Visa Direct for Card

Visa Direct APIs use Two-Way SSL (mutual TLS) to authenticate API requests. 

To securely access the APIs, you must:

• Install an X509 security certificate issued by Visa
• Include your username and password in the API request

See the Two-way SSL instructions to obtain credentials for the sandbox environment.

Visa Direct APIs uses Message Level Encryption (MLE) to protect and encrypt sensitive data. You must support MLE in both the certification and production environments.

Refer to the Message Level Encryption guide for implementation details.

For the receive side APIs, Visa encrypts sensitive information (for example, PAN).

Encrypted fields:

• Must be decrypted using a key ID and a shared secret provided during onboarding.
• Are prefixed with "enc" (For example, “encCosumerPan”).

To decrypt these fields, you must:

• Download and install the software library that supports AES-GCM mode encryption in the required programming language (e.g. Java, PHP, C#).
• Upon receipt of the response from Visa:
  • Identify the fields prefixed with “enc”.
  • Parse the encrypted value using the software library and extract the key ID.
  • Use the key ID to retrieve the corresponding shared secret. You may have multiple key ID and shared secret pairs stored for key management.
  • Decrypt the encrypted data field using the shared secret.

Encryption of the response payload is not required, as the payload does not contain any sensitive data fields.