Authorize

Select the following:
Home

>

API Products

>

Australia - Authorize API Documentation

Authorize

Summary

Authorize is our implementation of the OAuth 2.0 framework. It enables secure authorization using standard methods that can easily be integrated in your app. If you're familiar with OAuth 2.0, everything should look familiar. If not, you may want to check out the OAuth 2.0 resources <a target="_blank" href="https://oauth.net/2/">here</a>.

Want to try this API out on our Playground?

Go play now
Endpoints on this page
post /clientCredentials/oauth2/token/au/gcb Client Credentials grant: Retrieve access token
post /clientCredentials/oauth2/token/au/ppl Client Credentials grant: Retrieve access token
get /authCode/oauth2/authorize Authorization code grant: Retrieve authorization code
post /authCode/oauth2/token/au/gcb Authorization code grant: Retrieve access token
post /authCode/oauth2/refresh Authorization code grant: Refresh access token
post /authCode/oauth2/revoke Revoke Access Token
post /cardAuth/oauth2/authorize/{countrycode}/{businesscode} Enroll and Generate Card Access Token
post /cardAuth/oauth2/token/{countrycode}/{businesscode} Activate Card Access Token
post /cardAuth/oauth2/refresh Refresh Card Access Token
post /cardAuth/oauth2/revoke Revoke Card Access Token
post /v1/issuedDeviceAdministration/accessToken/retrieve/{countryCode}/{businessCode} This API is used to get a long-lived access token for customer.
post /v1/issuedDeviceAdministration/accessToken/refresh This API is used to refresh the long-lived access token for customer.
post /v1/issuedDeviceAdministration/accessToken/revoke The token revoke call requires the resource owner to pass the valid client credentails, a valid token and the token type as inputs. The inputs are validated by the authorization server and after successful validation the token is tagged as revoked. If you pass access token in the request, the corresponding refresh token will also be revoked and vice-versa. The tokens are marked invalid after revocation is successful
put /partner/v1/mfa/statuses MfaStausUpdate:API to update interdiction result as SUCCESS in session region
post /clientCredentials/oauth2/token/au/vma Client Credentials grant: Retrieve access token

Client Credentials grant: Retrieve access token

post /clientCredentials/oauth2/token/au/gcb
Description

Get access token for your application credentials. You can use this for APIs which do not require customer credential verification and consent (e.g. Onboarding).

Header Parameters
Authorization
string required
HTTP Basic authentication by passing base64 encoded value of the client id and client secret separated by colon (:).Example: Base64(client_id:client_secret) will be passed as Basic KGNsaWVudF9pZDpjbGllbnRfc2VjcmV0KQ==
Content-Type
string required
Value should always be application/x-www-form-urlencoded
FormData Parameters
grant_type
string required
The grant type. Valid value is client_credentials.
scope
string required
The set of scopes requested to make API calls. You can pass multiple values delimted by space
  • cURL
  • Ruby
  • Python
  • PHP
  • Java
  • Node
  • Go
  • Swift

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Responses
200

The request has succeeded
Definitions
  • access_token
    • The access token value received after exchanging the authorization token. This field should be passed as Authorization header in API request calls
    • type : string
  • refresh_token
    • You can use this token to refresh an expired access_token.
    • type : string
  • scope
    • Set of scopes allowed by customer and separated by space
    • type : string
  • token_type
    • Type of the access token issued. This is bearer token for authorization_code grant type
    • type : string
  • expires_in
    • Validity of access token in seconds
    • type : number
Example Response for post /clientCredentials/oauth2/token/au/gcb
400

error
invalid_request
invalid_grant
unsupported_grant_type
unauthorized_client
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /clientCredentials/oauth2/token/au/gcb
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
401

error
invalid_client
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /clientCredentials/oauth2/token/au/gcb
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
500

server_error
This operation returns no content.

Client Credentials grant: Retrieve access token

post /clientCredentials/oauth2/token/au/ppl
Description

Get access token for your application credentials. You can use this for APIs which do not require customer credential verification and consent (e.g. Onboarding).

Header Parameters
Authorization
string required
HTTP Basic authentication by passing base64 encoded value of the client id and client secret separated by colon (:).Example: Base64(client_id:client_secret) will be passed as Basic KGNsaWVudF9pZDpjbGllbnRfc2VjcmV0KQ==
Content-Type
string required
Value should always be application/x-www-form-urlencoded
FormData Parameters
grant_type
string required
The grant type. Valid value is client_credentials.
scope
string required
The set of scopes requested to make API calls. You can pass multiple values delimted by space
  • cURL
  • Ruby
  • Python
  • PHP
  • Java
  • Node
  • Go
  • Swift

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Responses
200

The request has succeeded
Definitions
  • access_token
    • The access token value received after exchanging the authorization token. This field should be passed as Authorization header in API request calls
    • type : string
  • refresh_token
    • You can use this token to refresh an expired access_token.
    • type : string
  • scope
    • Set of scopes allowed by customer and separated by space
    • type : string
  • token_type
    • Type of the access token issued. This is bearer token for authorization_code grant type
    • type : string
  • expires_in
    • Validity of access token in seconds
    • type : number
Example Response for post /clientCredentials/oauth2/token/au/ppl
400

error
invalid_request
invalid_grant
unsupported_grant_type
unauthorized_client
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /clientCredentials/oauth2/token/au/ppl
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
401

error
invalid_client
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /clientCredentials/oauth2/token/au/ppl
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
500

server_error
This operation returns no content.

Authorization code grant: Retrieve authorization code

get /authCode/oauth2/authorize
Description

To retrieve an authorization code, call the authorize endpoint by passing the required query parameters.You should end up with a relative URL similar to the below (illustrative).

/authCode/oauth2/authorize?response_type=code&client_id=[Your client_id issued to you during app registration]&scope=[Space delimited scopes selected from the table below. Only request the scopes required for your app to work.]&countryCode=US&businessCode=GCB&locale=en_US&state=[The state value you create and will verify]&redirect_uri=[The redirect_uri you registered during app registration].

Your final URL should look similar to this, go ahead a try it in any browser if you are unsure if you formed it properly:

https://sandbox.apihub.citi.com/gcb/api/authCode/oauth2/authorize?response_type=code&client_id=97086fae-c252-4d81-b4d9-d73cde5ea800&scope=accounts_details_transactions customers_profiles&countryCode=US&businessCode=GCB&locale=en_US&state=12093&redirect_uri=https://www.test.com

Scope Description
pay_with_points Manage Pay with Points enrollment, look up rewards balances and complete redemptions
accounts_details_transactions Retrieve a summary of all accounts, account details and transactions
customers_profiles Retrieve profile data such as name, email address and home address
payees Retrieve payees/source accounts for all accounts
personal_domestic_transfers Retrieve payees/source accounts and complete transfers between your own Citi accounts in the same market
internal_domestic_transfers Retrieve payees/source accounts and complete transfers from your Citi accounts to other customer Citi accounts in the same market
external_domestic_transfers Retrieve payees/source accounts and complete transfers from your Citi accounts to other bank accounts in the same market
bill_payments Retrieve bill payees and complete bill payments
Drawees Retrieve/Manage drawees.
Card_Payments Retrieve valid source and destination accounts and complete immediate card payment.
Auto_Debit Retrieve valid source and destination accounts and setup recurring card payment
cards Retrieve card IDs and update configurations such as overseas usage and configurations
onboarding Create and manage customer applications and prospects
reference_data Retrieve valid values for certain fields. Simplifies multi market app development
reset_atm_pin Sets the ATM Pin of the Card in context
statements_and_advices Retrieve the statement and advices listings as well as individual statement or advice in PDF format
meta_data Returns field properties and validations applied for a specific market

For successful request, citi will return a login page which allows customers to enter their credentials.

Use any of the following credentials.

