ENTERED
    • tokenInfoobjectoptional
      • encryptedDatastringrequired

        Encrypted data containing token PAN and token expiry. Sent only if the issuer has been configured to receive it in the notification. Encrypted with the issuer's public key.To know about the Encrypted String after Decription please refer EncryptedDataTokenInfoNotification Schema.

        example: encrypted_data
      • tokenMaskedstringoptional

        Masked token PAN.

        example: 44706XXXXXXX8928
      • tokenStatusstringrequired

        State of the token (ACTIVE,DELETED,SUSPENDED)

        example: ACTIVE
      • tokenTypestringrequiredexample: SECURE_ELEMENT
      • tokenRequestorIDstringrequired

        The ID of the token requestor

        example: 40010030273
      • tokenReferenceIDstringrequired

        Token reference ID provided by the scheme that uniquely identifies the token.

        example: DNIH487394827392873492834, 88410030273
      • tokenProviderIDstringrequired

        VTS for a VISA token, MDES for a Mastercard token.

        example: VTS
      • tokenUpdateDatestringoptionalexample: 2024-08-12T08:15:00Z
      • tokenProvisioningFlowstringrequiredexample: GREEN
    • deviceInfoobjectoptional
      • deviceIDstringoptional

        Device ID received from the scheme

        example: 192834712983471298347190
      • deviceNamestringoptionalexample: my phone
      • deviceProductstringoptional

        Manufacturer of product, e.g. Apple, Samsung

        example: Apple
      • deviceModelstringoptional

        Device model, e.g. iPhone7, Galaxy

        example: iPhone 7
      • deviceOSNamestringoptional

        Phone OS i.e. iOS, Android

        example: iOS
      • deviceOSVersionstringoptional

        Version of OS running on the device

        example: 11.4
      • deviceIMEIstringoptional

        IMEI number of the device

        example: 440725462341524345643456
      • deviceWalletIDstringoptionalexample: PPKSarajJ6VttrqlJw11nbvmCQ262626

    Request body

    {
    "virtualAccountID": "17278634608426073445672258",
    "actorID": "CARDHOLDER",
    "primaryTokenReferenceID": "DNIH487394827392873492834",
    "accountInfo": {
        "account": "CARDID",
        "accountType": "CARDID",
        "accountExpiry": "062028",
        "encryptedData": "encrypted_data",
        "accountMasked": "447065xxxxxx8729",
        "acccountSchemeReferenceID": "V-4200000000000000000090",
        "accountSource": "KEY_ENTERED"
    },
    "tokenInfo": {
        "encryptedData": "encrypted_data",
        "tokenMasked": "44706XXXXXXX8928",
        "tokenStatus": "ACTIVE",
        "tokenType": "SECURE_ELEMENT",
        "tokenRequestorID": "40010030273",
        "tokenReferenceID": "DNIH487394827392873492834, 88410030273",
        "tokenProviderID": "VTS",
        "tokenUpdateDate": "2024-08-12T08:15:00Z",
        "tokenProvisioningFlow": "GREEN"
    },
    "deviceInfo": {
        "deviceID": "192834712983471298347190",
        "deviceName": "my phone",
        "deviceProduct": "Apple",
        "deviceModel": "iPhone 7",
        "deviceOSName": "iOS",
        "deviceOSVersion": "11.4",
        "deviceIMEI": "440725462341524345643456",
        "deviceWalletID": "PPKSarajJ6VttrqlJw11nbvmCQ262626"
    }
}

    Responses

    • 200OKoptional
    • 401Unauthorizedoptional
    • 403Forbiddenoptional
    • 404Not Foundoptional