v1

latestOpenAPI 3.0.32026-07-26208618579.9 KB
PIN operations using PKI

Set PIN

This operation sets the card PIN. Provided PIN must be in ISO format 1 and encrypted with the tzpk received from the "Get tzpk" API call.

Example flow

Step 1, executed on the CARD-HOLDER DEVICE, encrypting the PIN block with the TZPK

// PIN 1234 in ISO format 1 (xxYYYYxxxxxxxxxx) where YYYY is the PIN
var pinBlock = "141234AAAAAAAAAA";
// encrypt pinBlock with previously received tzpk
var des = Cipher.getInstance("DESede/ECB/NoPadding");
des.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(tzpk, "DESede"));
var encryptedPinBlock = des.doFinal(Hex.decode(pinBlock.getBytes()));

Step 2, executed on the CLIENT BACK-END, sending the encrypted PIN block recieved from the device, to the API

// var encryptedPinBlock = // Received from the device
// make request
pinApiClient.post()
        .uri("/pin/v2/set?auditUser={user}", "test")
        .bodyValue(Map.of(
                "controlId", controlId,
                "pinBlock", Base64.getEncoder().encodeToString(encryptedPinBlock)
        ))
        .retrieve()
        .bodyToMono(Object.class)
        .block();
post/v2/set

Query parameters

auditUserstring required

The audit user to log the request

Request body

controlIdstring required

Control ID received from PIN control API.

pinBlockstring required

ISO format 1 PIN block 3DES encrypted with temporary PIN encryption key (tzpk). Base64-encoded.

Example request

{
  "controlId": "83fa5f55-3dd7-453a-8233-4242a6bad179",
  "pinBlock": "tACuB41yyfU="
}

Response

SetPinResponse required