Card enrollment and tokenization for agentic payments. Use these APIs to register a consumer's payment card, creating a tokenized reference that can be used in subsequent purchase instructions and payment credential retrieval. Supports Visa, Mastercard, and American Express networks.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/cybersource-enrollment-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
description: All CyberSource API specs merged together. These are available at https://developer.cybersource.com/api/reference/api-reference.html
version: 0.0.1
title: CyberSource Merged Spec bankAccountValidation Enrollment API
servers:
- url: https://apitest.cybersource.com/
tags:
- name: Enrollment
description: Card enrollment and tokenization for agentic payments. Use these APIs to register a consumer's payment card, creating a tokenized reference that can be used in subsequent purchase instructions and payment credential retrieval. Supports Visa, Mastercard, and American Express networks.
paths:
/acp/v1/tokens:
post:
tags:
- Enrollment
summary: Enroll a card
description: Enroll a payment card for agentic or e-commerce transactions. This is typically the first step in the Intelligent Commerce payment lifecycle — the agent calls this endpoint to register a consumer's card, creating a tokenized reference that can be used in subsequent purchase instructions and payment credential retrieval. Requires device information, consumer identity, billing details, and payment instrument references. Returns a status of ACTIVE (HTTP 200) if enrollment completes immediately, or PENDING (HTTP 202) with pendingEvents if cardholder authentication is required. Call this endpoint when a consumer wants to add a new payment card or when setting up a card for agentic payment flows.
operationId: enrollCard
x-devcenter-metaData:
categoryTag: Intelligent_Commerce_Connect
developerGuides: https://developer.cybersource.com/docs/cybs/en-us/intelligent-commerce/developer/all/rest/intelligent-commerce/intelligent-commerce-enroll-card-intro.html
mleForRequest: mandatory
mleForResponse: mandatory
disableProcessorDropDown: true
disableDefaultMerchantCreds: false
authorizationType:
- Json Web Token
overrideMerchantCredential: agentic_mid_091225001
responses:
'200':
description: OK
content:
application/hal+json;charset=utf-8:
schema:
title: agenticCardEnrollmentResponse200
type: object
required:
- clientCorrelationId
properties:
clientCorrelationId:
type: string
description: Client Correlation Id used during the tokenization or during FIDO assertion.
status:
type: string
description: Enrollment status.
'202':
description: OK
content:
application/hal+json;charset=utf-8:
schema:
title: agenticCardEnrollmentResponse202
required:
- clientCorrelationId
type: object
properties:
clientCorrelationId:
type: string
description: Client Correlation Id used during the tokenization or during FIDO assertion.
status:
type: string
description: Enrollment status.
pendingEvents:
type: array
description: Set of events that are pending completion.
items:
type: string
'400':
description: Bad Request
content:
application/hal+json;charset=utf-8:
schema:
title: agenticCardEnrollmentBadRequestResponse400
type: object
properties:
error:
type: object
description: Error response object.
required:
- status
- reason
- message
properties:
status:
type: string
description: HTTP status code to categorize the errors.
reason:
type: string
description: Error reason as associated with the HTTP status code
message:
type: string
description: Error message as associated with the HTTP status code.
detail:
type: object
description: Additional details about the error.
properties:
reason:
type: string
description: Detailed reason for the error.
source:
type: string
description: Source for the error
sourceType:
type: string
description: Detail about source for the error
message:
type: string
description: Detailed message for the error
'401':
description: Unauthorized
content:
application/hal+json;charset=utf-8:
schema:
title: agenticCardEnrollmentUnauthorizedResponse401
type: object
properties:
error:
type: object
description: Error response object.
required:
- status
- reason
- message
properties:
status:
type: string
description: HTTP status code to categorize the errors.
reason:
type: string
description: Error reason as associated with the HTTP status code
message:
type: string
description: Error message as associated with the HTTP status code.
detail:
type: object
description: Additional details about the error.
