# Visa Credit Card Application
## CCA API
### CCA Realtime API v1 - Latest
This endpoint processes CCA realtime API requests.
## Request
### Request Body schema: application/json
| | |
| --- | --- |
| requestType
required | string 2 characters
16 - Declined application. For Consumer or Small Business Application.
17 - Application (Approved/approvable application, application in process). For Consumer or Small Business Application.
18 - Unauthorized use (UU)/credit card fraud. For Consumer or Small Business Fraud.
28 - Debit card Fraud.
58 - Merchant Fraud.
68 - Prepaid card Fraud.
78 - Other card Fraud.
19 - Inquiry.
29 - Debit inquiry.
49 - Non-bankcard inquiry.
59 - Request to delete previously reported record.
Example: "17" |
| serviceSubscriberType
required | string 1 characters
Must be V (Visa).
Example: "V" |
| comment | string or null \[ 0 .. 34 \] characters
Issuer use comments.
Example: "Add App with UU" |
| Consumer-identity | object
Group of data elements tied to Consumer Identity. |
| | | |
| --- | --- |
| accountNumber | string or null \[ 0 .. 16 \] characters
Required for request record type 18, 28, 58, 68, or 78.
Value will be 16 digit primary card number.
If request is with regard to an existing card account, the account number will be the one associated with the card.
Not applicable for Unauthorized use (UU) type codes '07' and '08'.
Example: "4500010098110001" |
| Consumer-alternate-address | object
Consumer's "Mail to" or "other" address on file at time of application/inquiry. |
| | | |
| --- | --- |
| address2City | string or null \[ 0 .. 28 \] characters
City Name.
Example: "Hanover Park" |
| address2Line1 | string or null \[ 0 .. 35 \] characters
Street Number and Street Name. PO BOX can be listed in Address2Line1 or Address2Line2.
Example: "1928 Pastoral Ln" |
| address2Line2 | string or null \[ 0 .. 35 \] characters
Secondary unit designator. Required for multi-unit dwellings. PO BOX can be listed in Address2Line1 or Address2Line2. |
| address2State | string or null \[ 0 .. 2 \] characters
2-letter state code.
Example: "IL" |
| address2Zip5 | string or null \[ 0 .. 5 \] characters
First 5 digits of zip code.
Example: "60188" |
| address2ZipSuffix4 | string or null \[ 0 .. 4 \] characters
Only last 4 suffix digits of zip code (items after hyphen).
Example: "1111" | |
| Consumer-device-data | object
Consumer device data captured by subscriber's service/API. |
| | | |
| --- | --- |
| deviceID | string or null \[ 0 .. 40 \] characters
The unique device ID generated by the device ID provider.
Example: "100.101.100.100" |
| deviceIdProvider | string or null \[ 0 .. 1 \] characters
1 - Lovation
2 - ThreatMetrix
3 - 41st Parameter
4 - Kount
5 - Others
Example: "4" | |
| Consumer-name | object
Group of data elements tied to name components (US format). |
| | | |
| --- | --- |
| firstName | string or null \[ 0 .. 10 \] characters
Applicant's first name.
Example: "BEVERLY" |
| lastName | string or null \[ 0 .. 19 \] characters
Applicant's last name.
Example: "WELLING" |
| middleNameOrInitial | string or null \[ 0 .. 1 \] characters
Applicant's middle initial.
Example: "J" | |
| Consumer-phone-numbers | object
Group of data elements tied to phone numbers. |
| | | |
| --- | --- |
| primaryPhone | string or null \[ 0 .. 10 \] characters
Applicant's phone number.
Example: "7012802796" |
| secondaryPhone | string or null \[ 0 .. 10 \] characters
Applicant's second phone number.
Example: "3012211234" | |
| Consumer-primary-address | object
Consumer's official address on file at time of application/inquiry. |
| | | |
| --- | --- |
| address1City | string or null \[ 0 .. 28 \] characters
City Name.
Example: "WICHITA" |
| address1Line1 | string or null \[ 0 .. 35 \] characters
Street Number and Street Name. PO BOX can be listed in address1Line1 or address1Line2.
Example: "7620 W DOUGLAS AVE" |
| address1Line2 | string or null \[ 0 .. 27 \] characters
Secondary unit designator for multi-unit dwellings. PO BOX can be listed in address1Line1 or address1Line2. |
| address1State | string or null \[ 0 .. 2 \] characters
2-letter state code.
Example: "KS" |
| address1Zip5 | string or null \[ 0 .. 5 \] characters
First 5 digits of zip code.
Example: "67212" |
| address1ZipSuffix4 | string or null \[ 0 .. 4 \] characters
Only last 4 suffix digits of zip code (items after hyphen).
Example: "6132" | |
| Consumer-state-id-other | object
Group of data elements tied to Other-ID. |
| | | |
| --- | --- |
| idNumber | string or null \[ 0 .. 30 \] characters
Can be passport number (both US and others), NEXUS, SENTRI or other forms of ID.
Example: "230978657" |
| issuingEntity | string or null \[ 0 .. 2 \] characters
Country code or other issuing entity for ID Number.
Example: "IL" | |
| Consumer-state-id-usa | object
Group of data elements tied to US-State-ID. |
| | | |
| --- | --- |
| issuingState | string or null \[ 0 .. 2 \] characters
2-letter state code that issued ID.
