Worldline Card - Order API

openapi: 3.2.0
info:
  description: 'The current set of APIs will be available in Q2 2026 on Worldline Global Issuing Platforms.

    Additional APIs are under construction and planned to be available in 2026.'
  version: 2.41.1
  title: Worldline Card Issuing Card - Order API
  contact: {}
servers:
- url: https://sbx-wlip.api1-eu2.psapigateway.preprod.giservices.io/card-issuing/api/v2
tags:
- name: Card - Order
  description: Card Order Api Controller
paths:
  /issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/orders/{orderReference}:
    get:
      tags:
      - Card - Order
      summary: Retrieve card order by external reference
      description: 'The API enables the order information (card, PIN mailer or TAN mailer order) related to a given card to be retrieved. The order is identified with order reference.


        The response can also be enriched (if specified as embedded fields in input) with additional data such as the orders status history of the card, the card information.'
      operationId: retrieveOrderByCardIssuerExtRef
      parameters:
      - name: WL-Correlation-ID
        in: header
        required: false
        schema:
          type: string
      - name: WL-Origin
        in: header
        required: false
        schema:
          type: string
      - name: WL-Username
        in: header
        required: false
        schema:
          type: string
      - name: filter
        in: query
        description: Filtered Fields
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - name: issuerId
        in: path
        description: Issuer ID
        required: true
        schema:
          type: string
      - name: issuerCardExternalReference
        in: path
        description: Issuer Card External Reference
        required: true
        schema:
          type: string
      - name: orderReference
        in: path
        description: Order Reference
        required: true
        schema:
          type: string
      - name: embed
        in: query
        description: Embedded Fields
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - card
            - statusHistory
      responses:
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestErrorApiResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedErrorApiResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenErrorApiResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundErrorApiResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorErrorApiResponse'
        '502':
          description: Bad gateway
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadGatewayErrorApiResponse'
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiResponseEntityOrder'
      security:
      - basic: []
      deprecated: false
  /issuers/{issuerId}/cards/external-cards/{issuerCardExternalReference}/orders/{orderReference}/release:
    post:
      tags:
      - Card - Order
      summary: 'This API is deprecated.

        The Release orders for a card API must be used to release all orders related to a card.'
      operationId: releaseCardOrderByCardIssuerExtRef
      parameters:
      - name: WL-Correlation-ID
        in: header
        required: false
        schema:
          type: string
      - name: WL-Origin
        in: header
        required: false
        schema:
          type: string
      - name: WL-Username
        in: header
        required: false
        schema:
          type: string
      - name: filter
        in: query
        description: Filtered Fields
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - name: issuerId
        in: path
        description: Issuer ID
        required: true
        schema:
          type: string
      - name: issuerCardExternalReference
        in: path
        description: Issuer Card External Reference
        required: true
        schema:
          type: string
      - name: orderReference
        in: path
        description: Order Reference
        required: true
        schema:
          type: string
      responses:
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestErrorApiResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedErrorApiResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenErrorApiResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundErrorApiResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorErrorApiResponse'
        '502':
          description: Bad gateway
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadGatewayErrorApiResponse'
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiResponseEntityReleaseOrderResponse'
      security:
      - basic: []
      deprecated: true
  /issuers/{issuerId}/cards/{cardReference}/orders/{orderReference}:
    get:
      tags:
      - Card - Order
      summary: Retrieve card order
      description: 'The API enables the order information (card, PIN mailer or TAN mailer order) related to a given card to be retrieved. The order is identified with order reference.


        The response can also be enriched (if specified as embedded fields in input) with additional data such as the orders status history of the card, the card information.'
      operationId: retrieveOrder
      parameters:
      - name: WL-Correlation-ID
        in: header
        required: false
        schema:
          type: string
      - name: WL-Origin
        in: header
        required: false
        schema:
          type: string
      - name: WL-Username
        in: header
        required: false
        schema:
          type: string
      - name: filter
        in: query
        description: Filtered Fields
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - name: issuerId
        in: path
        description: Issuer ID
        required: true
        schema:
          type: string
      - name: cardReference
        in: path
        description: Card Reference
        required: true
        schema:
          type: string
      - name: orderReference
        in: path
        description: Order Reference
        required: true
        schema:
          type: string
      - name: embed
        in: query
        description: Embedded Fields
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            enum:
            - card
            - statusHistory
            - card.cardContract
      responses:
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestErrorApiResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedErrorApiResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenErrorApiResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundErrorApiResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorErrorApiResponse'
        '502':
          description: Bad gateway
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadGatewayErrorApiResponse'
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiResponseEntityOrder'
      security:
      - basic: []
      deprecated: false
  /issuers/{issuerId}/cards/{cardReference}/orders/{orderReference}/release:
    post:
      tags:
      - Card - Order
      summary: 'This API is deprecated.

