# Visa Consent Management Service The Visa Consent Management Service (VCMS) is a solution that enables informed and explicit consumer consent experience. This helps Visa and our clients in collecting user consent in a consistent, transparent, and intuitive manner. ## Version: 1 ### Servers | URL | Description | | --- | ----------- | | https://sandbox.api.visa.com | Sandbox server | --- ## Visa Consent Management API Visa Consent Management API ### [POST] /vcms/v1/consents/{consentID}/revoke **Revoke Consent** This API revokes a current consent. A consent may be revoked if it is in either ACTIVE or PAUSED state. Attempting to revoke a consent in any other state results in a 409 error with invalidConsentStateTransition reason. #### Parameters | Name | Located in | Description | Required | Schema | Explode | | ---- | ---------- | ----------- | -------- | ------ | ------- | | X-Correlation-Id | header | Unique ID for every API request - an optional header. Generated by the API client. Used for end-to-end tracing/debugging. | No | string | No | | consentID | path | Consent identifier. | Yes | string | No | #### Request Body Request body for revocation payload. | Required | Schema | | -------- | ------ | | Yes | **application/json**: { **"revocationReason"**: string }
| #### Responses | Code | Description | Schema | | ---- | ----------- | ------ | | 200 | Updated consent.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"status"**: string,
**Available values:** "INITIATED", "ACTIVE", "REVOKED", "EXPIRED", "CONSUMED", "PAUSED", **"userID"**: string, **"consentID"**: string (uuid) } & { **"frequency"**: string,
**Available values:** "STREAMING", "PERIODIC", "ON_DEMAND", "CONTEXT_BASED",
**Default:** STREAMING, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"primaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"externalConsentID"**: string, **"presentedLanguage"**: string (BCP-47), **"previousConsentID"**: string (uuid), **"secondaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"consentCaptureCity"**: string, **"consentDirectoryID"**: string (uuid), **"expirationDateTime"**: string (RFC3339), **"privacyPolicyVersion"**: string, **"consentCaptureCountry"**: string (ISO 3166-1 alpha 2), **"consentCaptureDateTime"**: string (RFC3339), **"presentedContentVersion"**: string, **"presenterOrganizationID"**: string (uuid), **"consentCaptureRegionState"**: string (ISO 3166-2 subdivision), **"resourceProviderOrganizationIDs"**: [ string (uuid) ] } & { **"constraints"**: { **"timespan"**: { **"endDateTime"**: string (RFC3339), **"startDateTime"**: string (RFC3339) }, **"maxNumberUses"**: integer, **"remainingNumberUses"**: integer }, **"createdDateTime"**: string (RFC3339), **"updatedDateTime"**: string (RFC3339), **"financialInstruments"**: [ { **"instrumentID"**: string (uuid), **"accountNumber"**: string, **"instrumentType"**: string,
**Available values:** "PAYMENT_CARD", "VCARDID", "BANK_ACCOUNT", "PAYMENT_TOKEN" } ], **"consumerContactInformation"**: { **"phoneNumber"**: string, **"emailAddress"**: string (Email Address), **"isPhoneNumberVerified"**: boolean, **"isEmailAddressVerified"**: boolean }, **"identityVerificationDetails"**: { **"userID"**: string, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"attestation"**: string, **"attestationType"**: string,
**Available values:** "ID_TOKEN" } }
| | 400 | The details part of the error response can provide a list of fields that failed data validation constraints and reason values for this error include:
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 401 | API authorized error caused due to any of the following reasons: + x-pay-token is not present, blank, or not in a valid format. + Timestamp field not in valid UTC timestamp format. + Version field is invalid. + Token's timestamp is more than 8 minutes off from the current time. + Token hash mismatch. + APIKey not present in request. + APIKey is not active. + APIKey not valid. + APIKey not active. + Request has more than one authentication token, which is not supported
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 403 | The 403 (Forbidden) HTTP Status code indicates that this Visa Developer Center project does not have permission to access the requested resource. This can happen if you are trying to invoke an API request for a resource that is not part of your project. Check for the following: + You are using a project and the credential for the project that includes the API being accessed. + You created a project and received sandbox credentials for the API’s being called. + You added the API being called to the project (if not already present) with the credentials that are being used.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 404 | The specified resource was not found
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 406 | Not Acceptable - Indicates that the "Accept:" header field is present in a request and none of the available representations for the response have a media type that is listed as acceptable. This can happen when the requested API version is not available or unsupported; for example, when the version requested in the Accept: header is newer than the currently live/supported version.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 409 | The current state of consent is incompatible with the requested mutation. For example, an EXPIRED consent cannot be revoked.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 410 | Gone - Indicates that the resource at this end point is no longer available. This is usually returned for old API versions that are not available anymore - EOL (End-of-Life). The content-type header in the response indicates the latest supported API version.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 429 | The Visa Developer Center project has clocked too many requests in a given amount of time. Please contact Visa Support at developer@visa.com if you want to increase the time limits.
**Headers:**
**Retry-After**: Header field to suggest an appropriate amount of time for the client to wait before retrying the request, typically after a 503 error or after a batch request when the batch job is not completed. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date || delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 500 | Internal Server Error. Please contact Visa Support at developer@visa.com with a complete error message, full http request and response details.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 503 | The Visa system is currently unable to handle the request due to a temporary overloading or maintenance of the server. There may be a Retry-After header field to suggest an appropriate amount of time for the client to wait before retrying the request. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date \|\| delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120 Please contact Visa Support at developer@visa.com if the issue persists.
**Headers:**
**Retry-After**: Header field to suggest an appropriate amount of time for the client to wait before retrying the request, typically after a 503 error or after a batch request when the batch job is not completed. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date || delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| ### [PUT] /vcms/v1/consents/{consentID}/constraints/remainingNumberUses **Update Remaining Consent Uses** API for Visa partners (Consent Requestors) to update the remaining number of uses for a multi-use consent. Notes: + This API is idempotent. + For an active consent, this value may be set to less than or equal to the current value, and only if maxNumberUses is set as non-zero on the consent. Any violation of the above conditions will result in a 409 error with invalidConsentModification reason. If set to zero, the status of the consent changes to CONSUMED and is no longer active. #### Parameters | Name | Located in | Description | Required | Schema | Explode | | ---- | ---------- | ----------- | -------- | ------ | ------- | | X-Correlation-Id | header | Unique ID for every API request - an optional header. Generated by the API client. Used for end-to-end tracing/debugging. | No | string | No | | consentID | path | Consent identifier. | Yes | string | No | #### Request Body Consent request body for PUT remaining number of uses. | Required | Schema | | -------- | ------ | | Yes | **application/json**: { **"remainingNumberUses"**: integer }
| #### Responses | Code | Description | Schema | | ---- | ----------- | ------ | | 200 | Consent remainingNumberUses updated successfully
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"remainingNumberUses"**: integer }
| | 400 | The details part of the error response can provide a list of fields that failed data validation constraints and reason values for this error include:
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 401 | API authorized error caused due to any of the following reasons: + x-pay-token is not present, blank, or not in a valid format. + Timestamp field not in valid UTC timestamp format. + Version field is invalid. + Token's timestamp is more than 8 minutes off from the current time. + Token hash mismatch. + APIKey not present in request. + APIKey is not active. + APIKey not valid. + APIKey not active. + Request has more than one authentication token, which is not supported
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 403 | The 403 (Forbidden) HTTP Status code indicates that this Visa Developer Center project does not have permission to access the requested resource. This can happen if you are trying to invoke an API request for a resource that is not part of your project. Check for the following: + You are using a project and the credential for the project that includes the API being accessed. + You created a project and received sandbox credentials for the API’s being called. + You added the API being called to the project (if not already present) with the credentials that are being used.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 404 | The specified resource was not found
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 406 | Not Acceptable - Indicates that the "Accept:" header field is present in a request and none of the available representations for the response have a media type that is listed as acceptable. This can happen when the requested API version is not available or unsupported; for example, when the version requested in the Accept: header is newer than the currently live/supported version.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 409 | The current state of consent is incompatible with the requested mutation. For example, an EXPIRED consent cannot be revoked.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 410 | Gone - Indicates that the resource at this end point is no longer available. This is usually returned for old API versions that are not available anymore - EOL (End-of-Life). The content-type header in the response indicates the latest supported API version.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 429 | The Visa Developer Center project has clocked too many requests in a given amount of time. Please contact Visa Support at developer@visa.com if you want to increase the time limits.
**Headers:**
**Retry-After**: Header field to suggest an appropriate amount of time for the client to wait before retrying the request, typically after a 503 error or after a batch request when the batch job is not completed. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date || delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 500 | Internal Server Error. Please contact Visa Support at developer@visa.com with a complete error message, full http request and response details.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 503 | The Visa system is currently unable to handle the request due to a temporary overloading or maintenance of the server. There may be a Retry-After header field to suggest an appropriate amount of time for the client to wait before retrying the request. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date \|\| delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120 Please contact Visa Support at developer@visa.com if the issue persists.
