---
title: "Verify Card"
method: POST
path: "/cms/api/v1/issuers/{issuerId}/cards/credentials"
---

# Verify Card

`POST /cms/api/v1/issuers/{issuerId}/cards/credentials`

When a tokenization request reaches D1, D1 can call your backend with this method to verify the status of the card for which the tokenization has been requested. This call will be done if the CVK used to compute the card CVV/DCVV has not been shared with D1 during the onboarding process.

It is expected that your backend verifies the consistency between the card information provided versus the card information known by the backend itself. As a minimum, you should check the following:
- that the PAN is valid
- if no expiration date is provided, that the card has not expired
- if a CVV is provided, that it is valid

It is important that you provide a proper result response because D1 uses this result when making a decision regarding the tokenization request of the card.

If the card **is not already registered in D1, and if it has been configured during the on boarding to not reject an unknow card**.
Then along with the card details, D1 provides a unique card reference : the cardId. You can, OPTIONALLY, override this value by providing your own card ID in the response. In this case, however, you must guarantee the uniqueness of the ID.
It is also required to provide a reference of the cardholder information (consumerId).
If D1 accepts the card verification, then the consumer and the card will be automatically registered in D1.

If the card **is not already registered in D1, and if it has been configured during the on boarding to reject an unknow card**. Then the tokenization flow will be stopped before calling your backend, and you will have to register the card using D1 register card API.

## Headers

- `Authorization` string

## Request body

- object
  - `encryptedData` string, required — The encryptedData is the encrypted json (cf http://www.json.org/ ) representation of the card credentials.<br/>This value is encrypted using the JWE encryption (please refer to the **[Sensitive Information Encryption](https://thales-dis-dbp.stoplight.io/docs/d1-developer-portal/24df87894894d-data-encryption)** for more details)<br/><br/><b>Content</b><br/><br/>Once deciphered, the plaintext contains: |JSON field parameter name|description|MOC|Format| |-------|-------|-------|-------| |pan|The funding pan value.|M|string - from 10 to 19 digits| |exp|The expiry date of the card.|M|string - 4 digits, following the format MMYY| |name|The card holder name.|O|string - up to 128 characters| |cvv|The CVV2 value of the funding card|O|string - 3 or 4 digits|
  - `cardId` string, required — Unique identifier of the card.
  - `cardBin` string, required — The first 6 digits of the PAN

## Response `200`

OK

- object
  - `cardId` string — Unique identifier of the card.
  - `consumerId` string — Unique identifier of the end user. Must be provided only when the card verification is successful: **verificationResults.card.invalid** flag is false.
  - `accountId` string — Unique identifier of the account. Note: This parameter is deprecated, you can still send it but it will be ignored.
  - `verificationResults` VerificationResults, required — Rules verified by the issuer
    - `securityCode` object
      - `valid` boolean
      - `verificationAttemptsExceeded` boolean
    - `card` object, required
      - `lostOrStolen` boolean
      - `expired` boolean
      - `invalid` boolean
      - `fraudSuspect` boolean

## Other responses

- `400` — Bad Request
- `401` — Authorization missing or invalid
- `403` — Action forbidden
- `404` — Resource not found
- `500` — Internal Server Error

---

[API](https://skmtc.net/thalescloud/apis/d1-oauth-api.md) · [All operations](https://skmtc.net/thalescloud/apis/d1-oauth-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/thalescloud/d1-oauth-api/versions/96089514858c/schema)