Q2 Card - Provision API

openapi: 3.2.0
info:
  title: Helix Card - Provision API
  version: 3.0.0
  description: Helix Public API (no customer KYC/IDV). **This spec covers all of Helix 3.x and is subject to change at any time.**
servers:
- url: https://sandbox-api.helix.q2.com
  description: Sandbox server
- url: https://api.helix.q2.com
  description: Production server
security:
- basicAuth: []
tags:
- name: Card - Provision
  description: Endpoints related to card provisioning
paths:
  /card/provision/applePay:
    post:
      tags:
      - Card - Provision
      summary: Provision to Apple Pay
      description: Get Apple Pay enrypted data for provisioning into Apple Pay Wallet.
      externalDocs:
        url: https://docs.helix.q2.com/reference/cardprovisionapplepay
      operationId: cardProvisionApplePay
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - customerId
              - cardId
              - certificates
              - nonceBase64
              - nonceSignatureBase64
              properties:
                customerId:
                  $ref: '#/components/schemas/HelixId'
                cardId:
                  $ref: '#/components/schemas/HelixId'
                certificates:
                  type: array
                  description: json string array of base 64 encoded Apple X.509 certificates (returned by Apple)
                  items:
                    type: string
                    format: byte
                nonceBase64:
                  type: string
                  format: byte
                  description: Base64 random number generated to avoid replay attacks (returned by Apple)
                nonceSignatureBase64:
                  type: string
                  format: byte
                  description: Base64 nonce signature (* returned by Apple)
      responses:
        '200':
          description: Data to pass to Apple for tokenization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CardProvisionApplePay200Response'
        '400':
          $ref: '#/paths/~1card~1lock/post/responses/400'
        '401':
          $ref: '#/paths/~1card~1lock/post/responses/401'
        '404':
          $ref: '#/paths/~1card~1lock/post/responses/404'
        '405':
          $ref: '#/paths/~1card~1lock/post/responses/405'
        '429':
          $ref: '#/paths/~1card~1lock/post/responses/429'
  /card/provision/cardDetail/{customerId}/{cardId}/{nonce}:
    get:
      tags:
      - Card - Provision
      summary: Get VDE provisioning details
      description: Retrieve VDE provisioning details for the given `cardId`.
      externalDocs:
        url: https://docs.helix.q2.com/reference/cardprovisioncarddetail
      operationId: cardProvisionCardDetail
      parameters:
      - $ref: '#/components/parameters/CustomerIdPath'
      - $ref: '#/components/parameters/CardIdPath'
      - name: nonce
        in: path
        required: true
        schema:
          type: string
          description: This value must be passed in plain base64-encoded format and must not be encrypted.
      responses:
        '200':
          description: An encrypted string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CardProvisionCardDetail200Response'
        '400':
          $ref: '#/paths/~1card~1lock/post/responses/400'
        '401':
          $ref: '#/paths/~1card~1lock/post/responses/401'
        '404':
          $ref: '#/paths/~1card~1lock/post/responses/404'
        '405':
          $ref: '#/paths/~1card~1lock/post/responses/405'
        '429':
          $ref: '#/paths/~1card~1lock/post/responses/429'
  /card/provision/googlePay:
    post:
      tags:
      - Card - Provision
      summary: Provision to Google Pay
      description: Get Google Pay enrypted data for provisioning into Google Pay Wallet.
      externalDocs:
        url: https://docs.helix.q2.com/reference/cardprovisiongooglepay
      operationId: cardProvisionGooglePay
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - customerId
              - cardId
              - deviceId
              - clientCustomerId
              properties:
                customerId:
                  $ref: '#/components/schemas/HelixId'
                cardId:
                  $ref: '#/components/schemas/HelixId'
                deviceId:
                  type: string
                  description: Customer’s Android Device ID
                clientCustomerId:
                  type: string
                  description: Customer’s Wallet account ID from Google Pay SDK.