**Headers:**
**Retry-After**: Header field to suggest an appropriate amount of time for the client to wait before retrying the request, typically after a 503 error or after a batch request when the batch job is not completed. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date || delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| ### [POST] /vcms/v1/consents **Save Consent** API for Visa partners (Consent Requestors) to save a consumer-granted consent. Notes: + This API is not idempotent, and there is no duplicate check to prevent clients from creating multiple consents with the same values. + The associated Consent Directory entry determines which, if any, identity verification attestation is required. #### Parameters | Name | Located in | Description | Required | Schema | Explode | | ---- | ---------- | ----------- | -------- | ------ | ------- | | X-Correlation-Id | header | Unique ID for every API request - an optional header. Generated by the API client. Used for end-to-end tracing/debugging. | No | string | No | #### Request Body Consent request body for transaction data. | Required | Schema | | -------- | ------ | | Yes | **application/json**: { **"userID"**: string } & { **"frequency"**: string,
**Available values:** "STREAMING", "PERIODIC", "ON_DEMAND", "CONTEXT_BASED",
**Default:** STREAMING, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"primaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"externalConsentID"**: string, **"presentedLanguage"**: string (BCP-47), **"previousConsentID"**: string (uuid), **"secondaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"consentCaptureCity"**: string, **"consentDirectoryID"**: string (uuid), **"expirationDateTime"**: string (RFC3339), **"privacyPolicyVersion"**: string, **"consentCaptureCountry"**: string (ISO 3166-1 alpha 2), **"consentCaptureDateTime"**: string (RFC3339), **"presentedContentVersion"**: string, **"presenterOrganizationID"**: string (uuid), **"consentCaptureRegionState"**: string (ISO 3166-2 subdivision), **"resourceProviderOrganizationIDs"**: [ string (uuid) ] } & { **"constraints"**: { **"timespan"**: { **"endDateTime"**: string (RFC3339), **"startDateTime"**: string (RFC3339) }, **"maxNumberUses"**: integer }, **"financialInstruments"**: [ { **"accountNumber"**: string, **"instrumentType"**: string,
**Available values:** "PAYMENT_CARD", "VCARDID", "BANK_ACCOUNT", "PAYMENT_TOKEN" } ], **"consumerContactInformation"**: { **"phoneNumber"**: string, **"emailAddress"**: string (Email Address), **"isPhoneNumberVerified"**: boolean, **"isEmailAddressVerified"**: boolean }, **"identityVerificationDetails"**: { **"userID"**: string, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"attestation"**: string, **"attestationType"**: string,
**Available values:** "ID_TOKEN", "THREED_SECURE" } }
| #### Responses | Code | Description | Schema | | ---- | ----------- | ------ | | 201 | Consent granted (object created) successfully
**Headers:**
**Location**: Location
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| | | 400 | The details part of the error response can provide a list of fields that failed data validation constraints and reason values for this error include:
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 401 | API authorized error caused due to any of the following reasons: + x-pay-token is not present, blank, or not in a valid format. + Timestamp field not in valid UTC timestamp format. + Version field is invalid. + Token's timestamp is more than 8 minutes off from the current time. + Token hash mismatch. + APIKey not present in request. + APIKey is not active. + APIKey not valid. + APIKey not active. + Request has more than one authentication token, which is not supported
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 403 | The 403 (Forbidden) HTTP Status code indicates that this Visa Developer Center project does not have permission to access the requested resource. This can happen if you are trying to invoke an API request for a resource that is not part of your project. Check for the following: + You are using a project and the credential for the project that includes the API being accessed. + You created a project and received sandbox credentials for the API’s being called. + You added the API being called to the project (if not already present) with the credentials that are being used.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 406 | Not Acceptable - Indicates that the "Accept:" header field is present in a request and none of the available representations for the response have a media type that is listed as acceptable. This can happen when the requested API version is not available or unsupported; for example, when the version requested in the Accept: header is newer than the currently live/supported version.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 409 | The current state of consent is incompatible with the requested mutation. For example, an EXPIRED consent cannot be revoked.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 410 | Gone - Indicates that the resource at this end point is no longer available. This is usually returned for old API versions that are not available anymore - EOL (End-of-Life). The content-type header in the response indicates the latest supported API version.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 429 | The Visa Developer Center project has clocked too many requests in a given amount of time. Please contact Visa Support at developer@visa.com if you want to increase the time limits.
**Headers:**
**Retry-After**: Header field to suggest an appropriate amount of time for the client to wait before retrying the request, typically after a 503 error or after a batch request when the batch job is not completed. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date || delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 500 | Internal Server Error. Please contact Visa Support at developer@visa.com with a complete error message, full http request and response details.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 503 | The Visa system is currently unable to handle the request due to a temporary overloading or maintenance of the server. There may be a Retry-After header field to suggest an appropriate amount of time for the client to wait before retrying the request. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date \|\| delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120 Please contact Visa Support at developer@visa.com if the issue persists.
**Headers:**
**Retry-After**: Header field to suggest an appropriate amount of time for the client to wait before retrying the request, typically after a 503 error or after a batch request when the batch job is not completed. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date || delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| #### Callback: consentCreated ##### [POST] `{callbackURL}` **Consent Created Callback** These are API calls initiated by the Visa Consent System to the Visa Partner’s backend servers. + The callbackURL is specified by the Visa partners during onboarding. + Invoked whenever a consent is created. The if details of the consent are required, the message recipient must fetch the consent details using the GET /consents/{consentId} API. + There will be 2 retries with random times from 1-30 minutes if there are any 5XX or 404 errors returned from the client/partner. #### Parameters | Name | Located in | Description | Required | Schema | Explode | | ---- | ---------- | ----------- | -------- | ------ | ------- | | X-Correlation-Id | header | Unique ID for every API request - an optional header. Generated by the API client. Used for end-to-end tracing/debugging. | No | string | No | #### Request Body | Required | Schema | | -------- | ------ | | No | **application/json**: { **"id"**: string (UUID), **"time"**: string (RFC3339), **"source"**: string, **"subject"**: string (UUID), **"specversion"**: string, **"datacontenttype"**: string (IANA Media Types), **"dataschemaversion"**: string (majorversion.minorversion), **"externalsubjectid"**: string } & { **"data"**: object, **"type"**: string }
| #### Responses | Code | Description | | ---- | ----------- | | 401 | Authorization error. | | 403 | Forbidden | | 500 | Internal Server Error | | 503 | Service Unavailable | | 2XX | Callback successfully processed; no retries will be performed. | #### Callback: consentStatusChanged ##### [POST] `{callbackURL}` **Consent Status Changed Callback** These are API calls initiated by the Visa Consent System to the Visa Partner’s backend servers. + The callbackURL is specified by the Visa partners during onboarding. + Invoked whenever a consent changes status. + There will be 2 retries with random times from 1-30 minutes if there are any 5XX or 404 errors returned from the client/partner. #### Parameters | Name | Located in | Description | Required | Schema | Explode | | ---- | ---------- | ----------- | -------- | ------ | ------- | | X-Correlation-Id | header | Unique ID for every API request - an optional header. Generated by the API client. Used for end-to-end tracing/debugging. | No | string | No | #### Request Body | Required | Schema | | -------- | ------ | | No | **application/json**: { **"id"**: string (UUID), **"time"**: string (RFC3339), **"source"**: string, **"subject"**: string (UUID), **"specversion"**: string, **"datacontenttype"**: string (IANA Media Types), **"dataschemaversion"**: string (majorversion.minorversion), **"externalsubjectid"**: string } & { **"data"**: { **"message"**: string, **"newStatus"**: string,
**Available values:** "INITIATED", "ACTIVE", "REVOKED", "EXPIRED", "CONSUMED", "PAUSED", **"updatedBy"**: string, **"previousStatus"**: string,
**Available values:** "INITIATED", "ACTIVE", "REVOKED", "EXPIRED", "CONSUMED", "PAUSED" }, **"type"**: string }
| #### Responses | Code | Description | | ---- | ----------- | | 401 | Authorization error. | | 403 | Forbidden | | 500 | Internal Server Error | | 503 | Service Unavailable | | 2XX | Callback successfully processed; no retries will be performed. | #### Callback: consentAttributeChanged ##### [POST] `{callbackURL}` **Consent Attribute Changed Callback** These are API calls initiated by the Visa Consent System to the Visa Partner’s backend servers. + The callbackURL is specified by the Visa partners during onboarding. + Invoked whenever one or more mutable consent attributes is changed. The if details of the new consent values are required, the message recipient must fetch the consent details using the GET /consents/{consentId} API. + There will be 2 retries with random times from 1-30 minutes if there are any 5XX or 404 errors returned from the client/partner. #### Parameters | Name | Located in | Description | Required | Schema | Explode | | ---- | ---------- | ----------- | -------- | ------ | ------- | | X-Correlation-Id | header | Unique ID for every API request - an optional header. Generated by the API client. Used for end-to-end tracing/debugging. | No | string | No | #### Request Body | Required | Schema | | -------- | ------ | | No | **application/json**: { **"id"**: string (UUID), **"time"**: string (RFC3339), **"source"**: string, **"subject"**: string (UUID), **"specversion"**: string, **"datacontenttype"**: string (IANA Media Types), **"dataschemaversion"**: string (majorversion.minorversion), **"externalsubjectid"**: string } & { **"data"**: object, **"type"**: string }
| #### Responses | Code | Description | | ---- | ----------- | | 401 | Authorization error. | | 403 | Forbidden | | 500 | Internal Server Error | | 503 | Service Unavailable | | 2XX | Callback successfully processed; no retries will be performed. | ### [GET] /vcms/v1/consents/{consentID} **Get Consent** This API retrieves the consent object identified by consent ID. #### Parameters | Name | Located in | Description | Required | Schema | Explode | | ---- | ---------- | ----------- | -------- | ------ | ------- | | X-Correlation-Id | header | Unique ID for every API request - an optional header. Generated by the API client. Used for end-to-end tracing/debugging. | No | string | No | | consentID | path | Consent identifier. | Yes | string | No | #### Responses | Code | Description | Schema | | ---- | ----------- | ------ | | 200 | Get the consent object corresponding to consentID.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"status"**: string,
**Available values:** "INITIATED", "ACTIVE", "REVOKED", "EXPIRED", "CONSUMED", "PAUSED", **"userID"**: string, **"consentID"**: string (uuid) } & { **"frequency"**: string,
**Available values:** "STREAMING", "PERIODIC", "ON_DEMAND", "CONTEXT_BASED",
**Default:** STREAMING, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"primaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"externalConsentID"**: string, **"presentedLanguage"**: string (BCP-47), **"previousConsentID"**: string (uuid), **"secondaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"consentCaptureCity"**: string, **"consentDirectoryID"**: string (uuid), **"expirationDateTime"**: string (RFC3339), **"privacyPolicyVersion"**: string, **"consentCaptureCountry"**: string (ISO 3166-1 alpha 2), **"consentCaptureDateTime"**: string (RFC3339), **"presentedContentVersion"**: string, **"presenterOrganizationID"**: string (uuid), **"consentCaptureRegionState"**: string (ISO 3166-2 subdivision), **"resourceProviderOrganizationIDs"**: [ string (uuid) ] } & { **"constraints"**: { **"timespan"**: { **"endDateTime"**: string (RFC3339), **"startDateTime"**: string (RFC3339) }, **"maxNumberUses"**: integer, **"remainingNumberUses"**: integer }, **"createdDateTime"**: string (RFC3339), **"updatedDateTime"**: string (RFC3339), **"financialInstruments"**: [ { **"instrumentID"**: string (uuid), **"accountNumber"**: string, **"instrumentType"**: string,
**Available values:** "PAYMENT_CARD", "VCARDID", "BANK_ACCOUNT", "PAYMENT_TOKEN" } ], **"consumerContactInformation"**: { **"phoneNumber"**: string, **"emailAddress"**: string (Email Address), **"isPhoneNumberVerified"**: boolean, **"isEmailAddressVerified"**: boolean }, **"identityVerificationDetails"**: { **"userID"**: string, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"attestation"**: string, **"attestationType"**: string,
**Available values:** "ID_TOKEN" } }
| | 400 | The details part of the error response can provide a list of fields that failed data validation constraints and reason values for this error include:
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 401 | API authorized error caused due to any of the following reasons: + x-pay-token is not present, blank, or not in a valid format. + Timestamp field not in valid UTC timestamp format. + Version field is invalid. + Token's timestamp is more than 8 minutes off from the current time. + Token hash mismatch. + APIKey not present in request. + APIKey is not active. + APIKey not valid. + APIKey not active. + Request has more than one authentication token, which is not supported
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 403 | The 403 (Forbidden) HTTP Status code indicates that this Visa Developer Center project does not have permission to access the requested resource. This can happen if you are trying to invoke an API request for a resource that is not part of your project. Check for the following: + You are using a project and the credential for the project that includes the API being accessed. + You created a project and received sandbox credentials for the API’s being called. + You added the API being called to the project (if not already present) with the credentials that are being used.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 404 | The specified resource was not found
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 406 | Not Acceptable - Indicates that the "Accept:" header field is present in a request and none of the available representations for the response have a media type that is listed as acceptable. This can happen when the requested API version is not available or unsupported; for example, when the version requested in the Accept: header is newer than the currently live/supported version.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 410 | Gone - Indicates that the resource at this end point is no longer available. This is usually returned for old API versions that are not available anymore - EOL (End-of-Life). The content-type header in the response indicates the latest supported API version.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 429 | The Visa Developer Center project has clocked too many requests in a given amount of time. Please contact Visa Support at developer@visa.com if you want to increase the time limits.