S.No Username Password
1 SandboxUser1 P@ssUser1$
2 SandboxUser2 P@ssUser2$
3 SandboxUser3 P@ssUser3$
4 SandboxUser4 P@ssUser4$
5 SandboxUser5 P@ssUser5$

Once credentials are verified, a consent page will be presented to the Citi customer to approve the scope requested by your app. After getting customer consent, the flow redirects to the provided redirect_uri and an authorization code will be sent back as a query component.

https://www.test.com/?code=AAJP_jIlIuuIqS-qj0ohfXLaOyhQK9y4bbyhEJWt39l5gWT-1XZmCHtESO2gcbLsPmLlERAAPj80IfLueI4WM8s_Ay1Gy8VtcwFUv8lQE4Svi9hOayu5kBP2OKLhvBwMwrZ_wz5SDHaKN96BdgScYmNEGww0IcV5gH4VBjeOPijN7CxdMRwc2H_w5RnpckbCtS4605BCp5FD0Qho4tYsfcmJ&state=12093

This authorization code is valid for a very short period of time and should be immediately exchanged for access token.

Query Parameters
response_type
string required
Value MUST be set to "code"
client_id
string required
Client ID generated during application registration.
scope
string required
The set of scopes required to make the API calls. Scope is case insensitive and multiple values can be passed using space delimiter.
countryCode
string required
Country code in 2 character ISO 3166 format (upper case)
businessCode
string required
The 3 character business code. Use GCB for consumer banking (upper case)
locale
string required
Locale identify a specific language and geographic region, it shoule follow [language[_territory]. eg - en_US, en_SG
state
string required
Opaque value to maintain the state between request and call back. This will be used to prevent cross-site request forgery.
redirect_uri
string required
Absolute uri for user-agent redirection.You should provide the uri used during client registration process.
  • cURL
  • Ruby
  • Python
  • PHP
  • Java
  • Node
  • Go
  • Swift

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Responses
200

Client Authentication
This operation returns no content.
302

The authorization response contains the authorization code needed to obtain an access token. Here are the parameters included in the response.
success response
field namefield typemandatorydescription
redirect_urilocationyesThis is the absolute uri provided in the request
codequeryyesThe authorization code
statequeryyesThe same value as sent by the client in the state parameter, if any

If an error occurs during authorization, two situations can occur. The first is, that the client is not authenticated or recognized. For instance, a wrong redirect URI was sent in the request. In that case the authorization server must not redirect the resource owner to the redirect URI. Instead it should inform the resource owner of the error. The second situation is that client is authenticated correctly, but that something else failed. In that case the following error response is sent to the client, included in the redirect_uri
failure response
field namefield typemandatorydescription
redirect_urilocationyesThis is the absolute uri provided in the request
statequeryyesThe same value as sent by the client in the state parameter, if any
errorqueryyes
error_descriptionqueryno
error_uriqueryno

Here is the list of errors:
error
invalid_request
unauthorized_client
unsupported_response_type
invalid_scope
access_denied
This operation returns no content.
500

server_error
This operation returns no content.
503

temporarily_unavailable
This operation returns no content.

Authorization code grant: Retrieve access token

post /authCode/oauth2/token/au/gcb
Description

Get an access token issued by calling our token endpoint and passing the authorization code from the previous call. The issued access token will have an expiry, and it will be valid only for the scope for which the consent has been provided by the customer. You can call the APIs by passing this token in Authorization header.
You also get a refresh token that can be used to get a new access token in case the original one expires.

Header Parameters
Authorization
string required
HTTP Basic authentication by passing base64 encoded value of the client id and client secret separated by colon (:).Example: Base64(client_id:client_secret) will be passed as Basic KGNsaWVudF9pZDpjbGllbnRfc2VjcmV0KQ==
Content-Type
string required
Value should always be application/x-www-form-urlencoded
FormData Parameters
grant_type
string required
Authentication grant type. Valid value is authorization_code
code
string required
The code from the response of GET /authCode/oauth2/authorize
redirect_uri
string required
Absolute uri for user-agent redirection. You should provide the uri passed in GET /authCode/oauth2/authorize request
  • cURL
  • Ruby
  • Python
  • PHP
  • Java
  • Node
  • Go
  • Swift

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Responses
200

The request has succeeded
Definitions
  • access_token
    • The access token value received after exchanging the authorization token. This field should be passed as Authorization header in API request calls
    • type : string
  • refresh_token
    • You can use this token to refresh an expired access_token.
    • type : string
  • scope
    • Set of scopes allowed by customer and separated by space
    • type : string
  • token_type
    • Type of the access token issued. This is bearer token for authorization_code grant type
    • type : string
  • expires_in
    • Validity of access token in seconds
    • type : number
Example Response for post /authCode/oauth2/token/au/gcb
400

error
invalid_request
invalid_grant
unsupported_grant_type
unauthorized_client
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /authCode/oauth2/token/au/gcb
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
401

error
invalid_client
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /authCode/oauth2/token/au/gcb
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
500

server_error
This operation returns no content.