properties:
reason:
type: string
description: Detailed reason for the error.
source:
type: string
description: Source for the error
sourceType:
type: string
description: Detail about source for the error
message:
type: string
description: Detailed message for the error
'403':
description: Forbidden
content:
application/hal+json;charset=utf-8:
schema:
title: agenticCardEnrollmentForbiddenResponse403
type: object
properties:
error:
type: object
description: Error response object.
required:
- status
- reason
- message
properties:
status:
type: string
description: HTTP status code to categorize the errors.
reason:
type: string
description: Error reason as associated with the HTTP status code
message:
type: string
description: Error message as associated with the HTTP status code.
detail:
type: object
description: Additional details about the error.
properties:
reason:
type: string
description: Detailed reason for the error.
source:
type: string
description: Source for the error
sourceType:
type: string
description: Detail about source for the error
message:
type: string
description: Detailed message for the error
'404':
description: Not Found
content:
application/hal+json;charset=utf-8:
schema:
title: agenticCardEnrollmentNotFoundResponse404
type: object
properties:
error:
type: object
description: Error response object.
required:
- status
- reason
- message
properties:
status:
type: string
description: HTTP status code to categorize the errors.
reason:
type: string
description: Error reason as associated with the HTTP status code
message:
type: string
description: Error message as associated with the HTTP status code.
detail:
type: object
description: Additional details about the error.
properties:
reason:
type: string
description: Detailed reason for the error.
source:
type: string
description: Source for the error
sourceType:
type: string
description: Detail about source for the error
message:
type: string
description: Detailed message for the error
'409':
description: Conflict
content:
application/hal+json;charset=utf-8:
schema:
title: agenticCardEnrollmentConflictResponse409
type: object
properties:
error:
type: object
description: Error response object.
required:
- status
- reason
- message
properties:
status:
type: string
description: HTTP status code to categorize the errors.
reason:
type: string
description: Error reason as associated with the HTTP status code
message:
type: string
description: Error message as associated with the HTTP status code.
detail:
type: object
description: Additional details about the error.
properties:
reason:
type: string
description: Detailed reason for the error.
source:
type: string
description: Source for the error
sourceType:
type: string
description: Detail about source for the error
message:
type: string
description: Detailed message for the error
'500':
description: Internal Server Error
content:
application/hal+json;charset=utf-8:
schema:
title: agenticCardEnrollmentInternalServerErrorResponse500
type: object
properties:
error:
type: object
description: Error response object.
required:
- status
- reason
- message
properties:
status:
type: string
description: HTTP status code to categorize the errors.
reason:
type: string
description: Error reason as associated with the HTTP status code
message:
type: string
description: Error message as associated with the HTTP status code.
detail:
type: object
description: Additional details about the error.
properties:
reason:
type: string
description: Detailed reason for the error.
source:
type: string
description: Source for the error
sourceType:
type: string
description: Detail about source for the error
message:
type: string
description: Detailed message for the error
requestBody:
content:
application/json;charset=utf-8:
schema:
required:
- billTo
- clientCorrelationId
- consumerIdentity
- deviceInformation
- paymentInformation
- buyerInformation
type: object
properties:
clientCorrelationId:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 255
description: Client Correlation Id used during the tokenization or during FIDO assertion.
deviceInformation:
type: object
description: Device and Application instance data. Identifies the device and application from which the consumer is making the payment request.
required:
- applicationName
- deviceData
- ipAddress
- fingerprintSessionId
properties:
userAgent:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 2048
description: "Base64 Encoded userAgent string of the connecting client application, with no padding. \nUser agent string of the connecting client application. \nConditionality: \n- Required for browsers\n- Optional for non-browsers\n"
applicationName:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 255
description: Name of the connecting client application.
fingerprintSessionId:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 255
description: Device Fingerprinting Session identifier.
country:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.+$
minLength: 2
maxLength: 2
format: ISO 3166-1-alpha2
description: ISO 3166-1 alpha-2 country code. The country where the Consumer is accessing the service from.
deviceData:
type: object
description: Device data.
required:
- type
- brand
properties:
type:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 255
description: "Type of device being used. \nExample values are: \n- Mobile Phone\n- Tablet\n- Tablet\n- Laptop\n- Personal Assistant\n- Connected Auto\n- Home Appliance\n- Wearable\n- Stationary Computer\n- E-Reader\n- Handheld Gaming Devices\n- Other\n"
manufacturer:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 255
description: Manufacturer of the device.
brand:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 255
description: Brand name of the device.
model:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 255
description: Specific model of the device.
ipAddress:
type: string
pattern: ^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(?:[^0-9]*(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))*$
minLength: 0
maxLength: 255
description: IP address of the consumer's device.
clientDeviceId:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 255
description: Unique identifier of the consumer's device.
buyerInformation:
type: object
description: Buyer Information data. Contains consumer identification and preference details.
properties:
merchantCustomerId:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 255
description: Reference identifier of the Consumer.
personalIdentification:
type: array
items:
type: object
properties:
type:
type: string
description: The type of the identification
id:
type: string
description: The value of the identification type
issueBy:
type: string
description: 'The government agency that issued the driver''s license or passport.
If `**type** = DRIVER_LICENSE`, this is the State or province where the customer''s driver''s license was issued.
If `**type** = PASSPORT`, this is the Issuing country for the cardholder''s passport.
'
language:
type: string
description: (Required) Consumer-provided language choice. ISO 639-1 Code
billTo:
required:
- country
- countryCallingCode
- phoneNumber
type: object
description: Consumer billing information. Required during card enrollment to identify the cardholder.
properties:
firstName:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 50
description: Consumer-provided first name.
lastName:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 50
description: Consumer-provided last name.
fullName:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 100
description: Consumer-provided full name.
email:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 255
description: Consumer-provided email address.
countryCallingCode:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 1
maxLength: 4
description: Phone number country code as defined by the International Telecommunication Union.
phoneNumber:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 4
maxLength: 14
description: Phone number without country code.
numberIsVoiceOnly:
type: boolean
description: Indicates that the phone number provided is not capable of receiving text messages.
country:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 2
maxLength: 2
description: Consumer-provided country code. ISO 3166-1 alpha-2 country code.
consumerIdentity:
required:
- identityType
- identityValue
type: object
description: Consumer Identity data. Identifies the consumer using an email address or phone number.
properties:
identityType:
type: string
description: "Type of Consumer Identity transmitted or collected. \nPossible values: \n - `EMAIL_ADDRESS`\n - `MOBILE_PHONE_NUMBER`\n"
identityValue:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 1
maxLength: 255
description: Consumer Identity value that corresponds to the Consumer Identity Type.
identityProvider:
type: string
description: "Identity provider of the Consumer Identity. \nPossible values: \n - `VISA`\n - `PARTNER` (Default)\n"
identityProviderUrl:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 255
description: Domain Name/URL(iss) of the Identity provider of the Consumer Identity.
paymentInformation:
required:
- instrumentIdentifier
type: object
description: Payment Information data. References the tokenized payment card to use for this transaction. At least one of customer, paymentInstrument, or instrumentIdentifier must be provided. The instrumentIdentifier is the most commonly used reference. If you have a TMS instrument identifier, provide it in instrumentIdentifier.id.
properties:
customer:
type: object
description: Customer data.
properties:
id:
type: string
description: Unique identifier for the Customer token used in the transaction.
minLength: 1
maxLength: 32
paymentInstrument:
type: object
description: Payment Instrument data.
properties:
id:
type: string
description: Unique identifier for the Payment Instrument token used in the transaction.
minLength: 1
maxLength: 32
instrumentIdentifier:
required:
- id
type: object
description: Instrument Identifier data.
