Full PCI Data Access V2

GET /paymentInstruments

Private payment instrument data, such as the PAN, expiration date, and CVV can be made available via API to Partners based on their physical and virtual card configurations. Contact Green Dot if your program would like to consider implementing this API.

Partners can request the private payment instrument data for a specific payment instrument using the following API endpoint:

• GET /paymentInstruments/{paymentInstrumentIdentifier}?usage={usage}& pciData={pciDataArray}&IpAddress={IpAddress}
• “BaaS-Version: 2.0” indicated in header

Benefits

• Cardholder experience - Provide cardholders easy access to physical or virtual card details that can be used for online purchases, manual e-wallet provisioning, and mobile payments.
• Flexible payment methods - Ability for Partners to access full payment instrument data with third parties, such as push-to-card (or IFT) transactions over debit card rails.

How it Works

1. Partner is configured to access private payment instrument data.
2. Partner submits a request to GET /paymentInstruments/...
3. Request must include the header value “BaaS-Version: 2.0” to point to applicable API version.
4. New request parameters in URL string will indicate:
5. Usage: Purpose of the private payment instrument data request
6. PciData: The specific private payment instrument data points requested
7. IpAddress: The cardholder’s IP Address (required if usage=cardholder)
   iii. See Request Parameters for details.
8. Green Dot sends a response to the Partner containing the encrypted private payment instrument data.
9. Partner accesses private payment instrument data to:
   1. Display to cardholder: Cardholder views private payment instrument data and the event is logged and monitored by Green Dot.
   2. Partner usage: Partner uses private payment instrument data to initiate a transaction. Cardholder does not see display of private data.

Configuration Requirements

1. Partners should ensure they are Payment Card Industry Data Security Standard (PCI) compliant or have completed the relevant PCI requirements.
2. Partners should ensure they adhere to all relevant PCI requirements, such as not storing CVV information persistently.
3. Partners must ensure that cardholders complete a successful authentication within 10 minutes of their request and the PCI data being displayed to end users.
4. Partners must implement measures to prevent screen scraping, such as requiring a tap to display user action before displaying any PCI data.
5. Partners will decrypt the encrypted data transmitted from Green Dot to access the full card details.
6. Partners will need to request the appropriate configurations from Green Dot for both physical and virtual cards.
7. All cardholder actions that result in a display of PCI data are logged (including cardholder IP address) appropriately on the Partner side as well.

Sample Requests

Endpoint: GET /paymentInstruments

Structure of API Call:

GET /paymentInstruments/programs/{programCode}/accounts/{accountIdentifier}/paymentInstruments/{paymentInstrumentIdentifier}?usage=cardholder&pcidata=pan,cvv,exp&ipAddress=127.0.0.1Sample Response

REQUEST

GET {{$host}}/baas/v1/programs/{programCode}/accounts/{accountIdentifier}/paymentInstruments/

{paymentInstrumentIdentifier}?usage=cardholder&pcidata=pan,cvv,exp&ipAddress=127.0.0.1

Content-Type: application/json

X-GD-RequestId: {{$guid}}

BaaS-Version: 2.0 ### WILL BE REQUIRED TO ACCESS API VERSION 2.0

{
   "paymentInstrument":{
      "encryptedPrivatePaymentInstrumentData":{
         "version":"EC_v1",
         "ephemeralPublicKey":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWQyizlkN8/ZHSVMRDub1lwFuWzHWuFQ6rXUtAMOvQUiLxTBfzrw8XHlqe3PdxfeEA+Gq67E4TK0Bbt78ximFXw==",
         "publicKeyHash":"pD35siZ5RZWxW+zxEoZzbB0BMrhpTqQUYVMXchC5aC4=",
         "data":"BF9pkBjf0qGTksE0TdRUCoSR5LAYJrhyVdL4kMaysk0E11xPylAoschJqdOwhJpgsVzK/nuF/qZfo7RFvg8yNd28C4TrsPnONhVfNr0iRPqwQ81jionJE6/z9vCK"
      },
      "paymentIdentifier":"9da28b7d-876c-41f7-9e07-efc0b6095905",
      "paymentInstrumentIdentifier":"935f4eb2-458f-42c2-889f-d383ae2e6d75",
      "paymentInstrumentType":"emv",
      "status":"activated",
      "isPinSet":true,
      "last4Pan":"2777",
      "activatedDateTime":"2021-01-28T03:39:16Z",
      "issuedDateTime":"2021-01-28T03:38:58Z",
      "isPrivateDataViewable":true,
      "embossedName":"UrKLLvhy lRxPuPyt"          
	  ### DECRYPTED PAYLOAD
         {
         "pan":"4111999999991234",
         "cvv":"123",
         "expiration":{
            "month":"12",
            "year":"2020"
         }
      }
   },
   "responseDetails":[
      {
         "code":0,
         "subCode":0,
         "description":"Success",
         "url":"http://tbd"
      }
   ]
}

Request Parameters

Error Codes

Voice Dial Functionality Feature for Multi-Factor Authentication Phone Call

This feature allows a customer to receive a phone call that recites and transcribes the MFA code so that the customer can enter it into the phone verification screen.

Sample Request for Voice Call

{
   "verificationEventType":"registration",
   "contactType":"Phone",
   "contactHandle":"6554952560",
   "accountIdentifier":"",
   "firstName":"",
   "lastName":"",
   "productCode":"40002",
   " CommunicationType":"VoiceCall"
}

Sample Response for Voice Call

{
   "contactVerificationIdentifier":"d6a577b8-85db-4c55-b8ba-2281fb1ac07b",
   "responseDetails":[
      {
         "code":0,
         " subCode":0,
         "description":"success",
         "url":"http://tbd"
      }
   ]
}

Partner Response Codes

Scenarios