Authorization code grant: Refresh access token

post /authCode/oauth2/refresh
Description

If your access token has expired and you still have a valid refresh token, you can exchange it for a new set of valid access and refresh tokens.

Header Parameters
Authorization
string required
HTTP Basic authentication by passing base64 encoded value of the client id and client secret separated by colon (:).Example: Base64(client_id:client_secret) will be passed as Basic KGNsaWVudF9pZDpjbGllbnRfc2VjcmV0KQ==
Content-Type
string required
Content type. Value is application/x-www-form-urlencoded
FormData Parameters
grant_type
string required
The grant type. Valid value is refresh_token.
refresh_token
string required
The refresh token issued to the client
  • cURL
  • Ruby
  • Python
  • PHP
  • Java
  • Node
  • Go
  • Swift

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Responses
200

The request has succeeded
Definitions
  • access_token
    • This field should be passed as Authorization header in API request calls
    • type : string
  • refresh_token
    • The refresh token value
    • type : string
  • scope
    • The list of scopes separated by space
    • type : string
  • token_type
    • The token type
    • type : string
  • expires_in
    • The access token expiry time (in seconds)
    • type : number
Example Response for post /authCode/oauth2/refresh
400

error
invalid_request
invalid_grant
unsupported_grant_type
unauthorized_client
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /authCode/oauth2/refresh
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
401

error
invalid_client
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /authCode/oauth2/refresh
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
500

server_error
This operation returns no content.

Revoke Access Token

post /authCode/oauth2/revoke
Description

This API is used to revoke the access token and requires the resource owner to pass the valid client credentials, a valid token and the token type as inputs. After successful validation of the inputs by the authorization server, the token is tagged as revoked. Along with the access token, the corresponding refresh token is also revoked and vice-versa. After successful revocation, the tokens are marked invalid.

Header Parameters
Authorization
string required
HTTP Basic authentication by passing base64 encoded value of the client id and client secret separated by colon (:).Example: Base64(client_id:client_secret) will be passed as Basic KGNsaWVudF9pZDpjbGllbnRfc2VjcmV0KQ==
Content-Type
string required
Content type. Value is application/x-www-form-urlencoded
FormData Parameters
token
string required
The token to be revoked
token_type_hint
string required
A hint about the type of the token submitted for revocation. Clients MAY pass this parameter in order to help the authorization server to optimize the token lookup. Valid values are access_token, refresh_token
  • cURL
  • Ruby
  • Python
  • PHP
  • Java
  • Node
  • Go
  • Swift

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Responses
200

The request has succeeded
Definitions
  • status
    • The status of the token revocation request.
    • type : string
Example Response for post /authCode/oauth2/revoke
400

error
invalid_request
invalid_grant
unauthorized_client
unsupported_grant_type
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /authCode/oauth2/revoke
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
401

error
invalid_client
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /authCode/oauth2/revoke
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
500

server_error
This operation returns no content.

Enroll and Generate Card Access Token

post /cardAuth/oauth2/authorize/{countrycode}/{businesscode}
Description

This API is used to enroll the customer to avail services like Rewards Redemption and EPP from the partner's site through a common registration. An OTP is sent to the customer's registered mobile number. The customer completes his registration by validating the OTP and receives a notification from the bank after the successful registration.

