NovoPayment MasterCard Tokenization API

---
openapi: 3.0.0
info:
  title: MasterCard Tokenization API
  description: >
    ## Introduction ##

    NovoPayment, as a Token Service Provider, has a collection of APIs that
    enables Issuers to participate in the Tokenization ecosystem; we are
    responsible for the interaction between the Issuer and the franchises.


    Providing security in the process, ease of implementation and support for
    your development teams throughout the project.


    The integration between the Issuer and this portfolio services are with API
    Rest, all these services are useful for the Issuer, who is responsible for
    providing the cards and carrying out the process of validation and approval
    of the tokens.


    The set of APIs that the Issuer needs to develop are listed below, depending
    on the relation between Novo and the client.


    When an issuer is a client of our issuance services, the verification and
    approval processes are performed by us. For that reason, only need to develop

    this set of APIs:
    - [Send Verification Verify Code](ToDo_URL_SendVerifyCode)

    - [Notification](ToDo_Notification)

    ## Headers Params ##
    
    **Header fields**
    
    | Name             | Description                                                  | Value                                | Required/Optional/Conditional |

    |------------------|--------------------------------------------------------------|--------------------------------------|-------------------------------|

    | Accept-Language | Language used.                                              | en                                   | Required                      |

    | Content-Type    | Response body type. Operation related information.          | application/json                    | Required                      |

    | Accept          | Content types that are acceptable related to this operation.| application/json                    | Conditional                   |

    | Authorization   | Application authentication information based on the RFC6750 OAUTH 2 specification, under the client’s credentials. | 'Bearer ' + accesToken        | Required                      |

    | X-Token         | Application authentication information based on the RFC7515 JWS under petition signature. | 'JWS ' + token               | Required                      |

    | X-Tenant-Id     | Identifies the tenant that is calling the operation.        | < tenantId >                          | Required                      |

    | X-Time-Zone     | Time Zone of the request.                                    | < timeZone >                          | Optional                      |

    | X-Request-Id   | Unique ID for the API request. This ID is the reference in all the API’s processes. | String (1-36)                 | Optional                      |

    _**Note:**_

    _The issuer must give to NovoPayment the RSA encryption certificates for JWE

    and JWS. In addition, NovoPayment will give the corresponding certificates

    to the issuer._
    
  version: v2.0
tags:
  - name: Tokenization Process
  - name: Life Cycle Management
#  
#Tokenization Process Endpoints
servers:
  - description: Certification
    url: https://[URLIssuer]/v2
paths:
  /sendverifycode:
    post:
      servers:
        - description: External
          url: "https://[URLIssuer]"
      tags:
        - Tokenization Process
      summary: Send Verify Code
      description: |
        Our endpoint empowers issuers to seamlessly receive and deliver a One-Time Password (OTP) to cardholders. 
        This temporary verification code is essential for cardholders to confirm their identity when registering 
        their card with merchants, ensuring a secure and smooth transaction experience. 
        
      operationId: SendVerifyCode
      requestBody:
        $ref: "#/components/requestBodies/RQSendVerifyCode"
      responses:
        "200":
          $ref: "#/components/responses/RSFromIssuer_200"
        "400":
          $ref: "#/components/responses/RSFromIssuer_400"
        "401":
          $ref: "#/components/responses/RSInvalidSignature"
        "500":
          $ref: "#/components/responses/RSInternalServerError" 
  /notifications/serviceactivated:
    post:
      servers:
        - description: External
          url: "https://[URLIssuer]"
      tags:
        - Tokenization Process
      summary: Notifications Service Activated
      description: |
        The Issuer exposes this endpoint to receive the notifications about token’s creation. 
        
