Skip to main content

Paynovus CIP Partner API (1.0.0)

Download OpenAPI specification:Download

Paynovus Development Team: office@paynovus.com

The CIP Partner API exposes a JWT-authenticated surface for trusted partners to manage individuals they onboard, create and operate cards under those individuals, and query fees / delivery options.

All endpoints are mounted under /api/partner and require an ES512 Bearer JWT whose iss matches the partner's registered URL and whose sub equals the partner's _id.

Authentication

  1. Generate a P-521 (secp521r1) ES512 keypair and provide the public key to Paynovus — it is stored on the Partner record.

  2. Sign a JWT with the partner's private key. The token must contain:

    {
      "iss": "https://your-registered-url.com",
      "sub": "<partnerObjectId>",
      "exp": <unix-seconds, +1 minute>,
      "iat": <unix-seconds>
    }
    
  3. Send the token on every request:

    Authorization: Bearer <jwt>
    

Partners are pre-trusted: a successful partnerAuth middleware pass grants full access to every resource owned by req.auth.partnerId. No additional role/permission checks are enforced.

Card-level endpoints additionally verify that the card (cardKey) belongs to the calling partner via assertPartnerCardOwnership.

Partner API

Endpoints that target the authenticated partner itself (/health-check, /me). Useful for connectivity checks and self-introspection.

Health check

Public liveness probe. Does not require authentication — useful for partner integration connectivity checks and infrastructure readiness probes. Always returns 200 OK with the body OK.

Responses

Response Schema: text/plain
string

Get partner identity

Returns the authenticated partner profile along with every B2B tenant and individual onboarding owned by that partner.

The partner object is sourced from the already-verified partner that partnerAuth attaches to the request, so the response always reflects exactly the authenticated partner.

Authorizations:
JWTBearerAuth

Responses

Response Schema: application/json
object (Partner)
activeTenantId
string or null

The B2B tenant this request was scoped to (null when the partner has no B2B tenant — common for individual-only partners).

Array of objects (B2BTenant)
Array of objects (IndividualAccountSummary)

Response samples

Content type
application/json
{
  • "partner": {
    },
  • "activeTenantId": "string",
  • "b2bAccounts": [
    ],
  • "individuals": [
    ]
}

Individual Accounts

Endpoints for managing individual cardholders onboarded by the partner. All paths under this tag are tenant-scoped via assertPartnerIndividualAccess.

List individual accounts

Returns every individual onboarding owned by the authenticated partner.

Authorizations:
JWTBearerAuth
query Parameters
page
integer >= 1
Default: 1

Page number for pagination

limit
integer [ 1 .. 100 ]
Default: 20

Items per page

Responses

Response Schema: application/json
count
integer
Array of objects (IndividualAccountSummary)

Response samples

Content type
application/json
{
  • "count": 0,
  • "data": [
    ]
}

Create individual account

Creates a partner-owned individual cardholder. The individual never logs into the CIP dashboard — the partner has its own dashboard for that; the record exists here only so CIP admins can see/control it.

Validates the payload against partnerCreateIndividualSchemaValidation and delegates to createPartnerIndividualOnboarding, which creates the User + IndividualOnboarding records and calls ryvyl-proxy-orasys to create the upstream account. Rolls both records back if the proxy call fails.

Authorizations:
JWTBearerAuth
Request Body schema: application/json
required
baasAccountClientId
integer

BaaS account/program the individual is created under

firstName
required
string <= 200 characters
middleName
required
string [ 2 .. 200 ] characters
lastName
required
string <= 200 characters
country
required
string = 2 characters