        The Release orders for a card API must be used to release all orders related to a card.'
      operationId: releaseCardOrder
      parameters:
      - name: WL-Correlation-ID
        in: header
        required: false
        schema:
          type: string
      - name: WL-Origin
        in: header
        required: false
        schema:
          type: string
      - name: WL-Username
        in: header
        required: false
        schema:
          type: string
      - name: filter
        in: query
        description: Filtered Fields
        required: false
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - name: issuerId
        in: path
        description: Issuer ID
        required: true
        schema:
          type: string
      - name: cardReference
        in: path
        description: Card Reference
        required: true
        schema:
          type: string
      - name: orderReference
        in: path
        description: Order Reference
        required: true
        schema:
          type: string
      responses:
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestErrorApiResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedErrorApiResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenErrorApiResponse'
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundErrorApiResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalServerErrorErrorApiResponse'
        '502':
          description: Bad gateway
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadGatewayErrorApiResponse'
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiResponseEntityReleaseOrderResponse'
      security:
      - basic: []
      deprecated: true
components:
  schemas:
    InternalServerErrorResponseMetadata:
      type: object
      required:
      - correlationId
      - responseDateTime
      - statusCode
      - statusMessage
      properties:
        correlationId:
          type: string
          description: Correlation Identifier
        responseDateTime:
          type: string
          example: format:yyyy-MM-dd'T'HH:mm:ss.SSSZ
          description: Timestamp when response date was generated
        statusCode:
          type: integer
          format: int32
          example: 500
          description: HTTP status code
        statusMessage:
          type: string
          example: Internal server error
          description: Executed REST API status message
      title: InternalServerErrorResponseMetadata
    Order:
      type: object
      properties:
        issuerId:
          type: string
          description: Issuer identifier (unique per platform)
        orderType:
          type: string
          description: 'The order can correspond to a card, a PIN mailer or a TAN mailer.

            Possible values are : CardOrder, PinMailerOrder, TanMailerOrder'
        orderIdentifier:
          description: 'Unique identifier of the order (mandatory)

            Refer to OrderIdentifier data type for detail information'
          allOf:
          - $ref: '#/components/schemas/OrderIdentifier'
        currentExternalStatus:
          type: string
          description: 'Current external status of the order (optional)

            The list of external statuses is configurable per issuer.

            The external status can be used to follow the card producing status for the card order e.g. received, embossed, sent, etc.'
        currentExternalStatusDate:
          type: string
          format: date-time
          description: Modification date of the last external status of the order (optional)
        currentInternalStatus:
          type: string
          description: 'Current internal status of the order (mandatory)

            Possible values: are: CREATED, CONFIRMED, ORDERED, REJECTED, CANCELLED, FINISHED, ORDERABLE'
        currentInternalStatusDate:
          type: string
          format: date-time
          description: Last modification date of the internal status of the order (optional)
        sendingMode:
          type: string
          description: 'Code identifying the desired sending mode for the order (mandatory)

            Example: Normal, Urgent, Ultra Urgent'
        deliveryChannel:
          type: string
          description: 'Code of the delivery channel for the card

            The list of delivery channels is configurable per Issuer.'
        deliveryType:
          type: string
          description: 'Indicates whether the delivery of the card should be to branch or customer (instead of the one from the distribution rule of the card product) (optional)

            Possible values: CUSTOMER (the card is to be delivered to the customer address, BRANCH (the card is to be delivered to the bank branch)'
        orderReason:
          type: string
          description: 'Reason why the order is done (mandatory)

            Possible values are: CARD_RENEWAL, PIN_CARD_RENEWAL, FIRST_CARD_ISSUE, FIRST_PIN_CARD_ISSUE, CARD_REPLACEMENT, PIN_CARD_REPLACEMENT, PIN_REMINDER, PIN_REORDER, TAN_REQUEST'
        statusHistory:
          type: array
          description: 'List of order status history data

            Refer to OrderStatusHistory data type for detail information.

