MPP (Machine Payment Protocol) token provisioning and encrypted credential generation. Use these APIs to provision encrypted payment credentials for use in MPP Authorization Payment headers. Accepts an instrument identifier and merchant challenge context, returns RSA-OAEP encrypted token payloads.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/national-australia-bank:national-australia-bank-credentials-api"curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
description: All CyberSource API specs merged together. These are available at https://developer.cybersource.com/api/reference/api-reference.html
version: 0.0.1
title: CyberSource Merged Spec Credentials API
servers:
- url: https://apitest.cybersource.com/
tags:
- name: Credentials
description: MPP (Machine Payment Protocol) token provisioning and encrypted credential generation. Use these APIs to provision encrypted payment credentials for use in MPP Authorization Payment headers. Accepts an instrument identifier and merchant challenge context, returns RSA-OAEP encrypted token payloads.
paths:
/icc/v1/mpp/credentials:
post:
tags:
- Credentials
summary: Provision MPP credentials
description: 'Provisions an encrypted MPP credential for use as the credential payload in an Authorization: Payment header (MPP spec Section 8.2).
The caller provides an instrument identifier (referencing a stored card in TMS) and the challenge context from the merchant''s 402 response, including the merchant''s RSA public encryption key.
This service:
1. Calls TMS to retrieve the network token and cryptogram for the instrument.
2. Builds the token plaintext (MPP spec Section 8.3, type: network_token).
3. Encrypts the plaintext using RSA-OAEP with SHA-256 and the merchant''s public key.
4. Returns the MPP credential payload fields (MPP spec Section 8.2, Table 4).'
operationId: provisionMppCredentials
responses:
'200':
description: OK
content:
application/hal+json;charset=utf-8:
schema:
title: mppCredentialsResponse200
type: object
required:
- token
- network
- lastFour
- expirationMonth
- expirationYear
- dynamicData
- eci
- paymentAccountReference
description: 'MPP payment credentials response. The ''token'' field Contains the RSA-OAEP encrypted network token ciphertext. All other fields are display-only metadata.
'
properties:
token:
type: string
description: Base64-encoded RSA-OAEP encrypted token ciphertext. Must not be parsed by client/server — forwarded opaquely to the Server Enabler.
network:
type: string
description: "Card network.\nPossible values:\n - `visa`\n - `mastercard`\n - `amex`\n - `discover`\n"
lastFour:
type: string
minLength: 4
maxLength: 4
description: Last four digits of the card number as displayed to cardholder.
expirationMonth:
type: string
minLength: 2
maxLength: 2
description: Token expiration month (e.g., '06'). Display only.
expirationYear:
type: string
minLength: 4
maxLength: 4
description: Token expiration year, four digits (e.g., '2028'). Display only.
dynamicData:
type: string
description: Base64-encoded cryptogram from TSP. Present only for network_token type. Display only.
eci:
type: string
description: Electronic Commerce Indicator (e.g., '05', '07'). Present only for network_token type. Display only.
paymentAccountReference:
type: string
description: Payment Account Reference — a stable reference to the underlying funding account.
'400':
description: Bad Request
content:
application/hal+json;charset=utf-8:
schema:
title: mppCredentialsBadRequestResponse400
type: object
properties:
error:
type: object
description: Error response object.
required:
- status
- reason
- message
properties:
status:
type: string
description: HTTP status code to categorize the errors.
reason:
type: string
description: Error reason as associated with the HTTP status code
message:
type: string
description: Error message as associated with the HTTP status code.
detail:
type: object
description: Additional details about the error.
properties:
reason:
type: string
description: Detailed reason for the error.
source:
type: string
description: Source for the error
sourceType:
type: string
description: Detail about source for the error
message:
type: string
description: Detailed message for the error
'401':
description: Unauthorized
content:
application/hal+json;charset=utf-8:
schema:
title: mppCredentialsUnauthorizedResponse401
type: object
properties:
error:
type: object
description: Error response object.
required:
- status
- reason
- message
properties:
status:
type: string
description: HTTP status code to categorize the errors.
reason:
type: string
description: Error reason as associated with the HTTP status code
message:
type: string
description: Error message as associated with the HTTP status code.
detail:
type: object
description: Additional details about the error.
properties:
reason:
type: string
description: Detailed reason for the error.
source:
type: string
description: Source for the error
sourceType:
type: string
description: Detail about source for the error
message:
type: string
description: Detailed message for the error
'403':
description: Forbidden
content:
application/hal+json;charset=utf-8:
schema:
title: mppCredentialsForbiddenResponse403
type: object
properties:
error:
type: object
description: Error response object.
required:
- status
- reason
- message
properties:
status:
type: string
description: HTTP status code to categorize the errors.
reason:
type: string
description: Error reason as associated with the HTTP status code
message:
type: string
description: Error message as associated with the HTTP status code.
detail:
type: object
description: Additional details about the error.
properties:
reason:
type: string
description: Detailed reason for the error.