ISO 3166-1 alpha-2 country code

city
required
string <= 100 characters
stateProvince
string <= 100 characters
zipCode
required
string <= 20 characters
buildingNumber
required
string <= 100 characters
idType
required
string
Enum: "PASSPORT" "DRIVER_LICENSE" "RESIDENCE_CARD" "MINOR_WITHOUT_ID" "OTHER"
address1
required
string <= 200 characters
address2
string <= 200 characters
passportNumber
required
string <= 40 characters
issuingDate
required
string

yyyy-mm-dd

validityDate
required
string

yyyy-mm-dd

passportCountry
required
string = 2 characters

ISO 3166-1 alpha-2 country code

taxCountry
string
taxIdNumber
string

Defaults to passportNumber when omitted

birthCountry
required
string = 2 characters
birthDate
required
string

yyyy-mm-dd

nationality
required
string = 2 characters
fatca
string

Defaults to F when omitted

phone
required
string
email
required
string <email>

Responses

Response Schema: application/json
_id
string
clientID
string
object
object
applicationStatus
string
dashboardStatus
string
createdAt
string <date-time>
updatedAt
string <date-time>

Request samples

Content type
application/json
{
  • "baasAccountClientId": 0,
  • "firstName": "string",
  • "middleName": "string",
  • "lastName": "string",
  • "country": "st",
  • "city": "string",
  • "stateProvince": "string",
  • "zipCode": "string",
  • "buildingNumber": "string",
  • "idType": "PASSPORT",
  • "address1": "string",
  • "address2": "string",
  • "passportNumber": "string",
  • "issuingDate": "string",
  • "validityDate": "string",
  • "passportCountry": "st",
  • "taxCountry": "string",
  • "taxIdNumber": "string",
  • "birthCountry": "st",
  • "birthDate": "string",
  • "nationality": "st",
  • "fatca": "string",
  • "phone": "string",
  • "email": "user@example.com"
}

Response samples

Content type
application/json
{
  • "_id": "string",
  • "clientID": "string",
  • "personalInfo": { },
  • "address": { },
  • "applicationStatus": "string",
  • "dashboardStatus": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "updatedAt": "2019-08-24T14:15:22Z"
}

Get individual account

Returns the individual onboarding identified by :id. Requires assertPartnerIndividualAccess('id') — the partner must own the record.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

Individual onboarding _id (Mongo ObjectId)

Responses

Response Schema: application/json
_id
string
clientID
string
object
object
applicationStatus
string
dashboardStatus
string
createdAt
string <date-time>
updatedAt
string <date-time>

Response samples

Content type
application/json
{
  • "_id": "string",
  • "clientID": "string",
  • "personalInfo": { },
  • "address": { },
  • "applicationStatus": "string",
  • "dashboardStatus": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "updatedAt": "2019-08-24T14:15:22Z"
}

List cards for an individual

Returns every active card owned by the given individual.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

Individual onboarding _id

Responses

Response Schema: application/json
Array
cardKey
string
cardMask
string
type
string
Enum: "virtual" "physical"
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string
currency
string
ownerType
string
Enum: "individual" "b2b"
ownerId
string
createdAt
string <date-time>

Response samples

Content type
application/json
[
  • {
    }
]

Create virtual card for an individual

Issues a virtual card under the given individual. Forwards the request to IT-Card's POST /cards/v1/create-card-virtual and stores the resulting card under the partner/individual ownership chain.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string
Request Body schema: application/json
required
expDate
required
string^(0[1-9]|1[0-2])\/\d{4}$
clientCode
required
string
currency
required
string = 3 characters
productCode
required
string
embossedName
string
shippingAddressId
string

Responses

Response Schema: application/json
cardKey
string
cardMask
string
type
string
Enum: "virtual" "physical"
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string
currency
string
ownerType
string
Enum: "individual" "b2b"
ownerId
string
createdAt
string <date-time>
productCode
string
holderClientCode
string
expDate
string
embossedName
string

Request samples

Content type
application/json
{
  • "expDate": "string",
  • "clientCode": "string",
  • "currency": "str",
  • "productCode": "string",
  • "embossedName": "string",
  • "shippingAddressId": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "cardMask": "string",
  • "type": "virtual",
  • "status": "ACTIVE",
  • "statusCode": "string",
  • "currency": "string",
  • "ownerType": "individual",
  • "ownerId": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "productCode": "string",
  • "holderClientCode": "string",
  • "expDate": "string",
  • "embossedName": "string"
}