      operationId: serviceactivated
      requestBody:
        $ref: "#/components/requestBodies/RQNotServiceActivated"
      responses:
        "200":
          $ref: "#/components/responses/RSFromIssuer_200"
        "400":
          $ref: "#/components/responses/RSFromIssuer_400"
        "401":
          $ref: "#/components/responses/RSInvalidSignature"
        "500":
          $ref: "#/components/responses/RSInternalServerError"
  /notifications/tokenupdated:
    post:
      servers:
        - description: External
          url: "https://[URLIssuer]"
      tags:
        - Tokenization Process
      summary: Notifications about Token Updated
      description: |
        The Issuer exposes this endpoint to receive notifications about the token’s status changes.
          Available Types:
          REDIGITIZATION_COMPLETE
          DELETED_FROM_CONSUMER_APP
          STATUS_UPDATE    
      operationId: tokenupdated
      requestBody:
        $ref: "#/components/requestBodies/RQNotTokenUpdated"
      responses:
        "200":
          $ref: "#/components/responses/RSFromIssuer_200"
        "400":
          $ref: "#/components/responses/RSFromIssuer_400"
        "401":
          $ref: "#/components/responses/RSInvalidSignature"
        "500":
          $ref: "#/components/responses/RSInternalServerError"
  /notifications/suspiciousevents:
    post:
      servers:
        - description: External
          url: "https://[URLIssuer]"
      tags:
        - Tokenization Process
      summary: Notifications about Suspicious Events
      description: |
        The Issuer exposes this endpoint to receive notifications 
        about the token when any suspicious events are detected.
      operationId: suspiciousevents
      requestBody:
        $ref: "#/components/requestBodies/RQNotSuspiciousEvents"
      responses:
        "200":
          $ref: "#/components/responses/RSFromIssuer_200"
        "400":
          $ref: "#/components/responses/RSFromIssuer_400"
        "401":
          $ref: "#/components/responses/RSInvalidSignature"
        "500":
          $ref: "#/components/responses/RSInternalServerError"
  
security:
  - oAuth2ClientCredentials: []
components:
  securitySchemes:
    oAuth2ClientCredentials:
      type: oauth2
      description: >
        See [Oauth2
        API](https://developer.novopayment.com/api/authentication-method-and-encryption/oauth2-api)
      flows:
        clientCredentials:
          tokenUrl: https://sandbox-api.novopayment.com/oauth2/token
          scopes: {}
  