source:
type: string
description: Source for the error
sourceType:
type: string
description: Detail about source for the error
message:
type: string
description: Detailed message for the error
'404':
description: Not Found
content:
application/hal+json;charset=utf-8:
schema:
title: mppCredentialsNotFoundResponse404
type: object
properties:
error:
type: object
description: Error response object.
required:
- status
- reason
- message
properties:
status:
type: string
description: HTTP status code to categorize the errors.
reason:
type: string
description: Error reason as associated with the HTTP status code
message:
type: string
description: Error message as associated with the HTTP status code.
detail:
type: object
description: Additional details about the error.
properties:
reason:
type: string
description: Detailed reason for the error.
source:
type: string
description: Source for the error
sourceType:
type: string
description: Detail about source for the error
message:
type: string
description: Detailed message for the error
'500':
description: Internal Server Error
content:
application/hal+json;charset=utf-8:
schema:
title: mppCredentialsInternalServerErrorResponse500
type: object
properties:
error:
type: object
description: Error response object.
required:
- status
- reason
- message
properties:
status:
type: string
description: HTTP status code to categorize the errors.
reason:
type: string
description: Error reason as associated with the HTTP status code
message:
type: string
description: Error message as associated with the HTTP status code.
detail:
type: object
description: Additional details about the error.
properties:
reason:
type: string
description: Detailed reason for the error.
source:
type: string
description: Source for the error
sourceType:
type: string
description: Detail about source for the error
message:
type: string
description: Detailed message for the error
requestBody:
content:
application/json;charset=utf-8:
schema:
required:
- instrumentId
- challenge
type: object
description: Request object for provisioning an MPP payment token.
properties:
instrumentId:
type: string
minLength: 1
description: TMS instrument identifier referencing the stored card.
challenge:
required:
- id
- realm
- amount
- currency
- acceptedNetworks
- merchantId
- merchantName
- encryption_jwk
type: object
description: MPP challenge context received from the merchant's 402 response.
properties:
id:
type: string
minLength: 1
description: Unique challenge identifier issued by the merchant server.
realm:
type: string
minLength: 1
description: Merchant realm (typically the API domain).
amount:
type: string
minLength: 1
description: Amount in the smallest currency unit (e.g., '4999' = $49.99).
currency:
type: string
minLength: 3
maxLength: 3
description: Three-letter ISO 4217 currency code, lowercase (e.g., 'usd').
acceptedNetworks:
type: array
description: Card networks accepted by the merchant (e.g., ['visa', 'mastercard']).
items:
type: string
merchantId:
type: string
minLength: 1
description: Merchant identifier (maps to 'recipient' in MPP spec request object).
merchantName:
type: string
minLength: 1
description: Human-readable merchant name.
encryption_jwk:
required:
- kty
- kid
- use
- alg
- n
- e
type: object
description: Merchant RSA public encryption key as a JSON Web Key (JWK, RFC 7517). Must be RSA (kty=RSA), alg=RSA-OAEP-256, use=enc. Used to encrypt the token payload using RSA-OAEP with SHA-256 per MPP spec Section 7.4.
properties:
kty:
type: string
minLength: 1
description: Key type. MUST be 'RSA'.
kid:
type: string
minLength: 1
description: Key ID. Identifies the key within a JWKS.
use:
type: string
minLength: 1
description: Public key use. MUST be 'enc'.
alg:
type: string
minLength: 1
description: Algorithm. MUST be 'RSA-OAEP-256'.
n:
type: string
minLength: 1
description: RSA modulus (Base64urlUInt-encoded per RFC 7518 Section 6.3.1.1).
e:
type: string
minLength: 1
description: RSA public exponent (Base64urlUInt-encoded per RFC 7518 Section 6.3.1.2).
example:
instrumentId: 459F91C888E1ED0EE063AF598E0AA44D
challenge:
id: ch_9xK2mR4vB7nQ
realm: api.merchant.com
amount: '1200'
currency: USD
acceptedNetworks:
- visa
merchantId: merch_abc123
merchantName: acme_corp
encryption_jwk:
kty: RSA
kid: test-enc-key-01
use: enc
alg: RSA-OAEP-256
n: sEpiOr0VIbr20jGqJ0DUjdmbyhpr_kJ30e661yFv0z4epiPH1UEnAK4w6Ja9RDWZXY4usRYtAoFc3FihpOWEaAjjm6doqCQTn4Re2eiekeBtTZje6kZL7OZxoI3LGeInySfMzVYltySmEJIDyn_TF9npIQFcDItHVhhxDqkHuCI6MrWqQyyOXjacZaHUDcvhidyxRELlALWA_2xdGpR6kWknqqf0gQCWx-3jCfDoI3BQLUDdKDK700ptbuDT-ThCabGAw7TYJQu2lT1nIWpxzH-3kyvZwiCTYYsCh2lrv_aaO3gskKMqWZJBgJwjF0AVDc7mUOvttxibxz2LsnZDhQIDAQAB
e: AQAB
required: true