Visa Credit Card Application API Reference
Visa Credit Card Application
CCA API
CCA Realtime API v1 - Latest
This endpoint processes CCA realtime API requests.
Request
Request Body schema: application/json
| requestType required |
string 2 characters 16 - Declined application. For Consumer or Small Business Application. 17 - Application (Approved/approvable application, application in process). For Consumer or Small Business Application. 18 - Unauthorized use (UU)/credit card fraud. For Consumer or Small Business Fraud. 28 - Debit card Fraud. 58 - Merchant Fraud. 68 - Prepaid card Fraud. 78 - Other card Fraud. 19 - Inquiry. 29 - Debit inquiry. 49 - Non-bankcard inquiry. 59 - Request to delete previously reported record. Example: "17" |
| serviceSubscriberType required |
string 1 characters Must be V (Visa). Example: "V" |
| comment | string or null [ 0 .. 34 ] characters Issuer use comments. Example: "Add App with UU" |
| Consumer-identity | object Group of data elements tied to Consumer Identity. |
| --- | --- |
| accountNumber | string or null [ 0 .. 16 ] characters Required for request record type 18, 28, 58, 68, or 78. Value will be 16 digit primary card number. If request is with regard to an existing card account, the account number will be the one associated with the card. Not applicable for Unauthorized use (UU) type codes '07' and '08'. Example: "4500010098110001" |
| Consumer-alternate-address | object Consumer's "Mail to" or "other" address on file at time of application/inquiry. |
| --- | --- |
| address2City | string or null [ 0 .. 28 ] characters City Name. Example: "Hanover Park" |
| address2Line1 | string or null [ 0 .. 35 ] characters Street Number and Street Name. PO BOX can be listed in Address2Line1 or Address2Line2. Example: "1928 Pastoral Ln" |
| address2Line2 | string or null [ 0 .. 35 ] characters Secondary unit designator. Required for multi-unit dwellings. PO BOX can be listed in Address2Line1 or Address2Line2. |
| address2State | string or null 2-letter state code. Example: "IL" |
| address2Zip5 | string or null [ 0 .. 5 ] characters First 5 digits of zip code. Example: "60188" |
| address2ZipSuffix4 | string or null [ 0 .. 4 ] characters Only last 4 suffix digits of zip code (items after hyphen). Example: "1111" |
| Consumer-device-data | object Consumer device data captured by subscriber's service/API. |
| --- | --- |
| deviceID | string or null [ 0 .. 40 ] characters The unique device ID generated by the device ID provider. Example: "100.101.100.100" |
| deviceIdProvider | string or null [ 0 .. 1 ] characters 1 - Lovation 2 - ThreatMetrix 3 - 41st Parameter 4 - Kount 5 - Others Example: "4" |
| Consumer-name | object Group of data elements tied to name components (US format). |
| --- | --- |
| firstName | string or null [ 0 .. 10 ] characters Applicant's first name. Example: "BEVERLY" |
| lastName | string or null [ 0 .. 19 ] characters Applicant's last name. Example: "WELLING" |
| middleNameOrInitial | string or null [ 0 .. 1 ] characters Applicant's middle initial. Example: "J" |
| Consumer-phone-numbers | object Group of data elements tied to phone numbers. |
| --- | --- |
| primaryPhone | string or null [ 0 .. 10 ] characters Applicant's phone number. Example: "7012802796" |
| secondaryPhone | string or null [ 0 .. 10 ] characters Applicant's second phone number. Example: "3012211234" |
| Consumer-primary-address | object Consumer's official address on file at time of application/inquiry. |
| --- | --- |
| address1City | string or null [ 0 .. 28 ] characters City Name. Example: "WICHITA" |
| address1Line1 | string or null [ 0 .. 35 ] characters Street Number and Street Name. PO BOX can be listed in address1Line1 or address1Line2. Example: "7620 W DOUGLAS AVE" |
| address1Line2 | string or null [ 0 .. 27 ] characters Secondary unit designator for multi-unit dwellings. PO BOX can be listed in address1Line1 or address1Line2. |
