Mastercard

Mastercard Users API

The Users API from Mastercard — 21 operation(s) for users.

Documentation GitHub OpenAPI

Operations 25

DELETE /user-consents/{user_consent_id} Revoke user consent using an identifier #

GET /user-consents/{user_consent_id} Retrieve user consent by an identifier #

POST /user-profiles/identity-searches View an Identity #

POST /user-profiles Create a new user. #

DELETE /user-profiles Delete an Identity. #

POST /user-profiles/identity-attribute-deletions Delete Document. #

POST /user-account-activity-searches View identity lifecycle activities which have occurred in a time period. #

POST /claims/user-data-extractions Share an Identity with an External RP - Provide the PDS to enable ID for TP to determine if these satisfy an RPs scope request. #

POST /claims/user-consents Share an Identity with an External RP - Provide consent to share the identity attributes which satisfy an RPs scope request. #

POST /users Register a new user #

PUT /users Updates personal information for currently enrolled users (cardholders), including their name, contact information, security question, and more. #

GET /users/{user_guid}/virtual-card-accounts Retrieve a list of all virtual cards linked to a user #

POST /users/{user_guid}/virtual-card-accounts Register a virtual card linked to a user #

GET /users/{user_guid}/virtual-card-accounts/{account_guid} Retrieve virtual card account details linked to a user #

PUT /users/{user_guid}/virtual-card-accounts/{account_guid} Update virtual card account details linked to a user #

DELETE /users/{user_guid}/virtual-card-accounts/{account_guid} Delete a virtual card account linked to a user #

GET /users/{user_guid} Retrieve user details #

PUT /users/{user_guid} Update a user #

DELETE /users/{user_guid} Delete a user #

POST /users/{user_guid}/virtual-card-accounts/{account_guid}/tokens Register a token linked to a user and a virtual card #

GET /users/{user_guid}/virtual-card-accounts/{account_guid}/tokens/{token_guid} Retrieve token details linked to a user and a virtual card #

PUT /users/{user_guid}/virtual-card-accounts/{account_guid}/tokens/{token_guid} Update a token linked to a user and a virtual card #

DELETE /users/{user_guid}/virtual-card-accounts/{account_guid}/tokens/{token_guid} Delete a token linked to a user and a virtual card #