      responses:
        '200':
          description: Data to pass to Google for tokenization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CardProvisionGooglePay200Response'
        '400':
          $ref: '#/paths/~1card~1lock/post/responses/400'
        '401':
          $ref: '#/paths/~1card~1lock/post/responses/401'
        '404':
          $ref: '#/paths/~1card~1lock/post/responses/404'
        '405':
          $ref: '#/paths/~1card~1lock/post/responses/405'
        '429':
          $ref: '#/paths/~1card~1lock/post/responses/429'
components:
  schemas:
    CardProvisionCardDetail200Response:
      allOf:
      - $ref: '#/components/schemas/CardArray200Response/allOf/0'
      - type: object
        properties:
          data:
            type: string
    CityProperty:
      type: string
      maxLength: 50
    CardProvisionGooglePay200Response:
      allOf:
      - $ref: '#/components/schemas/CardArray200Response/allOf/0'
      - type: object
        properties:
          data:
            type: object
            description: '`expirationDate` is always returned. Other fields may be omitted.

              '
            properties:
              address:
                allOf:
                - description: Customer `Residence` address
                - $ref: '#/components/schemas/AddressItem'
              expirationDate:
                type: object
                properties:
                  month:
                    type: string
                  year:
                    type: string
              googlePayPhoneNumber:
                type: object
                properties:
                  countryCode:
                    type: string
                  extension:
                    type: string
                  phoneNumber:
                    type: string
              last4:
                type: string
                description: Last 4 digits of the card PAN
              opaquePaymentCard:
                type: string
                format: byte
                description: Base64 encoded opaque card data that is needed for tokenization. This value should be passed through to Google as is.
        required:
        - expirationDate
    CardArray200Response:
      allOf:
      - type: object
        properties:
          errors:
            type: array
            items: {}
            example: []
          requestId:
            type: string
            example: 1249a3bf-aca1-40dd-9fba-2a3193550c39
          status:
            type: integer
            enum:
            - 200
          throttle:
            type: object
            properties:
              periodEndsAt:
                $ref: '#/components/schemas/CustomerSetLastContact200Response/allOf/1/properties/data/items/properties/lastContactDate'
              periodLengthInSeconds:
                $ref: '#/components/schemas/HelixId'
              periodRequestLimit:
                $ref: '#/components/schemas/HelixId'
              requestsRemainingInPeriod:
                $ref: '#/components/schemas/HelixId'
              warningThreshold:
                type: number
                format: decimal
                example: 0.2
      - type: object
        properties:
          data:
            type: array
            items:
              $ref: '#/components/schemas/CardObject200Response/allOf/1/properties/data'
    CustomerSetLastContact200Response:
      allOf:
      - $ref: '#/components/schemas/CardArray200Response/allOf/0'
      - type: object
        properties:
          data:
            type: array
            items:
              type: object
              properties:
                customerId:
                  $ref: '#/components/schemas/HelixId'
                dormancyStatus:
                  type: string
                  enum:
                  - Active
                  - Inactive
                  - Dormant
                lastContactDate:
                  type: string
                  format: date-time
                  example: '2021-01-07T19:00:59.761-06:00'
                lastContactType:
                  $ref: '#/components/schemas/LastContactType'
    CardProvisionApplePay200Response:
      allOf:
      - $ref: '#/components/schemas/CardArray200Response/allOf/0'
      - type: object
        properties:
          data:
            properties:
              encryptedPassData:
                type: string
                format: byte
                description: Base64 encoded encrypted authentication data consisting of encrypted PAN, expiry date, name etc. This value should be passed through to Apple as is.
              activationData:
                type: string
                format: byte
                description: Base64 encoded activation data consisting of encrypted nonce, noncesignature, and authCode. This value should be passed through to Apple as is.
              ephemeralPublicKey:
                type: string
                format: byte
                description: Base64 encoded encrypted JSON containing the sensitive information needed to add a card to Apple Pay. This value should be passed through to Apple as is.
