Initiate card data retrieval

Endpoint to initiate retrieval of card data. This will enable the end user make e-commerce transactions without needing access to a plastic card. This means that the end user will get access to card number (PAN), expiry date and CVC2/CVV2. This operation will generate an access token used to view the card data, enabling end users to access their card data through their own devices, via app or web interface.

Supporting the possibility to copy the card data to the devices clipboard should be examined with caution. The data lifespan and the access to the device clipboards varies between operating systems which introduces risk. So while recognising that the possibility to copy the card data can improve end-user experience, the potential increased risk of such a feature should be considered.

Process description

1. End user request to see the card data (Pan number, exp. date and CVV) through its own devices, via app or web interface.
2. The end user request triggers a request to Enfuce Card API (/v4/card/{cardId}/controlToken)
   • The request will fail if cardId is not valid.
   • Besides cardId, no additional validation is done. This means that Enfuce will not validate open-to-buy, card status or usage limiters of the card when responding to request. In order to validate if a purchase can be done with card data in question, separate API calls should be done to retrieve real time status of card and it´s balance.
3. The successful response from this endpoint returns a token and two URLs
   • Note the token is valid for 30 seconds which is the deadline for the end user device to make the POST call to retrieve the HTML snapshot
4. The end users device is instructed to access the returned URL to view the card data
   • Mobile app retrieves the HTML snapshot with card data by executing a POST call to the cardDataUrl with the content of the token in a form field named token.
   • Desktop browser opens iframe to cardDataFrameUrl with query parameter key. Key needs to agreed with Enfuce beforehand. After that is loaded, parent page makes window.postMessage() call to the iframe. Posted message object contains field operation with value view-pan and field token. Example: