swagger: '2.0'
info:
description: 'The current set of APIs will be available in Q2 2026 on Worldline Global Issuing Platforms.
Additional APIs are under construction and planned to be available in 2026.'
version: 2.41.1
title: Worldline Issuing Account - AccountState Card API
contact: {}
host: sbx-wlip.api1-eu2.psapigateway.preprod.giservices.io/card-issuing
basePath: /api/v2
schemes:
- https
tags:
- name: Card
description: Card Api Controller
paths:
/issuers/{issuerId}/cards/block-all:
post:
tags:
- Card
summary: Block all cards with same PAN or same PAN Reference
operationId: blockAllCards
description: "The API is similar to Block a card API but is applied to all cards having the same PAN or same PAN reference.\n\nThe API allows the permanent blocking (immediately or in the future), or temporary blocking, depending on the configured blocking reason, of all cards having the same PAN or same PAN reference.\nCards must be in “CREATED” or “ACTIVE” status. \nThe blocking reason is chosen from the reasons configured beforehand for the issuer.\nIf a card is in \"DEACTIVATED\" status and the blocking reason is temporary, it will be ignored.\n\nIt is also possible to update the following blocking information by this API :\n- When the card is already blocked:\n - Blocking reason among those available for the issuer\n - Blocking detail\n - Lost and stolen date if the blocking reason is LOST or STOLEN\n - Fraud process\n - The flag indicating whether the PIN is compromised\n - Scheduled blocking information : delay or blocking reason if the delay is not yet reached\n\n- When the card is active :\n - Scheduled blocking information : delay or blocking reason if the delay is not yet reached"
consumes:
- application/json
produces:
- application/json
parameters:
- name: WL-Correlation-ID
in: header
required: false
type: string
- name: WL-Origin
in: header
required: false
type: string
- name: WL-Username
in: header
required: false
type: string
- name: filter
in: query
description: Filtered Fields
required: false
type: array
items:
type: string
collectionFormat: multi
- name: issuerId
in: path
description: Issuer ID
required: true
type: string
- in: body
name: body
required: true
schema:
$ref: '#/definitions/BlockAllCardsRequest'
responses:
'400':
description: Bad request
schema:
$ref: '#/definitions/BadRequestErrorApiResponse'
'401':
description: Unauthorized
schema:
$ref: '#/definitions/UnauthorizedErrorApiResponse'
'403':
description: Forbidden
schema:
$ref: '#/definitions/ForbiddenErrorApiResponse'
'404':
description: Not found
schema:
$ref: '#/definitions/NotFoundErrorApiResponse'
'500':
description: Internal server error
schema:
$ref: '#/definitions/InternalServerErrorErrorApiResponse'
'502':
description: Bad gateway
schema:
$ref: '#/definitions/BadGatewayErrorApiResponse'
'200':
description: OK
schema:
$ref: '#/definitions/ApiResponseEntityBlockAllCardsResponse'
security:
- basic: []
deprecated: false
/issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}:
get:
tags:
- Card
summary: Retrieve card by external reference
operationId: retrieveCardByIssuerExtRef
description: 'This API enables card information for a given card identifier to be retrieved.
The response can also be enriched (if specified as embedded fields in input) with additional data such as the status history of the card, the card Contract information, the card order identifiers linked to the card.'
