SIX

SIX debiX API

REST API for card issuers on the debiX debit and mobile payment platform - transaction processing, card token lifecycle, push notifications, and bulk operations - with publicly downloadable OpenAPI 3.1 definitions for the bank-to-SIX and cardtoken surfaces and documented production and preprod hosts on api.six-group.com.

Documentation GitHub OpenAPI

Operations 25

POST /cards Orders a new card. #

PUT /cards Modifies the data of a card. #

POST /cards/{cardToken}/reverse-order Reverses a card order. #

POST /cards/{cardToken} Returns the card's details. #

PUT /cards/{cardToken} Modifies the data of a card. #

PUT /cards/{cardToken}/status Modifies the status of a card. #

POST /cards/{cardToken}/credentials Gets card credentials. #

POST /cards/{cardToken}/pin Gets the PIN for the given card. #

POST /cards/{cardToken}/start-set-pin Starts a PIN set operation. #

POST /cards/start-set-pin Starts a PIN set operation. #

POST /cards/{cardToken}/set-pin Sets the PIN for the given card. #

POST /cards/{cardToken}/pin-datamailer Orders a PIN datamailer for the specified card. #

POST /cards/{cardToken}/reset-pin-try-counter Resets the PIN try counter for the given card. #

POST /cards/card-token Returns the card token. #

POST /cards/{cardToken}/card-instance-token Returns the card instance token. #

POST /cards/card-instance-token Returns the card instance token. #

GET /cards/{cardToken}/short-card-id Returns the card identifier. #

POST /cards/reverse-order Reverses a card order. #

PUT /cards/status Modifies the status of a card. #

POST /cards/details Returns the card's details. #

POST /cards/credentials Gets card credentials. #

POST /cards/pin Gets the PIN for the specified card. #

POST /cards/set-pin Sets the PIN for the specified card. #

POST /cards/pin-datamailer Orders a PIN datamailer for the specified card. #

POST /cards/reset-pin-try-counter Resets the PIN try counter for the specified card. #

Documentation

https://docs.debix.six-group.com/

https://docs.debix.six-group.com/api/debix/v2

Specifications

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/openapi/six-group-card-management-api-openapi.yml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/openapi/six-group-card-usage-api-openapi.yml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/openapi/six-group-click-to-pay-issuer-offered-api-openapi.yml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/openapi/six-group-token-lifecycle-management-api-openapi.yml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/openapi/six-group-token-provisioning-api-openapi.yml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/openapi/six-group-alias-directory-beta-api-openapi.yml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/openapi/six-group-debix-push-management-beta-api-openapi.yml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/openapi/six-group-3ds-api-openapi.yml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/openapi/six-group-deprecated-api-openapi.yml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/openapi/six-group-health-check-api-openapi.yml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/openapi/six-group-healthcheck-api-openapi.yml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/openapi/_original/six-group-debix-bank-api-v2-bank-to-six-openapi.yml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/openapi/_original/six-group-debix-bank-api-cardtoken-v2-bank-to-six-openapi.yml

Other Resources

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/overlays/six-group-card-management-api-overlay.yaml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/overlays/six-group-card-usage-api-overlay.yaml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/overlays/six-group-click-to-pay-issuer-offered-api-overlay.yaml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/overlays/six-group-token-lifecycle-management-api-overlay.yaml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/overlays/six-group-token-provisioning-api-overlay.yaml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/overlays/six-group-alias-directory-beta-api-overlay.yaml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/overlays/six-group-debix-push-management-beta-api-overlay.yaml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/overlays/six-group-3ds-api-overlay.yaml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/overlays/six-group-deprecated-api-overlay.yaml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/overlays/six-group-health-check-api-overlay.yaml

https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/overlays/six-group-healthcheck-api-overlay.yaml