  examples:
    HeaderParamsRequired:
      value:
        code: 400.22.001
        message: Header Params Required
        datetime: "2022-04-25T23:19:12.000Z"
    JWEInvalidFormat:
      value:
        code: 400.22.002
        message: JWE Invalid format
        datetime: "2022-04-25T23:19:12.000Z"
    InvalidTenantID:
      value:
        code: 400.22.004
        message: Invalid Tenant ID
        datetime: "2022-04-25T23:19:12.000Z"
    UnableProcessRequest:
      value:
        code: 400.22.324
        message: We were unable to process your request
        datetime: "2022-04-25T23:19:12.000Z"
    IntegrationError:
      value:
        code: 400.22.376
        message: Integration Error
        datetime: "2022-04-25T23:19:12.000Z"
    InvalidAccessToken:
      value:
        code: 401.22.990
        message: Invalid Access Token
        datetime: "2022-04-25T23:19:12.000Z"
    AccessTokenNotApproved:
      value:
        code: 401.22.991
        message: Access Token not approved
        datetime: "2022-04-25T23:19:12.000Z"
    InvalidSignature:
      value:
        code: 401.22.992
        message: Invalid signature
        datetime: "2022-04-25T23:19:12.000Z"
    AccessTokenExpired:
      value:
        code: 401.22.993
        message: Access token expired
        datetime: "2022-04-25T23:19:12.000Z"
    InternalServerError:
      value:
        code: 500.22.999
        message: Internal Server Error
        datetime: "2022-04-25T23:19:12.000Z"
    HeaderParamsRequiredTk:
      value:
        code: 400.22.001
        message: Header Params Required
        datetime: "2022-04-25T23:19:12.000Z"
    ErrorGeneralService:
      value:
        code: 400.22.350
        message: Error General Service.
        datetime: "2022-04-25T23:19:12.000Z"
    InvalidParams:
      value:
        code: 400.22.396
        message: Invalid parameters.
        datetime: "2024-07-17T00:57:36.360Z"
    ConfigurationNotFound:
      value:
        code: 400.22.356
        message: Component configuration not found.
        datetime: "2024-07-17T00:57:36.360Z"
    EncryptionError:
      value:
        code: 400.22.994
        message: Encryption error
        datetime: "2024-07-17T00:57:36.360Z"
    InvalidSignatureTk:
      value:
        code: 401.22.992
        message: Invalid signature
        datetime: "2024-07-17T00:57:36.360Z"         
    DecryptionError:
      value:
        code: 401.22.997
        message: Decryption Error
        datetime: "2024-07-17T00:57:36.360Z"    
    InternalServerErrorTk:
      value:
        code: 500.22.999
        message: Internal Server Error
        datetime: "2022-04-25T23:19:12.000Z"
    InvalidadCardId:
      value:
        code: 400.22.009
        message: Invalid Card Id
        datetime: "2022-04-25T23:19:12.000Z"
    ParamsRequired:
      value:
        code: 400.22.324
        message: We were unable to process your request
        datetime: "2022-04-25T23:19:12.000Z"
        data: >
               "fieldName":
                [
                 "reasonCodes",
                 "tokenUniqueReference"
                ]
    RQNotServiceActivated:
      value:
        requestId: 808808080808
        reasonCode: SERVICE_ACTIVATED
        dateTime: 2026-07-04T19:08:56.123Z
        notificationBody: 
          services: [DIGITIZATION]
          correlationId: D98765432104
          decision: APPROVED
          decisionMadeBy: RULES
          tokenActivatedDateTime: 2022-04-25T23:19:12.000Z
          numberOfActivationAttempts: RULES
          numberOfActiveTokens: 0
          tokenAssuranceLevel: 0
          tokenInformation: 
            source: ON_FILE
            tokenType: ECOM
            tokenUniqueReference: DWSPMC000000000132d72d4fcb2f4136a0532d3093ff1a45
            tokenRequestorId: 40022358888
            accountPanSuffix: 1234
            serviceRequestDateTime: 2015-07-04T12:08:56.123-07:00
            panUniqueReference: FWSPMC000000000159f71f703d2141efaf04dd26803f922b
            tokenRequestorName: My Merchant
            cardId: 5DA...27
            walletId: 123
            paymentAppInstanceId: 1b24f24a24ba98e27d43e345b532a245e4723d7a9c4f624e
            secureElementId: 1b24f24a24ba98e27d43e345b532a245e4723d7a9c4f624e93452c            
            termsAndConditionsAssetId: a9f027e5-629d-11e3-949a-0800200c9a66
            termsAndConditionsAcceptedTimestamp: 2015-07-04T12:09:56.123-07:00
            productConfigurationId: 1234
            consumerLanguage: en
            encryptedPayload: 
              source: ON_FILE
              dataValidUntilTimestamp: 2015-07-04T12:09:56.123-07:00
              cardAccountData: 
                accountNumber: 5808123456789808
                expiryMonth: 12
                expiryYear: 15
                securityCode: 808
              financialAccountData: 
                financialAccountId: 5123456789012345
                interbankCardAssociationId: 1234
                countryCode: GBR
              tokenData: 
                token: 5345678901234521
                expiryMonth: 12
                expiryYear: 15
                sequenceNumber: 01
              paymentAccountReference: 512381d9f8e0629211e3949a08002
              accountHolderData: 
                accountHolderName: John Doe
                accountHolderEmailAddress: abcdef@xyz.com
                accountHolderMobilePhoneNumber: 
                  countryDialInCode: 1
                  phoneNumber: 4692392391
                accountHolderAddress: 
                  line1: 100 1st Street
                  line2: Apt. 4B
                  city: St. Louis
                  countrySubdivision: MO
                  postalCode: 61000
                  country: USA
                sourceIp: 127.0.0.1
                deviceLocation: 38.63/-90.2
                consumerIdentifier: 1b24f24a24ba98e27d43e345b532a245e4723d7a9c4f624e93452c1b24f24a24b
    