    PostalCode:
      type: string
      maxLength: 9
    HelixId:
      type: integer
      format: int32
      minimum: 1
    FormationState:
      type: string
      maxLength: 2
    AddressLine:
      type: string
      maxLength: 100
    CountryProperty:
      type: string
      maxLength: 50
    AddressItem:
      type: object
      required:
      - addressLine1
      - addressType
      - city
      - country
      - postalCode
      - state
      properties:
        addressLine1:
          $ref: '#/components/schemas/AddressLine'
        addressLine2:
          $ref: '#/components/schemas/AddressLine'
        addressLine3:
          $ref: '#/components/schemas/AddressLine'
        addressLine4:
          $ref: '#/components/schemas/AddressLine'
        addressType:
          type: string
          enum:
          - Individual
          - Mailing
          - PrimaryBusiness
          - Business
          - Registered
          - TaxFormMailing
        city:
          $ref: '#/components/schemas/CityProperty'
        country:
          $ref: '#/components/schemas/CountryProperty'
        isActive:
          type: boolean
          readOnly: true
        postalCode:
          $ref: '#/components/schemas/PostalCode'
        state:
          $ref: '#/components/schemas/FormationState'
  parameters:
    CustomerIdPath:
      name: customerId
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/HelixId'
    CardIdPath:
      name: cardId
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/HelixId'
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
x-samples-languages:
- curl
- node
- python
- csharp
- ruby
- go
- java
- kotlin
- php
x-provenance:
  method: searched
  source: https://docs.helix.q2.com/reference
  harvested: '2026-10-14'
  tool: harvest-readme-openapi.py
  note: Assembled verbatim from the OpenAPI definition ReadMe embeds in each operation page of the provider's developer portal; paths and components merged by API title, nothing authored.
  assembled_from:
  - https://docs.helix.q2.com/reference/accountaddentitlement.md
  - https://docs.helix.q2.com/reference/accountbeneficiaryadd.md
  - https://docs.helix.q2.com/reference/accountbeneficiaryedit.md
  - https://docs.helix.q2.com/reference/accountbeneficiaryget.md
  - https://docs.helix.q2.com/reference/accountbeneficiarylist.md
  - https://docs.helix.q2.com/reference/accountbeneficiaryremove.md
  - https://docs.helix.q2.com/reference/accountbeneficiaryreplace.md
  - https://docs.helix.q2.com/reference/accountclose.md
  - https://docs.helix.q2.com/reference/accountcreate.md
  - https://docs.helix.q2.com/reference/accounteditentitlement.md
  - https://docs.helix.q2.com/reference/accountget.md
  - https://docs.helix.q2.com/reference/accountgetbytag.md
  - https://docs.helix.q2.com/reference/accountlimitdelete.md
  - https://docs.helix.q2.com/reference/accountlimitlist.md
  - https://docs.helix.q2.com/reference/accountlimitset.md
  - https://docs.helix.q2.com/reference/accountlist.md
  - https://docs.helix.q2.com/reference/accountlistentitlements.md
  - https://docs.helix.q2.com/reference/accountlock.md
  - https://docs.helix.q2.com/reference/accountplacehold.md
  - https://docs.helix.q2.com/reference/accountreleasehold.md
  - https://docs.helix.q2.com/reference/accountremoveentitlement.md
  - https://docs.helix.q2.com/reference/accountstoppaycreatecheckstoppay.md
  - https://docs.helix.q2.com/reference/accountstoppayexpire.md
  - https://docs.helix.q2.com/reference/accountstoppaylist.md
  - https://docs.helix.q2.com/reference/accountunlock.md