POST /users/{id}/verifications Verifies user #

GET /users/{id} Retrieves a cardholder's information, including their name, address, communication preferences, and more. Users are unique cardholders, as compared to Accounts that are unique card #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/mastercard-users-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Mastercard Users API
  version: '1.0'
  description: 'Operations tagged Users across 4 of this provider''s published API definitions: mastercard-authentication-consent-openapi.yml, mastercard-id-for-trust-providers-openapi.yml, mastercard-in-control-for-mobile-payments-openapi.yml, mastercard-user-account-management-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://mtf.api.identity.mastercard.co.in/aes
  description: India MTF server
- url: https://mtf.api.identity.mastercard.com/aes
  description: Global MTF server
- url: https://api.identity.mastercard.co.in/aes
  description: India Production server
- url: https://api.identity.mastercard.com/aes
  description: Global Production server
- url: https://api.mastercard.com/idservice
  description: Production server (uses USA live data).
- url: https://sandbox.api.mastercard.com/idservice
  description: Sandbox server (testing USA environment).
- url: https://api.mastercard.com.au/idservice
  description: Production server  (uses AUS live data).
- url: https://sandbox.api.mastercard.com.au/idservice
  description: Sandbox server (testing AUS environment).
- url: https://apiedge.mastercard.com/commercial
  description: Production Server
- url: https://mtf.apiedge.mastercard.com/commercial
  description: Sandbox Server
- url: https://sandbox.api.mastercard.com/loyalty/mrs
  description: Sandbox server
- url: https://api.mastercard.com/loyalty/mrs
  description: Production server
tags:
- name: Users
paths:
  /user-consents/{user_consent_id}:
    delete:
      operationId: revokeUserConsentById
      summary: Revoke user consent using an identifier
      description: A merchant/PSP can use this API to revoke the user consent for a user consent identifier (user_consent_id). Once the user consent is revoked (deleted), it will not be available via Retrieve User-Consent request.
      tags:
      - Users
      responses:
        '204':
          $ref: '#/components/responses/DeleteConsentsSuccess'
        '400':
          $ref: '#/components/responses/DeleteConsentsBadRequestError'
        '401':
          $ref: '#/components/responses/UnAuthorizedMerchantError'
        '404':
          $ref: '#/components/responses/ResourceNotFoundError'
      parameters:
      - $ref: '#/components/parameters/user_consent_id'
    get:
      operationId: getUserConsentById
      summary: Retrieve user consent by an identifier
      description: Retrieve the user consent by an identifier. A Merchants/PSP can use this API to check whether the user consent for the user_consent_id exist or not.
      tags:
      - Users
      parameters:
      - $ref: '#/components/parameters/user_consent_id'
      responses:
        '200':
          $ref: '#/components/responses/GetConsentsSuccess'
        '400':
          $ref: '#/components/responses/GetConsentsBadRequestError'
        '401':
          $ref: '#/components/responses/UnAuthorizedMerchantError'
        '404':
          $ref: '#/components/responses/ResourceNotFoundError'
    servers:
    - url: https://mtf.api.identity.mastercard.co.in/aes
      description: India MTF server
    - url: https://mtf.api.identity.mastercard.com/aes
      description: Global MTF server
    - url: https://api.identity.mastercard.co.in/aes
      description: India Production server
    - url: https://api.identity.mastercard.com/aes
      description: Global Production server
  /user-profiles/identity-searches:
    post:
      tags:
      - Users
      responses:
        '200':
          $ref: '#/components/responses/IdentitySearchResponse'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
      description: "Retrieve decrypted identities along with rotated PDS to present the user\nwith the registered identity in the TP app. Does not require a minimum authentication standard.   \n**This API is mandatory.**\n"
      summary: View an Identity
      operationId: retrieveIdentities
      parameters:
      - $ref: '#/components/parameters/XUserIdentityParameter'
      - $ref: '#/components/parameters/XEncryptedPayload'
      requestBody:
        $ref: '#/components/requestBodies/IdentitySearchRequest'
    servers:
    - url: https://api.mastercard.com/idservice
      description: Production server (uses USA live data).
    - url: https://sandbox.api.mastercard.com/idservice
      description: Sandbox server (testing USA environment).
    - url: https://api.mastercard.com.au/idservice
      description: Production server  (uses AUS live data).
    - url: https://sandbox.api.mastercard.com.au/idservice
      description: Sandbox server (testing AUS environment).
  /user-profiles:
    post:
      tags:
      - Users
      responses:
        '201':
          $ref: '#/components/responses/UserProfilesResponse'
        '400':
          $ref: '#/components/responses/BadRequestError'
      description: "- This endpoint registers a user profile using the given\n`user profile ID`.\n\n- An error will be returned if the user profile already exists.   \n**This API is mandatory.**\n"
      summary: Create a new user.
      operationId: createUserProfile
      requestBody:
        $ref: '#/components/requestBodies/UserProfilesRequest'
    delete:
      tags:
      - Users
      responses:
        '200':
          $ref: '#/components/responses/UserProfilesResponse'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
      description: "Enable TP app to mark user account as deleted on Mastercard ID Network. Requires GPA authentication.   \n**This API is mandatory.**\n"
      summary: Delete an Identity.
      operationId: deleteUserProfile
      parameters:
      - $ref: '#/components/parameters/UserProfileIdParameter'
      - $ref: '#/components/parameters/UserConsentParameter'
    servers:
    - url: https://api.mastercard.com/idservice
      description: Production server (uses USA live data).
    - url: https://sandbox.api.mastercard.com/idservice
      description: Sandbox server (testing USA environment).
    - url: https://api.mastercard.com.au/idservice
      description: Production server  (uses AUS live data).
    - url: https://sandbox.api.mastercard.com.au/idservice
      description: Sandbox server (testing AUS environment).
  /user-profiles/identity-attribute-deletions:
    post:
      tags:
      - Users
      responses:
        '200':
          $ref: '#/components/responses/IdentityAttributeDeletionsResponse'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
      description: "Delete an identity attribute from a PDS and update the affected assurance levels. Requires GPA authentication.   \n**This API is mandatory.**\n"
      summary: Delete Document.
      operationId: deleteIdentityAttribute
      parameters:
      - $ref: '#/components/parameters/XUserIdentityParameter'
      - $ref: '#/components/parameters/XEncryptedPayload'
      requestBody:
        $ref: '#/components/requestBodies/IdentityAttributeDeletionsRequest'
    servers:
    - url: https://api.mastercard.com/idservice
      description: Production server (uses USA live data).
    - url: https://sandbox.api.mastercard.com/idservice
      description: Sandbox server (testing USA environment).
    - url: https://api.mastercard.com.au/idservice
      description: Production server  (uses AUS live data).
    - url: https://sandbox.api.mastercard.com.au/idservice
      description: Sandbox server (testing AUS environment).
  /user-account-activity-searches:
    post:
      tags:
      - Users
      responses:
        '200':
          $ref: '#/components/responses/UserAccountActivitySearchesResponse'
        '400':
          $ref: '#/components/responses/BadRequestError'
        '401':
          $ref: '#/components/responses/UnauthorizedError'
        '403':
          $ref: '#/components/responses/ForbiddenError'
        '404':
          $ref: '#/components/responses/NotFoundError'
      description: 'Retrieve decrypted user activities and present them to the user in the