https://docs.debix.six-group.com/debix-v2/release-notes

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/debix-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Six Group Card Management API
  version: 2.36.0
  description: 'Operations tagged Card Management across 2 of this provider''s published API definitions: six-group-debix-bank-api-cardtoken-v2-bank-to-six-openapi.yml, six-group-debix-bank-api-v2-bank-to-six-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.six-group.com/api/debix/bank/cardtoken/v2
  description: PROD - Internet
- url: https://api-preprod.np.six-group.com/api/debix/bank/cardtoken/v2
  description: TEST - Internet
- url: https://api.six.ssfn.ch/api/debix/bank/cardtoken/v2
  description: PROD - SSFN
- url: https://api-preprod.np.six.ssfn.ch/api/debix/bank/cardtoken/v2
  description: TEST - SSFN
- url: https://api.p2p.six-group.com/api/debix/bank/cardtoken/v2
  description: PROD - P2P
- url: https://api-preprod.np.p2p.six-group.com/api/debix/bank/cardtoken/v2
  description: TEST - P2P
- url: https://api.six-group.com/api/debix/bank/v2
  description: PROD - Internet
- url: https://api-preprod.np.six-group.com/api/debix/bank/v2
  description: TEST - Internet
- url: https://api.six.ssfn.ch/api/debix/bank/v2
  description: PROD - SSFN
- url: https://api-preprod.np.six.ssfn.ch/api/debix/bank/v2
  description: TEST - SSFN
- url: https://api.p2p.six-group.com/api/debix/bank/v2
  description: PROD - P2P
- url: https://api-preprod.np.p2p.six-group.com/api/debix/bank/v2
  description: TEST - P2P
security: []
tags:
- name: Card Management
  description: Allows card lifecycle, PIN management, retrieval of sensitive card data.
paths:
  /cards:
    post:
      tags:
      - Card Management
      summary: Orders a new card.
      description: "Orders a new virtual or physical card optionally with a reference to an existing parent card.\n\nIn case the feature toggle values are not specified in the request, either directly, or by referencing a parentCard with the takeoverFeatureToggles set to true, the \nfeature toggles will receive the following default values:\n| Feature Flag                 | Default Value            |\n|------------------------------|--------------------------|\n| eCommerceAllowed             | true                     |\n| trxOnlyAsChipAndPin          | false                    |\n| magStripePaymentAllowed      | true                     |\n| automaticBilling             | true                     |\n| purchaseWithCashBackAllowed  | true                     |\n| merchantInitiatedTrxAllowed  | true                     |\n| atmAllowed                   | true                     |\n| posAllowed                   | true                     |\n| motoAllowed                  | true                     |\n| bypassGeoblocking            | true                     |\n| moneySendReceiveAllowance    | RECEIVE_AND_SEND_ALLOWED |\n| reservationAllowed           | true                     |\n| transactionPushEnabled       | true                     |\n| gamblingAndBettingAllowance  | ALLOWED                  |\n| blockedMerchantCategoryCodes | (empty List)             |\n| contactlessActivationStatus  | ACTIVATED_CONFIRMED      |        \n\nIn addition to standard application error codes, the following codes can be returned:\n* 4432 - BANK_CLEARING_NUMBER_NOT_CONFIGURED\n* 4443 - UNKNOWN_PARENT_CARD\n* 4444 - VIRTUAL_CARD_EQUALS_PARENT_CARD\n* 4445 - CARD_ALREADY_EXISTING\n* 4446 - DELIVERY_INFORMATION_FOR_OTRC_MISSING\n* 4451 - INVALID_JWS_SIGNATURE\n* 4452 - START_SET_PIN_NOT_CALLED\n* 4462 - DELIVERY_INFORMATION_FOR_CARD_OR_PIN_MISSING\n* 4463 - CARD_EXPRESS_CODE_MISSING\n* 4464 - PIN_EXPRESS_CODE_MISSING\n* 4465 - PRODUCER_CODE_MISSING\n* 4466 - CARDLINE1_MISSING\n* 4469 - PIN_DELIVERY_NOT_ALLOWED_FOR_VIRTUAL_CARD\n* 4476 - DATAMAILER_DELIVERY_DESTINATION_DIFFERENCE_NOT_ALLOWED\n* 4477 - DATAMAILER_EXPRESS_CODE_DIFFERENCE_NOT_ALLOWED\n* 4478 - OTRC_EXPRESS_CODE_MISSING\n* 4480 - BANK_CARD_CAN_NOT_BE_ORDERED_AS_VIRTUAL_CARD\n* 4481 - PARAMETER_ONLY_ALLOWED_FOR_BANK_CARD\n* 4482 - BANK_DATA_TRACK_2_MISSING\n* 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER\n"
      operationId: orderCard
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/IssuerTraceIdHeader'
      requestBody:
        description: Configuration specifying the new card to be ordered.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CardOrderRequest'
        required: true
      responses:
        '202':
          description: 'Accepted. The request to order a new card has been successfully received and processed.