**Headers:**
**Retry-After**: Header field to suggest an appropriate amount of time for the client to wait before retrying the request, typically after a 503 error or after a batch request when the batch job is not completed. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date || delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 500 | Internal Server Error. Please contact Visa Support at developer@visa.com with a complete error message, full http request and response details.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 503 | The Visa system is currently unable to handle the request due to a temporary overloading or maintenance of the server. There may be a Retry-After header field to suggest an appropriate amount of time for the client to wait before retrying the request. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date \|\| delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120 Please contact Visa Support at developer@visa.com if the issue persists.
**Headers:**
**Retry-After**: Header field to suggest an appropriate amount of time for the client to wait before retrying the request, typically after a 503 error or after a batch request when the batch job is not completed. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date || delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| ### [PATCH] /vcms/v1/consents/{consentID} **Update Consent** #### Parameters | Name | Located in | Description | Required | Schema | Explode | | ---- | ---------- | ----------- | -------- | ------ | ------- | | X-Correlation-Id | header | Unique ID for every API request - an optional header. Generated by the API client. Used for end-to-end tracing/debugging. | No | string | No | | consentID | path | Consent identifier. | Yes | string | No | #### Request Body Consent request body for PATCH Consent. | Required | Schema | | -------- | ------ | | Yes | **application/json**: { **"status"**: string,
**Available values:** "ACTIVE", "CONSUMED", "PAUSED", **"constraints"**: { **"remainingNumberUses"**: integer }, **"secondaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"financialInstruments"**: [ { **"instrumentID"**: string (uuid) } & { **"accountNumber"**: string, **"instrumentType"**: string,
**Available values:** "PAYMENT_CARD", "VCARDID", "BANK_ACCOUNT", "PAYMENT_TOKEN" } ], **"consumerContactInformation"**: { **"phoneNumber"**: string, **"emailAddress"**: string (Email Address), **"isPhoneNumberVerified"**: boolean, **"isEmailAddressVerified"**: boolean }, **"identityVerificationDetails"**: { **"userID"**: string, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"attestation"**: string, **"attestationType"**: string,
**Available values:** "ID_TOKEN", "THREED_SECURE" } }
| #### Responses | Code | Description | Schema | | ---- | ----------- | ------ | | 200 | Update the consent object corresponding to consentID.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"status"**: string,
**Available values:** "INITIATED", "ACTIVE", "REVOKED", "EXPIRED", "CONSUMED", "PAUSED", **"userID"**: string, **"consentID"**: string (uuid) } & { **"frequency"**: string,
**Available values:** "STREAMING", "PERIODIC", "ON_DEMAND", "CONTEXT_BASED",
**Default:** STREAMING, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"primaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"externalConsentID"**: string, **"presentedLanguage"**: string (BCP-47), **"previousConsentID"**: string (uuid), **"secondaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"consentCaptureCity"**: string, **"consentDirectoryID"**: string (uuid), **"expirationDateTime"**: string (RFC3339), **"privacyPolicyVersion"**: string, **"consentCaptureCountry"**: string (ISO 3166-1 alpha 2), **"consentCaptureDateTime"**: string (RFC3339), **"presentedContentVersion"**: string, **"presenterOrganizationID"**: string (uuid), **"consentCaptureRegionState"**: string (ISO 3166-2 subdivision), **"resourceProviderOrganizationIDs"**: [ string (uuid) ] } & { **"constraints"**: { **"timespan"**: { **"endDateTime"**: string (RFC3339), **"startDateTime"**: string (RFC3339) }, **"maxNumberUses"**: integer, **"remainingNumberUses"**: integer }, **"createdDateTime"**: string (RFC3339), **"updatedDateTime"**: string (RFC3339), **"financialInstruments"**: [ { **"instrumentID"**: string (uuid), **"accountNumber"**: string, **"instrumentType"**: string,
**Available values:** "PAYMENT_CARD", "VCARDID", "BANK_ACCOUNT", "PAYMENT_TOKEN" } ], **"consumerContactInformation"**: { **"phoneNumber"**: string, **"emailAddress"**: string (Email Address), **"isPhoneNumberVerified"**: boolean, **"isEmailAddressVerified"**: boolean }, **"identityVerificationDetails"**: { **"userID"**: string, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"attestation"**: string, **"attestationType"**: string,
**Available values:** "ID_TOKEN" } }
| | 400 | The details part of the error response can provide a list of fields that failed data validation constraints and reason values for this error include:
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 401 | API authorized error caused due to any of the following reasons: + x-pay-token is not present, blank, or not in a valid format. + Timestamp field not in valid UTC timestamp format. + Version field is invalid. + Token's timestamp is more than 8 minutes off from the current time. + Token hash mismatch. + APIKey not present in request. + APIKey is not active. + APIKey not valid. + APIKey not active. + Request has more than one authentication token, which is not supported
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 403 | The 403 (Forbidden) HTTP Status code indicates that this Visa Developer Center project does not have permission to access the requested resource. This can happen if you are trying to invoke an API request for a resource that is not part of your project. Check for the following: + You are using a project and the credential for the project that includes the API being accessed. + You created a project and received sandbox credentials for the API’s being called. + You added the API being called to the project (if not already present) with the credentials that are being used.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 404 | The specified resource was not found
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 406 | Not Acceptable - Indicates that the "Accept:" header field is present in a request and none of the available representations for the response have a media type that is listed as acceptable. This can happen when the requested API version is not available or unsupported; for example, when the version requested in the Accept: header is newer than the currently live/supported version.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 409 | The current state of consent is incompatible with the requested mutation. For example, an EXPIRED consent cannot be revoked.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 410 | Gone - Indicates that the resource at this end point is no longer available. This is usually returned for old API versions that are not available anymore - EOL (End-of-Life). The content-type header in the response indicates the latest supported API version.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 429 | The Visa Developer Center project has clocked too many requests in a given amount of time. Please contact Visa Support at developer@visa.com if you want to increase the time limits.
**Headers:**
**Retry-After**: Header field to suggest an appropriate amount of time for the client to wait before retrying the request, typically after a 503 error or after a batch request when the batch job is not completed. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date || delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 500 | Internal Server Error. Please contact Visa Support at developer@visa.com with a complete error message, full http request and response details.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 503 | The Visa system is currently unable to handle the request due to a temporary overloading or maintenance of the server. There may be a Retry-After header field to suggest an appropriate amount of time for the client to wait before retrying the request. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date \|\| delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120 Please contact Visa Support at developer@visa.com if the issue persists.
**Headers:**
**Retry-After**: Header field to suggest an appropriate amount of time for the client to wait before retrying the request, typically after a 503 error or after a batch request when the batch job is not completed. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date || delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| ### [POST] /vcms/v1/consents/{consentID}/validate **Validate Consent** This API is used by Resource Providers to verify that a consent is recorded against the provided user ID. If so, the consent object is returned. #### Parameters | Name | Located in | Description | Required | Schema | Explode | | ---- | ---------- | ----------- | -------- | ------ | ------- | | X-Correlation-Id | header | Unique ID for every API request - an optional header. Generated by the API client. Used for end-to-end tracing/debugging. | No | string | No | | consentID | path | Consent identifier. | Yes | string | No | #### Request Body Consent validate request body. | Required | Schema | | -------- | ------ | | Yes | **application/json**: { **"userID"**: string, **"identityVerificationDetails"**: { **"userID"**: string } }
| #### Responses | Code | Description | Schema | | ---- | ----------- | ------ | | 200 | Consent response.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"status"**: string,
**Available values:** "INITIATED", "ACTIVE", "REVOKED", "EXPIRED", "CONSUMED", "PAUSED", **"userID"**: string, **"consentID"**: string (uuid) } & { **"frequency"**: string,
**Available values:** "STREAMING", "PERIODIC", "ON_DEMAND", "CONTEXT_BASED",
**Default:** STREAMING, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"primaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"externalConsentID"**: string, **"presentedLanguage"**: string (BCP-47), **"previousConsentID"**: string (uuid), **"secondaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"consentCaptureCity"**: string, **"consentDirectoryID"**: string (uuid), **"expirationDateTime"**: string (RFC3339), **"privacyPolicyVersion"**: string, **"consentCaptureCountry"**: string (ISO 3166-1 alpha 2), **"consentCaptureDateTime"**: string (RFC3339), **"presentedContentVersion"**: string, **"presenterOrganizationID"**: string (uuid), **"consentCaptureRegionState"**: string (ISO 3166-2 subdivision), **"resourceProviderOrganizationIDs"**: [ string (uuid) ] } & { **"constraints"**: { **"timespan"**: { **"endDateTime"**: string (RFC3339), **"startDateTime"**: string (RFC3339) }, **"maxNumberUses"**: integer, **"remainingNumberUses"**: integer }, **"createdDateTime"**: string (RFC3339), **"updatedDateTime"**: string (RFC3339), **"financialInstruments"**: [ { **"instrumentID"**: string (uuid), **"accountNumber"**: string, **"instrumentType"**: string,
**Available values:** "PAYMENT_CARD", "VCARDID", "BANK_ACCOUNT", "PAYMENT_TOKEN" } ], **"consumerContactInformation"**: { **"phoneNumber"**: string, **"emailAddress"**: string (Email Address), **"isPhoneNumberVerified"**: boolean, **"isEmailAddressVerified"**: boolean }, **"identityVerificationDetails"**: { **"userID"**: string, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"attestation"**: string, **"attestationType"**: string,
**Available values:** "ID_TOKEN" } }
| | 400 | The details part of the error response can provide a list of fields that failed data validation constraints and reason values for this error include:
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 401 | API authorized error caused due to any of the following reasons: + x-pay-token is not present, blank, or not in a valid format. + Timestamp field not in valid UTC timestamp format. + Version field is invalid. + Token's timestamp is more than 8 minutes off from the current time. + Token hash mismatch. + APIKey not present in request. + APIKey is not active. + APIKey not valid. + APIKey not active. + Request has more than one authentication token, which is not supported
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 403 | The 403 (Forbidden) HTTP Status code indicates that this Visa Developer Center project does not have permission to access the requested resource. This can happen if you are trying to invoke an API request for a resource that is not part of your project. Check for the following: + You are using a project and the credential for the project that includes the API being accessed. + You created a project and received sandbox credentials for the API’s being called. + You added the API being called to the project (if not already present) with the credentials that are being used.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 404 | The specified resource was not found
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 406 | Not Acceptable - Indicates that the "Accept:" header field is present in a request and none of the available representations for the response have a media type that is listed as acceptable. This can happen when the requested API version is not available or unsupported; for example, when the version requested in the Accept: header is newer than the currently live/supported version.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 410 | Gone - Indicates that the resource at this end point is no longer available. This is usually returned for old API versions that are not available anymore - EOL (End-of-Life). The content-type header in the response indicates the latest supported API version.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 422 | The server understands the content type of the request entity, and the syntax of the request entity is correct but was unable to process the contained instructions.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 429 | The Visa Developer Center project has clocked too many requests in a given amount of time. Please contact Visa Support at developer@visa.com if you want to increase the time limits.
**Headers:**
**Retry-After**: Header field to suggest an appropriate amount of time for the client to wait before retrying the request, typically after a 503 error or after a batch request when the batch job is not completed. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date || delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 500 | Internal Server Error. Please contact Visa Support at developer@visa.com with a complete error message, full http request and response details.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 503 | The Visa system is currently unable to handle the request due to a temporary overloading or maintenance of the server. There may be a Retry-After header field to suggest an appropriate amount of time for the client to wait before retrying the request. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date \|\| delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120 Please contact Visa Support at developer@visa.com if the issue persists.
**Headers:**
**Retry-After**: Header field to suggest an appropriate amount of time for the client to wait before retrying the request, typically after a 503 error or after a batch request when the batch job is not completed. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date || delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| ### [PUT] /vcms/v1/consents/{consentID}/status **Update Consent Status** API for Visa partners (Consent Requestors) to update consent status. Notes: Status may be set in accordance with the following state transitions, with invalid transitions resulting in a 409 error with invalidConsentStateTransition reason. + ACTIVE -> PAUSED + PAUSED -> ACTIVE + ACTIVE -> CONSUMED #### Parameters | Name | Located in | Description | Required | Schema | Explode | | ---- | ---------- | ----------- | -------- | ------ | ------- | | X-Correlation-Id | header | Unique ID for every API request - an optional header. Generated by the API client. Used for end-to-end tracing/debugging. | No | string | No | | consentID | path | Consent identifier. | Yes | string | No | #### Request Body Consent request body for PUT Consent Status. | Required | Schema | | -------- | ------ | | Yes | **application/json**: { **"status"**: string,
**Available values:** "ACTIVE", "CONSUMED", "PAUSED" }
| #### Responses | Code | Description | Schema | | ---- | ----------- | ------ | | 200 | Consent status updated successfully
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"status"**: string,
**Available values:** "ACTIVE", "CONSUMED", "PAUSED" }
| | 400 | The details part of the error response can provide a list of fields that failed data validation constraints and reason values for this error include:
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 401 | API authorized error caused due to any of the following reasons: + x-pay-token is not present, blank, or not in a valid format. + Timestamp field not in valid UTC timestamp format. + Version field is invalid. + Token's timestamp is more than 8 minutes off from the current time. + Token hash mismatch. + APIKey not present in request. + APIKey is not active. + APIKey not valid. + APIKey not active. + Request has more than one authentication token, which is not supported
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 403 | The 403 (Forbidden) HTTP Status code indicates that this Visa Developer Center project does not have permission to access the requested resource. This can happen if you are trying to invoke an API request for a resource that is not part of your project. Check for the following: + You are using a project and the credential for the project that includes the API being accessed. + You created a project and received sandbox credentials for the API’s being called. + You added the API being called to the project (if not already present) with the credentials that are being used.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 404 | The specified resource was not found
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 406 | Not Acceptable - Indicates that the "Accept:" header field is present in a request and none of the available representations for the response have a media type that is listed as acceptable. This can happen when the requested API version is not available or unsupported; for example, when the version requested in the Accept: header is newer than the currently live/supported version.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 409 | The current state of consent is incompatible with the requested mutation. For example, an EXPIRED consent cannot be revoked.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 410 | Gone - Indicates that the resource at this end point is no longer available. This is usually returned for old API versions that are not available anymore - EOL (End-of-Life). The content-type header in the response indicates the latest supported API version.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 429 | The Visa Developer Center project has clocked too many requests in a given amount of time. Please contact Visa Support at developer@visa.com if you want to increase the time limits.
**Headers:**
**Retry-After**: Header field to suggest an appropriate amount of time for the client to wait before retrying the request, typically after a 503 error or after a batch request when the batch job is not completed. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date || delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 500 | Internal Server Error. Please contact Visa Support at developer@visa.com with a complete error message, full http request and response details.
**Headers:**
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| | 503 | The Visa system is currently unable to handle the request due to a temporary overloading or maintenance of the server. There may be a Retry-After header field to suggest an appropriate amount of time for the client to wait before retrying the request. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date \|\| delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120 Please contact Visa Support at developer@visa.com if the issue persists.
**Headers:**
**Retry-After**: Header field to suggest an appropriate amount of time for the client to wait before retrying the request, typically after a 503 error or after a batch request when the batch job is not completed. The value of this field can be either an HTTP-date or a number of seconds to delay after the response is received. Retry-After = HTTP-date || delay-seconds examples: + Retry-After: Thu, 31 Dec 2020 23:59:59 GMT + Retry-After: 120
**X-Correlation-Id**: Unique ID for the API response; X-Correlation-Id is echoed back. Used for end-to-end tracing/debugging.
| **application/json**: { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } & { **"reason"**: , **"message"**: }
**application/problem+json**: { **"type"**: string (uri-reference),
**Default:** about:blank, **"title"**: string, **"detail"**: string, **"status"**: integer, **"instance"**: string (uri-reference) }
| --- ### Schemas #### ConsentConstraintsForCreation Schema Additional consent constraints. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | timespan | { **"endDateTime"**: string (RFC3339), **"startDateTime"**: string (RFC3339) } | A timespan constraint applicable for the consent item types captured in the consent. For example, consent for historical transaction data may have a constraint to include only transactions from the last 6 months. That constraint would be captured here. Not applicable to consents with STREAMING frequency. | No | | maxNumberUses | integer | The maximum number of uses for the consent item types captured in the consent. Not applicable to consents with STREAMING frequency. | No | #### StandardError Schema API errors are reported using a Standard Error Response structure. All errors are categorized into Standard errors and Business errors. Standard errors can be returned by any API and should be handled in a common way. Business errors are returned only by some APIs and are documented for each API. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | StandardError | { **"reason"**: string, **"details"**: [ { **"reason"**: string, **"message"**: string, **"location"**: string } ], **"message"**: string } | API errors are reported using a Standard Error Response structure. All errors are categorized into Standard errors and Business errors. Standard errors can be returned by any API and should be handled in a common way. Business errors are returned only by some APIs and are documented for each API. | | #### UserIdentifierType Schema The type of the provided user identifier (userID). | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | UserIdentifierType | string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED" | The type of the provided user identifier (userID). | | **Example** 
EMAIL_ADDRESS
#### ConsentType Schema The type of the consent describes the use cases applicable for the consent. CARD_TRANSACTION_EVENTS applies to card transaction data subscription (using webhooks/callback model), and CARD_TRANSACTION_DATA applies to card transaction history data (using REST API request/response model). There will be other consent types applicable in the future like PAYMENTS, etc. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | ConsentType | string,
**Available values:** "CARD_TRANSACTION_DATA", "CARD_TRANSACTION_EVENTS" | The type of the consent describes the use cases applicable for the consent. CARD_TRANSACTION_EVENTS applies to card transaction data subscription (using webhooks/callback model), and CARD_TRANSACTION_DATA applies to card transaction history data (using REST API request/response model). There will be other consent types applicable in the future like PAYMENTS, etc. | | #### ConsumerContactInformation Schema Contact information for the end consumer. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | phoneNumber | string | Phone number, which may include only numerical digits.
*Example:* `"15555555555"` | No | | emailAddress | string (Email Address) | Email address.
*Example:* `"consumer@visa.com"` | No | | isPhoneNumberVerified | boolean | Indicates whether the phone number has been verified by the caller. | No | | isEmailAddressVerified | boolean | Indicates whether the email address has been verified by the caller. | No | #### CloudEventEnvelopeSchema Schema | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | id | string (UUID) | Unique identifier for the message.
*Example:* `"b0ea6631-cb51-fa2b-f426-150b5757e201"` | No | | time | string (RFC3339) | Datetime when the message was generated.
*Example:* `"2021-04-05T17:31:00Z"` | No | | source | string | Source of the message.
*Example:* `"https://visa.com"` | No | | subject | string (UUID) | Consent identifier.
*Example:* `"01-a8023ee6-64a1-4c48-b1c8-7609faf41f1f"` | No | | specversion | string | Version of the message envelope schema.
*Example:* `"1.0"` | No | | datacontenttype | string (IANA Media Types) | Format of the message under the "data" object.
*Example:* `"application/json"` | No | | dataschemaversion | string (majorversion.minorversion) | Extension attribute which provides a version for the schema defined in the "data" element. Increments within a single major version indicate that backward compatibility is preserved.
*Example:* `"1.0"` | No | | externalsubjectid | string | Client-provided consent identifier, which was optionally supplied at consent creation in "externalConsentID".
*Example:* `"clientdefinedidentifier123"` | No | #### ConsentValidateRequest Schema | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | userID | string | The identifier of the user for whom the consent is created. The type of this identifier is defined by the value of the corresponding userIDType attribute. User identifiers of type EMAIL_ADDRESS PHONE_NUMBER PAN and CLIENT_DEFINED are not retained as-is in the consent system, and will be returned as masked values in subsequent API responses.
*Example:* `"consumer@visa.com"` | Yes | | identityVerificationDetails | { **"userID"**: string } | | No | #### AuthenticationMethod Schema | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | AuthenticationMethod | string,
**Available values:** "CARDHOLDER_AUTH_BY_ISSUER", "VERIFIED_BY_VISA" | | | #### ConsentDirectoryIdentifier Schema This value refers to a previously-configured Consent Directory entry, in whose context a consent may be created. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | ConsentDirectoryIdentifier | string (uuid) | This value refers to a previously-configured Consent Directory entry, in whose context a consent may be created. | | **Example** 
123e4567-e89b-12d3-a456-426614174000
#### TransactionDataToDate Schema The last point of the transaction / statement historical period that the cardholder has consented to provide access to the Consent Requestor + Controls the transaction data volume that is accessible to the beneficiaries using this consent. + Applicable especially for transaction history use cases. If transactionFromDate and transactionToDate are not specified, then beneficiaries have access any historical transaction data indefinitely until revoked. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | TransactionDataToDate | date | The last point of the transaction / statement historical period that the cardholder has consented to provide access to the Consent Requestor + Controls the transaction data volume that is accessible to the beneficiaries using this consent. + Applicable especially for transaction history use cases. If transactionFromDate and transactionToDate are not specified, then beneficiaries have access any historical transaction data indefinitely until revoked. | | #### VisaCardIdentifier Schema An interoperable Visa-generated card identifier scoped to the VDP project that it was created-in. It cannot be used outside this VDP project (client), unless there is a partner relationship established between the 2 VDP projects (clients).
Notes: + This identifier is idempotent and unique for a given VDP project ID (client ID) and card number (PAN). + A client has access to the vCardIDs that they have created and cannot view or access vCardIDs created by others. + The clients are expected to store this card identifier to be used in-lieu of a PAN for several Visa APIs, including consent search, tokenization, etc. + Returned in APIs where PAN is passed in the HTTP Request, for eg., Consent creation API | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | VisaCardIdentifier | string | An interoperable Visa-generated card identifier scoped to the VDP project that it was created-in. It cannot be used outside this VDP project (client), unless there is a partner relationship established between the 2 VDP projects (clients).
Notes: + This identifier is idempotent and unique for a given VDP project ID (client ID) and card number (PAN). + A client has access to the vCardIDs that they have created and cannot view or access vCardIDs created by others. + The clients are expected to store this card identifier to be used in-lieu of a PAN for several Visa APIs, including consent search, tokenization, etc. + Returned in APIs where PAN is passed in the HTTP Request, for eg., Consent creation API | | **Example** 
v-020-003b0411-b930-6647-7f04-81c857189601
#### MaskedUserIdentifier Schema The identifier of the user for whom the consent is created. The type of this identifier is defined by the value of the corresponding userIDType attribute. User identifiers of type EMAIL_ADDRESS PHONE_NUMBER PAN and CLIENT_DEFINED are not retained as-is in the consent system, and will be returned as masked values in subsequent API responses. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | MaskedUserIdentifier | string | The identifier of the user for whom the consent is created. The type of this identifier is defined by the value of the corresponding userIDType attribute. User identifiers of type EMAIL_ADDRESS PHONE_NUMBER PAN and CLIENT_DEFINED are not retained as-is in the consent system, and will be returned as masked values in subsequent API responses. | | **Example** 
con***@visa.com
#### TransactionDataConsentForCreation-1 Schema | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | TransactionDataConsentForCreation-1 | { **"userID"**: string } & { **"frequency"**: string,
**Available values:** "STREAMING", "PERIODIC", "ON_DEMAND", "CONTEXT_BASED",
**Default:** STREAMING, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"primaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"externalConsentID"**: string, **"presentedLanguage"**: string (BCP-47), **"previousConsentID"**: string (uuid), **"secondaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"consentCaptureCity"**: string, **"consentDirectoryID"**: string (uuid), **"expirationDateTime"**: string (RFC3339), **"privacyPolicyVersion"**: string, **"consentCaptureCountry"**: string (ISO 3166-1 alpha 2), **"consentCaptureDateTime"**: string (RFC3339), **"presentedContentVersion"**: string, **"presenterOrganizationID"**: string (uuid), **"consentCaptureRegionState"**: string (ISO 3166-2 subdivision), **"resourceProviderOrganizationIDs"**: [ string (uuid) ] } & { **"constraints"**: { **"timespan"**: { **"endDateTime"**: string (RFC3339), **"startDateTime"**: string (RFC3339) }, **"maxNumberUses"**: integer }, **"financialInstruments"**: [ { **"accountNumber"**: string, **"instrumentType"**: string,
**Available values:** "PAYMENT_CARD", "VCARDID", "BANK_ACCOUNT", "PAYMENT_TOKEN" } ], **"consumerContactInformation"**: { **"phoneNumber"**: string, **"emailAddress"**: string (Email Address), **"isPhoneNumberVerified"**: boolean, **"isEmailAddressVerified"**: boolean }, **"identityVerificationDetails"**: { **"userID"**: string, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"attestation"**: string, **"attestationType"**: string,
**Available values:** "ID_TOKEN", "THREED_SECURE" } } | | | #### DeprecatedConsentPurpose Schema | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | isPrimary | boolean | Indicates whether the purpose is the primary.
*Example:* `true` | No | | purposeType | string | Represents the consent purpose. The set of possible values is contained in the data dictionary for Purposes (TBD location).
*Example:* `"PERSONAL_FINANCE_MGMT"` | Yes | | consentItemTypes | [ string ] | The consent item types. | Yes | | beneficiaryOrganizationIDs | [ string (uuid) ] | The beneficiary IDs which are using the resource for the enclosing purpose. | Yes | #### ConsentPurposes Schema A list of primary consent purposes. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | ConsentPurposes | [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ] | A list of primary consent purposes. | | #### ConsentStatus Schema Valid status values of consent: + INITIATED + ACTIVE + REVOKED + EXPIRED + CONSUMED + PAUSED
Consent Status Value Description
INITIATED
  • This is the initial status of a consent when created/saved without successful consumer authentication.
  • A consent in this status cannot be used to access consent items (data or other resources).
ACTIVE
  • The status of the consent is considered active when it can be used to access consent items (data or other resources).
  • Only after successful cardholder authentication, a consent is considered in ACTIVE status.
REVOKED The consent is transitioned to this state only after it is revoked by the cardholder or by a party on behalf of the cardholder.
EXPIRED When a consent's expiry date is reached, it is transitioned to this state.
CONSUMED When the consent's applicability/policy is ONE_TIME and when the consent is used for the applicable use case, the consent is transitioned to this state.
