Partner Integration

Guest Enrollment Overview

Guest enrollment enables frictionless consumer opt-in through 1-click enrollment with no user involvement. This passwordless enrollment process allows issuers to increase consumer participation by enabling customers to access multiple Visa programs through issuer channels without repetitive registrations.

Guest enrollment supports multiple integration pathways depending on partner type, security requirements, and feature needs. All guest enrollments include mandatory OFAC sanctions screening, and users denied by OFAC will not be activated.

Enrollment Pathway Selection

Select the appropriate guest enrollment endpoint based on your integration requirements and partner classification.

Integration Type	Endpoint	Key Features	Requirements
Internal Partner	`POST /user/v2/enrollments`	Guest enrollment with marketing opt-ins, campaign management, clientId header	USER_REGISTRATION_GUEST_INTERNAL scope, clientId header
External Partner	`POST /user/external/guest/enrollments`	Secure enrollment with message-level encryption	USER_REGISTRATION_GUEST scope, message-level encryption
SSO Internal	`POST /user/internal/sso/enrollments`	Bank-to-Visa SSO enrollment with UserDetailsResponse	USER_REGISTRATION_GUEST_INTERNAL scope
Guest Updates	`POST /user/guest/update`	Update existing guest user accounts	USER_REGISTRATION_GUEST_INTERNAL scope

Internal Partner Integration

Internal partner integrations use direct API calls without message-level encryption for trusted Visa ecosystem partners.

Authentication: USER_REGISTRATION_GUEST_INTERNAL OAuth2 scope
Security: Standard API security without additional payload encryption
Features: Full feature access including enhanced features and SSO capabilities
Client ID: clientId header required for enrollments to identify GMAP client

External Partner Integration

External partner integrations require enhanced security measures including message-level encryption for sensitive data protection.

Authentication: USER_REGISTRATION_GUEST OAuth2 scope (different from internal)
Encryption: Request payload with user data must be encrypted using Message Level Encryption
Security Model: Additional data protection beyond standard API security
Payload Structure: guestEnrollmentRequest field contains encrypted JSON string of GuestEnrollmentRequest model

Message Level Encryption Implementation

Sensitive user data must be encrypted according to Visa Developer encryption guidelines before transmission.

Encryption Standard: Follow Message Level Encryption guidance
Payload Structure: Encrypt the complete GuestEnrollmentRequest JSON as a string
Field Mapping: guestEnrollmentRequest field contains the encrypted data string
Content Type: Standard application/json for the outer request structure

Encryption vs Standard Comparison

Aspect	Internal Enrollment	External Enrollment
Data Protection	Standard API security	Message-level encryption required
Payload Format	Direct JSON structure	Encrypted JSON string in wrapper
Partner Trust	Trusted Visa ecosystem partner	External partner with additional security
OAuth2 Scope	USER_REGISTRATION_GUEST_INTERNAL	USER_REGISTRATION_GUEST

Marketing Campaigns and Assets

Marketing Opt-ins

Guest enrollment APIs provide marketing opt-in features with comprehensive channel support and date tracking.

Channel Support: SMS, email, online, transactional, cashback opt-ins
Date Handling: Subscribed/unsubscribed date management with epoch milliseconds
Status Tracking: Opt-in status with proper boolean handling
Comprehensive Features: Full feature support for all marketing opt-in scenarios

Campaign Management Integration

Advanced campaign opt-in capabilities supporting multiple campaign types and platforms.

Campaign Types: CAUSES, PROGRAM, CLO, SWEEPSTAKES, TOPX with platform-specific handling
Platform Support: IMP and VDV platform distinctions for campaign orchestration
Platform Entities: CAMPAIGN vs OFFER entity differentiation
Timestamp Tracking: Opted-in and opted-out dates in epoch milliseconds
Attribute Support: Custom supplemental data for campaign-specific requirements

Asset Management for Partners

Enhanced asset management capabilities for partner-managed user assets.

Asset Types: Primarily PAN (Personal Account Number) support
Metadata Arrays: Extensible property storage for asset-specific information
Default Asset: Primary payment method designation capabilities
Security: Asset values are hashed for secure storage and transmission
Force Update: Mechanisms for asset synchronization across systems

Partner Prerequisites

Partner Eligibility and Access

Partner integration access follows the same restricted eligibility model as standard integrations.

Eligibility: Limited to approved issuer banks with active Visa relationships
Commercial Agreements: Appropriate commercial agreements must be in place
Compliance Requirements: Partners must meet Visa's consent, security, and data validation requirements
Business Prerequisites: Business agreement for guest enrollment features and compliance approval for user data handling

Technical Prerequisites

OAuth2 Configuration: Appropriate scopes for internal vs external partner classification
Encryption Setup: Message-level encryption capability for external partners
Site Configuration: Proper site ID setup in the GMAP system
Notification Systems: Email/SMS delivery integration for user communications

Integration Guide

Partner Integration Best Practices

Data Quality Priority: Focus on enrollment quality and data accuracy rather than enrollment volume. Successful partners prioritize payload correctness and proper consent management.
OFAC Screening Integration: Design systems to handle OFAC screening results appropriately. Failed screening prevents activation and requires business process alignment.
Asynchronous Processing: Account for background OFAC screening and user activation processes. Enrollment confirmation does not guarantee immediate user access.
Error Recovery: Implement proper error handling for enrollment validation failures. Most integration issues stem from data preparation rather than API connectivity.
Scope Management: Ensure OAuth2 scopes match your partner classification (internal vs external) and intended functionality.
Environment Alignment: Test with appropriate site domains for each environment level to avoid validation failures.

Guest Enrollment Response Structure

Guest enrollment responses provide essential information for tracking enrollment success and user activation status.

Guest Reference ID: Equivalent to userDetailsId in GMAP for user tracking
Guest Reference Token: HMAC token (currently not used but included for compatibility)
Response Variations: Internal SSO enrollments return UserDetailsResponse instead of GuestEnrollmentResponse

Post-Enrollment Processing

User Notification: System sends notification to user about password setup requirement
Password Setup: User must visit the GMAP website to establish password credentials
First Access: User can authenticate after password establishment using standard login endpoints
Business Outcome: Successful enrollment enables access to Visa Marketing & Benefits programs

Common Partner Integration Challenges

Data Preparation Issues:

Challenge: Partners struggle most with pre-enrollment preparation and validation.

Root Cause: Integration failures typically result from data quality issues, consent handling problems, or payload construction errors
Prevention: Ensure clean data, accurate consent management, and correct payload validation before API calls
Testing Strategy: Test enrollment data quality in sandbox before production deployment

Business Process Alignment:

Challenge: Misalignment between partner business processes and Visa Platforms Login enrollment flow.

Root Cause: Assumptions about immediate consumer access, minimal validation, or partner-controlled authentication
Solution: Understand that Visa owns consumer login and credential lifecycle; partners handle enrollment only
Process Design: Align consent management and validation handling with Visa Platforms Login business logic

Authentication Scope Confusion:

Challenge: Partners assume Visa Platforms Login behaves like a delegated identity or OAuth service.

Correct Understanding: Visa Platforms Login is an enrollment and activation platform, not an identity delegation service
Responsibility Separation: Partners authenticate API calls; Visa manages consumer authentication
Integration Pattern: No consumer-level authentication artifacts are exchanged via the API

Partner Success Criteria

Partner integration success is measured by complete end-to-end enrollment and authentication capability.

Technical Success Indicators

Enrollment Submission: Partner can submit valid enrollment requests with cardholder data and opt-in choices
Successful Response: Receive successful API response indicating consumer validation and registration in the platform
User Activation: Consumer can successfully access Visa Marketing & Benefits programs using Visa Platforms Login account
Credential Management: Consumer can create or reset credentials and authenticate for first access

Business Outcome Validation

Increased Participation: Higher consumer enrollment rates in Visa programs through reduced friction
Unified Access: Consumers can access multiple Visa programs through single account without repetitive registrations
Channel Integration: Consumers remain within issuer channels during the enrollment process
Program Activation: Faster program activation and improved customer experience