    RQNotificationRedigitizationComplete:
      value:  
          requestId: 808808080808
          reasonCode: REDIGITIZATION_COMPLETE
          dateTime: 2026-07-04T19:08:56.123Z
          notificationBody: 
            tokens:              
              - tokenUniqueReference: DWSPMC000000000132d72d4fcb2f4136a0532d3093ff1a45
                tokenRequestorId: 40022358888
                tokenRequestorName: My Merchant
                cardId: 5DA...27
                tokenExpiry: 0721
                encryptedPayload: 
                  panUniqueReference: FWSPMC000000000159f71f703d2141efaf04dd26803f922b
                  dataValidUntilTimestamp: 2015-07-04T12:09:56.123-07:00
                  source: ON_FILE
                  cardAccountData: 
                    accountNumber: 5808123456789808
                    expiryMonth: 12
                    expiryYear: 15
                    securityCode: 123                  
                  financialAccountData: 
                    financialAccountId: 5123456789012345
                    interbankCardAssociationId: 1234
                    countryCode: GBR                  
                  tokenData: 
                    token: 5345678901234521
                    expiryMonth: 12
                    expiryYear: 15
                    sequenceNumber: 01                  
                  paymentAccountReference: 512381d9f8e0629211e3949a08002
    RQNotificationSU_TokenExpiry:
      value:  
          requestId: 808808080808
          reasonCode: REDIGITIZATION_COMPLETE
          dateTime: 2026-07-04T19:08:56.123Z
          notificationBody: 
            tokens: 
              tokenUniqueReference: DWSPMC000000000132d72d4fcb2f4136a0532d3093ff1a45
              tokenRequestorId: 40022358888
              tokenRequestorName: My Merchant
              cardId: 5DA...27
              tokenExpiry: 0721
              encryptedPayload: 
                dataValidUntilTimestamp: 2015-07-04T12:09:56.123-07:00
                tokenData: 
                  token: 5345678901234521
                  expiryMonth: 12
                  expiryYear: 15
                  sequenceNumber: 01
    RQNotificationSU_PANSameRange:
      value:  
          requestId: 808808080808
          reasonCode: REDIGITIZATION_COMPLETE
          dateTime: 2026-07-04T19:08:56.123Z
          notificationBody: 
            tokens: 
              tokenUniqueReference: DWSPMC000000000132d72d4fcb2f4136a0532d3093ff1a45
              tokenRequestorId: 40022358888
              tokenRequestorName: My Merchant
              cardId: 5DA...27
              tokenExpiry: 0721
              encryptedPayload: 
                dataValidUntilTimestamp: 2015-07-04T12:09:56.123-07:00
                cardAccountData: 
                  accountNumber: 5808123456789808
                  expiryMonth: 12
                  expiryYear: 15
                  securityCode: 123
                tokenData: 
                  token: 5345678901234521
                  expiryMonth: 12
                  expiryYear: 15
                  sequenceNumber: 01
    RQNotificationSU_Suspend:
      value:  
          requestId: 808808080808
          reasonCode: STATUS_UPDATE
          dateTime: 2026-07-04T19:08:56.123Z
          notificationBody: 
            tokens: 
              tokenUniqueReference: DWSPMC000000000132d72d4fcb2f4136a0532d3093ff1a45
              tokenRequestorId: 40022358888
              tokenRequestorName: My Merchant
              cardId: 5DA...27
              status: SUSPENDED
              suspendedBy: >
               [ISSUER]
              tokenExpiry: 0721
    RQNotificationSU_Activated:
      value:  
          requestId: 808808080808
          reasonCode: STATUS_UPDATE
          dateTime: 2026-07-04T19:08:56.123Z
          notificationBody: 
            tokens: 
              tokenUniqueReference: DWSPMC000000000132d72d4fcb2f4136a0532d3093ff1a45
              tokenRequestorId: 40022358888
              tokenRequestorName: My Merchant
              cardId: 5DA...27
              status: ACTIVE
              tokenExpiry: 0721
              