| address1State | string or null 2-letter state code. Example: "KS" |
| address1Zip5 | string or null [ 0 .. 5 ] characters First 5 digits of zip code. Example: "67212" |
| address1ZipSuffix4 | string or null [ 0 .. 4 ] characters Only last 4 suffix digits of zip code (items after hyphen). Example: "6132" |
| Consumer-state-id-other | object Group of data elements tied to Other-ID. |
| --- | --- |
| idNumber | string or null [ 0 .. 30 ] characters Can be passport number (both US and others), NEXUS, SENTRI or other forms of ID. Example: "230978657" |
| issuingEntity | string or null [ 0 .. 2 ] characters Country code or other issuing entity for ID Number. Example: "IL" |
| Consumer-state-id-usa | object Group of data elements tied to US-State-ID. |
| --- | --- |
| issuingState | string or null 2-letter state code that issued ID. Example: "TX" |
| stateIDNumber | string or null [ 0 .. 30 ] characters Driver's License Example: "4325309845244334" |
| dateOfBirth | string or null [ 0 .. 8 ] characters Date of birth of consumer in YYYYMMDD format. If the request is for adding a card holder to an existing card, this DOB is for the additional card holder, NOT the existing card holder. Example: "19720203" |
| string or null [ 0 .. 42 ] characters Applicant's email address. Email address may include only one “@” and must contain at least one “.” after the @. Example: "Test3@Test.com" |
|
| Ip-address-data | object Consumer IP address captured by subscriber's service/API. |
| --- | --- |
| ipAddress | string or null [ 0 .. 39 ] characters IP address of the browser as returned by the HTTP headers (e.g. 111.222.33.44). Example: "101.101.102.103" |
| proxyIP | string or null [ 0 .. 64 ] characters IP address of the proxy. Example: "100.101.103.103" |
| proxyIPgeoLocation | string or null [ 0 .. 2 ] characters ISO 3166 country code of the proxy IP address or one of the special codes. Example: "US" |
| proxyIPISP | string or null [ 0 .. 50 ] characters Internet Service Provider (ISP) the Proxy IP address originates from. Example: "100.101.103.103" |
| proxyType | string or null [ 0 .. 32 ] characters Used to classify the type, and hence risk of the proxy in real time. Examples: Transparent - proxy is a transparent proxy Anonymous - anonymous proxy was detected Hidden - proxy is trying to avoid detection. This is the highest risk proxy type. Example: "NUMICS1" |
| trueIP | string or null [ 0 .. 64 ] characters The true client IP Address detected by Device ID vendor. Example: "100.101.103.103" |
| trueIPActivity | string or null [ 0 .. 64 ] characters Activities associated with IP Address based on infection detection and automated classification. Associated with phishing, spam, malware, peer to peer sharing, etc. Example: "100.101.103.103" |
| trueIPgeoLocation | string or null [ 0 .. 2 ] characters The ISO 3166 country code of the True IP Address or one of the special codes. Example: "US" |
| trueIPISP | string or null [ 0 .. 50 ] characters The Internet Service Provider (ISP) that serves the True IP address. Example: "100.101.103.103" |
| Ssn-or-taxID | object Group of data elements tied to SSN or Tax ID. |
| --- | --- |
| isSSNTaxid | string or null [ 0 .. 1 ] characters 1 - Tax ID Number. Any other value - SSN. Example: "1" |
| ssnTaxid | string or null [ 0 .. 9 ] characters SSN or Tax ID. Example: "887601476" |
| countryCode | string or null Country code in ISO 3166-1 alpha-2 format (assumes “US” if not populated). Example: "US" |
| Delete-or-update-key | object Key for deleting or updating previously reported request. |
| --- | --- |
| originalActivityDate | string or null [ 0 .. 8 ] characters Required for request type 59 (delete). Date of application activity/Inquiry/fraud in YYYYMMDD format sent on the original request’s request-key that is being deleted. Example: "20210929" |
