Mastercard
Mastercard Authentication API

The Authentication API from Mastercard — 1 operation(s) for authentication.
Documentation GitHub OpenAPI
OpenAPI Specification

swagger: '2.0'
info:
  title: Mastercard Bill Payment Validator Account Opening Authentication API
  description: This service is provided on behalf of the Mastercard Remote Payment and Presentment (RPPS) Bill Payment Processing Network, which supports consumer to business "push" bill payments (i.e. those which are not funded by debit/credit card transactions) in the U.S.
  version: '1.0'
  x-artifactId: billpay-api
  contact:
    name: Bill Pay Development Support
    email: Bill_Pay_Development_Support@mastercard.com
host: sandbox.api.mastercard.com
basePath: /billpayAPI/v1
schemes:
- https
consumes:
- application/json
produces:
- application/json
tags:
- name: Authentication
paths:
  /authentication-decisions/scans/{scan_id}:
    put:
      tags:
      - Authentication
      responses:
        '200':
          $ref: '#/components/responses/AuthenticationDecisionsResponse'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
      description: "Authenticate user identity and retrieve identity attributes without updating selfie.   \n**This API is mandatory.**\n"
      summary: Retrieve an outcome for an authentication.
      operationId: authenticationdecisions
      parameters:
      - $ref: '#/components/parameters/ScanIdPathParameter'
      - $ref: '#/components/parameters/XEncryptedPayload'
      requestBody:
        $ref: '#/components/requestBodies/AuthenticationDecisionRequest'
components:
  responses:
    UnauthorizedError:
      description: Unauthorized request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            UnauthorizedExample:
              $ref: '#/components/examples/UnauthorizedExample'
    AuthenticationDecisionsResponse:
      description: Success.
      headers:
        X-Transaction-ID:
          schema:
            type: string
          description: A random 128-bit UUID represents the transaction.
        X-User-Identity:
          schema:
            type: string
          description: JWT token for session validation in subsequent API calls.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/AuthenticationDecisions'
          examples:
            AuthenticationDecisionsUnencryptedResponse:
              $ref: '#/components/examples/AuthenticationDecisionsExample'
            AuthenticationDecisionsEncryptedResponse:
              $ref: '#/components/examples/EncryptedPayloadWithRotatedPDSExample'
    NotFoundError:
      description: The request didn't match an existing resource.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            NotFoundExample:
              $ref: '#/components/examples/NotFoundExample'
    ForbiddenError:
      description: Consent not given.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            ForbiddenExample:
              $ref: '#/components/examples/ForbiddenExample'
            ForbiddenExampleUnauthorizedScopedFields:
              $ref: '#/components/examples/ForbiddenExampleUnauthorizedScopedFields'
    BadRequestError:
      description: Something was wrong with the request.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            UserProfileDeletedErrorExample:
              $ref: '#/components/examples/UserProfileDeletedErrorExample'
  examples:
    AuthenticationDecisionsExample:
      value:
        transactionId: 1ec14310-e85c-11ea-adc1-0242ac120002
        status: SUCCESS
        attributes:
          legalName:
            aa6dee5a-6e4d-4932-8189-2ecb7ad6f676:
              value: SMITH, JOHN
              lastVerifiedDate: '2022-04-04T02:49:27.915Z'
        rotatedPds: ZGZnZGVmZ2RnZGVnZXJnZXJncmRnZXJ5aGdld3J0eWJld3J5dHdleXd5d3l3cmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
    UnauthorizedExample:
      value:
        Errors:
          Error:
          - Source: mids
            ReasonCode: UNAUTHORIZED_REQUEST
            Description: Unauthorized request.
            Recoverable: false
    EncryptedPayloadWithRotatedPDSExample:
      value:
        encryptedData: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IoxNTE2MjM5MDIyf
        rotatedPds: ZGZnZGVmZ2RnZGVnZXJnZXJncmRnZXJ5aGdld3J0eWJld3J5dHdleXd5d3l3cmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
    ForbiddenExampleUnauthorizedScopedFields:
      value:
        Errors:
          Error:
          - Source: mids
            ReasonCode: UNAUTHORIZED_SCOPED_FIELDS
            Description: 'UNAUTHORIZED_SCOPED_FIELDS: Requested scoped fields are not part of whitelisted fields.'
            Recoverable: false
    UserProfileDeletedErrorExample:
      value:
        Errors:
          Error:
          - Source: mids
            ReasonCode: USER_PROFILE_DELETED
            Description: 'USER_PROFILE_DELETED: ID of the deleted profile.'
            Recoverable: false
            redirectUri: https://sample-rp-redirect-uri.com?error=server_error&state=AJahbadinvjbdvdnvljkdnvdfhsrbghrtiu4w
    NotFoundExample:
      value:
        Errors:
          Error:
          - Source: mids
            ReasonCode: USER_PROFILE_ID_NOT_FOUND
            Description: The provided user profile ID does not exist.
            Recoverable: false
    ForbiddenExample:
      value:
        Errors:
          Error:
          - Source: mids
            ReasonCode: CONSENT_NOT_GIVEN
            Description: User Consent Not Given.
            Recoverable: false
  schemas:
    PDS:
      type: string
      description: Encrypted Personal Device Storage (PDS) which hosts the users identity attributes. The PDS can be retrieved from the MIDS Core SDK, please refer to the SDK guide for details on how to retrieve this.
      pattern: ^(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?$
      minLength: 1
      example: ZGZnZGVmZ2RnZGVnZXJnZXJncmRnZXJ5aGdld3J0eWJld3J5dHdleXd5d3l3cmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
    FraudDetection:
      type: object
      description: Object containing the signals from the device to be used for fraud detection.
      properties:
        nuDetectMeta:
          description: The data retrieved from the MIDS Fraud Detection SDK which will be used to determine whether the device is trusted.
          required:
          - behaviourData
          - remoteIp
          - sessionId
          - requestUrl
          - userAgent
          - xForwardedFor
          type: object
          properties:
            behaviourData:
              type: string
              description: base64 encoded JSON generated by MIDS (nuDetect) SDK.
              pattern: ^(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?$
              example: ewogICJuZHMtcG1kIiA6ICJ7XCJmdnFcIjpcIjBONjROOVAzLVBPM1ItNDcyNi04MDBPLTNQMzM2Mzg2Tk5RT1wiLFwianZxdHJnUW5nblwiOntcInp2cXNpXCI6XCJRUTYzOTc5Ny1OUFAyLTQ0OVItOVA0MS04UTM0NDdOODU5UzdcIixcInpjdlwiOlwidmJmXCIsXCJ6b3pzXCI6XCJOY2N5clwiLFwiemZ6XCI6MTcxNzk4NjkxODQsXCJqeGVcIjo0OTcwLFwiem9vXCI6XCJOY2N5clwiLFwienVmXCI6W1wienZ6Z1wiXSxcInF2cWdtXCI6NDIwLFwidmNlXCI6XCJhcHZjLDAsNXM5bzg0MXAsMywxO2ZnLDAsYXF2Y2V2YWNoZzAsMCxhcXZjZXZhY2hnMSwwO3NzLDAsYXF2Y2V2YWNoZzA7eHEsc3A7eHEsNG47eHEsNW87eHEsNjY7eHEsMjUzO3hxLDg1O3hxLHBxO3hxLDM4O3hxLDVuO3hxLDcyO3hxLDU2O3hxLDUyO3hxLDJwO3NvLG45LGFxdmNldmFjaGcwO3NzLDEsYXF2Y2V2YWNoZzE7eHEsMTI1O3hxLDQwO3hxLG82O3hxLDRyO3hxLG87Z3IscXMsNzcsMjM0LGFxdmNlcGJhZ2VieTBcIixcInpjemlcIjoxMixcInpvelwiOlwidkN1YmFyXCIsXCJ6Y3p2aVwiOjIsXCJ6ZmZcIjo0OTk5NjMxNzQ5MTIsXCJ6dW9wZlwiOi0xLFwiem9jXCI6XCJ2Q3ViYXIgS8qAXCIsXCJ6dmh2XCI6XCJjdWJhclwiLFwiZmVcIjpcIjE3OTJrODI4XCIsXCJoblwiOlwiMi4yLjEzODA2NVwiLFwiemh5XCI6XCJIRlwifSxcImpnXCI6XCIxLmotNDUxNjgwLjEuMi56U0dVQk56cHZNeUFoQjBOR2h2ZlRqLCwuM3hCRWhxSGhKZFREb1ZYY0hjYXJOSDUzVWFFS2t2amxNVF9RQTl5dUlYcWUwbV9iX0k0WWtBWGExUExTVXJzS1R4c0NFWHB2bkJjNkpEajhNTzhGZFVXMEcyaE9BWXZDRWZ5NXRLOHdJdVN4MzBnZmszZDF0MWhnc2NJODdFTG9MVlozNi1BcjhhV0pFSjJ1Ungza3RJYW5teDktOExZZmZsMWlFbVhSd1pqQ3FaQTVVMUZ1dzYzUERKZ2lIYzFUendFVjN3ak8yZDBrbUZIWUJaZTAxd0hnajVKQThTM0R6Z3FydE9pN1d3Q0VqZldZMHFITXFGT1g1d2RBYkl5LVNmOGVkYXBaeHNxaTItc0N6ejhRN2osLFwifSIsCiAgInNpZCIgOiAiMEE2NEE5QzMtQ0IzRS00NzI2LTgwMEItM0MzMzYzODZBQURCIgp9
            remoteIp:
              type: string
              description: The IP of user app to TP backend.
              minLength: 1
              maxLength: 255
              example: 127.0.0.1
            sessionId:
              type: string
              description: UUID which uniquely identifies a set of transactions being executed within the same authentication session.
              minLength: 36
              maxLength: 36
              example: da3fe5be-2a8e-11eb-adc1-0242ac120002
            userAgent:
              type: string
              description: The user-agent sent by the app to the TP backend.
              minLength: 1
              maxLength: 255
              example: 'Mozilla: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.3 Mozilla/5.0 (Macintosh; Intel Mac OS X x.y; rv:42.0) Gecko/20100101 Firefox/43.4.'
            xForwardedFor:
              type: string
              description: X-Forwarded-For header sent by the app to TP backend.