produces:
- application/json
parameters:
- name: WL-Correlation-ID
in: header
required: false
type: string
- name: WL-Origin
in: header
required: false
type: string
- name: WL-Username
in: header
required: false
type: string
- name: filter
in: query
description: Filtered Fields
required: false
type: array
items:
type: string
collectionFormat: multi
- name: issuerId
in: path
description: Issuer ID
required: true
type: string
- name: issuerCardExternalReference
in: path
description: Issuer Card External Reference
required: true
type: string
- name: publicKeyIdentifier
in: query
description: Public Key Identifier
required: false
type: string
- name: embed
in: query
description: Embedded Fields
required: false
type: array
items:
type: string
enum:
- statusHistory
- cardContract
- renewedBy
- renewedFor
- replacementBy
- replacementFor
- cardContract.contactCenters
- orderIdentifiers
- orders
collectionFormat: multi
responses:
'400':
description: Bad request
schema:
$ref: '#/definitions/BadRequestErrorApiResponse'
'401':
description: Unauthorized
schema:
$ref: '#/definitions/UnauthorizedErrorApiResponse'
'403':
description: Forbidden
schema:
$ref: '#/definitions/ForbiddenErrorApiResponse'
'404':
description: Not found
schema:
$ref: '#/definitions/NotFoundErrorApiResponse'
'500':
description: Internal server error
schema:
$ref: '#/definitions/InternalServerErrorErrorApiResponse'
'502':
description: Bad gateway
schema:
$ref: '#/definitions/BadGatewayErrorApiResponse'
'200':
description: OK
schema:
$ref: '#/definitions/ApiResponseEntityCard'
security:
- basic: []
deprecated: false
/issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/activate:
post:
tags:
- Card
summary: Activate a card by external reference
operationId: activateCardByIssuerExtRef
description: 'The API allows to activate on demand a card in ''''created'''' status identified by the Issuer Card External Reference or the Card Reference.
The activation reason is chosen among the reasons configured beforehand for the issuer.
As a result, the card is active in our system.'
consumes:
- application/json
produces:
- application/json
parameters:
- name: WL-Correlation-ID
in: header
required: false
type: string
- name: WL-Origin
in: header
required: false
type: string
- name: WL-Username
in: header
required: false
type: string
- name: filter
in: query
description: Filtered Fields
required: false
type: array
items:
type: string
collectionFormat: multi
- name: issuerId
in: path
description: Issuer ID
required: true
type: string
- name: issuerCardExternalReference
in: path
description: Issuer Card External Reference
required: true
type: string
- in: body
name: body
required: false
schema:
$ref: '#/definitions/ActivateCardRequest'
responses:
'400':
description: Bad request
schema:
$ref: '#/definitions/BadRequestErrorApiResponse'
'401':
description: Unauthorized
schema:
$ref: '#/definitions/UnauthorizedErrorApiResponse'
'403':
description: Forbidden
schema:
$ref: '#/definitions/ForbiddenErrorApiResponse'
'404':
description: Not found
schema:
$ref: '#/definitions/NotFoundErrorApiResponse'
'500':
description: Internal server error
schema:
$ref: '#/definitions/InternalServerErrorErrorApiResponse'
'502':
description: Bad gateway
schema:
$ref: '#/definitions/BadGatewayErrorApiResponse'
'200':
description: OK
schema:
$ref: '#/definitions/ApiResponseEntityActivateCardResponse'
security:
- basic: []
deprecated: false
/issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/block:
post:
tags:
- Card
summary: Block a card by external reference
operationId: blockCardByIssuerExtRef
description: "The API allows blocking a card permanently (immediately or in the future) or temporarily, depending on the configured blocking reason, using the Issuer Card External Reference or the Card Reference.\n\n- The card must be in “Created”, “Active”, or “Deactivated” status (“Deactivated” only if a reason for permanent blocking is requested).\n- The blocking reason is chosen among those configured beforehand for the issuer.\n\nExample Use Cases:\n- Use case 1: Card is blocked permanently (e.g., lost, stolen, not delivered, fraudulent activity).\n Result: The card is definitively blocked in our system (final status).\n- Use case 2: Card compromised in Common Point of Purchase (CPP); a permanent block is scheduled, but the cardholder can still use the card for PIN-based transactions.\n Result: The card remains active, and a permanent block is scheduled.\n- Use case 3: Card is blocked temporarily due to fraud suspicion (e.g., by issuer or fraud system).\n Result: The card is temporarily blocked and can be unblocked later.\n\nBlocking Information Updates via API:\n- When the card is already blocked:\n - Blocking reason (among those available for the issuer)\n - Blocking detail\n - Lost and stolen date (if the reason is LOST or STOLEN)\n - Fraud process\n - Flag indicating whether the PIN is compromised\n - Scheduled blocking information (delay or blocking reason if the delay is not yet reached)\n- When the card is active:\n - Scheduled blocking information (delay or blocking reason if the delay is not yet reached)"
consumes:
- application/json
produces:
- application/json
parameters:
- name: WL-Correlation-ID
in: header