        TP app. Does not require a minimum authentication standard.

        **This API is mandatory.**

        '
      summary: View identity lifecycle activities which have occurred in a time period.
      operationId: retrieveUserActivities
      parameters:
      - $ref: '#/components/parameters/XUserIdentityParameter'
      - $ref: '#/components/parameters/XEncryptedPayload'
      requestBody:
        $ref: '#/components/requestBodies/UserAccountActivitySearchRequest'
    servers:
    - url: https://api.mastercard.com/idservice
      description: Production server (uses USA live data).
    - url: https://sandbox.api.mastercard.com/idservice
      description: Sandbox server (testing USA environment).
    - url: https://api.mastercard.com.au/idservice
      description: Production server  (uses AUS live data).
    - url: https://sandbox.api.mastercard.com.au/idservice
      description: Sandbox server (testing AUS environment).
  /claims/user-data-extractions:
    post:
      tags:
      - Users
      responses:
        '200':
          $ref: '#/components/responses/RPClaimsDataResponse'
        '400':
          $ref: '#/components/responses/BadRequestErrorClaimSharing'
        '404':
          $ref: '#/components/responses/NotFoundErrorClaimSharing'
      description: 'Returns the user information from the PDS that is requested by the

        Relying Party based on the ARID. Does not require a minimum authentication standard.