              minLength: 1
              maxLength: 255
              example: 203.0.113.195,70.41.3.18,150.172.238.178
            requestUrl:
              type: string
              description: The requested URL is hit by the app to the TP backend.
              pattern: ^(https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]+\.[^\s]{2,}|www\.[a-zA-Z0-9]+\.[^\s]{2,})$
              example: http://tp-backend.com/api/path
    ErrorResponse:
      required:
      - Errors
      type: object
      description: The error response model used by all the API endpoints.
      properties:
        Errors:
          required:
          - Error
          type: object
          description: The error response model used by all the API endpoints.
          properties:
            Error:
              type: array
              description: A list of Error objects.
              minItems: 1
              items:
                type: object
                properties:
                  Source:
                    type: string
                    description: The source of the problem. That is where the error occurred.
                    example: mids
                  ReasonCode:
                    type: string
                    description: A code defining the error, as defined in documentation.
                    example: USER_PROFILE_ID_NOT_FOUND
                  Description:
                    type: string
                    description: A description of this specific occurrence of the Reason code.
                    example: The provided user profile ID does not exist.
                  Recoverable:
                    type: boolean
                    description: Whether or not retrying this request could result in a successful response.
                    example: false
                  Details:
                    type: string
                    description: More details of this specific error. This is an optional field and is sometimes used to give a more comprehensive description of the error that has occurred, when required.
                    example: User X was not found
                  redirectUri:
                    type: string
                    description: TP will use this URI to redirect to RP.
                    pattern: ^(https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]+\.[^\s]{2,}|www\.[a-zA-Z0-9]+\.[^\s]{2,})$
                    example: https://sample-rp-redirect-uri.com/?error=invalid_scope&state=AJahbadinvjbdvdnvljkdnvdfhsrbghrtiu4w&ARID=1234&error_description=claim_not_satisfied
    SdkVersion:
      type: string
      description: Mastercard SDK version integrated with TP App, it is a constant extracted from MIDS SDK Configurations (generated while bundling SDK artifacts). If the TP app supports split PDS, this attribute MUST be specified.
      pattern: ^[0-9]{1,5}\.[0-9]{1,5}\.[0-9]{1,5}$
      minLength: 5
      maxLength: 255
      example: 2.3.0
    UserConsent:
      enum:
      - ACCEPT
      - DECLINE
      - REVOKE
      - EXPIRE
      type: string
      description: Confirmation provided by the TP that the user has consented that the ID-Network can have access to their identity for the purposes of the API call. Should be ACCEPT, a forbidden exception will be thrown if it is any other value.
      pattern: ^(ACCEPT|DECLINE|REVOKE|EXPIRE)$
      minLength: 6
      maxLength: 7
      example: ACCEPT
    VerifyAuthenticationDecisions:
      required:
      - countryCode
      - sdkVersion
      - pds
      - userProfileId
      - userConsent
      - privacyPolicyVersion
      type: object
      properties:
        countryCode:
          $ref: '#/components/schemas/CountryCode'
        sdkVersion:
          $ref: '#/components/schemas/SdkVersion'
        pds:
          $ref: '#/components/schemas/PDS'
        userProfileId:
          type: string
          description: UUID identifying the user, which the TP App generates using the MIDS Core SDK.
          pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
          example: df52649e-4096-456a-bca0-751ee470009f
        sdkAuthenticationDecision:
          type: boolean
          description: Flag indicating the result of Liveness detection conducted by the SDK. This can be retrieved from the MIDS Verification SDK.
          example: false
        userConsent:
          $ref: '#/components/schemas/UserConsent'
        scopedFields:
          type: array
          description: 'Array of enums representing the identity attributes which the TP is requesting access to.

            The acceptable values are any/all of: ''all'', ''legalName'', ''email'', ''phone'', ''dateOfBirth'', ''driverLicense'', ''passport'', ''address''

            '
          minItems: 1
          items:
            enum:
            - all - legalName - email - phone - dateOfBirth - selfie - address - ageOver - ageUnder - city - postalCode - subDivision - govtId - govtIdDetails - govtIdImage - passportIdentity - passportDetails - passportImage - driverLicenseIdentity - driverLicenseCardNumber - driverLicenseDetails - driverLicenseImage - driverLicenseIssuingState - visaMatched - cpf - rgNumber - cnh - mothersName - fathersName
            type: string
            example: all
        privacyPolicyVersion:
          type: string
          description: The version of the privacy policy which the API call is being conducted under, this can be retrieved from the MIDS Core SDK.
          minLength: 1
          maxLength: 20
          example: 1.0.0
        deviceInfo:
          $ref: '#/components/schemas/DeviceInfo'
        fraudDetection:
          $ref: '#/components/schemas/FraudDetection'
        arid:
          $ref: '#/components/schemas/ARID'
    AuthenticationDecisions:
      required:
      - transactionId
      - status
      - attributes
      - rotatedPds
      type: object
      properties:
        transactionId:
          type: string
          description: A random 128-bit UUID represents the MIDS transaction.
          minLength: 36
          maxLength: 36
          example: 1ec14310-e85c-11ea-adc1-0242ac120002
        status:
          type: string
          description: Status of the authentication.
          pattern: ^(SUCCESS|FAILURE)$
          minLength: 1
          maxLength: 50
          example: SUCCESS
        attributes:
          type: object
          description: Keys will be in RetrieveIdentities.scopedFields and data structure will be the data object named after the key.
          example:
            legalName:
              aa6dee5a-6e4d-4932-8189-2ecb7ad6f676:
                value: SMITH, JOHN
                lastVerifiedDate: '2022-04-04T02:49:27.915Z'
          additionalProperties: {}
          minLength: 1
        rotatedPds:
          type: string
          description: A rotated PDS is created and returned when the encryption key expires and a new key is generated.
          pattern: ^(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?$
          minLength: 1
          example: ZGZnZGVmZ2RnZGVnZXJnZXJncmRnZXJ5aGdld3J0eWJld3J5dHdleXd5d3l3cmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh
    ARID:
      type: string
      description: A unique identifier for any activity being executed arising out of a Claim Share request. This value is passed as a parameter in the URL redirecting a User to the TP Flow during a Claim Share.
      format: uuid
      pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
      minLength: 36
      maxLength: 36
      example: a15fa6de-b199-11eb-8529-0242ac130003
    DeviceInfo:
      description: Object containing the details of the device from which the enrollment is being conducted.
      required:
      - deviceAppId
      - make
      - model
      type: object
      properties:
        deviceAppId:
          type: string
          description: The device application ID is retrieved from the mobile SDK.
          minLength: 1
          maxLength: 255
          example: 599F9C00-92DC-4B5C-9464-7971F01F8370
        make:
          type: string
          description: The make of the mobile device.
          minLength: 1
          maxLength: 255
          example: Samsung
        model:
          type: string
          description: The model of the mobile device.
          minLength: 1
          maxLength: 255
          example: S8
    CountryCode:
      type: string
      description: The country code of the country where the transaction originates from.
      pattern: ^[a-zA-Z]{2}$
      example: US
  requestBodies:
    AuthenticationDecisionRequest:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/VerifyAuthenticationDecisions'
      required: true
  parameters:
    XEncryptedPayload:
      in: header
      name: X-Encrypted-Payload
      type: boolean
      description: 'An indicator that the request is encrypted or indicates that the client is able to receive an encrypted response. If not set, the payload will be treated as plaintext.

        '
      example: true
      schema: null
    ScanIdPathParameter:
      name: scan_id
      in: path
      description: Scan ID.
      example: 1234
      required: true
      schema:
        type: string
        pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
Mastercard Authentication API

Documentation

Specifications

Code Examples

Other Resources

OpenAPI Specification