required: false
type: string
- name: WL-Origin
in: header
required: false
type: string
- name: WL-Username
in: header
required: false
type: string
- name: filter
in: query
description: Filtered Fields
required: false
type: array
items:
type: string
collectionFormat: multi
- name: issuerId
in: path
description: Issuer ID
required: true
type: string
- name: issuerCardExternalReference
in: path
description: Issuer Card External Reference
required: true
type: string
- in: body
name: body
required: false
schema:
$ref: '#/definitions/BlockCardRequest'
responses:
'400':
description: Bad request
schema:
$ref: '#/definitions/BadRequestErrorApiResponse'
'401':
description: Unauthorized
schema:
$ref: '#/definitions/UnauthorizedErrorApiResponse'
'403':
description: Forbidden
schema:
$ref: '#/definitions/ForbiddenErrorApiResponse'
'404':
description: Not found
schema:
$ref: '#/definitions/NotFoundErrorApiResponse'
'500':
description: Internal server error
schema:
$ref: '#/definitions/InternalServerErrorErrorApiResponse'
'502':
description: Bad gateway
schema:
$ref: '#/definitions/BadGatewayErrorApiResponse'
'200':
description: OK
schema:
$ref: '#/definitions/ApiResponseEntityBlockCardResponse'
security:
- basic: []
deprecated: false
/issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/block-and-replace:
post:
x-wl-idempotent: true
x-wl-lra-operation: true
tags:
- Card
summary: Block and replace a card by external reference
operationId: blockAndReplaceCardByIssuerExtRef
description: "The API allows a card identified by the Issuer Card External Reference or the Card Reference to be blocked and replaced.\nThis API regroups Block a card (for card blocking or blocking information update) and Replace a card APIs in a single request.\nAs result, the card is blocked and the new card is created.\nIf any error occurs while card blocking or card replacing, the card is neither blocked nor replaced.\n\nWith this API, it is also possible to block all cards having the same PAN than the card referenced by Issuer Card External Reference or the Card Reference. In this case Block all cards API is called instead Block a card API.\n\nIn case a product change on renewal is planned on the contract of the card to be replaced, the card will not be replaced but the product change will be forced instead. From the replace card request, only blocking reason and embossingName/embossingName2ndLine will be considered : \n- If blocking reason is provided (for temporary blocking only), the new card of the new contract is blocked with this reason\n- If embossingName and/or embossingName2ndLine are provided, they will be applied to the old card and will be transferred to the new card of the new contract.\nIn the request response, information related to the new contract and the product change will be returned.\n\nIdempotency is managed by the API; that is, if the request with the same WL-Correlation-ID is sent multiple times, it will be executed only once.The response will be retrieved directly from our system."
consumes:
- application/json
produces:
- application/json
parameters:
- name: WL-Correlation-ID
in: header
required: false
type: string
- name: WL-Origin
in: header
required: false
type: string
- name: WL-Username
in: header
required: false
type: string
- name: filter
in: query
description: Filtered Fields
required: false
type: array
items:
type: string
collectionFormat: multi
- name: issuerId
in: path
description: Issuer ID
required: true
type: string
- name: issuerCardExternalReference
in: path
description: Issuer Card External Reference
required: true
type: string
- in: body
name: body
required: false
schema:
$ref: '#/definitions/BlockAndReplaceCardRequest'
responses:
'400':
description: Bad request
schema:
$ref: '#/definitions/BadRequestErrorApiResponse'
'401':
description: Unauthorized
schema:
$ref: '#/definitions/UnauthorizedErrorApiResponse'
'403':
description: Forbidden
schema:
$ref: '#/definitions/ForbiddenErrorApiResponse'
'404':
description: Not found
schema:
$ref: '#/definitions/NotFoundErrorApiResponse'
'500':
description: Internal server error
schema:
$ref: '#/definitions/InternalServerErrorErrorApiResponse'
'502':
description: Bad gateway
schema:
$ref: '#/definitions/BadGatewayErrorApiResponse'
'200':
description: OK
schema:
$ref: '#/definitions/ApiResponseEntityBlockAndReplaceCardResponse'
security:
- basic: []
deprecated: false
/issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/card-contract:
get:
tags:
- Card
summary: Retrieve card contract for a card by external reference
operationId: retrieveCardContractForCardByIssuerExtRef
description: "The API enables the card contract information related to a given card to be retrieved.\nThe main input fields are:\n•\tThe issuer ID\n•\tThe card for which the detail is requested: It can be provided by using the card reference or the issuer card external reference. \nIt is also possible to request some additional data by using the embedded fields (such as the list of models linked to the card contract, the account identifiers linked to the card contract, the identifiers and the information of the linked cards).\nIn return, the interface provides the generic information (mainly master data) relevant to the card contract."