PAUSED In this state, the consent's purpose (e.g. data sharing, opt-in, etc) may not be fulfilled. If not expired or otherwise invalidated, a consent in this status may be transitioned back to ACTIVE.
| Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | ConsentStatus | string,
**Available values:** "INITIATED", "ACTIVE", "REVOKED", "EXPIRED", "CONSUMED", "PAUSED" | Valid status values of consent: + INITIATED + ACTIVE + REVOKED + EXPIRED + CONSUMED + PAUSED
Consent Status Value Description
INITIATED
  • This is the initial status of a consent when created/saved without successful consumer authentication.
  • A consent in this status cannot be used to access consent items (data or other resources).
ACTIVE
  • The status of the consent is considered active when it can be used to access consent items (data or other resources).
  • Only after successful cardholder authentication, a consent is considered in ACTIVE status.
REVOKED The consent is transitioned to this state only after it is revoked by the cardholder or by a party on behalf of the cardholder.
EXPIRED When a consent's expiry date is reached, it is transitioned to this state.
CONSUMED When the consent's applicability/policy is ONE_TIME and when the consent is used for the applicable use case, the consent is transitioned to this state.
PAUSED In this state, the consent's purpose (e.g. data sharing, opt-in, etc) may not be fulfilled. If not expired or otherwise invalidated, a consent in this status may be transitioned back to ACTIVE.
| | **Example** 
ACTIVE
#### SecondaryConsentPurpose Schema | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | isOptedIn | boolean | Indicator as to whether the secondary consent was opted in or out by the consumer. A value of true indicates the the consumer opted in to the secondary purpose. | Yes | #### SecondaryConsentPurposes Schema A list of secondary consent purposes. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | SecondaryConsentPurposes | [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ] | A list of secondary consent purposes. | | #### IDToken Schema ID Token represents the consumer identity and the details on the authentication performed on the consumer.
Visa uses authentication details for various risk purposes. The identity of the consumer is necessary for ensuring proper capture of the consent.
IDToken is a base64 urlencoded string - a standard JWT format. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | IDToken | byte | ID Token represents the consumer identity and the details on the authentication performed on the consumer.
Visa uses authentication details for various risk purposes. The identity of the consumer is necessary for ensuring proper capture of the consent.
IDToken is a base64 urlencoded string - a standard JWT format. | | #### ConsentIdentifier Schema Unique identifier generated by Visa for every new consent. A consentID is only accessible and visible to the clients that created it. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | ConsentIdentifier | string (Custom uuid) | Unique identifier generated by Visa for every new consent. A consentID is only accessible and visible to the clients that created it. | | **Example** 
1-123e4567-e89b-12d3-a456-426614174000
#### TransactionDataConsentInResponse Schema Consent object returned in the responses. A consent represents the end-user permission to access its transaction events or historical data. The limits of a consent are represented by: 1. What: Type of the consent - what data or events or payments or actions (payments, etc.) are permitted 2. Context: a. Time-based retrictions/validity for the Consent. b. Beneficiaries and the consent requestor information 3. Why: Purpose of the consent 4. Terms and Conditions applicable for the Consent The consent is typically unique for a combination of the following, but it not enforced by the API implementation: 1. Client ID (Partner VDP Project) 2. Region (US as default) 3. Cardholder Identity (vCardID/PAN) 4. Consent Type (as defined in consentType definition) | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | TransactionDataConsentInResponse | { **"status"**: string,
**Available values:** "INITIATED", "ACTIVE", "REVOKED", "EXPIRED", "CONSUMED", "PAUSED", **"userID"**: string, **"consentID"**: string (uuid) } & { **"frequency"**: string,
**Available values:** "STREAMING", "PERIODIC", "ON_DEMAND", "CONTEXT_BASED",
**Default:** STREAMING, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"primaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"externalConsentID"**: string, **"presentedLanguage"**: string (BCP-47), **"previousConsentID"**: string (uuid), **"secondaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"consentCaptureCity"**: string, **"consentDirectoryID"**: string (uuid), **"expirationDateTime"**: string (RFC3339), **"privacyPolicyVersion"**: string, **"consentCaptureCountry"**: string (ISO 3166-1 alpha 2), **"consentCaptureDateTime"**: string (RFC3339), **"presentedContentVersion"**: string, **"presenterOrganizationID"**: string (uuid), **"consentCaptureRegionState"**: string (ISO 3166-2 subdivision), **"resourceProviderOrganizationIDs"**: [ string (uuid) ] } & { **"constraints"**: { **"timespan"**: { **"endDateTime"**: string (RFC3339), **"startDateTime"**: string (RFC3339) }, **"maxNumberUses"**: integer, **"remainingNumberUses"**: integer }, **"createdDateTime"**: string (RFC3339), **"updatedDateTime"**: string (RFC3339), **"financialInstruments"**: [ { **"instrumentID"**: string (uuid), **"accountNumber"**: string, **"instrumentType"**: string,
**Available values:** "PAYMENT_CARD", "VCARDID", "BANK_ACCOUNT", "PAYMENT_TOKEN" } ], **"consumerContactInformation"**: { **"phoneNumber"**: string, **"emailAddress"**: string (Email Address), **"isPhoneNumberVerified"**: boolean, **"isEmailAddressVerified"**: boolean }, **"identityVerificationDetails"**: { **"userID"**: string, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"attestation"**: string, **"attestationType"**: string,
**Available values:** "ID_TOKEN" } } | Consent object returned in the responses. A consent represents the end-user permission to access its transaction events or historical data. The limits of a consent are represented by: 1. What: Type of the consent - what data or events or payments or actions (payments, etc.) are permitted 2. Context: a. Time-based retrictions/validity for the Consent. b. Beneficiaries and the consent requestor information 3. Why: Purpose of the consent 4. Terms and Conditions applicable for the Consent The consent is typically unique for a combination of the following, but it not enforced by the API implementation: 1. Client ID (Partner VDP Project) 2. Region (US as default) 3. Cardholder Identity (vCardID/PAN) 4. Consent Type (as defined in consentType definition) | | #### ConsentStatusForUpdate Schema Valid status values of consent: + ACTIVE + CONSUMED + PAUSED
Consent Status Value Description
ACTIVE
  • The status of the consent is considered active when it can be used to access consent items (data or other resources).
  • Only after successful cardholder authentication, a consent is considered in ACTIVE status.
CONSUMED When the consent's applicability/policy is ONE_TIME and when the consent is used for the applicable use case, the consent is transitioned to this state.
PAUSED In this state, the consent's purpose (e.g. data sharing, opt-in, etc) may not be fulfilled. If not expired or otherwise invalidated, a consent in this status may be transitioned back to ACTIVE.
| Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | ConsentStatusForUpdate | string,
**Available values:** "ACTIVE", "CONSUMED", "PAUSED" | Valid status values of consent: + ACTIVE + CONSUMED + PAUSED
Consent Status Value Description
ACTIVE
  • The status of the consent is considered active when it can be used to access consent items (data or other resources).
  • Only after successful cardholder authentication, a consent is considered in ACTIVE status.
CONSUMED When the consent's applicability/policy is ONE_TIME and when the consent is used for the applicable use case, the consent is transitioned to this state.
PAUSED In this state, the consent's purpose (e.g. data sharing, opt-in, etc) may not be fulfilled. If not expired or otherwise invalidated, a consent in this status may be transitioned back to ACTIVE.
| | **Example** 
ACTIVE
#### TransactionDataConsentForCreation Schema | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | TransactionDataConsentForCreation | { **"userID"**: string } & { **"frequency"**: string,
**Available values:** "STREAMING", "PERIODIC", "ON_DEMAND", "CONTEXT_BASED",
**Default:** STREAMING, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"primaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"externalConsentID"**: string, **"presentedLanguage"**: string (BCP-47), **"previousConsentID"**: string (uuid), **"secondaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"consentCaptureCity"**: string, **"consentDirectoryID"**: string (uuid), **"expirationDateTime"**: string (RFC3339), **"privacyPolicyVersion"**: string, **"consentCaptureCountry"**: string (ISO 3166-1 alpha 2), **"consentCaptureDateTime"**: string (RFC3339), **"presentedContentVersion"**: string, **"presenterOrganizationID"**: string (uuid), **"consentCaptureRegionState"**: string (ISO 3166-2 subdivision), **"resourceProviderOrganizationIDs"**: [ string (uuid) ] } & { **"constraints"**: { **"timespan"**: { **"endDateTime"**: string (RFC3339), **"startDateTime"**: string (RFC3339) }, **"maxNumberUses"**: integer }, **"financialInstruments"**: [ { **"accountNumber"**: string, **"instrumentType"**: string,
**Available values:** "PAYMENT_CARD", "VCARDID", "BANK_ACCOUNT", "PAYMENT_TOKEN" } ], **"consumerContactInformation"**: { **"phoneNumber"**: string, **"emailAddress"**: string (Email Address), **"isPhoneNumberVerified"**: boolean, **"isEmailAddressVerified"**: boolean }, **"identityVerificationDetails"**: { **"userID"**: string, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"attestation"**: string, **"attestationType"**: string,
**Available values:** "ID_TOKEN", "THREED_SECURE" } } | | | #### ConsentFrequency Schema An enum representing the consent frequency. * STREAMING: * The consent item types in the consent are made available on a streaming basis, whenever a triggering event occurs. * PERIODIC: * The consent item types in the consent are available on a periodic basis. * ON_DEMAND: * The consent item types in the consent are available on demand from the Resource Provider. * CONTEXT_BASED: * The consent item types in the consent are available subject to additional filtering. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | ConsentFrequency | string,
**Available values:** "STREAMING", "PERIODIC", "ON_DEMAND", "CONTEXT_BASED",
**Default:** STREAMING | An enum representing the consent frequency. * STREAMING: * The consent item types in the consent are made available on a streaming basis, whenever a triggering event occurs. * PERIODIC: * The consent item types in the consent are available on a periodic basis. * ON_DEMAND: * The consent item types in the consent are available on demand from the Resource Provider. * CONTEXT_BASED: * The consent item types in the consent are available subject to additional filtering. | | #### MaskedConsumerContactInformation Schema Masked contact information for the end consumer. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | phoneNumber | string | Phone number, which may include only numerical digits.
