Barclays

Barclays Card Application API

Integrate credit card application functionality with real-time status updates.

GitHub OpenAPI

Operations 9

POST /cards/prequal Pre Qualification Check.Please use Content-Type as application/jose for request, response will be send with Content-Type as application/jose. #
POST /cards/applications/verify Process the application post challenge verification #
POST /cards/prescreen/{prescreenId}/capture Capture the fact that the offer(s) were displayed to the customer #
POST /cards/prescreen Get all eligible offers for a customer. This operation contains sensitive data. Please use Content-Type as application/jose for request. #
POST /cards/accounts/instant-credit Get card details based on the accountId. This operation contains sensitive data. Expect response Content-Type as application/jose #
POST /cards/app-consent The API accepts consent from Applicant for various capabilities. Expect response Content-Type as application/jose #
POST /cards/applications Apply for the credit card and get status, T&C and CMA. This operation contains sensitive data. Please use Content-Type as application/jose for request, response will be send with C #
GET /cards/applications/{applicationId} Get the status of application #
POST /cards/offer Accepts meta data to fetch a unique offerId #

Documentation

📖
Documentation
https://developer.barclays.com/apis/card-application/372df8da-72cb-4fe5-b4fb-7e0bcaac7d20.bdn/documentation
📖
APIReference
https://developer.barclays.com/apis/card-application/372df8da-72cb-4fe5-b4fb-7e0bcaac7d20.bdn/documentation

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/barclays/refs/heads/main/openapi/barclays-card-application-openapi.yml

Other Resources

🔗
Overlay
https://raw.githubusercontent.com/api-evangelist/barclays/refs/heads/main/overlays/barclays-card-application-overlay.yaml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/card-application-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