Create physical card for an individual

Issues a physical card under the given individual.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string
Request Body schema: application/json
required
expDate
required
string^(0[1-9]|1[0-2])\/\d{4}$
clientCode
required
string
currency
required
string = 3 characters
productCode
required
string
embossedName
string
shippingAddressId
string

Responses

Response Schema: application/json
cardKey
string
cardMask
string
type
string
Enum: "virtual" "physical"
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string
currency
string
ownerType
string
Enum: "individual" "b2b"
ownerId
string
createdAt
string <date-time>
productCode
string
holderClientCode
string
expDate
string
embossedName
string

Request samples

Content type
application/json
{
  • "expDate": "string",
  • "clientCode": "string",
  • "currency": "str",
  • "productCode": "string",
  • "embossedName": "string",
  • "shippingAddressId": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "cardMask": "string",
  • "type": "virtual",
  • "status": "ACTIVE",
  • "statusCode": "string",
  • "currency": "string",
  • "ownerType": "individual",
  • "ownerId": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "productCode": "string",
  • "holderClientCode": "string",
  • "expDate": "string",
  • "embossedName": "string"
}

List audit logs for an individual

Returns the B2B audit log entries scoped to the given individual. Pagination is via page and limit.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string
query Parameters
page
integer >= 1
Default: 1

Page number for pagination

limit
integer [ 1 .. 100 ]
Default: 20

Items per page

Responses

Response Schema: application/json
Array of objects (AuditLogEntry)
object (Pagination)

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "pagination": {
    }
}

Card status history for an individual

Returns every card-status change recorded for this individual.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string
query Parameters
page
integer >= 1
Default: 1

Page number for pagination

limit
integer [ 1 .. 100 ]
Default: 20

Items per page

Responses

Response Schema: application/json
Array of objects (CardStatusHistoryEntry)
object (Pagination)

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "pagination": {
    }
}

List transactions for an individual

Fetches transactions from Card Processing by account identification and card id. Empty results are returned for partners who have not configured Card Processing yet.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string
query Parameters
page
integer >= 1
Default: 1

Page number for pagination

limit
integer [ 1 .. 100 ]
Default: 20

Items per page

Responses

Response Schema: application/json
Array of objects (Transaction)
object (Pagination)

Response samples

Content type
application/json
{
  • "data": [
    ],
  • "pagination": {
    }
}

Cards

Card-level endpoints that operate on a single IT-Card cardKey. The :id path parameter is the IT-Card cardKey (for example KDRYV10100033065). Every endpoint under /cards/:id/... runs the assertPartnerCardOwnership middleware before reaching the controller.

List all partner cards

Returns every card owned by the authenticated partner across all account types (B2B + individual). Not tenant-scoped per-card — returns the full partner-wide list.

Authorizations:
JWTBearerAuth
query Parameters
page
integer >= 1
Default: 1

Page number for pagination

limit
integer [ 1 .. 100 ]
Default: 20

Items per page

status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"

Filter by IT-Card status

type
string
Enum: "virtual" "physical"

virtual or physical

search
string

Case-insensitive search on cardMask / name

Responses

Response Schema: application/json
success
boolean
Array of objects (CardSummary)
object (Pagination)

Response samples

Content type
application/json
{
  • "success": true,
  • "data": [
    ],
  • "pagination": {
    }
}

Get card details

Returns full IT-Card card details. Does not include the PAN or CVV — use the dedicated sensitive endpoints below for those.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Responses

Response Schema: application/json
cardKey
string
cardMask
string
type
string
Enum: "virtual" "physical"
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string
currency
string
ownerType
string
Enum: "individual" "b2b"
ownerId
string
createdAt
string <date-time>
productCode
string
holderClientCode
string
expDate
string
embossedName
string

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "cardMask": "string",
  • "type": "virtual",
  • "status": "ACTIVE",
  • "statusCode": "string",
  • "currency": "string",
  • "ownerType": "individual",
  • "ownerId": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "productCode": "string",
  • "holderClientCode": "string",
  • "expDate": "string",
  • "embossedName": "string"
}