*Example:* `"***555"` | No | | emailAddress | string (Email Address) | Email address.
*Example:* `"con***@visa.com"` | No | | isPhoneNumberVerified | boolean | Indicates whether the phone number has been verified by the caller. | No | | isEmailAddressVerified | boolean | Indicates whether the email address has been verified by the caller. | No | #### BaseConsent Schema | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | frequency | string,
**Available values:** "STREAMING", "PERIODIC", "ON_DEMAND", "CONTEXT_BASED",
**Default:** STREAMING | An enum representing the consent frequency. * STREAMING: * The consent item types in the consent are made available on a streaming basis, whenever a triggering event occurs. * PERIODIC: * The consent item types in the consent are available on a periodic basis. * ON_DEMAND: * The consent item types in the consent are available on demand from the Resource Provider. * CONTEXT_BASED: * The consent item types in the consent are available subject to additional filtering.
*Enum:* `"STREAMING"`, `"PERIODIC"`, `"ON_DEMAND"`, `"CONTEXT_BASED"` | No | | userIDType | string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED" | The type of the provided user identifier (userID).
*Enum:* `"EMAIL_ADDRESS"`, `"PHONE_NUMBER"`, `"VCARDID"`, `"PAN"`, `"CLIENT_DEFINED"`
*Example:* `"EMAIL_ADDRESS"` | No | | primaryPurposes | [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ] | A list of primary consent purposes. | No | | externalConsentID | string | A client-provided identifier for the consent being created. Uniqueness of this value should be enforced by the client.
*Example:* `"qwertyK"` | No | | presentedLanguage | string (BCP-47) | The language of the content presented to the user.
*Example:* `"en-US"` | No | | previousConsentID | string (uuid) | This attribute may be used to reference a prior consent for which the new consent is a "renewal". This reference must have been created in the context of the same Consent Directory and for the same user.
*Example:* `""` | No | | secondaryPurposes | [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ] | A list of secondary consent purposes. | No | | consentCaptureCity | string | The city where the user's consent was captured.
*Example:* `"Austin"` | No | | consentDirectoryID | string (uuid) | This value refers to a previously-configured Consent Directory entry, in whose context a consent may be created.
*Example:* `"123e4567-e89b-12d3-a456-426614174000"` | No | | expirationDateTime | string (RFC3339) | The consent is invalid after this datetime. After expiry, the consent is not renewable. When provided by the client, this value must be greater than the current date. Format is based on RFC 3339, with the following stipulations: + ‘T’ is used as separator between date and time. + Only fractional seconds are optional - all other parts of the datetime are required. + Fractional seconds may contain up to 3 decimal places. + All datetimes will be converted to GMT (+00:00) for storage and subsequent retrieval.
*Example:* `"2026-02-05T17:31:00Z"` | No | | privacyPolicyVersion | string | The version of the privacy policy presented to the user.
*Example:* `"4.1"` | No | | consentCaptureCountry | string (ISO 3166-1 alpha 2) | The country where the user's consent was captured.
*Example:* `"US"` | No | | consentCaptureDateTime | string (RFC3339) | The date and time that the consent was captured from the user, in the user's local time zone. Format is based on RFC 3339, with the following stipulations: + ‘T’ is used as separator between date and time. + Only fractional seconds are optional - all other parts of the datetime are required. + Fractional seconds may contain up to 3 decimal places. + The time zone provided will be maintained and returned on subsequent retrieval.
*Example:* `"2021-01-12T10:15:20.343-06:00"` | No | | presentedContentVersion | string | The version of the content presented to the user.
*Example:* `"1.0"` | No | | presenterOrganizationID | string (uuid) | This attribute identifies a previously-onboarded organization.
*Example:* `"123e4567-e89b-12d3-a456-426614174000"` | No | | consentCaptureRegionState | string (ISO 3166-2 subdivision) | The region or state where the user's consent was captured, represented as the subdivision part of ISO 3166-2.
*Example:* `"TX"` | No | | resourceProviderOrganizationIDs | [ string (uuid) ] | The list of Resource Provider identifiers who are participating in this consent. | No | #### RemainingNumberUses Schema The remaining number of uses for the consent item types captured in the consent.. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | RemainingNumberUses | integer | The remaining number of uses for the consent item types captured in the consent.. | | #### Purpose Schema Represents the consent purpose. The set of possible values is contained in the data dictionary for Purposes (TBD location). | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | Purpose | string | Represents the consent purpose. The set of possible values is contained in the data dictionary for Purposes (TBD location). | | **Example** 
PERSONAL_FINANCE_MGMT
#### ResourceType Schema The classes of resources which the user may consent to sharing with a beneficiary. The set of possible values is contained in the data dictionary for Consent Type Items (TBD location). | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | ResourceType | string | The classes of resources which the user may consent to sharing with a beneficiary. The set of possible values is contained in the data dictionary for Consent Type Items (TBD location). | | **Example** 
TRANSACTION_DATA
#### ConsentPeriodDays Schema The consent is invalid after the number of days past the activation date. It cannot be renewed, currently. A new consent must be created after consent expiry. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | ConsentPeriodDays | integer | The consent is invalid after the number of days past the activation date. It cannot be renewed, currently. A new consent must be created after consent expiry. | | **Example** 
30
#### ConsentExpirationDate Schema The consent is invalid after this datetime. After expiry, the consent is not renewable. When provided by the client, this value must be greater than the current date. Format is based on RFC 3339, with the following stipulations: + ‘T’ is used as separator between date and time. + Only fractional seconds are optional - all other parts of the datetime are required. + Fractional seconds may contain up to 3 decimal places. + All datetimes will be converted to GMT (+00:00) for storage and subsequent retrieval. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | ConsentExpirationDate | string (RFC3339) | The consent is invalid after this datetime. After expiry, the consent is not renewable. When provided by the client, this value must be greater than the current date. Format is based on RFC 3339, with the following stipulations: + ‘T’ is used as separator between date and time. + Only fractional seconds are optional - all other parts of the datetime are required. + Fractional seconds may contain up to 3 decimal places. + All datetimes will be converted to GMT (+00:00) for storage and subsequent retrieval. | | **Example** 
2026-02-05T17:31:00Z
#### DeprecatedConsentPurposes-1 Schema A list of consent purposes. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | DeprecatedConsentPurposes-1 | [ { **"isPrimary"**: boolean, **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ] | A list of consent purposes. | | **Example** 
[]
#### ErrorResponse Schema Standard error response body provided when there is an error. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | reason | string | API developers must use this field to drive their error handling logic
*Example:* `"badRequest"` | Yes | | details | [ { **"reason"**: string, **"message"**: string, **"location"**: string } ] | Array of fields - Data validation errors should use this array to specify fields that failed validation using the location field | No | | message | string | Every error should have a human readable message describing the error. The message can very even for the same reason, thus providing additional details. API providers are free to change the message at any point of time. API clients should not use the message field to drive their business logic or to expose it directly to the consumers via UI or other means.
*Example:* `"Input parameters validation failed"` | No | #### ConsentPurpose Schema | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | purposeType | string | Represents the consent purpose. The set of possible values is contained in the data dictionary for Purposes (TBD location).
*Example:* `"PERSONAL_FINANCE_MGMT"` | Yes | | consentItemTypes | [ string ] | The consent item types. | Yes | | beneficiaryOrganizationIDs | [ string (uuid) ] | The beneficiary IDs which are using the resource for the enclosing purpose. | Yes | #### OrganizationIdentifier Schema This attribute identifies a previously-onboarded organization. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | OrganizationIdentifier | string (uuid) | This attribute identifies a previously-onboarded organization. | | **Example** 
123e4567-e89b-12d3-a456-426614174000
#### ConsentConstraintsForResponse Schema Additional consent constraints. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | timespan | { **"endDateTime"**: string (RFC3339), **"startDateTime"**: string (RFC3339) } | A timespan constraint applicable for the consent item types captured in the consent. For example, consent for historical transaction data may have a constraint to include only transactions from the last 6 months. That constraint would be captured here. | No | | maxNumberUses | integer | The maximum number of uses for the consent item types captured in the consent. | No | | remainingNumberUses | integer | The remaining number of uses for the consent item types captured in the consent.. | No | #### IDVDetails Schema The Identity verification details represent an attestation of the consumer identity and the details of the authentication performed on the consumer.
Visa uses authentication details for various risk purposes. The identity of the consumer is necessary for ensuring proper capture of the consent.
If the attestationType is ID_TOKEN, the attestation is represented by a base64 urlencoded string - a standard JWT format.
If the userID used for IDV differs form the root-level userID attribute, the IDV userID should be specified in this userID attribute. If userID is specified, then userIDType must also be specified. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | userID | string | The user identifier used for IDV, if it differs from the root-level userID attribute. Identifiers of type EMAIL_ADDRESS PHONE_NUMBER PAN and CLIENT_DEFINED are not retained as-is in the consent system, and will be returned as masked values in subsequent API responses. | No | | userIDType | string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED" | The type of the provided user identifier (userID).
*Enum:* `"EMAIL_ADDRESS"`, `"PHONE_NUMBER"`, `"VCARDID"`, `"PAN"`, `"CLIENT_DEFINED"`
*Example:* `"EMAIL_ADDRESS"` | No | | attestation | string | The attestation contents, format as determined by the attestationType.