| originalIssuingBID | string or null [ 0 .. 8 ] characters Required for request type 59 (delete). Business ID or member ID sent on the original request's request-key that is being deleted or updated. Numeric value. Example: "99901235" |
| originalIssuingBIN | string or null [ 0 .. 8 ] characters Required for request type 59 (delete). Issuing BIN or Processing ID sent on the original request’s request-key that is being deleted or updated. Will support both 6 and 8 numeric byte Issuing BIN's. Example: "55501235" |
| originalLocatorNumber | string or null [ 0 .. 11 ] characters Required for request type 59 (delete). Locator number (numeric) sent on the original request’s request-key that is being deleted. Example: "22531066015" |
| Fraud-report | object Group of data elements tied to fraud report. |
| --- | --- |
| cardMailedZipCode | string or null [ 0 .. 9 ] characters Relevant only for fraud/unauthorized use (type 18, 28, 58, 68 or 78) record with UU fraud type code ‘02’, where a consumer reported that card was not received. Five or nine digit ZIP code which card was mailed. Example: "605151111" |
| fraudTypeCode | string or null [ 0 .. 2 ] characters MUST be present for unauthorized use/fraud (type 18, 28, 58, 68 or 78) record. Account level frauds detected at both acquisition stage and post-booking must be reported by issuers. 00 – Fraud loss due to card lost 01 – Fraud loss due to card stolen 02 – Fraud loss due to card not received 03 – Fraud loss due to a fraudulent application 04 – Fraud loss due to counterfeit card 05 – Fraud loss due to Account takeover 06 – Fraud loss due to card not present activity 07 – Fraudulent application; consumer verified (pre-booking, no loss) 08 – Suspicious application; unable to verify (pre-booking, no loss) 09 – Bust out Example: "02" |
| internetFraud_arrestCode | integer or null <= 1 characters Relevant only for fraud/unauthorized use reports (type 18, 28, 58, 68 or 78). Indicates whether the fraud report was tied to an internet originated card application. 0 - No arrest; non-Internet application 1 - Arrest; non-internet application 2 - No arrest; Internet application 3 - Arrest; Internet application |
| lawEnforcementCaseNumber | string or null [ 0 .. 7 ] characters Relevant only for unauthorized use (type 18, 28, 58, 68 or 78) record. If a report was filed with law enforcement, the case number associated with the report. Example: "2340987" |
| Product-id | object Group of data elements tied to product id. |
| --- | --- |
| requestCategory | string or null [ 0 .. 4 ] characters If subscriber request is related to issuing new card or adding services to an existing card, the card type associated with request - credit, debit etc. Value will be numeric. Example: "10" |
| Request-key | object Group of data elements tied to request key. |
| --- | --- |
| activityDate required |
string 8 characters Date of application activity/Inquiry/fraud in YYYYMMDD format. Example: "20210929" |
| issuingBIN required |
string [ 6 .. 8 ] characters Issuing BIN (Bank Identification Number) or Processing ID assigned by Visa. Values can be 6 or 8 numeric bytes. Example: "55501235" |
| locatorNumber required |
string [ 1 .. 11 ] characters Unique for record by Issuing BIN and date; Must fill all 11 numeric bytes using leading zeros where necessary; May not be spaces or all zeros. Example: "22531066015" |
| internalTraceNumber | string or null [ 0 .. 6 ] characters Trace number (numeric) within the subscriber's business solution, like application ID. This is not the ID for a JSON request. Example: "333333" |
| issuingBID | string or null [ 0 .. 8 ] characters Business ID or member ID assigned to subscriber by Visa. Example: "99901235" |
| processorBIN | string or null [ 0 .. 6 ] characters Processing ID (numeric) if using processor for reporting data. Example: "77701235" |