        **This API is mandatory.**

        '
      summary: Share an Identity with an External RP - Provide the PDS to enable ID for TP to determine if these satisfy an RPs scope request.
      operationId: extractClaimsUserData
      parameters:
      - $ref: '#/components/parameters/XEncryptedPayload'
      requestBody:
        $ref: '#/components/requestBodies/RPClaimsDataRequestData'
    servers:
    - url: https://api.mastercard.com/idservice
      description: Production server (uses USA live data).
    - url: https://sandbox.api.mastercard.com/idservice
      description: Sandbox server (testing USA environment).
    - url: https://api.mastercard.com.au/idservice
      description: Production server  (uses AUS live data).
    - url: https://sandbox.api.mastercard.com.au/idservice
      description: Sandbox server (testing AUS environment).
  /claims/user-consents:
    post:
      tags:
      - Users
      responses:
        '200':
          $ref: '#/components/responses/UserConsentResponse'
        '400':
          $ref: '#/components/responses/BadRequestErrorClaimSharing'
        '404':
          $ref: '#/components/responses/NotFoundErrorClaimSharing'
      description: "Inform the Trust Party about the user consent. If the consent is given,\nthe identity attributes will be shared with Relying Party. Does not require a minimum authentication standard. \n**This API is mandatory.**\n"
      summary: Share an Identity with an External RP - Provide consent to share the identity attributes which satisfy an RPs scope request.
      operationId: getUserConsentStatus
      requestBody:
        $ref: '#/components/requestBodies/UserConsentRequest'
    servers:
    - url: https://api.mastercard.com/idservice
      description: Production server (uses USA live data).
    - url: https://sandbox.api.mastercard.com/idservice
      description: Sandbox server (testing USA environment).
    - url: https://api.mastercard.com.au/idservice
      description: Production server  (uses AUS live data).
    - url: https://sandbox.api.mastercard.com.au/idservice
      description: Sandbox server (testing AUS environment).
  /users:
    post:
      tags:
      - Users
      summary: Register a new user
      description: This endpoint allows users to register a new user
      operationId: Users
      requestBody:
        $ref: '#/components/requestBodies/User'
      responses:
        '201':
          $ref: '#/components/responses/ResourceIdentifier'
        '400':
          $ref: '#/components/responses/BadRequestError_2'
        '401':
          $ref: '#/components/responses/UnauthorizedError_2'
        '403':
          $ref: '#/components/responses/ForbiddenError_2'
        '404':
          $ref: '#/components/responses/ResourceNotFoundError_2'
    put:
      tags:
      - Users
      summary: 'Updates personal information for currently enrolled users (cardholders), including their name, contact information, security question, and more.