            The new card is ready for immediate use in subsequent card-related operations.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CardOrderResponse'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        '404':
          description: Not found or card is deleted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
    put:
      tags:
      - Card Management
      summary: Modifies the data of a card.
      description: 'Deprecated, use `PUT /debix/bank/cardtoken/v2/cards/{cardToken}` instead.


        Allows the modification of certain data fields belonging to a card.


        In addition to standard application error codes, the following codes can be returned:

        * 4430 - UNKNOWN_CARD

        * 4436 - CARD_INACTIVE

        * 4447 - NO_CARD_DETAILS_AVAILABLE

        * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER

        '
      operationId: mutateCardDetails
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/IssuerTraceIdHeader'
      requestBody:
        description: Fields to modify. Not all fields are mandatory.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CardMutationRequest_2'
        required: true
      responses:
        '202':
          description: Successful
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        '404':
          description: Not found or card is deleted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
    servers:
    - url: https://api.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - Internet
    - url: https://api-preprod.np.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - Internet
    - url: https://api.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: PROD - SSFN
    - url: https://api-preprod.np.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: TEST - SSFN
    - url: https://api.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - P2P
    - url: https://api-preprod.np.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - P2P
  /cards/{cardToken}/reverse-order:
    post:
      tags:
      - Card Management
      summary: Reverses a card order.
      description: 'Reverses a previously ordered card.

        The reversal is only possible while the card order of a physical card is still in a cancellable state: for card renewals before 7:55 am on the same day as the card order request and for new card orders before 18:25 on the same day as the card order request.


        In addition to standard application error codes, the following codes can be returned:

        * 4430 - UNKNOWN_CARD

        * 4470 - CARD_ORDER_REVERSAL_NOT_POSSIBLE

        * 4471 - CARD_ORDER_REVERSAL_FOR_VIRTUAL_CARD_NOT_ALLOWED

        * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER

        '
      operationId: reverseCardOrder
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/IssuerTraceIdHeader'
      - in: path
        name: cardToken
        description: Card token
        required: true
        schema:
          $ref: '#/components/schemas/CardToken'
      requestBody:
        description: Identifier of the card whose order should be reversed.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CardOrderReversalRequest'
      responses:
        '202':
          description: Successful
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        '404':
          description: Not found or card is deleted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
    servers:
    - url: https://api.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - Internet
    - url: https://api-preprod.np.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - Internet
    - url: https://api.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: PROD - SSFN
    - url: https://api-preprod.np.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: TEST - SSFN
    - url: https://api.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - P2P
    - url: https://api-preprod.np.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - P2P
  /cards/{cardToken}:
    post:
      tags:
      - Card Management
      summary: Returns the card's details.
      description: 'Returns the status and the details of the given card.


        In addition to standard application error codes, the following codes can be returned:

        * 4430 - UNKNOWN_CARD

        * 4447 - NO_CARD_DETAILS_AVAILABLE

        * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER

        '
      operationId: getCardDetails
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/IssuerTraceIdHeader'
      - in: path
        name: cardToken
        description: Card token
        required: true
        schema:
          $ref: '#/components/schemas/CardToken'
      requestBody:
        description: Identifier of the card for which to return the details.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CardDetailsRequest'
        required: true
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CardDetailsResponse'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        '404':
          description: Not found or card is deleted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
    put:
      tags:
      - Card Management
      summary: Modifies the data of a card.
      description: 'Allows the modification of certain data fields belonging to a card.


        In addition to standard application error codes, the following codes can be returned:

        * 4430 - UNKNOWN_CARD

        * 4436 - CARD_INACTIVE

        * 4447 - NO_CARD_DETAILS_AVAILABLE

        * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER

        '
      operationId: mutateCardDetails
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/IssuerTraceIdHeader'
      - in: path
        name: cardToken
        description: Card token
        required: true
        schema:
          $ref: '#/components/schemas/CardToken'
      requestBody:
        description: Fields to modify. Not all fields are mandatory.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CardMutationRequest'
        required: true
      responses:
        '202':
          description: Successful
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        '404':
          description: Not found or card is deleted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
    servers:
    - url: https://api.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - Internet
    - url: https://api-preprod.np.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - Internet
    - url: https://api.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: PROD - SSFN
    - url: https://api-preprod.np.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: TEST - SSFN
    - url: https://api.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - P2P
    - url: https://api-preprod.np.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - P2P
  /cards/{cardToken}/status:
    put:
      tags:
      - Card Management
      summary: Modifies the status of a card.
      description: 'Modifies the status of the specified card.