    RQNotificationSU_DeletedFromApp:
      value:  
          requestId: 808808080808
          reasonCode: DELETED_FROM_CONSUMER_APP
          dateTime: 2026-07-04T19:08:56.123Z
          notificationBody: 
            tokens: 
              tokenUniqueReference: DWSPMC000000000132d72d4fcb2f4136a0532d3093ff1a45
              tokenRequestorId: 40022358888
              tokenRequestorName: My Merchant
              cardId: 5DA...27
    RQNotificationSU_AuthenticationPerf:
      value:  
          requestId: 808808080808
          reasonCode: AUTHENTICATION_PERFORMED
          dateTime: 2026-07-04T19:08:56.123Z
          notificationBody: 
            tokens: 
              tokenUniqueReference: DWSPMC000000000132d72d4fcb2f4136a0532d3093ff1a45
              tokenRequestorId: 40022358888
              tokenRequestorName: My Merchant
              cardId: 5DA...27
              tokenExpiry: 0721
    RQNotificationSuspiciousEvents:
      value:
        requestId: 808808080808
        reasonCode: SUSPICIOUS_EVENTS
        dateTime: 2026-07-04T19:08:56.123Z
        notificationBody: 
          tokenUniqueReference: DWSPMC000000000132d72d4fcb2f4136a0532d3093ff1a45
          tokenRequestorId: 40022358888
          tokenRequestorName: My Merchant
          cardId: 5DA...27
          status: ACTIVE
          paymentAppInstanceId: 1b24f24a24ba98e27d43e345b532a245e4723d7a9c4f624e
          events:
            - eventName: REPLENISH
              walletAtcStatus:
                - unusedDiscarded: 1234
                  usedForContactless: 1234
                  usedForDsrp: 1234
                  unusedActive: 1234
              SystemAtcStatus:
                - atcNotFound: 1234
                  atcAlreadyProcessed: 1234
                  atcReportedUsedByWallet: 1234
                  unusedActive: 1234
  parameters:
    vCardId:
      name: vCardId
      in: path
      description: |
        This value is generated on Universal Card Enrollment. Only applicable for VISA.
      required: true
      example: 502c2656-7110-4994-a820-f593e468c6b4
      schema:
        type: string
        maxLength: 42
    
  schemas:
    RQSendVerifyCode:
      type: object
      required:
        - correlationId 
        - requestId
        - activationCode
        - codeExpiration
        - activationMethod
      properties:
        correlationId:
          type: string
          description: |
            Identification of the Tokenization Process. This value linked 
            both processes.
          example: D98765432104
          maxLength: 14
        requestId:
          type: string
          $ref: "#/components/schemas/prm_requestId"
        tokenRequestorID:
          type: integer
          description: |
            Unique ID assigned to the entity that is requesting the token.
          example: 40022358888
        tokenRequestorName:
          type: string
          description: |
            Name of the token requestor.
          example: My Merchant
        tokenUniqueReference:
          type: string
          description: |
            Unique ID associating a token with a card. This ID can be used in 
            future calls to make operations related to the token in the I-TSP, 
            for example events related to the management of the life cycle.
          example: DWSPMC000000000132d72d4fcb2f4136a0532d3093ff1a45
          maxLength: 64
        panUniqueID:
          type: string
          description: |
            Unique ID representing a card. This ID can be used instead of the 
            PAN number for tokenization calls.
          example: V-3019231458906209630635
        cardId: 
          type: string
          description: |
            Unique Identification for the card in NovoPayment Issuance Services.
            This value only exists for Issuers that are clients of NovoPayment 
            Issuance Services.
          maxLength: 40
        clientWalletAccountID:
          type: string
          description: |
            Identifier of the wallet that sends the request. Client provided 
            consumer ID that identifies the wallet account holder entity. 
            Only available for VISA.
          maxLength: 32
        otpMaxReached:
          type: boolean
          description: |
            If this field is active, it means the user with the referenced token 
            has exceeded the number of requests for authentication methods or OTP 
            requests, thus, the response must not include the value when requesting 
            them again. Only available for VISA.
        activationCode:
          type: string
          description: |
             The value that the cardholder needs to validate his/her identity.
          example: A1B2C3D4
          maxLength: 8
        reasonCodes: 
          type: array
          description: |
            Array of OTP reason codes.
            Allowed values: 
            - ADD_CARD: The account holder is being authenticated after adding 
            the card to the token requestor.
            - VERIFY_ACCOUNT: The account holder is being authenticated to verify 
            account ownership.
            - OTHER: The account holder is being authenticated for a reason not 
            enumerated in this list. Conditional - Only present for Consent Service
          example: 
            - ADD_CARD
        codeExpiration:
          type: string
          description: |
             Token expiration date. Format: yyyy-MM-ddTHH:mm:ss.SSSZ
          example: 2026-07-04T19:08:56.123Z
        activationMethod:
          $ref: "#/components/schemas/ObjActivationMethod"
    RQNotServiceActivated:
      type: object
      required:
        - requestId
        - reasonCode
        - dateTime
        - notificationBody
      properties:
        requestId:
          type: string
          $ref: "#/components/schemas/prm_requestId"
        reasonCode:
          type: string
          description: | 
              SERVICE_ACTIVATED
          example: SERVICE_ACTIVATED
        dateTime:
          type: string
          description: |
             dateTime. Format: yyyy-MM-ddTHH:mm:ss.SSSZ
          example: 2026-07-04T19:08:56.123Z
        notificationBody:
          type: object
          $ref: "#/components/schemas/ObjBodyServiceActivated"
    RQNotTokenUpdated:
      type: object
      required:
        - requestId
        - reasonCode
        - dateTime
        - notificationBody
      properties:
        requestId:
          type: string
          $ref: "#/components/schemas/prm_requestId"
        reasonCode:
          type: string
          description: | 
              The reason that cause the notification.
              Available values:
              REDIGITIZATION_COMPLETE : The token has been re-digitized to the device in the token expiry and FPAN update to a new range use cases.
              DELETED_FROM_CONSUMER_APP : The token has been deleted from the consumer application. The token may still be active in MDES
              STATUS_UPDATE : The status of the tokens has been changed when the token is activated, suspended, deleted, or inactivated.
              AUTHENTICATION_PERFORMED - Account holder authentication was performed on the token. 
              PAYMT_CHANNEL_PREFERENCE_UPDATED - Cardholder has updated the payment channels the token is allowed to be used for (India only).
              FUNDING_ACCOUNT_UPDATE - Token and FPAN mapping has been updated due to FPAN or expiry or Financial account has been changed but Token is not changed. The status did not change as a result.
          enum:
            - REDIGITIZATION_COMPLETE
            - DELETED_FROM_CONSUMER_APP
            - STATUS_UPDATE
            - AUTHENTICATION_PERFORMED
            - PAYMT_CHANNEL_PREFERENCE_UPDATED
            - FUNDING_ACCOUNT_UPDATE
          example: STATUS_UPDATE
        dateTime:
          type: string
          description: |
             dateTime. Format: yyyy-MM-ddTHH:mm:ss.SSSZ
          example: 2026-07-04T19:08:56.123Z
        notificationBody:
          $ref: "#/components/schemas/ObjBodyTokenUpdated"