produces:
- application/json
parameters:
- name: WL-Correlation-ID
in: header
required: false
type: string
- name: WL-Origin
in: header
required: false
type: string
- name: WL-Username
in: header
required: false
type: string
- name: filter
in: query
description: Filtered Fields
required: false
type: array
items:
type: string
collectionFormat: multi
- name: issuerId
in: path
description: Issuer ID
required: true
type: string
- name: issuerCardExternalReference
in: path
description: Issuer Card External Reference
required: true
type: string
- name: embed
in: query
description: Embedded Fields
required: false
type: array
items:
type: string
enum:
- selectedModels
- cardIdentifiers
- relatedAccounts
- cards
collectionFormat: multi
responses:
'400':
description: Bad request
schema:
$ref: '#/definitions/BadRequestErrorApiResponse'
'401':
description: Unauthorized
schema:
$ref: '#/definitions/UnauthorizedErrorApiResponse'
'403':
description: Forbidden
schema:
$ref: '#/definitions/ForbiddenErrorApiResponse'
'404':
description: Not found
schema:
$ref: '#/definitions/NotFoundErrorApiResponse'
'500':
description: Internal server error
schema:
$ref: '#/definitions/InternalServerErrorErrorApiResponse'
'502':
description: Bad gateway
schema:
$ref: '#/definitions/BadGatewayErrorApiResponse'
'200':
description: OK
schema:
$ref: '#/definitions/ApiResponseEntityCardContract'
security:
- basic: []
deprecated: false
/issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/card-events:
get:
tags:
- Card
summary: Retrieve card event list (e.g. PIN change information) by external reference
operationId: listCardEventsByIssuerExternalRef
description: The API enables the events information related to a given card to be retrieved (e.g. status change such as card blocking/card activation, card issuing for replacement or renewal, PIN change.).
produces:
- application/json
parameters:
- name: issuerId
in: path
description: Issuer ID
required: true
type: string
- name: issuerCardExternalReference
in: path
description: Issuer Card External Reference
required: true
type: string
- name: WL-Correlation-ID
in: header
required: false
type: string
- name: WL-Origin
in: header
required: false
type: string
- name: WL-Username
in: header
required: false
type: string
- name: filter
in: query
description: Filtered Fields
required: false
type: array
items:
type: string
collectionFormat: multi
- name: eventType
in: query
description: 'Type of event to return.
Possible values are :
PINChange, TanMailerOrderIssuing, CardOrderIssuing, PinMailerOrderIssuing, TanMailerOrderExtraction, CardOrderExtraction, PinMailerOrderExtraction, CancelCardOrderIssuing, CancelTanMailerOrderIssuing, CancelPinMailerOrderIssuing, CardActivation, CardIssuing, CardCancellation, CardDeactivation, CardBlocking, CardUnblocking.'