        '
      description: Updates the existing user's demographic information.
      operationId: updateUser
      requestBody:
        $ref: '#/components/requestBodies/UserUpdateRequest'
      responses:
        '200':
          $ref: '#/components/responses/UserUpdateResponse'
        '400':
          $ref: '#/components/responses/ErrorsResponse'
    servers:
    - url: https://apiedge.mastercard.com/commercial
      description: Production Server
    - url: https://mtf.apiedge.mastercard.com/commercial
      description: Sandbox Server
  /users/{user_guid}/virtual-card-accounts:
    get:
      tags:
      - Users
      summary: Retrieve a list of all virtual cards linked to a user
      description: This endpoint allows users to retrieve a list of all virtual cards linked to a user
      operationId: findVcnCardsByUser
      parameters:
      - $ref: '#/components/parameters/userGUID'
      responses:
        '200':
          $ref: '#/components/responses/VirtualCards'
        '400':
          $ref: '#/components/responses/BadRequestError_2'
        '401':
          $ref: '#/components/responses/UnauthorizedError_2'
        '403':
          $ref: '#/components/responses/ForbiddenError_2'
        '404':
          $ref: '#/components/responses/ResourceNotFoundError_2'
    post:
      parameters:
      - $ref: '#/components/parameters/userGUID'
      tags:
      - Users
      summary: Register a virtual card linked to a user
      description: This endpoint allows users to register a virtual card linked to a user
      operationId: createVirtualCardWithControls
      requestBody:
        $ref: '#/components/requestBodies/NewVirtualCard'
      responses:
        '201':
          $ref: '#/components/responses/ResourceCreated'
        '400':
          $ref: '#/components/responses/BadRequestError_2'
        '401':
          $ref: '#/components/responses/UnauthorizedError_2'
        '403':
          $ref: '#/components/responses/ForbiddenError_2'
        '404':
          $ref: '#/components/responses/ResourceNotFoundError_2'
    servers:
    - url: https://apiedge.mastercard.com/commercial
      description: Production Server
    - url: https://mtf.apiedge.mastercard.com/commercial
      description: Sandbox Server
  /users/{user_guid}/virtual-card-accounts/{account_guid}:
    get:
      parameters:
      - $ref: '#/components/parameters/userGUID'
      - $ref: '#/components/parameters/accountGUID'
      tags:
      - Users
      summary: Retrieve virtual card account details linked to a user
      description: This endpoint allows users to retrieve virtual card account details linked to a user
      operationId: findVcnCardByUser
      responses:
        '200':
          $ref: '#/components/responses/VirtualCard'
        '400':
          $ref: '#/components/responses/BadRequestError_2'
        '401':
          $ref: '#/components/responses/UnauthorizedError_2'
        '403':
          $ref: '#/components/responses/ForbiddenError_2'
        '404':
          $ref: '#/components/responses/ResourceNotFoundError_2'
    put:
      parameters:
      - $ref: '#/components/parameters/userGUID'
      - $ref: '#/components/parameters/accountGUID'
      tags:
      - Users
      summary: Update virtual card account details linked to a user
      description: This endpoint allows users to update virtual card account details linked to a user
      operationId: updateUserCardAndControls
      requestBody:
        $ref: '#/components/requestBodies/UpdatedVirtualCard'
      responses:
        '200':
          $ref: '#/components/responses/OKResponse'
        '400':
          $ref: '#/components/responses/BadRequestError_2'
        '401':
          $ref: '#/components/responses/UnauthorizedError_2'
        '403':
          $ref: '#/components/responses/ForbiddenError_2'
        '404':
          $ref: '#/components/responses/ResourceNotFoundError_2'
    delete:
      tags:
      - Users
      summary: Delete a virtual card account linked to a user
      description: This endpoint allows users to delete a virtual card account linked to a user
      parameters:
      - $ref: '#/components/parameters/userGUID'
      - $ref: '#/components/parameters/accountGUID'
      operationId: deleteUserVirtualCard
      responses:
        '204':
          $ref: '#/components/responses/NOContentResponse'
        '400':
          $ref: '#/components/responses/BadRequestError_2'
        '401':
          $ref: '#/components/responses/UnauthorizedError_2'
        '403':
          $ref: '#/components/responses/ForbiddenError_2'
        '404':
          $ref: '#/components/responses/ResourceNotFoundError_2'
    servers:
    - url: https://apiedge.mastercard.com/commercial
      description: Production Server
    - url: https://mtf.apiedge.mastercard.com/commercial
      description: Sandbox Server
  /users/{user_guid}:
    get:
      tags:
      - Users
      summary: Retrieve user details
      description: This endpoint allows users to retrieve details of a particular user
      operationId: getUserById
      parameters:
      - $ref: '#/components/parameters/userGUID'
      responses:
        '200':
          $ref: '#/components/responses/User'
        '400':
          $ref: '#/components/responses/BadRequestError_2'
        '401':
          $ref: '#/components/responses/UnauthorizedError_2'
        '403':
          $ref: '#/components/responses/ForbiddenError_2'
        '404':
          $ref: '#/components/responses/ResourceNotFoundError_2'
    put:
      tags:
      - Users
      summary: Update a user
      description: This endpoint allows users to update details of a particular user
      operationId: updateUserById
      parameters:
      - $ref: '#/components/parameters/userGUID'
      requestBody:
        $ref: '#/components/requestBodies/User'
      responses:
        '200':
          $ref: '#/components/responses/OKResponse'