        In addition to standard application error codes, the following codes can be returned:

        * 4430 - UNKNOWN_CARD

        * 4438 - CARD_STATUS_UPDATE_NOT_ALLOWED

        * 4439 - CARD_HAS_PENDING_STATUS

        * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER

        '
      operationId: updateCardStatus
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/IssuerTraceIdHeader'
      - in: path
        name: cardToken
        description: Card token
        required: true
        schema:
          $ref: '#/components/schemas/CardToken'
      requestBody:
        description: Contains the new status to be set on the card. In case of a blocking action, contains also the block reason.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateCardStatusRequest'
        required: true
      responses:
        '202':
          description: Accepted
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        '404':
          description: Not found or card is deleted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
    servers:
    - url: https://api.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - Internet
    - url: https://api-preprod.np.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - Internet
    - url: https://api.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: PROD - SSFN
    - url: https://api-preprod.np.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: TEST - SSFN
    - url: https://api.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - P2P
    - url: https://api-preprod.np.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - P2P
  /cards/{cardToken}/credentials:
    post:
      tags:
      - Card Management
      summary: Gets card credentials.
      description: 'Get credentials (PAN, CVV) of the specified card.


        In addition to standard application error codes, the following codes can be returned:

        * 4430 - UNKNOWN_CARD

        * 4450 - NO_CERTIFICATE_FOUND

        * 4451 - INVALID_JWS_SIGNATURE

        * 4483 - OPERATION_NOT_ALLOWED_FOR_BANK_CARD

        '
      operationId: getCardCredentials
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/IssuerTraceIdHeader'
      - in: path
        name: cardToken
        description: Card token
        required: true
        schema:
          $ref: '#/components/schemas/CardToken'
      requestBody:
        description: Signed request for the credentials, containing card identifiers and encryption parameters.
        content:
          text/plain:
            schema:
              $ref: '#/components/schemas/CardCredentialsRequest'
            examples:
              JWS Header (decoded):
                value:
                  alg: ES256 (example)
                  typ: JWT
                  x5t#S256: 0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEp
              JWS Payload (decoded):
                value:
                  cardToken: CTK-85AB2A9FE2374A188A039F03F88E6EE1
                  cardTokenExtension:
                    cardSequenceNumber: 1
                    cardExpiry:
                      month: 6
                      year: 23
                  clientEphPubKey: SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
        required: true
      responses:
        '200':
          description: Successful
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/CardCredentialsResponse'
              examples:
                JWS Header (decoded):
                  value:
                    alg: none
                    typ: JWT
                JWS Payload (decoded):
                  value:
                    serverEphPubKey: QbTKxwRJSMeKKF2Q_T4fwpMeJf36POk6yJVadQssZi9
                    encryptedData: TG9yZW0gaXBzdW0gZG9sciBzaXI=
                Card Credentials (decrypted):
                  value:
                    fpan: 1234567812345678
                    cvv: 123
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        '404':
          description: Not found or card is deleted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
    servers:
    - url: https://api.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - Internet
    - url: https://api-preprod.np.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - Internet
    - url: https://api.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: PROD - SSFN
    - url: https://api-preprod.np.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: TEST - SSFN
    - url: https://api.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - P2P
    - url: https://api-preprod.np.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - P2P
  /cards/{cardToken}/pin:
    post:
      tags:
      - Card Management
      summary: Gets the PIN for the given card.
      description: 'Get PIN of the given card.