Get card status

Returns the current IT-Card status + status code.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Responses

Response Schema: application/json
cardKey
string
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string

IT-Card raw status code (e.g. 00, S1, L1)

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "status": "ACTIVE",
  • "statusCode": "string"
}

Lock card

Locks the card. The card stays in the holder's possession but cannot authorize transactions.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
expDate
required
string^(0[1-9]|1[0-2])\/\d{4}$

Card expiration in MM/YYYY

reason
string

Audit reason (free-form)

Responses

Response Schema: application/json
cardKey
string
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string

IT-Card raw status code (e.g. 00, S1, L1)

Request samples

Content type
application/json
{
  • "expDate": "string",
  • "reason": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "status": "ACTIVE",
  • "statusCode": "string"
}

Unlock card

Unlocks a previously-locked card.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
expDate
required
string^(0[1-9]|1[0-2])\/\d{4}$

Card expiration in MM/YYYY

reason
string

Audit reason (free-form)

Responses

Response Schema: application/json
cardKey
string
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string

IT-Card raw status code (e.g. 00, S1, L1)

Request samples

Content type
application/json
{
  • "expDate": "string",
  • "reason": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "status": "ACTIVE",
  • "statusCode": "string"
}

Activate card

Activates a freshly-issued card.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
expDate
required
string^(0[1-9]|1[0-2])\/\d{4}$

Card expiration in MM/YYYY

reason
string

Audit reason (free-form)

Responses

Response Schema: application/json
cardKey
string
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string

IT-Card raw status code (e.g. 00, S1, L1)

Request samples

Content type
application/json
{
  • "expDate": "string",
  • "reason": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "status": "ACTIVE",
  • "statusCode": "string"
}

Temporary lock card

Temporarily locks the card (e.g. while the holder travels).

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
expDate
required
string^(0[1-9]|1[0-2])\/\d{4}$

Card expiration in MM/YYYY

reason
string

Audit reason (free-form)

Responses

Response Schema: application/json
cardKey
string
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string

IT-Card raw status code (e.g. 00, S1, L1)

Request samples

Content type
application/json
{
  • "expDate": "string",
  • "reason": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "status": "ACTIVE",
  • "statusCode": "string"
}

Restrict card (generic)

Generic card restriction.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
expDate
string^(0[1-9]|1[0-2])\/\d{4}$
reason
string
description
string
cardLocation
string

Where the card was last seen

Responses

Response Schema: application/json
cardKey
string
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string

IT-Card raw status code (e.g. 00, S1, L1)

Request samples

Content type
application/json
{
  • "expDate": "string",
  • "reason": "string",
  • "description": "string",
  • "cardLocation": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "status": "ACTIVE",
  • "statusCode": "string"
}

Restrict card as lost

Restricts the card as lost. The card cannot be used; the holder must request a replacement.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
expDate
string^(0[1-9]|1[0-2])\/\d{4}$
reason
string
description
string
cardLocation
string

Where the card was last seen

Responses

Response Schema: application/json
cardKey
string
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string

IT-Card raw status code (e.g. 00, S1, L1)

Request samples

Content type
application/json
{
  • "expDate": "string",
  • "reason": "string",
  • "description": "string",
  • "cardLocation": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "status": "ACTIVE",
  • "statusCode": "string"
}

Restrict card as stolen

Restricts the card as stolen.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
expDate
string^(0[1-9]|1[0-2])\/\d{4}$
reason
string
description
string
cardLocation
string

Where the card was last seen

Responses

Response Schema: application/json
cardKey
string
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string

IT-Card raw status code (e.g. 00, S1, L1)

Request samples

Content type
application/json
{
  • "expDate": "string",
  • "reason": "string",
  • "description": "string",
  • "cardLocation": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "status": "ACTIVE",
  • "statusCode": "string"
}

Restrict card as closed

Restricts the card as closed.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
expDate
string^(0[1-9]|1[0-2])\/\d{4}$
reason
string
description
string
cardLocation
string

Where the card was last seen

Responses

Response Schema: application/json
cardKey
string
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string