Header Parameters
Authorization
string required
HTTP Basic authentication by passing base64 encoded value of the client id and client secret separated by colon (:).Example: Base64(client_id:client_secret) will be passed as Basic KGNsaWVudF9pZDpjbGllbnRfc2VjcmV0KQ==
uuid
string required
128 bit random UUID generated uniquely for every request.
Accept
string required
Content-Type that are acceptable for the response.
client_id
string required
Client ID generated during application registration.
Content-Type
string required
application/json
clientDetails
string Optional
This field is used to capture device,browser and network information. Refer the developer portal for more information.These are the fields which will be passed as part of the header devicePrint,deviceTokenCookie,userIpAddress,userAgent,hardwareId,simId,deviceModel,deviceName,deviceOsName,deviceOsVersion,multitaskingSupportFlag,languageSupport,wifiMacAddress,cellTowerId,locationAreaCode,rsaApplicationKey,wapClientId,mobileCarrierCode,mobileCountryCode,osId,geoLongitude,geoLatitude,geoHorizontalAccuracy,geoAltitude,geoAltitudeAccuracy,geoSpeed,geoTimestamp,geoStatus,basicServiceSetId,signalStrength,wifiChannel,serviceSetId
channelId
string Optional
ChannelId
ConsumerOrg
string Optional
ConsumerOrg
Body Parameters
CardAuthorizationRequest
required
CardAuthorizationRequest
Show schema
Path Parameters
countrycode
string required
Countrycode
businesscode
string required
Businesscode
  • cURL
  • Ruby
  • Python
  • PHP
  • Java
  • Node
  • Go
  • Swift

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Responses
200

Successful operation.
This operation returns no content.
400

TypeCodeDetails
invalidinvalid_requestMissing or invalid Parameters
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/authorize/{countrycode}/{businesscode}
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
401

TypeCodeDetails
errorunAuthorizedAuthorization credentials are missing or invalid
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/authorize/{countrycode}/{businesscode}
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
403

TypeCodeDetails
erroraccessNotConfiguredThe request operation is not configured to access this resource
errormfaRequiredMFA is required
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/authorize/{countrycode}/{businesscode}
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
422

TypeCodeDetails
errorregistrationFailedRegistration failed
invalidinvalid_grantThe provided access grant is invalid, expired, or revoked
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/authorize/{countrycode}/{businesscode}
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
500

TypeCodeDetails
fatalserverUnavailableThe request failed due to an internal error
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/authorize/{countrycode}/{businesscode}
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}

Activate Card Access Token

post /cardAuth/oauth2/token/{countrycode}/{businesscode}
Description

This API activates customer's access token. Separate token activation is required for each credit card held by the customer.

Header Parameters
Authorization
string required
HTTP Basic authentication by passing base64 encoded value of the client id and client secret separated by colon (:).Example: Base64(client_id:client_secret) will be passed as Basic KGNsaWVudF9pZDpjbGllbnRfc2VjcmV0KQ==
uuid
string required
128 bit random UUID generated uniquely for every request.
Accept
string required
Content-Type that are acceptable for the response.
client_id
string required
Client ID generated during application registration.
Content-Type
string required
application/json
clientDetails
string Optional
This field is used to capture device,browser and network information. Refer the developer portal for more information.These are the fields which will be passed as part of the header devicePrint,deviceTokenCookie,userIpAddress,userAgent,hardwareId,simId,deviceModel,deviceName,deviceOsName,deviceOsVersion,multitaskingSupportFlag,languageSupport,wifiMacAddress,cellTowerId,locationAreaCode,rsaApplicationKey,wapClientId,mobileCarrierCode,mobileCountryCode,osId,geoLongitude,geoLatitude,geoHorizontalAccuracy,geoAltitude,geoAltitudeAccuracy,geoSpeed,geoTimestamp,geoStatus,basicServiceSetId,signalStrength,wifiChannel,serviceSetId
channelId
string Optional
channelId
ConsumerOrg
string Optional
ConsumerOrg
Body Parameters
CardAuthorizationAccessTokenRequest
required
CardAuthorizationAccessTokenRequest
Show schema
Path Parameters
countrycode
string required
Countrycode
businesscode
string required
Businesscode
  • cURL
  • Ruby
  • Python
  • PHP
  • Java
  • Node
  • Go
  • Swift