*Example:* `"abc123"` | Yes | | attestationType | string,
**Available values:** "ID_TOKEN", "THREED_SECURE" | The type of identity verification attestation.
*Enum:* `"ID_TOKEN"`, `"THREED_SECURE"` | Yes | #### TransactionDataFromDate Schema The earliest point of the transaction / statement historical period that the cardholder has consented to provide access to the Consent Requestor + Controls the transaction data volume that is accessible to the beneficiaries using this consent. + Applicable especially for transaction history use cases. If transactionFromDate and transactionToDate are not specified, then beneficiaries have access any historical transaction data indefinitely until revoked. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | TransactionDataFromDate | date | The earliest point of the transaction / statement historical period that the cardholder has consented to provide access to the Consent Requestor + Controls the transaction data volume that is accessible to the beneficiaries using this consent. + Applicable especially for transaction history use cases. If transactionFromDate and transactionToDate are not specified, then beneficiaries have access any historical transaction data indefinitely until revoked. | | #### ConsentConstraintsForUpdate Schema Additional consent constraints. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | remainingNumberUses | integer | The remaining number of uses for the consent item types captured in the consent.. | No | #### FinancialInstrument Schema Financial instrument representation. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | accountNumber | string | The account number. Account numbers of type PAYMENT_CARD BANK_ACCOUNT and PAYMENT_TOKEN are not retained in the consent system as-is, and will be returned as masked values in subsequent API responses. Validations by instrumentType: + PAYMENT_CARD : 13-16 length , numeric + VCARDID : 42 length, alphanumeric + BANK_ACCOUNT : 9-34 length alphanumeric + PAYMENT_TOKEN : 13-16 length , numeric
*Example:* `"4000000000000000"` | Yes | | instrumentType | string,
**Available values:** "PAYMENT_CARD", "VCARDID", "BANK_ACCOUNT", "PAYMENT_TOKEN" | The type of financial instrument.
*Enum:* `"PAYMENT_CARD"`, `"VCARDID"`, `"BANK_ACCOUNT"`, `"PAYMENT_TOKEN"`
*Example:* `"PAYMENT_CARD"` | Yes | #### FinancialInstrumentWithID Schema Financial instrument representation, including identifier. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | FinancialInstrumentWithID | { **"instrumentID"**: string (uuid) } & { **"accountNumber"**: string, **"instrumentType"**: string,
**Available values:** "PAYMENT_CARD", "VCARDID", "BANK_ACCOUNT", "PAYMENT_TOKEN" } | Financial instrument representation, including identifier. | | #### TransactionDataConsentInResponse-1 Schema Consent object returned in the responses. A consent represents the end-user permission to access its transaction events or historical data. The limits of a consent are represented by: 1. What: Type of the consent - what data or events or payments or actions (payments, etc.) are permitted 2. Context: a. Time-based retrictions/validity for the Consent. b. Beneficiaries and the consent requestor information 3. Why: Purpose of the consent 4. Terms and Conditions applicable for the Consent The consent is typically unique for a combination of the following, but it not enforced by the API implementation: 1. Client ID (Partner VDP Project) 2. Region (US as default) 3. Cardholder Identity (vCardID/PAN) 4. Consent Type (as defined in consentType definition) | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | TransactionDataConsentInResponse-1 | { **"status"**: string,
**Available values:** "INITIATED", "ACTIVE", "REVOKED", "EXPIRED", "CONSUMED", "PAUSED", **"userID"**: string, **"consentID"**: string (uuid) } & { **"frequency"**: string,
**Available values:** "STREAMING", "PERIODIC", "ON_DEMAND", "CONTEXT_BASED",
**Default:** STREAMING, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"primaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"externalConsentID"**: string, **"presentedLanguage"**: string (BCP-47), **"previousConsentID"**: string (uuid), **"secondaryPurposes"**: [ { **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ], **"consentCaptureCity"**: string, **"consentDirectoryID"**: string (uuid), **"expirationDateTime"**: string (RFC3339), **"privacyPolicyVersion"**: string, **"consentCaptureCountry"**: string (ISO 3166-1 alpha 2), **"consentCaptureDateTime"**: string (RFC3339), **"presentedContentVersion"**: string, **"presenterOrganizationID"**: string (uuid), **"consentCaptureRegionState"**: string (ISO 3166-2 subdivision), **"resourceProviderOrganizationIDs"**: [ string (uuid) ] } & { **"constraints"**: { **"timespan"**: { **"endDateTime"**: string (RFC3339), **"startDateTime"**: string (RFC3339) }, **"maxNumberUses"**: integer, **"remainingNumberUses"**: integer }, **"createdDateTime"**: string (RFC3339), **"updatedDateTime"**: string (RFC3339), **"financialInstruments"**: [ { **"instrumentID"**: string (uuid), **"accountNumber"**: string, **"instrumentType"**: string,
**Available values:** "PAYMENT_CARD", "VCARDID", "BANK_ACCOUNT", "PAYMENT_TOKEN" } ], **"consumerContactInformation"**: { **"phoneNumber"**: string, **"emailAddress"**: string (Email Address), **"isPhoneNumberVerified"**: boolean, **"isEmailAddressVerified"**: boolean }, **"identityVerificationDetails"**: { **"userID"**: string, **"userIDType"**: string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED", **"attestation"**: string, **"attestationType"**: string,
**Available values:** "ID_TOKEN" } } | Consent object returned in the responses. A consent represents the end-user permission to access its transaction events or historical data. The limits of a consent are represented by: 1. What: Type of the consent - what data or events or payments or actions (payments, etc.) are permitted 2. Context: a. Time-based retrictions/validity for the Consent. b. Beneficiaries and the consent requestor information 3. Why: Purpose of the consent 4. Terms and Conditions applicable for the Consent The consent is typically unique for a combination of the following, but it not enforced by the API implementation: 1. Client ID (Partner VDP Project) 2. Region (US as default) 3. Cardholder Identity (vCardID/PAN) 4. Consent Type (as defined in consentType definition) | | #### DeprecatedConsentPurposes Schema A list of consent purposes. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | DeprecatedConsentPurposes | [ { **"isPrimary"**: boolean, **"purposeType"**: string, **"consentItemTypes"**: [ string ], **"beneficiaryOrganizationIDs"**: [ string (uuid) ] } ] | A list of consent purposes. | | #### Problem Schema | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | type | string (uri-reference),
**Default:** about:blank | A URI reference that uniquely identifies the problem type only in the context of the provided API. Opposed to the specification in RFC-7807, it is neither recommended to be dereferenceable and point to a human-readable documentation nor globally unique for the problem type.
*Example:* `"/some/uri-reference"` | No | | title | string | A short summary of the problem type. Written in English and readable for engineers, usually not suited for non technical stakeholders and not localized.
*Example:* `"some title for the error situation"` | No | | detail | string | A human readable explanation specific to this occurrence of the problem that is helpful to locate the problem and give advice on how to proceed. Written in English and readable for engineers, usually not suited for non technical stakeholders and not localized.
*Example:* `"some description for the error situation"` | No | | status | integer | The HTTP status code generated by the origin server for this occurrence of the problem. | No | | instance | string (uri-reference) | A URI reference that identifies the specific occurrence of the problem, e.g. by adding a fragment identifier or sub-path to the problem type. May be used to locate the root of this problem in the source code.
*Example:* `"/some/uri-reference#specific-occurrence-context"` | No | #### MaskedFinancialInstrument Schema Financial instrument representation, with masked account number. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | instrumentID | string (uuid) | Unique identifier for the instance of financial instrument.
*Example:* `"f38de9d8-129a-40ea-b149-b8b64a7eda33"` | No | | accountNumber | string | The account number. Account numbers of type PAYMENT_CARD BANK_ACCOUNT and PAYMENT_TOKEN are not retained in the consent system as-is, and will be returned as masked values in subsequent API responses.
*Example:* `"400000******0000"` | No | | instrumentType | string,
**Available values:** "PAYMENT_CARD", "VCARDID", "BANK_ACCOUNT", "PAYMENT_TOKEN" | The type of financial instrument.
*Enum:* `"PAYMENT_CARD"`, `"VCARDID"`, `"BANK_ACCOUNT"`, `"PAYMENT_TOKEN"` | No | #### MaskedIDVDetails Schema The Identity verification details represent an attestation of the consumer identity and the details of the authentication performed on the consumer.
Visa uses authentication details for various risk purposes. The identity of the consumer is necessary for ensuring proper capture of the consent.
If the attestationType is ID_TOKEN, the attestation is represented by a base64 urlencoded string - a standard JWT format. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | userID | string | The user identifier used for IDV, if it differs from the root-level userID attribute. Identifiers of type EMAIL_ADDRESS PHONE_NUMBER PAN and CLIENT_DEFINED are not retained as-is in the consent system, and will be returned as masked values in subsequent API responses. | No | | userIDType | string,
**Available values:** "EMAIL_ADDRESS", "PHONE_NUMBER", "VCARDID", "PAN", "CLIENT_DEFINED" | The type of the provided user identifier (userID).
*Enum:* `"EMAIL_ADDRESS"`, `"PHONE_NUMBER"`, `"VCARDID"`, `"PAN"`, `"CLIENT_DEFINED"`
*Example:* `"EMAIL_ADDRESS"` | No | | attestation | string | The attestation contents, format as determined by the attestationType. | No | | attestationType | string,
**Available values:** "ID_TOKEN" | The type of identity verification attestation.
*Enum:* `"ID_TOKEN"` | No | #### UserIdentifier Schema The identifier of the user for whom the consent is created. The type of this identifier is defined by the value of the corresponding userIDType attribute. User identifiers of type EMAIL_ADDRESS PHONE_NUMBER PAN and CLIENT_DEFINED are not retained as-is in the consent system, and will be returned as masked values in subsequent API responses. | Name | Type | Description | Required | | ---- | ---- | ----------- | -------- | | UserIdentifier | string | The identifier of the user for whom the consent is created. The type of this identifier is defined by the value of the corresponding userIDType attribute. User identifiers of type EMAIL_ADDRESS PHONE_NUMBER PAN and CLIENT_DEFINED are not retained as-is in the consent system, and will be returned as masked values in subsequent API responses. | | **Example** 
consumer@visa.com