properties:
id:
type: string
description: Unique identifier for the Instrument Identifier token used in the transaction.
minLength: 12
maxLength: 32
enrollmentReferenceData:
required:
- enrollmentReferenceType
type: object
description: Enrollment Reference Data. Links the enrollment to an existing token reference.
properties:
enrollmentReferenceType:
type: string
description: Type of Enrollment Reference Data.
enrollmentReferenceProvider:
type: string
description: Provider of Enrollment Reference Data.
assuranceData:
type: array
description: Assurance data.
items:
required:
- verificationMethod
- verificationResults
- verificationTimestamp
type: object
description: Assurance data. Contains identity verification details that prove the consumer or device has been authenticated before the payment operation.
properties:
verificationType:
type: string
description: "Optional. Type of the verification data. \nPossible values:\n - `CARDHOLDER` (Default)\n - `DEVICE`\n"
verificationEntity:
type: string
description: "Optional. Entity performing the verification. \nPossible value: \n - `10` - VISA (Default)\n"
verificationEvents:
type: array
items:
type: string
description: "Optional. Event where the verification occurred. \nPossible values: \n - `01` - Payment transaction\n - `02` - Add card/Card enrollment\n - `03` - Profile access\n - `04` - Account verification\n"
verificationMethod:
type: string
description: "Required. Method of the verification. \nPossible values: \n - `02` - App-based authentication\n - `04` - One-time passcode\n - `21` - Visa Token Service step-up: Device binding\n - `22` - Visa Token Service step-up: Cardholder verification\n - `23` - FIDO2\n"
verificationResults:
type: string
description: "Required. Result of the verification. \nPossible values: \n - `01` - Verified\n - `02` - Not Verified\n - `03` - Not performed\n - `04` - Not required\n - `21` - Not allowed\n"
verificationTimestamp:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.+$
minLength: 1
maxLength: 12
description: Required. Date and time the verification occurred. UTC time in Unix epoch format.
authenticationContext:
type: object
description: Authentication Context data. Describes the authentication action performed.
properties:
action:
type: string
description: Authentication Context action.
authenticatedIdentities:
required:
- id
type: object
description: Authenticated Identities data. Contains the identity assertion from the authentication provider.
properties:
data:
type: string
description: Data related to the authenticated identity.
provider:
type: string
description: Provider of the authenticated identity.
id:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.+$
minLength: 1
maxLength: 50
description: "This is a distinctive and non-transparent identifier provided by VISA for correlation purposes in the previous, related API. \nField Mapping when authenticationMethodType is 'FIDO2': \n - On Success: FidoResponse.identifier\n - On Error: AuthContext.identifier\n"
additionalData:
type: string
description: Additional data related to assurance.
consentData:
type: array
description: Consent data.
items:
required:
- acceptedTime
- effectiveUntil
- id
- source
- type
type: object
properties:
id:
type: string
description: Unique identifier for the consent.
type:
type: string
description: "Type of the consent. \nPossible value: \n - `PERSONALIZATION`\n"
source:
type: string
description: Source of the consent.
acceptedTime:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 12
description: Date and time when the consent was accepted by the consumer. UTC time in Unix epoch format.
effectiveUntil:
type: string
pattern: (?!^[*.,'#_/-]+$)(?!.*\./.*)^.*$
minLength: 0
maxLength: 12
description: Date and time until which the consent remains effective. UTC time in Unix epoch format.
example:
clientCorrelationId: 3e1b7943-6567-4965-a32b-5aa93d057d35
deviceInformation:
userAgent: SampleUserAgent
applicationName: My Magic App
fingerprintSessionId: finSessionId
country: US
deviceData:
type: Mobile
manufacturer: Apple
brand: Apple
model: iPhone 16 Pro Max
ipAd
# --- truncated at 32 KB (46 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cybersource/refs/heads/main/openapi/cybersource-enrollment-api-openapi.yml