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Responses
200

Successful operation.
Definitions
  • token_type
    • The token type
    • type : string
  • expires_in
    • The access token expiry time (in seconds)
    • type : integer
    • format : int32
  • scope
    • The list of scopes separated by space
    • type : string
  • refresh_token
    • The refresh token value
    • type : string
  • cardId
    • The card id in encrypted format
    • type : string
  • access_token
    • This field should be passed as Authorization header in API request calls
    • type : string
  • refresh_token_expires_in
    • This refer to the time in refersh token expiry
    • type : integer
  • consented_on
    • This refer to the customer consent time for authorization
    • type : string
  • customerId
    • Customer number in the encrypted format
    • type : string
  • cardReferenceNumber
    • Partner will include Card reference number in the settlement file to sent it to Citi to aprove the purchase
    • type : string
Example Response for post /cardAuth/oauth2/token/{countrycode}/{businesscode}
400

TypeCodeDetails
invalidinvalidRequestMissing or invalid Parameters
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/token/{countrycode}/{businesscode}
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
401

TypeCodeDetails
errorunAuthorizedAuthorization credentials are missing or invalid
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/token/{countrycode}/{businesscode}
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
403

TypeCodeDetails
erroraccessNotConfiguredThe request operation is not configured to access this resource
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/token/{countrycode}/{businesscode}
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
422

TypeCodeDetails
erroractivationFailedLink code activation is failed
errorexceedsMaximumAttemptsMaximum attempts exceeded for activation. Link credit card to a merchant again.
errorlinkageConfirmationCodeExpiredThe linkage confirmation Code is expired . Link credit card to a merchant again.
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/token/{countrycode}/{businesscode}
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
500

TypeCodeDetails
fatalserverUnavailableThe request failed due to an internal error
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/token/{countrycode}/{businesscode}
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}

Refresh Card Access Token

post /cardAuth/oauth2/refresh
Description

This API generates a fresh access token. If your access token has expired and you still have a valid refresh token, you can exchange it for a new set of valid access and refresh tokens.

Header Parameters
Authorization
string required
HTTP Basic authentication by passing base64 encoded value of the client id and client secret separated by colon (:).Example: Base64(client_id:client_secret) will be passed as Basic KGNsaWVudF9pZDpjbGllbnRfc2VjcmV0KQ==
uuid
string required
128 bit random UUID generated uniquely for every request.
Accept
string required
Content-Type that are acceptable for the response.
client_id
string required
Client ID generated during application registration.
Content-Type
string required
application/json
clientDetails
string Optional
This field is used to capture device,browser and network information. Refer the developer portal for more information.These are the fields which will be passed as part of the header devicePrint,deviceTokenCookie,userIpAddress,userAgent,hardwareId,simId,deviceModel,deviceName,deviceOsName,deviceOsVersion,multitaskingSupportFlag,languageSupport,wifiMacAddress,cellTowerId,locationAreaCode,rsaApplicationKey,wapClientId,mobileCarrierCode,mobileCountryCode,osId,geoLongitude,geoLatitude,geoHorizontalAccuracy,geoAltitude,geoAltitudeAccuracy,geoSpeed,geoTimestamp,geoStatus,basicServiceSetId,signalStrength,wifiChannel,serviceSetId
Body Parameters
CardAuthorizationRefreshTokenRequest
required
CardAuthorizationRefreshTokenRequest
Show schema
  • cURL
  • Ruby
  • Python
  • PHP
  • Java
  • Node
  • Go
  • Swift

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Responses
200

Successful operation.
Definitions
  • token_type
    • The token type
    • type : string
  • access_token
    • This field should be passed as Authorization header in API request calls
    • type : string
  • expires_in
    • The access token expiry time (in seconds)
    • type : integer
    • format : int32
  • scope
    • The list of scopes separated by space
    • type : string
  • refresh_token
    • The refresh token value
    • type : string
  • cardId
    • The card id in encrypted format
    • type : string
Example Response for post /cardAuth/oauth2/refresh
400

TypeCodeDetails
invalidinvalidRequestMissing or invalid Parameters
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/refresh
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
401

TypeCodeDetails
errorunAuthorizedAuthorization credentials are missing or invalid
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/refresh
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
403