            _Embedded property, only filled when available for the endpoint and explicitly requested in the ''embed'' query parameter._'
          items:
            $ref: '#/components/schemas/OrderStatusHistory'
        cardProducer:
          type: string
          description: 'It is the card producer or embosser.

            It is present if it is different than the default one (defined in the card profile) and was provided when requesting the card creation.

            The list of allowed card producer is configurable per issuer.'
        pinMailerEditor:
          type: string
          description: 'It is the PIN mailer printer.

            It is present if it is different than the default one (defined in the card profile) and was provided when requesting the card/PIN creation.

            The list of allowed PIN mailer editors is configurable by issuer.'
        deliveryBranchCode:
          type: string
          description: 'Code of the delivery branch (mandatory only if card delivery type is BRANCH)

            The list of issuer branches is configurable  per Issuer.

            The branch code is used to access a preconfigured Postal address (configured in the system).'
        customDeliveryAddressee:
          type: string
          description: "Custom postal address to send the order \n Depending on countries, the address format (mainly for line1, line 2, line3, line4 and line5) can have specific conditions such as length restriction. The customer should contact WL to check the address format and have more information."
        customDeliveryAddress:
          description: 'Custom postal address to send the order

            Depending on countries, the address format (mainly for line1, line 2, line3, line4 and line5) can have specific conditions such as length restriction. The customer should contact WL to check the address format and have more information.'
          allOf:
          - $ref: '#/components/schemas/MailAddress'
        customDeliveryPhone:
          description: 'Custom phone to send the card.

            NOT USED'
          allOf:
          - $ref: '#/components/schemas/PhoneNumber'
        customDeliveryEmail:
          description: 'Custom email to send the card.

            NOT USED'
          allOf:
          - $ref: '#/components/schemas/EmailAddress'
        specificFields:
          type: object
          description: 'List of external data {"label":"value"} separated by a "," related to an order that can be provided by e.g. the issuer for information or for usage by other systems. Example : {"label1":"value1","label2":"value2"} Those provided data have no impact on our system business processes.'
          additionalProperties:
            type: string
        card:
          description: 'Card information related to the order.

            _Embedded property, only filled when available for the endpoint and explicitly requested in the ''embed'' query parameter._'
          allOf:
          - $ref: '#/components/schemas/Card'
        cardIdentifier:
          description: Unique identifier of the card
          allOf:
          - $ref: '#/components/schemas/CardIdentifier'
        embossingFileName:
          type: string
          description: Embossing file name in CardOrder
        tanOrigin:
          type: string
          description: Origin of the TAN request, e.g. GUI. (free text)
        tanBackupMethod:
          type: string
          description: The backup method that should be applied for TAN mailer order.
        tanExpiryDate:
          type: string
          format: date-time
          description: Expiry date of the TAN, date until which the TAN can used (mandatory for TanMailerOrder)
        tanStatus:
          type: string
          description: 'Status of the TAN (mandatory for TanMailerOrder)

            Possible values: CREATED, FAILED, ACTIVE, USED, EXPIRED'
        freeTanMailerCounter:
          type: integer
          description: Number of free TAN requests (optional)
        tanUsageDate:
          type: string
          format: date-time
          description: Date when the TAN was used to change the PIN (optional)
        free:
          type: boolean
          description: Indicates if the operation is free (true) or not (false). Default value is false (mandatory)
        tanValue:
          type: string
          description: Clear value of the TAN (mandatory for TanMailerOrder)
        feeConditions:
          type: array
          description: Conditions of the fee generation (if fee configured in the product) (optional)
          items:
            $ref: '#/components/schemas/FeeCondition'
        notExtractedReason:
          type: string
          description: In case the order will not be extracted because of invalid customer address, then it will be indicated in this field
        notExtractedUpdateDate:
          type: string
          format: date-time
          description: The last update date of notExtractedReason field
        waitingPin:
          type: boolean
          format: date-time
          description: 'This flag is used only for a card order or a PIN mailer order.

            - If this flag is true, the PIN is waiting to be provided by the cardholder (the mode “Self Selected Pin” is activated in the PIN production model). Depending on the configuration, after x days, the card is extracted with a default PIN if the cardholder has not provided a PIN.