        '400':
          $ref: '#/components/responses/BadRequestError_2'
        '401':
          $ref: '#/components/responses/UnauthorizedError_2'
        '403':
          $ref: '#/components/responses/ForbiddenError_2'
        '404':
          $ref: '#/components/responses/ResourceNotFoundError_2'
    delete:
      tags:
      - Users
      summary: Delete a user
      description: This endpoint allows users to delete a particular user
      parameters:
      - $ref: '#/components/parameters/userGUID'
      operationId: deleteUser
      responses:
        '204':
          $ref: '#/components/responses/NOContentResponse'
        '400':
          $ref: '#/components/responses/BadRequestError_2'
        '401':
          $ref: '#/components/responses/UnauthorizedError_2'
        '403':
          $ref: '#/components/responses/ForbiddenError_2'
        '404':
          $ref: '#/components/responses/ResourceNotFoundError_2'
    servers:
    - url: https://apiedge.mastercard.com/commercial
      description: Production Server
    - url: https://mtf.apiedge.mastercard.com/commercial
      description: Sandbox Server
  /users/{user_guid}/virtual-card-accounts/{account_guid}/tokens:
    post:
      parameters:
      - $ref: '#/components/parameters/userGUID'
      - $ref: '#/components/parameters/accountGUID'
      tags:
      - Users
      summary: Register a token linked to a user and a virtual card
      description: This endpoint allows users to register a token linked to a user and a virtual card
      operationId: TokenCreate
      requestBody:
        $ref: '#/components/requestBodies/NewToken'
      responses:
        '201':
          $ref: '#/components/responses/ResourceCreated'
        '400':
          $ref: '#/components/responses/BadRequestError_2'
        '401':
          $ref: '#/components/responses/UnauthorizedError_2'
        '403':
          $ref: '#/components/responses/ForbiddenError_2'
        '404':
          $ref: '#/components/responses/ResourceNotFoundError_2'
    servers:
    - url: https://apiedge.mastercard.com/commercial
      description: Production Server
    - url: https://mtf.apiedge.mastercard.com/commercial
      description: Sandbox Server
  /users/{user_guid}/virtual-card-accounts/{account_guid}/tokens/{token_guid}:
    get:
      parameters:
      - $ref: '#/components/parameters/userGUID'
      - $ref: '#/components/parameters/accountGUID'
      - $ref: '#/components/parameters/tokenGUID'
      tags:
      - Users
      summary: Retrieve token details linked to a user and a virtual card
      description: This endpoint allows users to retrieve token details linked to a user and a virtual card
      operationId: getTokenById
      responses:
        '200':
          $ref: '#/components/responses/Token'
        '400':
          $ref: '#/components/responses/BadRequestError_2'
        '401':
          $ref: '#/components/responses/UnauthorizedError_2'
        '403':
          $ref: '#/components/responses/ForbiddenError_2'
        '404':
          $ref: '#/components/responses/ResourceNotFoundError_2'
    put:
      tags:
      - Users
      parameters:
      - $ref: '#/components/parameters/userGUID'
      - $ref: '#/components/parameters/accountGUID'
      - $ref: '#/components/parameters/tokenGUID'
      summary: Update a token linked to a user and a virtual card
      description: This endpoint allows users to update a token linked to a user and a virtual card
      operationId: updateTokenById
      requestBody:
        $ref: '#/components/requestBodies/UpdatedToken'
      responses:
        '200':
          $ref: '#/components/responses/OKResponse'
        '400':
          $ref: '#/components/responses/BadRequestError_2'
        '401':
          $ref: '#/components/responses/UnauthorizedError_2'
        '403':
          $ref: '#/components/responses/ForbiddenError_2'
        '404':
          $ref: '#/components/responses/ResourceNotFoundError_2'
    delete:
      tags:
      - Users
      parameters:
      - $ref: '#/components/parameters/userGUID'
      - $ref: '#/components/parameters/accountGUID'
      - $ref: '#/components/parameters/tokenGUID'
      summary: Delete a token linked to a user and a virtual card
      description: This endpoint allows users to delete a token linked to a user and a virtual card
      operationId: deleteTokenById
      responses:
        '204':
          $ref: '#/components/responses/NOContentResponse'
        '400':
          $ref: '#/components/responses/BadRequestError_2'
        '401':
          $ref: '#/components/responses/UnauthorizedError_2'
        '403':
          $ref: '#/components/responses/ForbiddenError_2'
        '404':
          $ref: '#/components/responses/ResourceNotFoundError_2'
    servers:
    - url: https://apiedge.mastercard.com/commercial
      description: Production Server
    - url: https://mtf.apiedge.mastercard.com/commercial
      description: Sandbox Server
  /users/{id}/verifications:
    post:
      tags:
      - Users
      summary: Verifies user
      description: Verify user based on answers to the security questions.
      operationId: verifyUser
      parameters:
      - $ref: '#/components/parameters/UserId'
      - $ref: '#/components/parameters/VerifyUsersIdType'
      x-mastercard-api-encrypted: true
      requestBody:
        $ref: '#/components/requestBodies/VerifyUserRequest'
      responses:
        '200':
          $ref: '#/components/responses/VerifyUserResponse'
        '400':
          $ref: '#/components/responses/ErrorsResponse'
    servers:
    - url: https://sandbox.api.mastercard.com/loyalty/mrs
      description: Sandbox server
    - url: https://api.mastercard.com/loyalty/mrs
      description: Production server
  /users/{id}:
    get:
      tags:
      - Users
      summary: 'Retrieves a cardholder''s information, including their name, address, communication preferences, and more.