TypeCodeDetails
erroraccessNotConfiguredThe request operation is not configured to access this resource
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/refresh
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
422

TypeCodeDetails
invalidinvalid_grantThe provided access grant is invalid, expired, or revoked
errorunsupported_grant_typegrant type not supported
errorunauthorized_clientThe client is not authorized to request an authorization code using this method
errorinvalidCustomerCustomer not found or invalid
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/refresh
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
500

TypeCodeDetails
fatalserverUnavailableThe request failed due to an internal error
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/refresh
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}

Revoke Card Access Token

post /cardAuth/oauth2/revoke
Description

The revoke call will terminate the access granted by Citi customer to your application.

Header Parameters
Authorization
string required
HTTP Basic authentication by passing base64 encoded value of the client id and client secret separated by colon (:).Example: Base64(client_id:client_secret) will be passed as Basic KGNsaWVudF9pZDpjbGllbnRfc2VjcmV0KQ==
uuid
string required
128 bit random UUID generated uniquely for every request.
Accept
string required
Content-Type that are acceptable for the response.
client_id
string required
Client ID generated during application registration.
Content-Type
string required
application/json
clientDetails
string Optional
This field is used to capture device,browser and network information. Refer the developer portal for more information.These are the fields which will be passed as part of the header devicePrint,deviceTokenCookie,userIpAddress,userAgent,hardwareId,simId,deviceModel,deviceName,deviceOsName,deviceOsVersion,multitaskingSupportFlag,languageSupport,wifiMacAddress,cellTowerId,locationAreaCode,rsaApplicationKey,wapClientId,mobileCarrierCode,mobileCountryCode,osId,geoLongitude,geoLatitude,geoHorizontalAccuracy,geoAltitude,geoAltitudeAccuracy,geoSpeed,geoTimestamp,geoStatus,basicServiceSetId,signalStrength,wifiChannel,serviceSetId
Body Parameters
CardAuthorizationRevokeTokenRequest
required
CardAuthorizationRevokeTokenRequest
Show schema
  • cURL
  • Ruby
  • Python
  • PHP
  • Java
  • Node
  • Go
  • Swift

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Responses
200

Successful operation.
This operation returns no content.
400

TypeCodeDetails
invalidinvalidRequestMissing or invalid Parameters
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/revoke
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
401

TypeCodeDetails
errorunAuthorizedAuthorization credentials are missing or invalid
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/revoke
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
403

TypeCodeDetails
erroraccessNotConfiguredThe request operation is not configured to access this resource
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/revoke
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
422

TypeCodeDetails
invalidinvalid_grantThe provided access grant is invalid, expired, or revoked
errorunsupported_grant_typegrant type not supported
errorunauthorized_clientThe client is not authorized to request an authorization code using this method
errorinvalidCustomerCustomer not found or invalid
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/revoke
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
500

TypeCodeDetails
fatalserverUnavailableThe request failed due to an internal error
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /cardAuth/oauth2/revoke
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}

This API is used to get a long-lived access token for customer.

post /v1/issuedDeviceAdministration/accessToken/retrieve/{countryCode}/{businessCode}
Description

This API is used to get a long-lived access token for customer.

Header Parameters
Authorization
string required
HTTP Basic authentication by passing base64 encoded value of the client id and client secret separated by colon (:).Example: Base64(client_id:client_secret) will be passed as Basic KGNsaWVudF9pZDpjbGllbnRfc2VjcmV0KQ==
uuid
string required
128 bit random UUID generated uniquely for every request.
Accept
string required
Content-Type that are acceptable for the response.
client_id
string required
Client ID generated during application registration.
Content-Type
string required
The MIME type of the body of the request (used with POST and PUT requests). application/x-www-form-urlencoded.
clientDetails
string Optional
This field is used to capture device,browser and network information. Refer the developer portal for more information.These are the fields which will be passed as part of the header devicePrint,deviceTokenCookie,userIpAddress,userAgent,hardwareId,simId,deviceModel,deviceName,deviceOsName,deviceOsVersion,multitaskingSupportFlag,languageSupport,wifiMacAddress,cellTowerId,locationAreaCode,rsaApplicationKey,wapClientId,mobileCarrierCode,mobileCountryCode,osId,geoLongitude,geoLatitude,geoHorizontalAccuracy,geoAltitude,geoAltitudeAccuracy,geoSpeed,geoTimestamp,geoStatus,basicServiceSetId,signalStrength,wifiChannel,serviceSetId
Path Parameters
countryCode
string required
Country code in ISO 3166 alpha-2 format. Examples: SG (Singapore), PH (Philippines), TH (Thailand).
businessCode
string required
Citi business codes. Examples: GCB, VMA, QCC.
Body Parameters
RetrieveIssuedDeviceAllocationAccessTokenRequest
required
RetrieveIssuedDeviceAllocationAccessTokenRequest
Show schema
  • cURL
  • Ruby
  • Python
  • PHP
  • Java
  • Node
  • Go
  • Swift