barclays-card-application-openapi.yml Raw ↑ 
openapi: 3.1.0
info:
  title: Card Application
  description: Enables the user to securely apply for a card within your channel
  version: '4.0'
x-method: searched
x-source: https://developer.barclays.com/api/apis/versions/6e3e3358-11bd-4353-92f5-fc0f74c91d3e.bdn/design?specification=oas31
x-harvested: '2026-09-04'
x-harvested-note: Verbatim OpenAPI 3.1 design export from the Barclays API Exchange registry (developer.barclays.com), fetched
  anonymously. The untouched export is in openapi/_original/barclays-card-application-openapi.json. The UK Open Banking documents
  carry OBIE (openbanking.org.uk) in info.contact/termsOfService because they are the OBIE standard contract as Barclays implements
  and publishes it — the API, the registry record and the host are Barclays'.
tags:
- name: applyProductExternalAPI-OAS
  description: Apply Product External API
paths:
  /cards/prequal:
    summary: Pre Qualification Check.Please use Content-Type as application/jose for request, response will be send with Content-Type
      as application/jose.
    description: Pre Qualification Check
    post:
      tags:
      - applyProductExternalAPI-OAS
      summary: Pre Qualification Check.Please use Content-Type as application/jose for request, response will be send with
        Content-Type as application/jose.
      description: Pre Qualification Check
      operationId: postRequestForPrequalDecision
      parameters:
      - name: Content-Type
        in: header
        description: Content-Type
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 35
          minLength: 16
          pattern: ^[a-z0-9A-Z\-\/\;\=\ ]{16,35}$
        example: application/json
      - name: Correlation-ID
        in: header
        description: "Unique end-to-end trace ID. The initiating system (such as a Channel or \nBatch Job), must generate\
          \ this unique ID, then this must be passed \nthrough the API call stack. This is required to maintain compliance\
          \ with the current Barclays REST Standard."
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 36
          minLength: 36
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        example: 7d444840-9dc0-11d1-b245-5ffdce74fad2
      - name: Authorization
        in: header
        description: TIAA-US External token
        required: true
        deprecated: false
        schema:
          type: string
        example: Bearer <token>
      requestBody:
        description: Prequal Decision Request for an customer
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PrequalRequest'
            examples:
              prescreen-offers-req:
                $ref: '#/components/examples/PrequalRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PrequalResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      deprecated: false
  /cards/applications/verify:
    summary: Process the application post challenge verification
    description: Process the application post challenge verification
    post:
      tags:
      - applyProductExternalAPI-OAS
      summary: Process the application post challenge verification
      description: Process the application post challenge verification
      operationId: postApiForApplicationVerification
      parameters:
      - name: Content-Type
        in: header
        description: Content-Type
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 35
          minLength: 16
          pattern: ^[a-z0-9A-Z\-\/\;\=\ ]{16,35}$
        example: application/json
      - name: Correlation-ID
        in: header
        description: "Unique end-to-end trace ID. The initiating system (such as a Channel or \nBatch Job), must generate\
          \ this unique ID, then this must be passed \nthrough the API call stack. This is required to maintain compliance\
          \ with the current Barclays REST Standard."
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 36
          minLength: 36
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        example: 7d444840-9dc0-11d1-b245-5ffdce74fad2
      - name: Authorization
        in: header
        description: TIAA-US External token
        required: true
        deprecated: false
        schema:
          type: string
        example: Bearer <token>
      requestBody:
        description: Verification request data
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationVerificationRequest'
            examples:
              application-verify-req:
                $ref: '#/components/examples/ApplicationVerificationReq'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/ApplicationVerificationResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      deprecated: false
  /cards/prescreen/{prescreenId}/capture:
    summary: Capture the fact that the offer(s) were displayed to the customer
    description: Capture the fact that the offer(s) were displayed to the customer
    post:
      tags:
      - applyProductExternalAPI-OAS
      summary: Capture the fact that the offer(s) were displayed to the customer
      description: Capture the fact that the offer(s) were displayed to the customer
      operationId: postApiForPrescreenOffersCapture
      parameters:
      - name: Content-Type
        in: header
        description: Content-Type
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 35
          minLength: 16
          pattern: ^[a-z0-9A-Z\-\/\;\=\ ]{16,35}$