            - If this flag is false, the PIN is not waiting to be provided , e.g. the PIN has been generated by PMM or provided by the cardholder.'
      title: Order
    ProductExtensionIdentifier:
      properties:
        issuerProductExtensionExternalReference:
          description: External reference of the product extension provided by the issuer and defined for a product (e.g. it can be used when adding cards and accounts to a contract )
          type: string
      title: ProductExtensionIdentifier
      type: object
    ResponseMetadata:
      type: object
      required:
      - correlationId
      - responseDateTime
      - statusCode
      - statusMessage
      properties:
        correlationId:
          type: string
          description: Correlation Identifier
        links:
          description: Metadata Links
          allOf:
          - $ref: '#/components/schemas/Links'
        statusMessage:
          type: string
          example: Executed successfully
          description: Executed REST API status message
        statusCode:
          type: integer
          format: int32
          example: 200
          description: HTTP status code
        responseDateTime:
          type: string
          example: format:yyyy-MM-dd'T'HH:mm:ss.SSSZ
          description: Timestamp when response date was generated
        timeTakenMs:
          type: integer
          format: int64
          example: 12
          description: Wall clock time required from service to generate the response
      title: ResponseMetadata
    BadRequestErrorApiResponse:
      type: object
      required:
      - responseMetadata
      properties:
        responseMetadata:
          allOf:
          - $ref: '#/components/schemas/BadRequestResponseMetadata'
      title: BadRequestErrorApiResponse
    CardContract:
      type: object
      properties:
        issuerId:
          type: string
          description: Issuer identifier (unique per platform)
        cardContractIdentifier:
          description: Identification of the card contract either by Issuer card contract external reference or by card contract reference
          allOf:
          - $ref: '#/components/schemas/CardContractIdentifier'
        cardTemplateReference:
          type: string
          description: Card template reference used for card contract creation
        cardTypeCode:
          type: string
          description: Scheme card type from the card profile
        cardTypeLabel:
          type: string
          description: Scheme card type label from the card profile
        status:
          type: string
          description: 'Status of the card contract (mandatory)

            The status of the card contract is changing during its life cycle according to business processes in the system.

            Possible values are :

            - CREATED : The first status when the card contract is created. Related card is not activated.

            - ACTIVE : The card contract is active. Related card is activated as per product configuration

            Examples of business processes triggering this status: contract creation request, contract creation after a product change request.

            - CLOSED : The card contract is closed and the associated card is deactivated/cancelled (if not already permanently blocked). Card renewal and card replacement are not possible.

            Examples of business processes triggering this status: contract closing request, card contract closing request, contract closure after a product change request.'
        openingDate:
          type: string
          format: date-time
          description: Creation date of the card contract (mandatory)
        activationDate:
          type: string
          format: date-time
          description: Date when the card contract becomes active in our system
        closingDate:
          type: string
          format: date-time
          description: Closing date of the card contract (present only in case of card contract is already closed or card contract closing is scheduled)
        closingComment:
          type: string
          description: 'Comment associated with the card contract closing action (optional)

            Free text'
        closingReason:
          type: string
          description: Indicates the reason for closing the card contract (present only in case of card contract is already closed or card contract closing is scheduled) Free text
        closingDelayType:
          type: string
          description: 'The closing type of the card contract (present only in case of card contract is already closed or card contract closing is scheduled)

            The closing type can be:

            IMMEDIATE (at current date)

            SCHEDULED (at future date, greater than the current date)

            SCHEDULED_EXP_DATE (at the expiration date of active card)'
        trustedAuthenticationReference:
          type: string
          description: 'Unique reference generated by card management system used as trusted authentication credential

            It is related to a card. Same reference is used in case of card renewal/replacement.