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Example Request

Responses
200

Successful operation.
Definitions
  • tokenType
    • Type of token, default is \"Bearer\".
    • type : string
  • accessToken
    • Session token which is created after auth service. The token is granted for an individual user to access his data.
    • type : string
  • expiresIn
    • The remaining lifetime of the access token.
    • type : integer
    • format : int32
  • refreshToken
    • The refresh token issued to the client
    • type : string
  • refreshTokenExpiresIn
    • The remaining lifetime of the refresh access token.
    • type : integer
    • format : int32
  • cardId
    • The customer card identifier in encrypted format
    • type : string
  • scope
    • The set of function scopes applicable for the token
    • type : string
Example Response for post /v1/issuedDeviceAdministration/accessToken/retrieve/{countryCode}/{businessCode}
400

TypeCodeDetails
invalidinvalidRequestMissing or invalid Parameters
invalidinvalidGrantGrant type is not valid
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /v1/issuedDeviceAdministration/accessToken/retrieve/{countryCode}/{businessCode}
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
401

TypeCodeDetails
errorunAuthorizedAuthorization credentials are missing or invalid
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /v1/issuedDeviceAdministration/accessToken/retrieve/{countryCode}/{businessCode}
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
403

TypeCodeDetails
erroraccessNotConfiguredAccess is not configured for this resource
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /v1/issuedDeviceAdministration/accessToken/retrieve/{countryCode}/{businessCode}
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
404

TypeCodeDetails
errorresourceNotFoundEmpty resource/resource not found
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /v1/issuedDeviceAdministration/accessToken/retrieve/{countryCode}/{businessCode}
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
422

TypeCodeDetails
errorbusinessValidationsFailedBusiness validations failed
errorcustomerNotAllowedCustomer is not allowed based on accessibility check
errorvalidationFailedCustomer data is not valid
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /v1/issuedDeviceAdministration/accessToken/retrieve/{countryCode}/{businessCode}
{
    "properties": {
        "error_description": {
            "description": "Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred",
            "type": "string"
        },
        "error": {
            "description": "If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.",
            "type": "string",
            "enum": [
                "invalid_request",
                "unauthorized_client",
                "access_denied",
                "unsupported_response_type",
                "invalid_scope",
                "server_error",
                "temporarily_unavailable",
                "unsupported_token_type"
            ]
        },
        "error_uri": {
            "description": "A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.",
            "type": "string"
        }
    },
    "required": [
        "error"
    ]
}
500

TypeCodeDetails
fatalserverUnavailableThe request failed due to an internal error/server unavailability
Definitions
  • error_description
    • Human-readable ASCII [USASCII] text providing additional information, used to assist the client developer in understanding the error that occurred
    • type : string
  • error
    • If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource owner of the error and MUST NOT automatically redirect the user-agent to the invalid redirection URI.
    • type : string
    • enum : invalid_request, unauthorized_client, access_denied, unsupported_response_type, invalid_scope, server_error, temporarily_unavailable, unsupported_token_type
  • error_uri
    • A URI identifying a human-readable web page with information about the error, used to provide the client developer with additional information about the error.
    • type : string
  • required
    • error
Response Schema for post /v1/issuedDeviceAdministration/accessToken/retrieve/{countryCode}/{businessCode}