        example: application/json
      - name: Correlation-ID
        in: header
        description: "Unique end-to-end trace ID. The initiating system (such as a Channel or \nBatch Job), must generate\
          \ this unique ID, then this must be passed \nthrough the API call stack. This is required to maintain compliance\
          \ with the current Barclays REST Standard."
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 36
          minLength: 36
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        example: 7d444840-9dc0-11d1-b245-5ffdce74fad2
      - name: prescreenId
        in: path
        description: Prescreen Id
        required: true
        deprecated: false
        schema:
          type: string
          maxLength: 20
          minLength: 1
          pattern: ^[a-zA-Z0-9]{1,20}$
        example: PS12345678
      - name: Authorization
        in: header
        description: TIAA-US External token
        required: true
        deprecated: false
        schema:
          type: string
        example: Bearer <token>
      requestBody:
        description: Prescreen Offers capture Request Data
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PrescreenOffersCaptureRequest'
            examples:
              prescreen-offers-capture-req:
                $ref: '#/components/examples/PrescreenOffersCaptureReq'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PrescreenOffersCaptureRes'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      deprecated: false
  /cards/prescreen:
    summary: Get all eligible offers for a customer. This operation contains sensitive data. Please use Content-Type as application/jose.
    description: Get all eligible offers for a customer
    post:
      tags:
      - applyProductExternalAPI-OAS
      summary: Get all eligible offers for a customer. This operation contains sensitive data. Please use Content-Type as
        application/jose for request.
      description: Get all eligible offers for a customer
      operationId: postApiForPrescreenOffer
      parameters:
      - name: Content-Type
        in: header
        description: Content-Type
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 35
          minLength: 16
          pattern: ^[a-z0-9A-Z\-\/\;\=\ ]{16,35}$
        example: application/json
      - name: Correlation-ID
        in: header
        description: "Unique end-to-end trace ID. The initiating system (such as a Channel or \nBatch Job), must generate\
          \ this unique ID, then this must be passed \nthrough the API call stack. This is required to maintain compliance\
          \ with the current Barclays REST Standard."
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 36
          minLength: 36
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        example: 7d444840-9dc0-11d1-b245-5ffdce74fad2
      - name: Authorization
        in: header
        description: TIAA-US External token
        required: true
        deprecated: false
        schema:
          type: string
        example: Bearer <token>
      requestBody:
        description: Prescreen Offers Request Data
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PrescreenOffersRequest'
            examples:
              prescreen-offers-req:
                $ref: '#/components/examples/PrescreenOffersReq'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/PrescreenOffersRes'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      deprecated: false
  /cards/accounts/instant-credit:
    summary: Get card details based on the accountId. This operation contains sensitive data. Expect Content-Type as application/jose.
    description: Customer need the card details to complete the purchase journey in the instant credit path
    post:
      tags:
      - applyProductExternalAPI-OAS
      summary: Get card details based on the accountId. This operation contains sensitive data. Expect response Content-Type
        as application/jose
      description: Customer card details will be provided in encrypted form
      operationId: postApiForInstantCreditCardDetail
      parameters:
      - name: Content-Type
        in: header
        description: Content-Type
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 35
          minLength: 16
          pattern: ^[a-z0-9A-Z\-\/\;\=\ ]{16,35}$
        example: application/json
      - name: Correlation-ID
        in: header
        description: "Unique end-to-end trace ID. The initiating system (such as a Channel or \nBatch Job), must generate\
          \ this unique ID, then this must be passed \nthrough the API call stack. This is required to maintain compliance\
          \ with the current Barclays REST Standard."
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 36
          minLength: 36
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        example: 7d444840-9dc0-11d1-b245-5ffdce74fad2
      - name: Authorization
        in: header
        description: TIAA-US External token
        required: true
        deprecated: false
        schema:
          type: string
        example: Bearer <token>
      requestBody:
        description: Request for InstantCredit detail lookup by accountId .
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/InstantCreditByAccountRequest'
            examples:
              instant-credit-by-account-req:
                $ref: '#/components/examples/InstantCreditByAccountReq'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/InstantCreditByAccountRes'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      deprecated: false
  /cards/app-consent:
    summary: The API accepts consent from Applicant for various capabilities
    description: This API is used after the Card Application API (/applications) when applicant consent is needed to proceed.If
      a card application returns 'DOWNSELL_APPROVED_CONSENT_REQUIRED' or 'DOWNSELL_PENDED_CONSENT_REQUIRED', present the required
      content to the customer and obtain their consent for the Downsell Product before continuing.The API captures this consent
      and resumes processing. Once completed, a decision is provided. If approved and instant credit is requested, the Card
      Member Agreement (CMA) will be included in the response, and its acceptance can be tracked via the InstantCredit (/instant-credit)
      API.
    post:
      tags:
      - applyProductExternalAPI-OAS
      summary: The API accepts consent from Applicant for various capabilities. Expect response Content-Type as application/jose
      description: This API is used after the Card Application API (/applications) when applicant consent is needed to proceed.If
        a card application returns 'DOWNSELL_APPROVED_CONSENT_REQUIRED' or 'DOWNSELL_PENDED_CONSENT_REQUIRED', present the
        required content to the customer and obtain their consent for the Downsell Product before continuing.The API captures
        this consent and resumes processing. Once completed, a decision is provided. If approved and instant credit is requested,
        the Card Member Agreement (CMA) will be included in the response, and its acceptance can be tracked via the InstantCredit
        (/instant-credit) API.
      operationId: postApiForAppConsent
      parameters:
      - name: Content-Type
        in: header
        description: Content-Type
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 35
          minLength: 16
          pattern: ^[a-z0-9A-Z\-\/\;\=\ ]{16,35}$
        example: application/json
      - name: Correlation-ID
        in: header
        description: "Unique end-to-end trace ID. The initiating system (such as a Channel or \nBatch Job), must generate\
          \ this unique ID, then this must be passed \nthrough the API call stack. This is required to maintain compliance\
          \ with the current Barclays REST Standard."
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 36
          minLength: 36
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        example: 7d444840-9dc0-11d1-b245-5ffdce74fad2
      - name: Authorization
        in: header
        description: TIAA-US External token
        required: true
        deprecated: false
        schema:
          type: string
        example: Bearer <token>
      requestBody:
        description: App consent request data
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationConsentRequest'
            examples:
              application-consent-accept-req:
                $ref: '#/components/examples/AppConsentReqConsentAccepted'
              application-consent-reject-req:
                $ref: '#/components/examples/AppConsentReqConsentRejected'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/ApplicationConsentResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      deprecated: false
  /cards/applications:
    summary: Apply for the credit card and get status, T&C and CMA. This operation contains sensitive data. Please use Content-Type
      as application/jose.
    description: Apply for the credit card and get status, T&C and CMA
    post:
      tags:
      - applyProductExternalAPI-OAS
      summary: Apply for the credit card and get status, T&C and CMA. This operation contains sensitive data. Please use Content-Type
        as application/jose for request, response will be send with Content-Type as application/jose.
      description: Apply for credit card
      operationId: applyPostOperation
      parameters:
      - name: Content-Type
        in: header
        description: Content-Type
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 35
          minLength: 16
          pattern: ^[a-z0-9A-Z\-\/\;\=\ ]{16,35}$
        example: application/json
      - name: Correlation-ID
        in: header
        description: "Unique end-to-end trace ID. The initiating system (such as a Channel or \nBatch Job), must generate\
          \ this unique ID, then this must be passed \nthrough the API call stack. This is required to maintain compliance\
          \ with the current Barclays REST Standard."
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 36
          minLength: 36
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        example: 7d444840-9dc0-11d1-b245-5ffdce74fad2
      - name: Authorization
        in: header
        description: TIAA-US External token
        required: true
        deprecated: false
        schema:
          type: string
        example: Bearer <token>
      requestBody:
        description: Application Request Data
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ApplicationReq'
            examples:
              application-req:
                $ref: '#/components/examples/ApplicationReq'
              application-req-device-verfication-context:
                $ref: '#/components/examples/ApplicationReq-DeviceVerificationContext'
              application-req-balance-transfer:
                $ref: '#/components/examples/ApplicationReq-BalanceTransfer'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/ApplicationRes'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      deprecated: false
  /cards/applications/{applicationId}:
    summary: Get the status of application
    description: Get the status of application
    get:
      tags:
      - applyProductExternalAPI-OAS
      summary: Get the status of application
      description: Get the status of application
      operationId: getApiForApplicationStatus
      parameters:
      - name: Content-Type
        in: header
        description: Content-Type
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 35
          minLength: 16
          pattern: ^[a-z0-9A-Z\-\/\;\=\ ]{16,35}$
        example: application/json
      - name: Correlation-ID
        in: header
        description: "Unique end-to-end trace ID. The initiating system (such as a Channel or \nBatch Job), must generate\
          \ this unique ID, then this must be passed \nthrough the API call stack. This is required to maintain compliance\
          \ with the current Barclays REST Standard."
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 36
          minLength: 36
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        example: 7d444840-9dc0-11d1-b245-5ffdce74fad2
      - name: applicationId
        in: path
        description: Applicant Application ID.
        required: true
        deprecated: false
        schema:
          type: number
          maxLength: 16
          minLength: 15
          pattern: ^[0-9]{15,16}$
        example: 001346780132564
      - name: Authorization
        in: header
        description: TIAA-US External token
        required: true
        deprecated: false
        schema:
          type: string
        example: Bearer <token>
      responses:
        '200':
          $ref: '#/components/responses/ApplicationStatusRes'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      deprecated: false
  /cards/offer:
    summary: Accepts meta data to fetch a unique offerId
    description: Accepts meta data to fetch a unique offerId
    post:
      tags:
      - applyProductExternalAPI-OAS
      summary: Accepts meta data to fetch a unique offerId
      description: Accepts meta data to fetch a unique offerId
      operationId: postApiForOffer
      parameters:
      - name: Content-Type
        in: header
        description: Content-Type
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 35
          minLength: 16
          pattern: ^[a-z0-9A-Z\-\/\;\=\ ]{16,35}$
        example: application/json
      - name: Correlation-ID
        in: header
        description: "Unique end-to-end trace ID. The initiating system (such as a Channel or \nBatch Job), must generate\
          \ this unique ID, then this must be passed \nthrough the API call stack. This is required to maintain compliance\
          \ with the current Barclays REST Standard."
        required: true
        deprecated: false
        allowEmptyValue: false
        schema:
          type: string
          maxLength: 36
          minLength: 36
          pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
        example: 7d444840-9dc0-11d1-b245-5ffdce74fad2
      - name: Authorization
        in: header
        description: TIAA-US External token
        required: true
        deprecated: false
        schema:
          type: string
        example: Bearer <token>
      requestBody:
        description: Offer Request .
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OfferRequest'
            examples:
              offer-req:
                $ref: '#/components/examples/OfferReq'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/OfferRes'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
        '403':
          $ref: '#/components/responses/Forbidden'
        '503':
          $ref: '#/components/responses/ServiceUnavailable'
      deprecated: false
components:
  schemas:
    ApplicationConsentResponse:
      type: object
      additionalProperties: false
      deprecated: false
      description: App consent response data
      properties:
        data:
          $ref: '#/components/schemas/ApplicationConsentResponseAttributes'
      required:
      - data
      nullable: false
    DownsellProductInfoAttributes:
      type: object
      additionalProperties: false
      deprecated: false
      description: Downsell Product information will be sent in the response for the application status 'DOWNSELL_APPROVED_CONSENT_REQUIRED'
        and 'DOWNSELL_PENDED_CONSENT_REQUIRED'.In case of these statuses, the downsell product information should be presented
        to the Applicant and take consent from the Applicant. Use /app-consent api to send the consent information back to
        Barclays
      properties:
        downsellProductInfoUrl:
          type: string
          description: Access this URL to present the benefits of the downsell product
          example: https://qa01-www.barclaycardus.com/apply/action/downsellProductInfo/17e3338d-344b-403c-8a87-f7d8006d6e33
          maxLength: 200
          minLength: 2
          pattern: ^(https\:\/\/)([0-9a-zA-Z\.\-\/\=\?\&]{2,200})$
        downsellOfferProductId:
          type: string
          description: Downsell product for Applicant to review and provide consent. Need to use this ID to call offer details
