Set Card Limits

Cards

Set Card Limits

Set your self-imposed credit card daily spend limits and domestic and international transaction limits in order to optimize your card usage and keep your finances on track.

India

Set credit card limits

Set your credit card's daily limits as well as domestic and international transaction limits through Partner platform in an easy and convenient way.
Zoom In

Identify yourself securely

Customers are redirected to a modal window (triggered by the OAuth API) where they are asked to log in to their Citi account in order to verify their identity.
Zoom In

API(s) Callout

View Api Callout 1 >
×

Use Case Callout

Authorization code grant: Retrieve authorization code

This API gets invoked by a web browser redirection and requires user interaction. It is used to retrieve an authorization code by redirecting the user to a login page followed by the consent approval page. At the end of this flow, this endpoint returns to the redirect_uri configured for the associated application.

Endpoint

Australia: GET /authCode/oauth2/authorize

Singapore: GET /authCode/oauth2/authorize

Hong Kong: GET /authCode/oauth2/authorize

India: GET /authCode/oauth2/authorize

Indonesia: GET /authCode/oauth2/authorize

Malaysia: GET /authCode/oauth2/authorize

Philippines: GET /authCode/oauth2/authorize

Thailand: GET /authCode/oauth2/authorize

Poland: GET /authCode/oauth2/authorize

UK: GET /authCode/oauth2/authorize

Parameters

PATH

NA

Query

response_type

client_id

scope

countryCode

businessCode

locale

state

redirect_uri

Customers validate the one-time password

Customers validate the one-time password sent to their registered mobile number. In the three-legged OAuth flow, OTP validation is based on a fraud and risk recommendation, which is not mandatory.
Zoom In

Customer consent

Customers are then presented with Citi’s consent page where they can read the Terms and Conditions as well as what account information will be shared with the third-party application. If they agree, the customers click "Authorize".
Zoom In

API(s) Callout

View Api Callout 1 >
×

Use Case Callout

Authorization code grant: Retrieve access token

Get an access token issued by calling our token endpoint and passing the authorization code from the previous call. The issued access token will have an expiry, and it will be valid only for the scope for which the consent has been provided by the customer. You can call the APIs by passing this token in Authorization header.
You also get a refresh token that can be used to get a new access token in case the original one expires.

Endpoint

POST /authCode/oauth2/token/<countryCode>/<businessCode>

Parameters

PATH

countryCode

businessCode

FormData

grant_type

code

redirect_uri

Card selection

From the list of eligible cards, customers can select the card they wish to set the daily and transaction limits for.

 

There is a variation in API callouts for listing of cards on this screen between aggregrators and co-brand partners. Please refer to whichever is applicable.

Zoom In

API(s) Callout

View Api Callout 1 >
×

Use Case Callout

Retrieve All Cards - For Aggregators

This API is used to retrieve all the credit card numbers and corresponding details of the customers who authorized the application.

Endpoint

India : GET /v1/cards

Parameters

PATH

NA

Query

cardFunction

View Api Callout 2 >
×

Use Case Callout

Retrieve All Cards - For Cobrand Partners

This API is used to list all the cards held by a customer with Citi partner.

Endpoint

India : GET /partner/v1/cards

Parameters

PATH

NA

Query

cardFunction

Set card's daily limits

Customers can select daily limits for point of sale transactions, online transactions and ATM transactions. Once confirmed, the new limits will be effective immediately.

Zoom In

API(s) Callout

View Api Callout 1 >
×

Use Case Callout

Update Card Limits

This API is used to update the limits(daily and transaction level) and the enrollments applicable for the credit/debit card of a customer.

Endpoint

India: PUT /v1/cards/{cardId}/limitsAndEnrollments

Parameters

PATH

cardId

Body

CardsLimitsAndEnrollmentsUpdateRequest

Customers validate the one-time password

To proceed, customers need to validate the one-time password sent to the registered mobile number. This is a session-level OTP validation.

 

Refer to the below API callouts :

 

  • API callout1 for retrieving the public key used for encryption.
  • API callout2 to validate the one time password.
  • API callout3 to re-generate and send the one time password.
  • API callout4 to update the card limit.

 

In an ideal scenario, only API callouts 1, 2 and 4 would be needed.

Zoom In

API(s) Callout

View Api Callout 1 >
×

Use Case Callout

E2E Public Key Modulas and exponent

This API is used by browser based applications for retrieving the public key used for encryption. It returns the modulus and exponent for setting up a business public key. This is a post login API.

Endpoint

India : GET /v1/security/e2ekey

Parameters

PATH

NA

View Api Callout 2 >
×

Use Case Callout

Validate OTP

This API validates the OTP token submitted by customer.

Endpoint

India : PUT /v1/mfa/otp

Parameters

PATH

N/A

Body

ValidateOTPRequest

View Api Callout 3 >
×

Use Case Callout

Generate and Send OTP

This API allows you to generate the one time password and delivers to customer.

Endpoint

India : POST /v1/mfa/otp

Parameters

PATH

N/A

Body

GenerateOTPRequest

View Api Callout 4 >
×

Use Case Callout

Update Card Limits

This API is used to update the limits(daily and transaction level) and the enrollments applicable for the credit/debit card of a customer.

Endpoint

India: PUT /v1/cards/{cardId}/limitsAndEnrollments

Parameters

PATH

cardId

Body

CardsLimitsAndEnrollmentsUpdateRequest

Acknowledgement for card's daily limits

Customers recieve confirmation that their card's daily limit has been set, along with transaction reference number.

Zoom In

Set card's domestic transaction limits

Customers can select a card's domestic limits for point of sale transactions, online transactions, ATM transactions and contactless transactions. Once confirmed, the new limits will be effective immediately.

 

If a particular transaction type is turned off, the card limiting feature will be disabled for that transaction type, and customers won’t be able to make any purchases of this transaction type.

Zoom In

API(s) Callout

View Api Callout 1 >
×

Use Case Callout

Update Card Limits

This API is used to update the limits(daily and transaction level) and the enrollments applicable for the credit/debit card of a customer.

Endpoint

India: PUT /v1/cards/{cardId}/limitsAndEnrollments

Parameters

PATH

cardId

Body

CardsLimitsAndEnrollmentsUpdateRequest

Acknowledgement for domestic transaction limits

Customers receive confirmation that their card's domestic transaction limits have been set, along with transaction reference number.
Zoom In

Set card's international transaction limits

Customers can select a card's international limits for point of sale transactions, online transactions, ATM transactions and contactless transactions. Once confirmed, the new limits will be effective immediately.

 

If a particular transaction type is turned off, the card limiting feature will be disabled for that transaction type, and customers won’t be able to make any purchases of this transaction type.

Zoom In

API(s) Callout

View Api Callout 1 >
×

Use Case Callout

Update Card Limits

This API is used to update the limits(daily and transaction level) and the enrollments applicable for the credit/debit card of a customer.

Endpoint

India: PUT /v1/cards/{cardId}/limitsAndEnrollments

Parameters

PATH

cardId

Body

CardsLimitsAndEnrollmentsUpdateRequest

Acknowledgement for international transaction limits

Customers recieve confirmation that their card's international transaction limit has been set, along with a transaction reference numbers.

Zoom In