Visa Platforms Login

Workflow Reference

Select the appropriate workflow based on your business requirements and operational context.

Business Goal Recommended Workflow Key Endpoints Prerequisites
Standard user enrollment with email activation User Registration Workflow /user/registration → /user/activate-token → /user/site/{siteId}/login Email delivery system, password management
Frictionless consumer opt-in through issuer channels Guest Enrollment Workflow /user/v2/enrollments → /user/change-password-from-passcode CLIENT_ID header, OFAC compliance, consent management
Secure external partner enrollment External Guest Enrollment /user/external/guest/enrollments Message-level encryption, external partner agreements
Email-based authentication without passwords Passwordless Login /user/pwless-login-send-otp → /user/site/{siteId}/login/pwless-otp Email OTP delivery, domain validation
Enhanced security with two-factor authentication MFA Setup Workflow /user/mfa/totp/setup → /user/mfa/totp/enroll TOTP application support, NOT_ENROLLED status
Bulk user data migration Migration Workflow /migrate → /migrate/status → /migrate/{migrationBatchId} MIGRATE_USERS scope, batch processing capability
Customer service and support operations Concierge Workflow /concierge/cardholder-details → /concierge/send-code SYSTEM_USER_R scope, issuer site association

User Account Workflows

New User Onboarding Sequence

  1. POST /user/registration → Create account with email validation
  2. Email activation link sent automatically by system
  3. POST /user/activate-token/{userId} → Complete activation
  4. POST /user/site/{siteId}/login → First authenticated login

Critical Dependencies: Account creation must complete before activation. Account activation must complete before login attempts.

Password Reset Workflow

  1. POST /user/send-passcode → Request reset code
  2. POST /user/find-code → Verify code validity
  3. POST /user/change-password-from-passcode → Set new password

Security Note: Old password is not required for passcode-based password changes.

Site Registration Workflow

  1. Verify user has existing GMAP account with active status
  2. POST /user/register/{siteId} → Register user to specific site with attributes
  3. User gains access to site-specific features and data

Business Rule: Site attributes are customizable per site configuration and isolated per site ID.

Passwordless Login Workflow

  1. POST /user/pwless-login-send-otp → Send passwordless login OTP to user's email
  2. POST /user/site/{siteId}/login/pwless-otp → Authenticate using OTP (no password required)

Requirements: Domain validation and lockout protection. Users may be locked out from passwordless login due to failed attempts.

Alias Management Workflow

  1. POST /user/alias → Create or update user login alias
  2. User can login with alias instead of primary identifier
  3. POST /user/alias/delete → Remove alias when no longer needed

Validation Rule: User aliases must be unique within tenant scope and require proper user authentication for all operations.

Administrative Workflows

User Revalidation Workflow

  1. POST /user/re-validate or POST /user/internal/batch/re-validate to trigger revalidation
  2. System calls OFAC screening, MOE sync, or program enrollment based on callType parameter
  3. Background processing updates user status and attributes

CallType Options: OFAC (sanctions screening), MOE (system sync), ENROLL_PROGRAM_AND_MOE (combined program enrollment and sync).

Migration Workflow

  1. POST /migrate to submit bulk user migration request with batch ID
  2. System processes users and saves migration records with detailed status tracking
  3. GET /migrate/status to check migration progress and error reporting
  4. POST /migrate/{migrationBatchId} to retry failed migrations if needed

Business Logic: Failed migrations can be retried by batch ID without reprocessing successful records.

Duplicate Account Cleanup

  1. Identify duplicate user accounts using POST /user/queries
  2. POST /user/internal/clean-duplicate-accounts to merge duplicate accounts
  3. System retains active or updated user and transfers unique data from deleted account

Caution: Duplicate cleanup operations may take extended time for complex merges and data transfers.

Concierge Customer Service Workflow

  1. GET /concierge/cardholder-details → Look up customer information
  2. GET /concierge/cardholder-history → Review customer interaction history
  3. POST /concierge/send-code → Trigger password reset email for customer
  4. Concierge can assist with account issues using administrative privileges

Access Control: Concierge access is restricted by issuer site associations and requires proper permissions for cardholder information access.

DTS Integration Workflow

  1. POST /dts/save → Save DTS user details into user-mgmt database
  2. GET /dts/find → Fetch DTS user details by userDetailsId
  3. GET /dts/find-for-update → Retrieve DTS details for update operations
  4. DELETE /dts/delete → Delete DTS user details when no longer needed

Integration Note: DTS tokens are managed separately from main user authentication and require USER-ATTRIBUTES_RW scope.

Workflow Dependencies

Technical Prerequisites

  • OAuth2 client credentials must be established before any API calls
  • Site ID must be configured and known for authentication endpoints
  • User account must exist and be activated before authentication attempts
  • Valid session/token required for most user-specific operations

Sequential Dependencies

  • Account Creation: /user/registration must complete before activation
  • Account Activation: /user/activate-token/{userId} must complete before login
  • Authentication: Login must complete before accessing protected resources
  • MFA Setup: TOTP setup must complete before enrollment
  • Password Reset: Passcode must be sent before verification/reset

Parallel Operations

  • Multiple users can be registered simultaneously
  • Profile updates and password changes are independent
  • Administrative queries can run concurrently
  • Migration batches can process in parallel