            Used for ACS enrolment (3D Secure)'
        newCardRenewalAllowed:
          type: boolean
          description: "Indicates if the renewal is allowed for a card (true) or not (false). \nDefault value is true."
        blockingRenewalReasonCode:
          type: string
          description: 'Reason for blocking the renewal of a card (optional)

            The list of renewal blocking reasons is configurable per issuer (For example : LOST, CREDIT_RISK, FRAUDULENT …)'
        newCardReplacementAllowed:
          type: boolean
          description: 'Indicates if the replacement is allowed for a card (true) or not (false). Default value is false '
        blockingReplacementReasonCode:
          type: string
          description: Reason for blocking the replacement of a card (optional) The list of replacement blocking reasons is configurable per issuer (For example, CONTRACT_SUSPENSION …)
        blockingPinReorderReasonCode:
          type: string
          description: 'Mandatory reason to be set for blocking a pin reorder

            The list of blocking reasons for pin reorder is configurable per issuer (For example, CONTRACT_SUSPENSION …)'
        newPinReorderAllowed:
          type: boolean
          description: The pin reorder process can be blocked (blocking pin reorder reason code must be provided) or not.
        blockingPinReminderReasonCode:
          type: string
          description: 'Mandatory reason to be set for blocking pin reminder

            The list of blocking reasons for pin reminder is configurable per issuer (For example, CONTRACT_SUSPENSION …)'
        newPinReminderAllowed:
          type: boolean
          description: The pin reminder process can be blocked (blocking pin reminder reason code must be provided) or not.
        issuerBranchCode:
          type: string
          description: 'The Branch code (optional)

            By default, the value is NO_BRANCH.'
        artwork:
          type: string
          description: Artwork (card design) defined for the card contract (mandatory)
        forcedEmbossingName:
          type: string
          description: First line of the name to be embossed on the next physical card if provided by the issuer (optional)
        forcedEmbossingName2ndLine:
          type: string
          description: 'The second line of the name to be embossed on the physical card if provided by the issuer (optional)

            Can be present (optional) only if first line of forced embossing name is present and if embossing name calculation algorithm accepts a second line.'
        schemeDeclarationOptOut:
          type: boolean
          description: DEPRECATED
        schemeReportDeclarationBehavior:
          type: string
          description: 'The issuer can indicate if the card events are reported to the scheme. Relevant only if the ABU-VAU program is enabled. If the ABU-VAU program is disabled, the use of this attribute generates an error. Possible values are: OPT_IN: the card events are reported to the scheme, OPT_OUT: the card events are not reported to the scheme. If the ABU-VAU program is enabled and the attribute is empty, the default value set on card product is applied.'
        principalSupplementaryCardIndicator:
          type: string
          description: 'Indicates if it is a Principal card or an additional card (mandatory)

            Possible values: PRINCIPAL, SUPPLEMENTARY'
        productCategory:
          type: string
          description: 'Defines the category of the product (mandatory)

            The list of product categories is configurable per issuer (e.g. CREDIT, DEBIT, PREPAID)'
        productCategoryLabel:
          type: string
          description: 'Label of the product category (optional)

            Example: IMMEDIATE_DEBIT_DEBIT, REVOLVING_CREDIT_CREDIT, DIFFERED_DEBIT_CREDIT'
        specificFields:
          type: object
          description: 'List of external data {"label":"value"} separated by a "," related to a card contract that can be provided by e.g. the issuer for information or for usage by other systems. Example : {"label1":"value1","label2":"value2"} Those provided data have no impact on our system business processes.'
          additionalProperties:
            type: string
        productIdentifier:
          description: Identifier of the product used to create the contract to which the card contract is belonging. It corresponds also to the identifier of the product used to create the card contract if the card contract is created from the product directly.
          allOf:
          - $ref: '#/components/schemas/ProductIdentifier'
        productExtensionIdentifier:
          description: "Identifier of the product extension used to create the card contract. \n Relevant if the card contract is created from a product extension."
          allOf:
          - $ref: '#/components/schemas/ProductExtensionIdentifier'
        selectedModels:
          type: array
          description: 'List of models linked to the card contract

            _Embedded property, only filled when available for the endpoint and explicitly requested in the ''embed'' query parameter._'
          items:
            $ref: '#/components/schemas/CardContractModel'
        cardClass:
          type: string
          description: 'Information provided by the issuer to categorize cards within a contract.

            The list of allowed card classes is defined by the issuer at its convenience according to its own business rules (e.g special conditions on fees for example) and is configured at product level to be controlled at card creation.'
        cardIdentifiers:
          type: array
          description: 'Card Identifiers

            _Embedded property, only filled when available for the endpoint and explicitly requested in the ''embed'' query parameter._'
          items:
            $ref: '#/components/schemas/CardIdentifier'
        cards

# --- truncated at 32 KB (78 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/wordline/refs/heads/main/openapi/wordline-card-order-api-openapi.yml