IT-Card raw status code (e.g. 00, S1, L1)

Request samples

Content type
application/json
{
  • "expDate": "string",
  • "reason": "string",
  • "description": "string",
  • "cardLocation": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "status": "ACTIVE",
  • "statusCode": "string"
}

Restrict card as fraud

Restricts the card as fraud.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
expDate
string^(0[1-9]|1[0-2])\/\d{4}$
reason
string
description
string
cardLocation
string

Where the card was last seen

Responses

Response Schema: application/json
cardKey
string
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string

IT-Card raw status code (e.g. 00, S1, L1)

Request samples

Content type
application/json
{
  • "expDate": "string",
  • "reason": "string",
  • "description": "string",
  • "cardLocation": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "status": "ACTIVE",
  • "statusCode": "string"
}

Restrict card as mobile-lost

Restricts the card as lost on mobile (device).

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
expDate
string^(0[1-9]|1[0-2])\/\d{4}$
reason
string
description
string
cardLocation
string

Where the card was last seen

Responses

Response Schema: application/json
cardKey
string
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string

IT-Card raw status code (e.g. 00, S1, L1)

Request samples

Content type
application/json
{
  • "expDate": "string",
  • "reason": "string",
  • "description": "string",
  • "cardLocation": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "status": "ACTIVE",
  • "statusCode": "string"
}

Change card nickname

Local-only — sets a friendly name for the card.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
nickname
required
string <= 64 characters

Responses

Response Schema: application/json
cardKey
string
cardMask
string
type
string
Enum: "virtual" "physical"
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string
currency
string
ownerType
string
Enum: "individual" "b2b"
ownerId
string
createdAt
string <date-time>
productCode
string
holderClientCode
string
expDate
string
embossedName
string

Request samples

Content type
application/json
{
  • "nickname": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "cardMask": "string",
  • "type": "virtual",
  • "status": "ACTIVE",
  • "statusCode": "string",
  • "currency": "string",
  • "ownerType": "individual",
  • "ownerId": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "productCode": "string",
  • "holderClientCode": "string",
  • "expDate": "string",
  • "embossedName": "string"
}

Change emboss name

Updates the embossed name on the card. Note: IT-Card does not allow spaces in the emboss-name request.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
embossedName
required
string <= 26 characters

Responses

Response Schema: application/json
cardKey
string
cardMask
string
type
string
Enum: "virtual" "physical"
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string
currency
string
ownerType
string
Enum: "individual" "b2b"
ownerId
string
createdAt
string <date-time>
productCode
string
holderClientCode
string
expDate
string
embossedName
string

Request samples

Content type
application/json
{
  • "embossedName": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "cardMask": "string",
  • "type": "virtual",
  • "status": "ACTIVE",
  • "statusCode": "string",
  • "currency": "string",
  • "ownerType": "individual",
  • "ownerId": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "productCode": "string",
  • "holderClientCode": "string",
  • "expDate": "string",
  • "embossedName": "string"
}

Replace card

Replaces the physical card. IT-Card returns a new cardKey; the local AccountCard record is updated to the new key and a card_created webhook is sent to Card Processing.

CIP then enriches the response with cardMask (not present in IT-Card's replace response) by fetching the new card from GET /cards/{newCardKey}.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
expDate
required
string^(0[1-9]|1[0-2])\/\d{4}$
reason
string
pinMailer
string

Postal pin-mailer reference

Responses

Response Schema: application/json
cardKey
string
cardMask
string
type
string
Enum: "virtual" "physical"
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string
currency
string
ownerType
string
Enum: "individual" "b2b"
ownerId
string
createdAt
string <date-time>
productCode
string
holderClientCode
string
expDate
string
embossedName
string

Request samples

Content type
application/json
{
  • "expDate": "string",
  • "reason": "string",
  • "pinMailer": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "cardMask": "string",
  • "type": "virtual",
  • "status": "ACTIVE",
  • "statusCode": "string",
  • "currency": "string",
  • "ownerType": "individual",
  • "ownerId": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "productCode": "string",
  • "holderClientCode": "string",
  • "expDate": "string",
  • "embossedName": "string"
}

Re-issue / resign card

Re-issues the card (e.g. PIN reissue, expiration). IT-Card returns a new cardKey; the old card is closed locally and a card_created webhook is sent to Card Processing.