        In addition to standard application error codes, the following codes can be returned:

        * 4430 - UNKNOWN_CARD

        * 4450 - NO_CERTIFICATE_FOUND

        * 4451 - INVALID_JWS_SIGNATURE

        * 4458 - RETRIEVE_PIN_NOT_ALLOWED_FOR_DELETED_CARD

        * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER

        '
      operationId: getPin
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/IssuerTraceIdHeader'
      - in: path
        name: cardToken
        description: Card token
        required: true
        schema:
          $ref: '#/components/schemas/CardToken'
      requestBody:
        description: Signed request for the PIN, containing card identifiers and encryption parameters.
        content:
          text/plain:
            schema:
              $ref: '#/components/schemas/GetPinRequest'
            examples:
              JWS Header (decoded):
                value:
                  alg: ES256 (example)
                  typ: JWT
                  x5t#S256: 0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEp
              JWS Payload (decoded):
                value:
                  cardToken: CTK-85AB2A9FE2374A188A039F03F88E6EE1
                  cardTokenExtension:
                    cardSequenceNumber: 1
                    cardExpiry:
                      month: 6
                      year: 23
                  clientEphPubKey: SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
        required: true
      responses:
        '200':
          description: Successful
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/GetPinResponse'
              examples:
                JWS Header (decoded):
                  value:
                    alg: ES256 (example)
                    typ: JWT
                JWS Payload (decoded):
                  value:
                    serverEphPubKey: QbTKxwRJSMeKKF2Q_T4fwpMeJf36POk6yJVadQssZi9
                    encryptedData: TG9yZW0gaXBzdW0gZG9sciBzaXI=
                PIN (decrypted):
                  value:
                    pin: 123456
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        '404':
          description: Not found or card is deleted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
    servers:
    - url: https://api.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - Internet
    - url: https://api-preprod.np.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - Internet
    - url: https://api.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: PROD - SSFN
    - url: https://api-preprod.np.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: TEST - SSFN
    - url: https://api.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - P2P
    - url: https://api-preprod.np.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - P2P
  /cards/{cardToken}/start-set-pin:
    post:
      tags:
      - Card Management
      summary: Starts a PIN set operation.
      description: 'First call to be able to set the PIN for the specified card. debiX returns an ephemeral public key to encrypt the PIN on the issuer''s side for the ''/set-pin'' call.


        In addition to standard application error codes, the following codes can be returned:

        * 4430 - UNKNOWN_CARD

        * 4440 - SET_PIN_NOT_ALLOWED_FOR_BLOCKED_OR_DELETED_CARD

        * 4442 - PIN_PREVIOUSLY_PASSED_TO_NEWER_CARD

        * 4450 - NO_CERTIFICATE_FOUND

        * 4451 - INVALID_JWS_SIGNATURE

        * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER

        '
      operationId: startSetPin
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/IssuerTraceIdHeader'
      - in: path
        name: cardToken
        description: Card token
        required: true
        schema:
          $ref: '#/components/schemas/CardToken'
      requestBody:
        description: Signed request to get debiX's ephemeral public key, it contains card identifiers.
        content:
          text/plain:
            schema:
              $ref: '#/components/schemas/StartSetPinRequest'
            examples:
              JWS Header (decoded):
                value:
                  alg: ES256 (example)
                  typ: JWT
                  x5t#S256: 0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEp
              JWS Payload (decoded):
                value:
                  cardToken: CTK-85AB2A9FE2374A188A039F03F88E6EE1
                  cardTokenExtension:
                    cardSequenceNumber: 1
                    cardExpiry:
                      month: 6
                      year: 23
        required: true
      responses:
        '200':
          description: Successful
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/StartSetPinResponse'
              examples:
                JWS Header (decoded):
                  value:
                    alg: ES256 (example)
                    typ: JWT
                JWS Payload (decoded):
                  value:
                    serverEphPubKey: QbTKxwRJSMeKKF2Q_T4fwpMeJf36POk6yJVadQssZi9
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        '404':
          description: Not found or card is deleted
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
    servers:
    - url: https://api.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - Internet
    - url: https://api-preprod.np.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - Internet
    - url: https://api.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: PROD - SSFN
    - url: https://api-preprod.np.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: TEST - SSFN
    - url: https://api.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - P2P
    - url: https://api-preprod.np.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - P2P
  /cards/start-set-pin:
    post:
      tags:
      - Card Management
      summary: Starts a PIN set operation.
      description: 'First call to be able to set the PIN for the specified card. debiX returns an ephemeral public key to encrypt the PIN on the issuer''s side for the ''/set-pin'' call.


        In addition to standard application error codes, the following codes can be returned:

        * 4430 - UNKNOWN_CARD

        * 4440 - SET_PIN_NOT_ALLOWED_FOR_BLOCKED_OR_DELETED_CARD

        * 4442 - PIN_PREVIOUSLY_PASSED_TO_NEWER_CARD

        * 4450 - NO_CERTIFICATE_FOUND

        * 4451 - INVALID_JWS_SIGNATURE

        * 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER

        '
      operationId: startSetPinByCardId
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/IssuerTraceIdHeader'
      requestBody:
        description: Signed request to get debiX's ephemeral public key, it contains a card identifier.
        content:
          text/plain:
            schema:
              $ref: '#/components/schemas/StartSetPinByCardIdRequest'
            examples:
              JWS Header (decoded):
                value:
                  alg: ES256 (example)
                  typ: JWT
                  x5t#S256: 0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEp
              JWS Payload (decoded):
                value:
                  cardId:
                    bankClearingNumber: 5000
                    cardNumber: 123456
                    cardType: 1
                    cardSequenceNumber: 1
                    cardExpiry:
                      month: 6
                      year: 23
        required: true
      responses:
        '200':
          description: Successful
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/StartSetPinResponse'
              examples:
                JWS Header (decoded):
                  value:
                    alg: ES256 (example)
                    typ: JWT
                JWS Payload (decoded):
                  value:
                    serverEphPubKey: QbTKxwRJSMeKKF2Q_T4fwpMeJf36POk6yJVadQssZi9
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
    servers:
    - url: https://api.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - Internet
    - url: https://api-preprod.np.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - Internet
    - url: https://api.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: PROD - SSFN
    - url: https://api-preprod.np.six.ssfn.ch/api/debix/bank/cardtoken/v2
      description: TEST - SSFN
    - url: https://api.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: PROD - P2P
    - url: https://api-preprod.np.p2p.six-group.com/api/debix/bank/cardtoken/v2
      description: TEST - P2P
  /cards/{cardToken}/set-pin:
    post:
      tags:
      - Card Management
      summary: Sets the PIN for the given card.
      description: "Sets the PIN for the given card. The PIN is encrypted with the shared key derived from debiX's ephemeral public key from the '/start-set-pin' request \nand the issuer's ephemeral private key corresponding to the issuer's ephemeral public key in this request (clientEphPubKey).  \n\nIn addition to standard application error codes, the following codes can be returned:\n* 4430 - UNKNOWN_CARD\n* 4440 - SET_PIN_NOT_ALLOWED_FOR_BLOCKED_OR_DELETED_CARD\n* 4442 - PIN_PREVIOUSLY_PASSED_TO_NEWER_CARD\n* 4450 - NO_CERTIFICATE_FOUND\n* 4451 - INVALID_JWS_SIGNATURE\n* 4452 - START_SET_PIN_NOT_CALLED\n* 4484 - BANK_CARDS_NOT_SUPPORTED_BY_ISSUER\n"
      operationId: setPin
      parameters:
      - $ref: '#/components/parameters/RequestIdHeader'
      - $ref: '#/components/parameters/IssuerTraceIdHeader'
      - in: path
        name: cardToken
        description: Card token
        required: true
        schema:
          $ref: '#/components/schemas/CardToken'
      requestBody:
        description: Signed request for the PIN set operation, containing card identifiers, encryption parameters and encrypted PIN.
        content:
          text/plain:
            schema:
              $ref: '#/components/schemas/SetPinRequest'
            examples:
              JWS Header (decoded):
                value:
                  alg: ES256 (example)
                  typ: JWT
                  x5t#S256: 0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEp
              JWS Payload (decoded):
                value:
                  cardToken: CTK-85AB2A9FE2374A188A039F03F88E6EE1
                  cardTokenExtension:
                    cardSequenceNumber: 1
                    cardExpiry:
                      month: 6
                      year: 23
                  clientEphPubKey: SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
                  encryptedData: TG9yZW0gaXBzdW0gZG9sciBzaXI=
        required: true
      responses:
        '204':
          description: Set PIN was successful.
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BankApiError'
        '404':
          description: Not found or card is deleted
          content:
            application/json:


# --- truncated at 32 KB (129 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/six-group/refs/heads/main/openapi/six-group-card-management-api-openapi.yml