    RQNotSuspiciousEvents:
      type: object
      required:
        - requestId
        - reasonCode
        - dateTime
        - notificationBody
      properties:
        requestId:
          type: string
          $ref: "#/components/schemas/prm_requestId"
        reasonCode:
          type: string
          description: | 
              SUSPICIOUS_EVENTS
          enum:
            - SUSPICIOUS_EVENTS
          example: SUSPICIOUS_EVENTS
        dateTime:
          type: string
          description: |
             dateTime. Format: yyyy-MM-ddTHH:mm:ss.SSSZ
          example: 2026-07-04T19:08:56.123Z
        notificationBody:
          $ref: "#/components/schemas/ObjBodyNotSuspiciousEv"
    
    ObjBodyNotSuspiciousEv:
      required:
      - tokenUniqueReference
      - events
      type: object
      properties:
        tokenUniqueReference:
          type: string
          $ref: "#/components/schemas/prm_tokenUniqueReference"
        tokenRequestorId:
          type: string
          $ref: "#/components/schemas/prm_tokenRequestorID"
        tokenRequestorName:
          type: string
          $ref: "#/components/schemas/prm_tokenRequestorName"
        cardId:
          type: string
          $ref: "#/components/schemas/prm_cardId"
        status:
          type: string
          description: >
           The current status of token. 
           Available Values:
           INACTIVE - Token has not yet been activated
           ACTIVE - Token is active and ready to transact
           SUSPENDED - Token is suspended and unable to transact
           DEACTIVATED - Token has been permanently deactivated. 
           Present only if reasonCode = "STATUS_UPDATE". 
          minLength: 1
          maxLength: 32
          example: ACTIVE
        paymentAppInstanceId:
          type: string
          description: The identifier of the Payment App instance within a device
            that will be provisioned with a token. Only present when supplied by a
            Wallet Provider.
          minLength: 1
          maxLength: 48
          example: 1b24f24a24ba98e27d43e345b532a245e4723d7a9c4f624e
        events:
          $ref: '#/components/schemas/SuspiciousEvent'
    SuspiciousEvent:
      required:
      - eventName
      type: object
      properties:
        eventName:
          type: string
          description: The name of the suspicious event. Must be one of; REPLENISH
            - There were suspicious ATC values reporting during Replenish
          minLength: 1
          maxLength: 32
          example: REPLENISH
        walletAtcStatus:
          $ref: '#/components/schemas/WalletAtcStatus'
          description: The ATCs statuses are reported by the wallet. Required if 
            EventName is REPLENISH.
        systemAtcStatus:
          $ref: '#/components/schemas/SystemAtcStatus'
          description: The ATCs statuses as reported by authorization network. 
            Required if EventName is REPLENISH
    SystemAtcStatus:
      type: object
      properties:
        atcNotFound:
          type: array
          description: The ATCs reported by the authorization network as not found.
            Max length - Not applicable. Type - Array[String].
          items:
            type: string
            example: "1234"
        atcAlreadyProcessed:
          type: array
          description: The ATCs reported by the authorization network as processed
            for a transaction. Max length - Not applicable. Type - Array[String].
          items:
            type: string
            example: "1234"
        atcReportedUsedByWallet:
          type: array
          description: The ATCs prviously reported by the wallet as processed or discarded.
            Max length - Not applicable. Type - Array[String]
          items:
            type: string
            example: "1234"
        unusedActive:
          type: array
          description: The ATCs reported by the wallet that are unused active. Max
            length - Not applicable. Type - Array[String]
          items:
            type: string
            example: "1234"
      description: The ATCs statuses as reported by authorization network. Conditional
        – required if EventName is REPLENISH
    WalletAtcStatus:
      type: object
      properties:
        unusedDiscarded:
          type: array
          description: The ATCs reported by the wallet that are unused discarded.
            Max length - Not applicable. Type - Array[String].
          items:
            type: string
            example: "1234"
        usedForContactless:
          type: array
          description: The ATCs reported by the wallet that are used for contactless
            transaction. Max length - Not applicable. Type - Array[String].
          items:
            type: string
            example: "1234"
        usedForDsrp:
          type: array
          description: The ATCs reported by the wallet that are used for DSRP transaction.
            Max length - Not applicable. Type - Array[String]
          items:
            type: string
            example: "1234"
        unusedActive:
          type: array
          description: The ATCs reported by the wallet that are unused active. Max
            length - Not applicable. Type - Array[String]
          items:
            type: string
            example: "1234"
      description: The ATCs statuses are reported by the wallet. Conditional – required
        if EventName is REPLENISH
    ObjActivationMethod:
      type: object
      required:
        - type
        - destiny
      description: |
        Object with the information of the identification method chosen 
        by the cardholder.
      properties:
        type:
          type: string
          description: |
            Specifies the activation method type. Must be one of:
            - TEXT_TO_CARDHOLDER_NUMBER = Text message to Account holder's 
            mobile phone number. Value will be the Account holder's masked 
            mobile phone number.
            - EMAIL_TO_CARDHOLDER_ADDRESS = Email to Account holder's email 
            address. Value will be the Account holder's masked email address
            - CARDHOLDER_TO_CALL_AUTOMATED_NUMBER = Account holder-initiated 
            call to automated call center phone number. Value will be the phone 
            number for the Account holder to call
            - CARDHOLDER_TO_CALL_MANNED_NUMBER = Account holder-initiated call 
            to manned call center phone number. Value will be the phone number 
            for the Account holder to call
            - CARDHOLDER_TO_VISIT_WEBSITE = Account holder to visit a website. 
            Value will be the website URL
            - CARDHOLDER_TO_USE_MOBILE_APP = Account holder to use a specific 
            mobile app to activate token. Value will be replaced by a formatted 
            string
            - ISSUER_TO_CALL_CARDHOLDER_NUMBER = Issuer-initiated voice call to 
            Account holder's phone. Value will be the Account holder's masked 
            voice call phone number.
          example: TEXT_TO_CARDHOLDER_NUMBER
        destiny:
          type: string
          description: |
            Specifies the activation method value.
          example: 
            "someaccount@novopayment.com"
          maxLength: 64
        otpMethodIdentifier: 
          type: string
          description: |
            Unique ID that allows to associate an OTP action to

# --- truncated at 32 KB (70 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/novopayment/refs/heads/main/openapi/novopayment-mastercard-issuer-tokenization-openapi.yml