The old statusCode is captured from the local AccountCard row BEFORE the local update overwrites it, then forwarded to POST /api/cip/update-card-status with the OLD cardKey.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
expDate
required
string^(0[1-9]|1[0-2])\/\d{4}$
reason
string
pinMailer
string

Postal pin-mailer reference

Responses

Response Schema: application/json
cardKey
string
cardMask
string
type
string
Enum: "virtual" "physical"
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string
currency
string
ownerType
string
Enum: "individual" "b2b"
ownerId
string
createdAt
string <date-time>
productCode
string
holderClientCode
string
expDate
string
embossedName
string

Request samples

Content type
application/json
{
  • "expDate": "string",
  • "reason": "string",
  • "pinMailer": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "cardMask": "string",
  • "type": "virtual",
  • "status": "ACTIVE",
  • "statusCode": "string",
  • "currency": "string",
  • "ownerType": "individual",
  • "ownerId": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "productCode": "string",
  • "holderClientCode": "string",
  • "expDate": "string",
  • "embossedName": "string"
}

Get card CVV

Returns the CVV2 for the card. Sensitive — never log this response. Requires expDate and securityKey (RSA-OAEP, base64).

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

query Parameters
expDate
required
string^(0[1-9]|1[0-2])\/\d{4}$

Card expiration in MM/YYYY format

securityKey
required
string

RSA-OAEP security key (base64)

Responses

Response Schema: application/json
cvv
string

Response samples

Content type
application/json
{
  • "cvv": "123"
}

Get full card number (PAN)

Returns the full PAN for the card. Highly sensitive — never log this response. Requires expDate and securityKey (RSA-OAEP, base64).

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

query Parameters
expDate
required
string^(0[1-9]|1[0-2])\/\d{4}$

Card expiration in MM/YYYY format

securityKey
required
string

RSA-OAEP security key (base64)

Responses

Response Schema: application/json
cardNumber
string

Response samples

Content type
application/json
{
  • "cardNumber": "4111111111111111"
}

Set 3DS answer

Updates the 3-D Secure answer configured on the card.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
answer
required
string <= 200 characters

Responses

Response Schema: application/json
cardKey
string
cardMask
string
type
string
Enum: "virtual" "physical"
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string
currency
string
ownerType
string
Enum: "individual" "b2b"
ownerId
string
createdAt
string <date-time>
productCode
string
holderClientCode
string
expDate
string
embossedName
string

Request samples

Content type
application/json
{
  • "answer": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "cardMask": "string",
  • "type": "virtual",
  • "status": "ACTIVE",
  • "statusCode": "string",
  • "currency": "string",
  • "ownerType": "individual",
  • "ownerId": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "productCode": "string",
  • "holderClientCode": "string",
  • "expDate": "string",
  • "embossedName": "string"
}

Change 3DS phone number

Local-only — updates the 3-D Secure phone number on the card.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
phoneNumber
required
string <= 32 characters

Responses

Response Schema: application/json
cardKey
string
cardMask
string
type
string
Enum: "virtual" "physical"
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string
currency
string
ownerType
string
Enum: "individual" "b2b"
ownerId
string
createdAt
string <date-time>
productCode
string
holderClientCode
string
expDate
string
embossedName
string

Request samples

Content type
application/json
{
  • "phoneNumber": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "cardMask": "string",
  • "type": "virtual",
  • "status": "ACTIVE",
  • "statusCode": "string",
  • "currency": "string",
  • "ownerType": "individual",
  • "ownerId": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "productCode": "string",
  • "holderClientCode": "string",
  • "expDate": "string",
  • "embossedName": "string"
}

Reset PIN tries

Resets the cardholder's PIN-attempt counter.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Responses