required: false
type: array
items:
type: string
collectionFormat: multi
responses:
'400':
description: Bad request
schema:
$ref: '#/definitions/BadRequestErrorApiResponse'
'401':
description: Unauthorized
schema:
$ref: '#/definitions/UnauthorizedErrorApiResponse'
'403':
description: Forbidden
schema:
$ref: '#/definitions/ForbiddenErrorApiResponse'
'404':
description: Not found
schema:
$ref: '#/definitions/NotFoundErrorApiResponse'
'500':
description: Internal server error
schema:
$ref: '#/definitions/InternalServerErrorErrorApiResponse'
'502':
description: Bad gateway
schema:
$ref: '#/definitions/BadGatewayErrorApiResponse'
'200':
description: OK
schema:
$ref: '#/definitions/ApiResponseEntityListCardEvent'
security:
- basic: []
deprecated: false
/issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/deactivate:
post:
tags:
- Card
summary: Deactivate a card by external reference
operationId: deactivateCardByIssuerExtRef
description: 'The API allows an active card, or a temporary blocked card, to be deactivated on demand, by using the Issuer Card External Reference or the Card Reference.
The deactivation reason is chosen from the reasons configured beforehand for the issuer.
As a result, the card is deactivated in our system.
This process is not reversible. New card authorizations are declined. If necessary, a request for a card replacement may be made by the issuer.
This API allows also to cancel a card in “Created” status, e.g., when the card production has failed.'
consumes:
- application/json
produces:
- application/json
parameters:
- name: WL-Correlation-ID
in: header
required: false
type: string
- name: WL-Origin
in: header
required: false
type: string
- name: WL-Username
in: header
required: false
type: string
- name: filter
in: query
description: Filtered Fields
required: false
type: array
items:
type: string
collectionFormat: multi
- name: issuerId
in: path
description: Issuer ID
required: true
type: string
- name: issuerCardExternalReference
in: path
description: Issuer Card External Reference
required: true
type: string
- in: body
name: body
required: false
schema:
$ref: '#/definitions/DeactivateCardRequest'
responses:
'400':
description: Bad request
schema:
$ref: '#/definitions/BadRequestErrorApiResponse'
'401':
description: Unauthorized
schema:
$ref: '#/definitions/UnauthorizedErrorApiResponse'
'403':
description: Forbidden
schema:
$ref: '#/definitions/ForbiddenErrorApiResponse'
'404':
description: Not found
schema:
$ref: '#/definitions/NotFoundErrorApiResponse'
'500':
description: Internal server error
schema:
$ref: '#/definitions/InternalServerErrorErrorApiResponse'
'502':
description: Bad gateway
schema:
$ref: '#/definitions/BadGatewayErrorApiResponse'
'200':
description: OK
schema:
$ref: '#/definitions/ApiResponseEntityDeactivateCardResponse'
security:
- basic: []
deprecated: false
/issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/new-tan:
post:
x-wl-idempotent: true
tags:
- Card
summary: Create new TAN by external reference
operationId: createTanByIssuerExtRef
description: "For PIN self-selection without a direct bank connection to the card issuing institute - i.e., without online banking access - Worldline offers the variant PIN change with TAN (Trusted Authentication Number). \nThis applies in particular to card programs where the bank is the card issuer for another partner, e.g., TUI or eBay.\nThe API allows to generate a TAN, which is used as a one-time password, printed and sent to cardholder in order to change card pin by e.g. IVR.\n\nIdempotency is managed by the API; that is, if the request with the same WL-Correlation-ID is sent multiple times, it will be executed only once.The response will be retrieved directly from our system."