  - https://docs.helix.q2.com/reference/accountupdate.md
  - https://docs.helix.q2.com/reference/bankdocumentdownload.md
  - https://docs.helix.q2.com/reference/bankdocumentlist.md
  - https://docs.helix.q2.com/reference/cardaddaccount.md
  - https://docs.helix.q2.com/reference/cardarchive.md
  - https://docs.helix.q2.com/reference/cardcontrolarchive.md
  - https://docs.helix.q2.com/reference/cardcontrolarchivebytag.md
  - https://docs.helix.q2.com/reference/cardcontrolcreate.md
  - https://docs.helix.q2.com/reference/cardcontrolget.md
  - https://docs.helix.q2.com/reference/cardcontrolgetbytag.md
  - https://docs.helix.q2.com/reference/cardcreatedigital.md
  - https://docs.helix.q2.com/reference/cardfraudtextalertget.md
  - https://docs.helix.q2.com/reference/cardfraudtextalertoptout.md
  - https://docs.helix.q2.com/reference/cardget.md
  - https://docs.helix.q2.com/reference/cardgetbytag.md
  - https://docs.helix.q2.com/reference/cardhotlist.md
  - https://docs.helix.q2.com/reference/cardinitiate.md
  - https://docs.helix.q2.com/reference/cardlimitget.md
  - https://docs.helix.q2.com/reference/cardlimitoverride.md
  - https://docs.helix.q2.com/reference/cardlimitreset.md
  - https://docs.helix.q2.com/reference/cardlimittemporaryoverride.md
  - https://docs.helix.q2.com/reference/cardlist.md
  - https://docs.helix.q2.com/reference/cardlock.md
  - https://docs.helix.q2.com/reference/cardmockadminfalconfraud.md
  - https://docs.helix.q2.com/reference/cardmockdeclinepurchaseauthorize.md
  - https://docs.helix.q2.com/reference/cardmockdepositpurchasereturn.md
  - https://docs.helix.q2.com/reference/cardmockdepositpurchasereturnreversal.md
  - https://docs.helix.q2.com/reference/cardmockwithdrawalcardcash.md
  - https://docs.helix.q2.com/reference/cardmockwithdrawalpurchaseauthorize.md
  - https://docs.helix.q2.com/reference/cardmockwithdrawalpurchasecomplete.md
  - https://docs.helix.q2.com/reference/cardorderphysical.md
  - https://docs.helix.q2.com/reference/cardprovisionapplepay.md
  - https://docs.helix.q2.com/reference/cardprovisioncarddetail.md
  - https://docs.helix.q2.com/reference/cardprovisiongooglepay.md
  - https://docs.helix.q2.com/reference/cardreissue.md
  - https://docs.helix.q2.com/reference/cardremoveaccount.md
  - https://docs.helix.q2.com/reference/cardrenewaloverride.md
  - https://docs.helix.q2.com/reference/cardreprioritizeaccount.md
  - https://docs.helix.q2.com/reference/cardresetpin.md
  - https://docs.helix.q2.com/reference/cardriskfactorget.md
  - https://docs.helix.q2.com/reference/cardriskfactorset.md
  - https://docs.helix.q2.com/reference/cardunlock.md
  - https://docs.helix.q2.com/reference/cardupdate.md
  - https://docs.helix.q2.com/reference/cardverify.md
  - https://docs.helix.q2.com/reference/cardverifybycvv.md
  - https://docs.helix.q2.com/reference/customeranswerlist.md
  - https://docs.helix.q2.com/reference/customeranswerpost.md
  - https://docs.helix.q2.com/reference/customerarchive.md
  - https://docs.helix.q2.com/reference/customerbeneficiaryaccountassignmentlist.md
  - https://docs.helix.q2.com/reference/customerbeneficiarycreate.md
  - https://docs.helix.q2.com/reference/customerbeneficiarydeactivate.md
  - https://docs.helix.q2.com/reference/customerbeneficiaryget.md
  - https://docs.helix.q2.com/reference/customerbeneficiarylist.md
  - https://docs.helix.q2.com/reference/customerbeneficiaryupdate.md
  - https://docs.helix.q2.com/reference/customercreate.md
  - https://docs.helix.q2.com/reference/customercreatebusiness.md
  - https://docs.helix.q2.com/reference/customercreatebusinessapplication.md
  - https://docs.helix.q2.com/reference/customerdocumentget.md
  - https://docs.helix.q2.com/reference/customerdocumentlist.md
  - https://docs.helix.q2.com/reference/customerdocumentupdatestatus.md
  - https://docs.helix.q2.com/reference/customerdocumentupload.md
  - https://docs.helix.q2.com/reference/customergeneratetoken.md
  - https://docs.helix.q2.com/reference/customerget.md
  - https://docs.helix.q2.com/reference/customergetbyemail.md
  - https://docs.helix.q2.com/reference/customergetbytag.md
  - https://docs.helix.q2.com/reference/customerlist.md
  - https://docs.helix.q2.com/reference/customernote.md
  - https://docs.helix.q2.com/reference/customernoteslist.md
  - https://docs.helix.q2.com/reference/customerrelationshiparchive.md
  - https://docs.helix.q2.com/reference/customerrelationshipcreate.md
  - https://docs.helix.q2.com/reference/customerrelationshiplist.md
  - https://docs.helix.q2.com/reference/customerrelationshipupdate.md
  - https://docs.helix.q2.com/reference/customerrelationshipupdateprimarycontact.md
  - https://docs.helix.q2.com/reference/customersearch.md
  - https://docs.helix.q2.com/reference/customersecurityanswerslist.md
  - https://docs.helix.q2.com/reference/customersetlastcontact.md
  - https://docs.helix.q2.com/reference/customerupdate.md
  - https://docs.helix.q2.com/reference/customerupdateaddress-2.md
  - https://docs.helix.q2.com/reference/externalaccountarchive.md
  - https://docs.helix.q2.com/reference/externalaccountcreate.md
  - https://docs.helix.q2.com/reference/externalaccountdocumentupload.md
  - https://docs.helix.q2.com/reference/externalaccountget.md
  - https://docs.helix.q2.com/reference/externalaccountgetbytag.md
  - https://docs.helix.q2.com/reference/externalaccountinitiate.md
  - https://docs.helix.q2.com/reference/externalaccountlist.md
  - https://docs.helix.q2.com/reference/externalaccountlock.md
  - https://docs.helix.q2.com/reference/externalaccountresendverification.md
  - https://docs.helix.q2.com/reference/externalaccountunlock.md
  - https://docs.helix.q2.com/reference/externalaccountupdate.md
  - https://docs.helix.q2.com/reference/externalaccountverify.md
  - https://docs.helix.q2.com/reference/feeconfiglist.md
  - https://docs.helix.q2.com/reference/feeget.md
  - https://docs.helix.q2.com/reference/feegetbycustomertag.md
  - https://docs.helix.q2.com/reference/programget.md
  - https://docs.helix.q2.com/reference/programlistaccountholds.md
  - https://docs.helix.q2.com/reference/programlistindustryclassificationcodes.md
  - https://docs.helix.q2.com/reference/programquestionslist.md
  - https://docs.helix.q2.com/reference/statementdownload.md
  - https://docs.helix.q2.com/reference/statementget.md
  - https://docs.helix.q2.com/reference/statementlist.md
  - https://docs.helix.q2.com/reference/statementsearch.md
  - https://docs.helix.q2.com/reference/transactioncreatefee.md
  - https://docs.helix.q2.com/reference/transactionget.md
  - https://docs.helix.q2.com/reference/transactiongetbytag.md
  - https://docs.helix.q2.com/reference/transactionlist.md
  - https://docs.helix.q2.com/reference/transactionsetavailabledate.md
  - https://docs.helix.q2.com/reference/transactionsetstatus.md
  - https://docs.helix.q2.com/reference/transactionwireget.md
  - https://docs.helix.q2.com/reference/transferachoriginationcreate.md
  - https://docs.helix.q2.com/reference/transfercreate.md
  - https://docs.helix.q2.com/reference/transfervoid.md
  - https://docs.helix.q2.com/reference/transferwirecreate-2.md
  merge:
    pages: 137
    deduped: 1427
    conflicts_kept_first: 0