---
title: "POST /getCardWithCredentials"
method: POST
path: "/getCardWithCredentials"
tags: ["card"]
---

# POST /getCardWithCredentials

`POST /getCardWithCredentials`

## Request

- Base URL: `https://financial-services.developer.worldline.com` (the document declares no server; this is the origin it was published from)
- URL: `https://financial-services.developer.worldline.com/getCardWithCredentials`
- Auth: none declared
- TypeScript: <https://skmtc.dev/worldline/apis/referential-ws-client/docs/getCardWithCredentials/post.ts> (a function with typed inputs; its response is checked against the schema)

Get a card with its credentials. In case of success, the server should only return success code HTTP 200. In case of error, no retry will be triggered on client side.

## Headers

- `Authorization` string

## Request body

- MessageClientRequestBody: Generic container for every message.
  - `header` Header, required: Metadata of the message.
    - `requestId` string, uuid, required: Unique identifier of the request.
    - `service` string, required: Service code (defined during project).
    - `issuerCode` string, required: Issuer code.
    - `subIssuerCode` string, required: Sub-issuer code.
    - `keyTag` string: Key indicator shared between client and server. If `keyTag` is provided, then this reference should be used to encrypt / decrypt sensitive data (PAN, expiry date).
    - `iv` union
      - string: IV value used for **CBC** encryption. IV is provided only if HUB's IV configuration is set to "RANDOM".
      - string: IV value used for **GCM** encryption. IV is provided only if HUB's IV configuration is set to "RANDOM".
  - `body` ClientRequestBody, required: ClientRequestBody DTO resource representation.
    - `cardHolderId` string, String of 8 to 36 characters - Alphanumeric and '-' (not mandatory, but UUID format is also acceptable), required: Cardholder identifier.
    - `dynamicLinking` DynamicLinking, required: All information of the transaction which could be displayed at cardholder during the authentication process.
      - `xid` string, required: Transaction XID (unique identifier of the transaction).
      - `binAcquirer` string: Bin Acquirer.
      - `browserIP` string: IP address of the Browser used during purchase (IPV4 IPV6).
      - `cardType` 'CREDIT' | 'DEBIT': Card (network) type.
      - `convertedAmount` Amount: Transaction Amount converted in Euro.
        - `amount` string, Numeric string, required: Amount without exponent.
        - `exponent` string, Numeric string, required: Exponent of the amount.
        - `currency` Currency, required: Currency information.
          - `code` string, Numeric string, required: Currency code. Numeric code ISO 4217.
          - `label` string, required: Currency label. Alphabetic code ISO 4217 (String of 3 alpha characters)
      - `transactionAmount` Amount: Transaction Amount converted in Euro.
        - `amount` string, Numeric string, required: Amount without exponent.
        - `exponent` string, Numeric string, required: Exponent of the amount.
        - `currency` Currency, required: Currency information.
          - `code` string, Numeric string, required: Currency code. Numeric code ISO 4217.
          - `label` string, required: Currency label. Alphabetic code ISO 4217 (String of 3 alpha characters)
      - `deviceChannel` string: Indicates the type of channel interface being used to initiate the transaction. 3DS (Corresponding to EMV 3-D Secure Protocol specification)
      - `deviceOs` string: The device OS is provided in INSE message by ACS since 23R1.
      - `amountInd` string: Amount Indicator of the Recurring indicator, available since 24R2. - **01**: Fixed purchase amount - **02**: Variable Purchase amount - **03–79**: Reserved for EMVCo future use (values invalid until defined by EMVCo) - **80–99**: Reserved for DS use
      - `frequencyInd` string: Frequency Indicator of the Recurring indicator, available since 24R2 - **01**: Fixed Frequency - **02**: Variable or Unknown Frequency - **03–79**: Reserved for EMVCo future use (values invalid until defined by EMVCo) - **80–99**: Reserved for DS use
      - `maskedPan` string: Masked PAN from INSE, available since 23R3.
      - `maskedVPan` string: Masked Virtual PAN from INSE, available since 23R3.
      - `merchant` Merchant: Merchant information.
        - `id` string: ID of the merchant.
        - `name` string: Name of the merchant.
        - `url` string: URL of the merchant.
        - `country` string, ISO 3166 standard: Country code of the merchant.
      - `messageCategory` string: Identifies the category of the message for a specific use case. - **01**: PA - **02**: NPA - **03–79**: Reserved for EMVCo future use (values invalid until defined by EMVCo) - **80–99**: Reserved for DS use
      - `network` 'BANCONTACT' | 'CB' | 'MAESTRO' | 'MASTERCARD' | 'VISA': DS network of the purchase Transaction.
      - `purchaseDate` string, yyyyMMddHHmmss: Date and time of the authentication converted into UTC. Date provided by merchant in AReq message.
      - `purchaseInstalData` string: Indicates the maximum number of authorizations permitted for instalment payments, available since 24R2
      - `recurringDate` string, yyyyMMdd: Effective date of the new authorised amount following the first / promotional payment in a recurring or instalment transaction, available since 24R2
      - `recurringExpiry` string, yyyyMMdd: Date after which no further authorisations are performed, available since 24R2
      - `recurringFrequency` string: Indicates the minimum number of days between authorizations for a recurring or instalment transaction, available since 24R2
      - `recurringAmount` Amount: Transaction Amount converted in Euro.
        - `amount` string, Numeric string, required: Amount without exponent.
        - `exponent` string, Numeric string, required: Exponent of the amount.
        - `currency` Currency, required: Currency information.
          - `code` string, Numeric string, required: Currency code. Numeric code ISO 4217.
          - `label` string, required: Currency label. Alphabetic code ISO 4217 (String of 3 alpha characters)
      - `threeDSRequestorAuthenticationInd` string: Indicates the type of Authentication request. This data element provides additional information to the ACS to determine the best approach for handing an authentication request. - **01**: Payment transaction - **02**: Recurring transaction - **03**: Instalment transaction - **04**: Add card - **05**: Maintain card - **06**: Cardholder verification as part of EMV token ID&V - **07–79**: Reserved for EMVCo future use (values invalid until defined by EMVCo) - **80–99**: Reserved for DS use
      - `threeDSRequestorDecMaxTime` string, Numeric String between 1 and 10080.: Indicates the maximum amount of time that the 3DS Requestor will wait for an ACS to provide the results of a Decoupled Authentication transaction (in minutes).
      - `threeDSRequestorDecReqInd` string, 'Y' or 'N': Indicates whether the 3DS Requestor requests the ACS to utilise decoupled authentication and agrees to utilise decoupled authentication if the ACS confirms its use. - **Y**: Decoupled authentication is supported and preferred if challenge is necessary - **N**: Do not use decoupled authentication Note: if the element is not provided, the expected action is for the ACS to interpret as N, do not use decoupled authentication.
      - `threeRIInd` string: Indicates the type of 3RI request. This data element provides additional information to the ACS to determine the best approach for handing an authentication request - **01**: Recurring transaction - **02**: Instalment transaction - **03**: Add card - **04**: Maintain card information - **05**: Account verification - **06**: Split/delayed shipment - **07**: Top-up - **08**: Mail Order - **09**: Telephone Order - **10**: Whitelist status check - **11**: Other payment - **12–79**: Reserved for EMVCo future use (values invalid until defined by EMVCo) - **80–99**: Reserved for DS use
      - `transactionDate` string, String of characters complying with the ISO 8601 datetime format (yyyy-MM-ddTHH:mm:ss): Date of the transaction.
      - `ua` string: User Agent of the Browser used during purchase.
    - `principal` object, required: Type and value pair.
      - `type` 'pan' | 'encryptedPan' | 'cardId' | 'tokenPan', enum, required: Type.
      - `value` string, required: Value.
    - `expiry` object: Type and value pair.
      - `type` 'plain' | 'encrypted', enum, required: Type.
      - `value` string, required: Value.
    - `credentials` object: Type and value pair.
      - `type` 'plain' | 'encrypted', enum, required: Type.
      - `value` string, required: Value.
    - `freeContext` object: Free map of key-value pairs to add specific information.
  - `footer` Footer: Not used.
    - `signature` Signature: Not used. For signature feature, please refer to the `signature` field at the root of the messages.
      - `algorithm` string: Algorithm.
      - `keyInfo` string: Key info.
      - `value` string: Value.
  - `signature` string: Base64 URL encoded value representation of the signature output. The payload used to generate the signature consists of the JSON serialization of the whole object, excluding old signatures and null values, which is then Base 64 URL encoded as well

## Response `200`

OK.

- MessageGetCardResponse
  - `header` Header, required: Metadata of the message.
    - `requestId` string, uuid, required: Unique identifier of the request.
    - `service` string, required: Service code (defined during project).
    - `issuerCode` string, required: Issuer code.
    - `subIssuerCode` string, required: Sub-issuer code.
    - `keyTag` string: Key indicator shared between client and server. If `keyTag` is provided, then this reference should be used to encrypt / decrypt sensitive data (PAN, expiry date).
    - `iv` union
      - string: IV value used for **CBC** encryption. IV is provided only if HUB's IV configuration is set to "RANDOM".
      - string: IV value used for **GCM** encryption. IV is provided only if HUB's IV configuration is set to "RANDOM".
  - `body` ClientResponseBody, required: ClientResponseBody DTO resource representation.
    - `availableMeans` string[]: List of available means.
    - `cardData` string: Optional field to provide more card information.
    - `cardId` string, String of 2 to 36 characters - Alphanumeric and '-': Card identifier.
    - `cardholderId` string, String of 8 to 36 characters - Alphanumeric and ‘-‘: Cardholder identifier.
    - `credentials` object: Type and value pair.
      - `type` string, enum, required: Type.
      - `value` string, required: Value.
    - `deletedTime` string, yyyy-MM-dd HH:mm:ss,SSS: Deleted time.
    - `label` string: Label to associate to the card.
    - `language` string: Language of the customer, as per the ISO 639-1 standard.
    - `freeContext` object: Free list of field key/value to add specific information.
  - `footer` Footer: Not used.
    - `signature` Signature: Not used. For signature feature, please refer to the `signature` field at the root of the messages.
      - `algorithm` string: Algorithm.
      - `keyInfo` string: Key info.
      - `value` string: Value.
  - `signature` string: Base64 URL encoded value representation of the signature output. The payload used to generate the signature consists of the JSON serialization of the whole object, excluding old signatures and null values, which is then Base 64 URL encoded as well

## Other responses

- `400`: Bad Request.
- `401`: Unauthorized.
- `403`: Forbidden.
- `404`: Not Found.

---

[API](https://skmtc.dev/worldline/apis/referential-ws-client.md) - [All operations](https://skmtc.dev/worldline/apis/referential-ws-client/llms.txt) - [OpenAPI document](https://skmtc.dev/worldline/apis/referential-ws-client/revisions/21cb2439c982?raw)