        Users are unique cardholders, as compared to Accounts that are unique cards. Each User can have multiple Accounts.'
      description: Retrieves Cardholder information.
      operationId: getUser
      parameters:
      - $ref: '#/components/parameters/UserId'
      - $ref: '#/components/parameters/UsersIdType'
      - $ref: '#/components/parameters/IncludeVerificationDetails'
      - $ref: '#/components/parameters/Language'
      responses:
        '200':
          $ref: '#/components/responses/UserDetailsResponse'
        '400':
          $ref: '#/components/responses/ErrorsResponse'
    servers:
    - url: https://sandbox.api.mastercard.com/loyalty/mrs
      description: Sandbox server
    - url: https://api.mastercard.com/loyalty/mrs
      description: Production server
components:
  parameters:
    user_consent_id:
      in: path
      name: user_consent_id
      required: true
      schema:
        type: string
        minLength: 36
        maxLength: 36
      description: User Consent Identifier
      example: 2c0743c0-fe6a-41a6-88c4-2c94786fb9c2
    XEncryptedPayload:
      in: header
      name: X-Encrypted-Payload
      type: boolean
      description: 'An indicator that the request is encrypted or indicates that the client is able to receive an encrypted response. If not set, the payload will be treated as plaintext.

        '
      example: true
      schema: null
    UserProfileIdParameter:
      name: user_profile_id
      in: query
      description: UUID identifying the user, which the TP App generates using the MIDS Core SDK.
      example: ee13a7ec-5a5a-4618-a55d-5e1ed016ccd5
      required: true
      schema:
        type: string
        pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
    XUserIdentityParameter:
      in: header
      name: X-User-Identity
      example: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
      description: 'JWT token for session validation. Returned as response header in previous API calls with key X-User-Identity.