Response Schema: application/json
cardKey
string
cardMask
string
type
string
Enum: "virtual" "physical"
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string
currency
string
ownerType
string
Enum: "individual" "b2b"
ownerId
string
createdAt
string <date-time>
productCode
string
holderClientCode
string
expDate
string
embossedName
string

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "cardMask": "string",
  • "type": "virtual",
  • "status": "ACTIVE",
  • "statusCode": "string",
  • "currency": "string",
  • "ownerType": "individual",
  • "ownerId": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "productCode": "string",
  • "holderClientCode": "string",
  • "expDate": "string",
  • "embossedName": "string"
}

Change PIN

Changes the card PIN. pin is the RSA-OAEP encrypted PIN (base64). Known limitation: IT-Card currently returns an error on this operation.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
expDate
required
string^(0[1-9]|1[0-2])\/\d{4}$
pin
required
string

RSA-OAEP encrypted PIN (base64)

Responses

Response Schema: application/json
cardKey
string
cardMask
string
type
string
Enum: "virtual" "physical"
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string
currency
string
ownerType
string
Enum: "individual" "b2b"
ownerId
string
createdAt
string <date-time>
productCode
string
holderClientCode
string
expDate
string
embossedName
string

Request samples

Content type
application/json
{
  • "expDate": "string",
  • "pin": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "cardMask": "string",
  • "type": "virtual",
  • "status": "ACTIVE",
  • "statusCode": "string",
  • "currency": "string",
  • "ownerType": "individual",
  • "ownerId": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "productCode": "string",
  • "holderClientCode": "string",
  • "expDate": "string",
  • "embossedName": "string"
}

Force PIN lock

Forces a PIN-attempt lock on the card. Known limitation: IT-Card currently returns an error on this operation.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
expDate
required
string^(0[1-9]|1[0-2])\/\d{4}$

Responses

Response Schema: application/json
cardKey
string
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string

IT-Card raw status code (e.g. 00, S1, L1)

Request samples

Content type
application/json
{
  • "expDate": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "status": "ACTIVE",
  • "statusCode": "string"
}

Authorize cardholder

Authorizes a cardholder action (PIN-less). Requires the holder's pin (RSA-OAEP encrypted, base64).

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
pin
required
string

RSA-OAEP encrypted PIN (base64)

Responses

Response Schema: application/json
cardKey
string
cardMask
string
type
string
Enum: "virtual" "physical"
status
string (CardStatus)
Enum: "ACTIVE" "LOCKED" "CLOSED" "LOST" "STOLEN" "FRAUD" "MOBILE_LOST" "RESTRICTED" "TEMP_LOCKED"
statusCode
string
currency
string
ownerType
string
Enum: "individual" "b2b"
ownerId
string
createdAt
string <date-time>
productCode
string
holderClientCode
string
expDate
string
embossedName
string

Request samples

Content type
application/json
{
  • "pin": "string"
}

Response samples

Content type
application/json
{
  • "cardKey": "string",
  • "cardMask": "string",
  • "type": "virtual",
  • "status": "ACTIVE",
  • "statusCode": "string",
  • "currency": "string",
  • "ownerType": "individual",
  • "ownerId": "string",
  • "createdAt": "2019-08-24T14:15:22Z",
  • "productCode": "string",
  • "holderClientCode": "string",
  • "expDate": "string",
  • "embossedName": "string"
}

Get all card limits

Returns the full set of card limits.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Responses

Response Schema: application/json
Array
name
string
value
number <double>
currency
string
used
number <double>
available
number <double>

Response samples

Content type
application/json
[
  • {
    }
]

Patch card limits

Updates multiple card limits at once.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

Request Body schema: application/json
required
Array
name
required
string
value
required
number <double>

Responses

Response Schema: application/json
Array
name
string
value
number <double>
currency
string
used
number <double>
available
number <double>

Request samples

Content type
application/json
[
  • {
    }
]

Response samples

Content type
application/json
[
  • {
    }
]

Set a single card limit

Sets a named card limit (e.g. dailyPurchase).

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

limitName
required
string
Request Body schema: application/json
required
name
required
string
value
required
number <double>

Responses

Response Schema: application/json
name
string
value
number <double>
currency
string
used
number <double>
available
number <double>

Request samples

Content type
application/json
{
  • "name": "dailyPurchase",
  • "value": 0.1
}

Response samples

Content type
application/json
{
  • "name": "dailyPurchase",
  • "value": 0.1,
  • "currency": "string",
  • "used": 0.1,
  • "available": 0.1
}

Get a single card limit

Returns the value of a single named limit.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

limitName
required
string

Responses

Response Schema: application/json
name
string
value
number <double>
currency
string
used
number <double>
available
number <double>

Response samples

Content type
application/json
{
  • "name": "dailyPurchase",
  • "value": 0.1,
  • "currency": "string",
  • "used": 0.1,
  • "available": 0.1
}

Get available limit

Returns the remaining available amount for the named limit.

Authorizations:
JWTBearerAuth
path Parameters
id
required
string

IT-Card cardKey (for example KDRYV10100033065). The assertPartnerCardOwnership middleware verifies that the card is owned by the calling partner before the controller runs.

limitName
required
string

Responses

Response Schema: application/json
available
number <double>

Response samples

Content type
application/json
{
  • "available": 0.1
}

Fees & Delivery

Fee and delivery-method lookups. The issuing/delivery fee endpoints require a validateRequest pass against the shared checkFeePayloadSchema.

List delivery methods by country

Returns PocztaPost + DHL delivery methods available for the given ISO 3166-1 alpha-2 country code.

Authorizations:
JWTBearerAuth
query Parameters
country
required
string = 2 characters

ISO 3166-1 alpha-2 country code (e.g. PL, DE)

Responses

Response Schema: application/json
object
success
boolean
country
string
deliveryMethods
Array of objects

Response samples

Content type
application/json
{
  • "data": {
    }
}

Check card issuing fee

Forwards a CheckTransactionFee request to Card Processing with OperationType fixed server-side to Card Issuing Fee.

At least one of cardKey, clientId, or iban must be present.

Authorizations:
JWTBearerAuth
Request Body schema: application/json
required
CustomerType
required
string
Enum: "Consumer Debit" "Business Debit" "Consumer Prepaid" "Business Prepaid"
ProductType
required
string
Enum: "R001" "R002" "R003" "R004" "R005" "R006"
cardKey
string

At least one of cardKey / clientId / iban must be present

clientId
string
iban
string

Responses

Response Schema: application/json
OperationType
string
CustomerType
string
ProductType
string
fee
number <double>
currency
string

Request samples

Content type
application/json
{
  • "CustomerType": "Consumer Debit",
  • "ProductType": "R001",
  • "cardKey": "string",
  • "clientId": "string",
  • "iban": "string"
}

Response samples

Content type
application/json
{
  • "OperationType": "string",
  • "CustomerType": "string",
  • "ProductType": "string",
  • "fee": 0.1,
  • "currency": "string"
}

Check card delivery fee

Forwards a CheckTransactionFee request to Card Processing with OperationType fixed server-side to Card Delivery Fee.

At least one of cardKey, clientId, or iban must be present.

Authorizations:
JWTBearerAuth
Request Body schema: application/json
required
CustomerType
required
string
Enum: "Consumer Debit" "Business Debit" "Consumer Prepaid" "Business Prepaid"
ProductType
required
string
Enum: "R001" "R002" "R003" "R004" "R005" "R006"
cardKey
string

At least one of cardKey / clientId / iban must be present

clientId
string
iban
string

Responses

Response Schema: application/json
OperationType
string
CustomerType
string
ProductType
string
fee
number <double>
currency
string

Request samples

Content type
application/json
{
  • "CustomerType": "Consumer Debit",
  • "ProductType": "R001",
  • "cardKey": "string",
  • "clientId": "string",
  • "iban": "string"
}

Response samples

Content type
application/json
{
  • "OperationType": "string",
  • "CustomerType": "string",
  • "ProductType": "string",
  • "fee": 0.1,
  • "currency": "string"
}