consumes:
- application/json
produces:
- application/json
parameters:
- name: WL-Correlation-ID
in: header
required: false
type: string
- name: WL-Origin
in: header
required: false
type: string
- name: WL-Username
in: header
required: false
type: string
- name: filter
in: query
description: Filtered Fields
required: false
type: array
items:
type: string
collectionFormat: multi
- name: issuerId
in: path
description: Issuer ID
required: true
type: string
- name: issuerCardExternalReference
in: path
description: Issuer Card External Reference
required: true
type: string
- in: body
name: body
required: true
schema:
$ref: '#/definitions/CreateTanRequest'
responses:
'400':
description: Bad request
schema:
$ref: '#/definitions/BadRequestErrorApiResponse'
'401':
description: Unauthorized
schema:
$ref: '#/definitions/UnauthorizedErrorApiResponse'
'403':
description: Forbidden
schema:
$ref: '#/definitions/ForbiddenErrorApiResponse'
'404':
description: Not found
schema:
$ref: '#/definitions/NotFoundErrorApiResponse'
'500':
description: Internal server error
schema:
$ref: '#/definitions/InternalServerErrorErrorApiResponse'
'502':
description: Bad gateway
schema:
$ref: '#/definitions/BadGatewayErrorApiResponse'
'200':
description: OK
schema:
$ref: '#/definitions/ApiResponseEntityCreateTanResponse'
security:
- basic: []
deprecated: false
/issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/orders:
get:
tags:
- Card
summary: List orders for a card by external reference
operationId: listOrdersForCardByIssuerExtRef
description: 'The API enables the orders information related to a given card to be retrieved.
The response can also be enriched (if specified as embedded fields in input) with additional data such as the orders status history of the card, the card information.'
produces:
- application/json
parameters:
- name: WL-Correlation-ID
in: header
required: false
type: string
- name: WL-Origin
in: header
required: false
type: string
- name: WL-Username
in: header
required: false
type: string
- name: filter
in: query
description: Filtered Fields
required: false
type: array
items:
type: string
collectionFormat: multi
- name: issuerId
in: path
description: Issuer ID
required: true
type: string
- name: issuerCardExternalReference
in: path
description: Issuer Card External Reference
required: true
type: string
- name: orderType
in: query
description: Order type to retrieve (CardOrder, PinMailerOrder or TanMailerOrder)
required: false
type: string
- name: embed
in: query
description: Embedded Fields
required: false
type: array
items:
type: string
enum:
- card
- statusHistory
collectionFormat: multi
responses:
'400':
description: Bad request
schema:
$ref: '#/definitions/BadRequestErrorApiResponse'
'401':
description: Unauthorized
schema:
$ref: '#/definitions/UnauthorizedErrorApiResponse'
'403':
description: Forbidden
schema:
$ref: '#/definitions/ForbiddenErrorApiResponse'
'404':
description: Not found
schema:
$ref: '#/definitions/NotFoundErrorApiResponse'
'500':
description: Internal server error
schema:
$ref: '#/definitions/InternalServerErrorErrorApiResponse'
'502':
description: Bad gateway
schema:
$ref: '#/definitions/BadGatewayErrorApiResponse'
'200':
description: OK
schema:
$ref: '#/definitions/ApiResponseEntityListOrder'
security:
- basic: []
deprecated: false
/issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/remind-pin:
post:
x-wl-idempotent: true
tags:
- Card
summary: Remind pin for a card by external reference
description: 'The API allows a PIN reminder to be requested for a card, identified by the Issuer Card External Reference or the Card Reference when a cardholder forgot its PIN.
The card must be in “ACTIVE” status.
As a result, a PIN mailer order is generated.
Idempotency is managed by the API; that is, if the request with the same WL-Correlation-ID is sent multiple times, it will be executed only once.The response will be retrieved directly from our system.'
operationId: remindPINByIssuerExtRef
consumes:
- application/json
produces:
- application/json
parameters:
- name: WL-Correlation-ID
in: header
required: false
type: string
- name: WL-Origin
in: header
required: false
type: string
- name: WL-Username
in: header
required: false
type: string
- name: filter
in: query
description: Filtered Fields
required: false
type: array
items:
type: string
collectionFormat: multi
- name: issuerId
in: path
description: Issuer ID
required: true
type: string
- name: issuerCardExternalReference
in: path
description: Issuer Card External Reference
required: true
type: string
- in: body
name: body
required: false
schema:
$ref: '#/definitions/RemindPINRequest'
responses:
'400':
description: Bad request
schema:
$ref: '#/definitions/BadRequestErrorApiResponse'
'401':
description: Unauthorized
schema:
$ref: '#/definitions/UnauthorizedErrorApiResponse'
'403':
description: Forbidden
schema
# --- truncated at 32 KB (295 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/wordline/refs/heads/main/openapi/wordline-card-api-openapi.yml