        '
      schema:
        type: string
    UserConsentParameter:
      name: user_consent
      in: query
      description: Confirmation provided by the TP that the user has consented that the ID-Network can have access to their identity for the purposes of the API call. Should be ACCEPT, a forbidden exception will be thrown if it is any other value.
      example: ACCEPT
      required: true
      schema:
        type: string
        pattern: ^(ACCEPT|DECLINE|REVOKE|EXPIRE)$
    accountGUID:
      name: account_guid
      in: path
      description: The globally unique identifier of the card being queried
      required: true
      schema:
        $ref: '#/components/schemas/ResourceIdentifier'
      example: 8f242496-b71a-11eb-8529-0242ac130003
    tokenGUID:
      name: token_guid
      in: path
      description: The globally unique identifier of the token being queried
      required: true
      schema:
        $ref: '#/components/schemas/ResourceIdentifier'
      example: 8f242496-b71a-11eb-8529-0242ac130003
    userGUID:
      name: user_guid
      in: path
      description: The globally unique identifier of the user being queried
      required: true
      schema:
        $ref: '#/components/schemas/ResourceIdentifier'
      example: 8f242496-b71a-11eb-8529-0242ac130003
    UserId:
      name: id
      in: path
      description: The unique identifier for the given user.
      required: true
      schema:
        type: string
      example: '268810378058708149455458707247'
    VerifyUsersIdType:
      name: user_id_type
      in: query
      description: Determines the type of user or account identification. Supported identifiers are RANAC or RANCU.
      required: true
      schema:
        type: string
      example: RANCU
    IncludeVerificationDetails:
      name: include_verification_details
      in: query
      description: Cardholder verification details are included in the response if true.
      required: false
      schema:
        type: boolean
      example: true
    Language:
      name: language
      in: query
      description: Cardholder verification details are returned in the language requested.
      required: false
      schema:
        type: string
      example: en_US
    UsersIdType:
      name: user_id_type
      in: query
      description: Determines the type of user or account identification. Supported identifiers are RANAC or RANCU.
      required: false
      schema:
        type: string
      example: RANCU
  schemas:
    Error:
      type: object
      required:
      - Source
      - ReasonCode
      - Recoverable
      properties:
        Source:
          type: string
          description: The application that generated this error. <br>Possible values = GATEWAY/AUTHENTICATION_CONSENT_SERVICE
          example: AUTHENTICATION_CONSENT_SERVICE
          minLength: 1
          maxLength: 50
        ReasonCode:
          type: string
          description: A unique constant identifying the error case encountered during transaction processing
          example: resource.not.found
          minLength: 1
          maxLength: 100
        Description:
          type: string
          description: Description of the 'ReasonCode' field with additional details
          example: The requested resource does not exist
          minLength: 0
          maxLength: 500
        Recoverable:
          type: boolean
          description: Indicates whether this error will always be returned for this request, or retrying with same value could change the outcome. For example, if the request contains an invalid signature, retrying will never result in a success. However, if the error is related to some unexpected timeout with the service, retrying the call could result in a successful response.
          example: false
        Details:
          type: string
          description: Could be null, present for backwards compatibility or extra information
          example: The provided acctNumber did not pass the Mod10 validation
          minLength: 0
          maxLength: 500
    ErrorResponse:
      type: object
      required:
      - Errors
      properties:
        Errors:
          type: object
          required:
          - Error
          properties:
            Error:
              $ref: '#/components/schemas/Errors'
    Errors:
      type: array
      minItems: 1
      items:
        $ref: '#/components/schemas/Error'
    UserConsent:
      type: object
      description: The user consent resource
      required:
      - userConsentId
      - consentLanguageId
      - consentedDate
      properties:
        userConsentId:
          type: string
          description: User consent Identifier, generated at the time of store consent API to track the user consents.
          example: 2c0743c0-fe6a-41a6-88c4-2c94786fb9c2
          minLength: 36
          maxLength: 36
        consentLanguageId:
          type: string
          description: Unique Id for a specific consent language text. This Id will be available through GET consent-languages API.
          example: 75c4f996-1910-420f-b82b-fcc3e5196b99
          minLength: 36
          maxLength: 36
        consentedDate:
          type: string
          format: YYYYMMDDHHMMSS
          description: Consented date (in UTC) at which the user is consented.
          example: '20200223000001'
          minLength: 14
          maxLength: 14
    ErrorResponse_2:
      required:
      - Errors
      type: object
      description: The error response model used by all the API endpoints.
      properties:
        Errors:
          required:
      

# --- truncated at 32 KB (144 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mastercard/refs/heads/main/openapi/mastercard-users-api-openapi.yml

Mastercard Users API

Operations 25

Documentation

Specifications

Code Examples

Other Resources