How to Use Directory Network Manager
Visa Alias Directory Service
Simplify the push payment experience. Link and resolve an Alias to a payment credential.
How to Use Directory Network Manager
Overview
Alias Directory offers the capability to connect to remote directories via a component called Directory Network Manager. Directory Network Manager has the capability to query available remote directories with an Alias and retrieve the associated payment details, if available.
Directory Network Manager Marketing Video
High-level Steps
The steps apply for both sandbox and production environments.
Client Fill out onboarding form
Client
Code to API specifications
Client and Visa Exchange OAuth credentials
Client and VIsa Exchange IP Addresses for whitelisting
Client and Visa Exchange MLE keys
Client Provide SSL certificate chain
Client Complete test cases
Additional Details
| Step | Description | Details |
|---|---|---|
| 1 | Remote Directory Onboarding Form | Implementation manager to provide Directory Network Manager onboarding form. The form contains the Remote Directory Profile and OAuth 2.0 Setup Details. Remote Directory to fill out and send back to implementation manager. |
| 2 | API Specifications | Remote Directory to expose API endpoints according to Directory Network Manager API specifications here: The URI should follow the below format: https:// |
| 3 | OAuth Credentials | Remote Directory to provide OAuth credentials securely to implementation manager. This can be done in parallel with the API development. |
| 4 | Whitelist IP Addresses | Implementation manager will provide IP addresses to Remote Directory for whitelisting. Note: Directory Network Manager does not need Remote Directory IPs for whitelisting. |
| 5 | MLE Setup | Remote Directory and Visa implementation manager to exchange MLE credentials. The Remote Directory will submit a CSR request to the implementation manager. This CSR will be signed by Visa. |
| 6 | SSL | The Remote Directory will need to provide the certificate chain to the implementation manager. |
| 7 | Test Cases | The Remote Directory must complete the test cases provided by the implementation manager. |
| 8 | Remote Directory Service Level Requirements | - Remote Directory is required to respond to API requests within 3 seconds. - Remote Directory uptime must be 99.9% or higher. |
Remote Directory Onboarding Form Details
If a remote directory would like to connect to Directory Network Manager, the below information will need to be provided as part of onboarding.
| Key Terms | Definitions |
|---|---|
| Remote Directory Name | The name of the directory. This parameter will also be used in API calls when clients want to ping a specific directory. |
| APIs Exposed | This indicates the APIs that the Remote Directory will expose to Directory Network Manager. Valid values: 1. Alias Resolution 2. Alias Inquiry |
| Supported Country Codes | Specifies the country codes of the requestor that are allowed by the remote directory. |
| Supported Alias Types | Valid values: 1. "PHONE" 2. "EMAIL" 3. "DIRECTORY_ALIASID" |
| Remote Directory Base URL | The base URL of the Remote Directory exposed endpoints. |
| List of Entity Ids | The entity Id is used by some remote directories to identify the entities within their directory. |
Authentication and Encryption
OAuth Authentication
The Remote Directory should provide the below OAuth information in the Remote Directory onboarding form.
| Information | Description |
|---|---|
| Client ID | The client_id is a public identifier for apps. |
| Client Secret | The client_secret is a secret known only to the application and the authorization server. |
| Authentication Path | Path of the authentication API which Directory Network Manager can use to get a JWT (Access token). |
OAuth 2.0 Specifications
OAuth 2.0 Grant Type client_credentials must to be used for API authentication between the Directory Network Manager and the remote directory. During the Remote Directory setup, Visa will receive a set of credentials to consume an authentication API that the Remote Directory will expose.
Message Level Encryption
Message Level Encryption (MLE) will be used to encrypt the messages that Directory Network Manager exchanges with the Remote Directory.
MLE is required for APIs that primarily deal with sensitive transaction data. During the Remote Directory onboarding, Directory Network Manager and the Remote Directory will exchange public keys.
API Specifications
The remote directory must implement the specifications for Alias Resolution API and Alias Inquiry API to connect with Directory Network Manager. Please see API specifications here.
| API Name | Description |
|---|---|
| Alias Resolution API | This API accepts an Alias for a query and returns a payment credential which can then be used for a push payment. |
| Alias Inquiry API | This API enables clients to check if an Alias or list of Aliases is available for Alias resolution. |
Alias Metadata
The current Alias Directory Service connects to remote directories and queries them during every Resolve or Inquiry API call. Alias Metadata APIs allow remote directories to store limited info in the Alias Directory such as the alias and preferredFor.