            API to get the product information.
          example: 17e3338d-344b-403c-8a87-f7d8006d6e33
          maxLength: 36
          minLength: 36
          pattern: ^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$
        downsellOfferMappingId:
          type: string
          description: Downsell product for Applicant to review and provide consent. Need to use this ID to call offer details
            API to get the product information.
          example: 17e3338d-344b-403c-8a87-f7d8006d6e33
          maxLength: 36
          minLength: 36
          pattern: ^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$
      nullable: false
    CasServiceResponseAttributes:
      type: object
      additionalProperties: false
      deprecated: false
      description: cas service apply response
      properties:
        status:
          type: string
          description: cas service status
          example: SUCCESS
          maxLength: 50
          minLength: 0
          pattern: ^[ A-Za-z0-9_]{0,50}$
      nullable: false
    ApplicationStatusResponseAttributes:
      type: object
      additionalProperties: false
      deprecated: false
      description: Application status for applicant
      properties:
        status:
          type: string
          description: Application status
          enum:
          - PENDING
          - APPROVED
          - DECLINED
          - COMPLETED
          example: COMPLETED
        accountId:
          type: string
          description: Account Id (UUID)
          example: 17e3338d-344b-403c-8a87-f7d8006d6e33
          maxLength: 36
          minLength: 36
          pattern: ^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$
        approvedAmount:
          type: string
          description: approved ammount
          example: '120.40'
          maxLength: 200
          minLength: 0
          pattern: ^\d{3,4}(\.\d{1,2})?$
        createdOn:
          type: string
          description: Date Application created on
          example: '20210623'
          maxLength: 8
          minLength: 8
          pattern: ^([12]\d{3}(0[1-9]|1[0-2])(0[1-9]|[12]\d|3[01]))$
        cmaUrl:
          type: string
          description: Card Member Agreemant URL for approved applications
          example: https://qa01-www.barclaycardus.com/apply/action/rbpcma?approvedProductId=CCVPS71944.jsp
          maxLength: 200
          minLength: 2
          pattern: ^(https\:\/\/)([0-9a-zA-Z\.\-\/\=\?\&]{2,200})$
        cmaStatus:
          type: string
          description: Indicates if customer has accepted CMA or acceptance is pending
          enum:
          - ACCEPTED
          - PENDING_ACCEPTANCE
          example: ACCEPTED
        decisionType:
          type: string
          description: Decision Type
          enum:
          - INSTANT_CREDIT
          - INSTANT_DECISION
          example: INSTANT_CREDIT
        approvedProductLevel:
          type: string
          description: Indicates the approved Product level
          enum:
          - PRIMARY
          - SECONDARY
          example: PRIMARY
      required:
      - createdOn
      - decisionType
      - status
      nullable: false
    Address:
      type: object
      additionalProperties: false
      deprecated: false
      description: Permanent address Info
      properties:
        zip:
          type: string
          description: Applicant’s Address Zip
          example: '19801'
          maxLength: 9
          minLength: 5
          pattern: ^[0-9]{5,9}$
        state:
          $ref: '#/components/schemas/StateEnums'
        city:
          type: string
          description: Applicant's City
          example: Wilimgton
          maxLength: 32
          minLength: 1
          pattern: ^(?!\s)[a-zA-Z'\s]{1,32}(?<!\s)$
        addressLine1:
          type: string
          description: Applicant's Address line 1
          example: 100 W St
          maxLength: 32
          minLength: 2
          pattern: ^[\-\w#&/`.,\s]{2,32}$
        addressLine2:
          type: string
          description: Applicant's Address line 2
          example: 100 W St
          maxLength: 32
          minLength: 0
          pattern: ^[\-\w#&/`.,\s]{0,32}$
      required:
      - addressLine1
      - city
      - state
      - zip
    OfferAttributes:
      type: array
      items:
        $ref: '#/components/schemas/NameValueAttributePair'
      maxItems: 100
      minItems: 0
    PartnerAttributes_2:
      type: array
      description: Partner specific custom attributes
      items:
        $ref: '#/components/schemas/NameValueAttributePair'
      maxItems: 100
      minItems: 0
    PartnerAttributes_1:
      type: array
      description: Partner specific custom attributes
      items:
        $ref: '#/components/schemas/NameValueAttributePair'
      maxItems: 100
      minItems: 0
    ApplyPreScreenCaptureResponseAttributes:
      type: object
      additionalProperties: false
      deprecated: false
      description: Screening capture response
      properties:
        status:
          type: string
          description: Screening offer status
          enum:
          - SUCCESS
          example: SUCCESS
      required:
      - status
      nullable: false
    Attribut

# --- truncated at 32 KB (123 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/barclays/refs/heads/main/openapi/barclays-card-application-openapi.yml