Example: "TX" |
| stateIDNumber | string or null \[ 0 .. 30 \] characters
Driver's License
Example: "4325309845244334" | |
| dateOfBirth | string or null \[ 0 .. 8 \] characters
Date of birth of consumer in YYYYMMDD format. If the request is for adding a card holder to an existing card, this DOB is for the additional card holder, NOT the existing card holder.
Example: "19720203" |
| email | string or null \[ 0 .. 42 \] characters
Applicant's email address. Email address may include only one “@” and must contain at least one “.” after the @.
Example: "Test3@Test.com" |
| Ip-address-data | object
Consumer IP address captured by subscriber's service/API. |
| | | |
| --- | --- |
| ipAddress | string or null \[ 0 .. 39 \] characters
IP address of the browser as returned by the HTTP headers (e.g. 111.222.33.44).
Example: "101.101.102.103" |
| proxyIP | string or null \[ 0 .. 64 \] characters
IP address of the proxy.
Example: "100.101.103.103" |
| proxyIPgeoLocation | string or null \[ 0 .. 2 \] characters
ISO 3166 country code of the proxy IP address or one of the special codes.
Example: "US" |
| proxyIPISP | string or null \[ 0 .. 50 \] characters
Internet Service Provider (ISP) the Proxy IP address originates from.
Example: "100.101.103.103" |
| proxyType | string or null \[ 0 .. 32 \] characters
Used to classify the type, and hence risk of the proxy in real time. Examples:
Transparent - proxy is a transparent proxy
Anonymous - anonymous proxy was detected
Hidden - proxy is trying to avoid detection. This is the highest risk proxy type.
Example: "NUMICS1" |
| trueIP | string or null \[ 0 .. 64 \] characters
The true client IP Address detected by Device ID vendor.
Example: "100.101.103.103" |
| trueIPActivity | string or null \[ 0 .. 64 \] characters
Activities associated with IP Address based on infection detection and automated classification. Associated with phishing, spam, malware, peer to peer sharing, etc.
Example: "100.101.103.103" |
| trueIPgeoLocation | string or null \[ 0 .. 2 \] characters
The ISO 3166 country code of the True IP Address or one of the special codes.
Example: "US" |
| trueIPISP | string or null \[ 0 .. 50 \] characters
The Internet Service Provider (ISP) that serves the True IP address.
Example: "100.101.103.103" | |
| Ssn-or-taxID | object
Group of data elements tied to SSN or Tax ID. |
| | | |
| --- | --- |
| isSSNTaxid | string or null \[ 0 .. 1 \] characters
1 - Tax ID Number. Any other value - SSN.
Example: "1" |
| ssnTaxid | string or null \[ 0 .. 9 \] characters
SSN or Tax ID.
Example: "887601476" | | |
| countryCode | string or null 2 characters
Country code in ISO 3166-1 alpha-2 format (assumes “US” if not populated).
Example: "US" |
| Delete-or-update-key | object
Key for deleting or updating previously reported request. |
| | | |
| --- | --- |
| originalActivityDate | string or null \[ 0 .. 8 \] characters
Required for request type 59 (delete). Date of application activity/Inquiry/fraud in YYYYMMDD format sent on the original request’s request-key that is being deleted.
Example: "20210929" |
| originalIssuingBID | string or null \[ 0 .. 8 \] characters
Required for request type 59 (delete). Business ID or member ID sent on the original request's request-key that is being deleted or updated. Numeric value.
Example: "99901235" |
| originalIssuingBIN | string or null \[ 0 .. 8 \] characters
Required for request type 59 (delete). Issuing BIN or Processing ID sent on the original request’s request-key that is being deleted or updated. Will support both 6 and 8 numeric byte Issuing BIN's.
Example: "55501235" |
| originalLocatorNumber | string or null \[ 0 .. 11 \] characters
Required for request type 59 (delete). Locator number (numeric) sent on the original request’s request-key that is being deleted.
Example: "22531066015" | |
| Fraud-report | object
Group of data elements tied to fraud report. |
| | | |
| --- | --- |
| cardMailedZipCode | string or null \[ 0 .. 9 \] characters
Relevant only for fraud/unauthorized use (type 18, 28, 58, 68 or 78) record with UU fraud type code ‘02’, where a consumer reported that card was not received.
Five or nine digit ZIP code which card was mailed.
Example: "605151111" |
| fraudTypeCode | string or null \[ 0 .. 2 \] characters
MUST be present for unauthorized use/fraud (type 18, 28, 58, 68 or 78) record. Account level frauds detected at both acquisition stage and post-booking must be reported by issuers.
00 – Fraud loss due to card lost
01 – Fraud loss due to card stolen
02 – Fraud loss due to card not received
03 – Fraud loss due to a fraudulent application
04 – Fraud loss due to counterfeit card
05 – Fraud loss due to Account takeover
06 – Fraud loss due to card not present activity
07 – Fraudulent application; consumer verified (pre-booking, no loss)
08 – Suspicious application; unable to verify (pre-booking, no loss)
09 – Bust out
Example: "02" |
| internetFraud_arrestCode | integer or null <= 1 characters
Relevant only for fraud/unauthorized use reports (type 18, 28, 58, 68 or 78). Indicates whether the fraud report was tied to an internet originated card application.
0 - No arrest; non-Internet application
1 - Arrest; non-internet application
2 - No arrest; Internet application
3 - Arrest; Internet application |
| lawEnforcementCaseNumber | string or null \[ 0 .. 7 \] characters
Relevant only for unauthorized use (type 18, 28, 58, 68 or 78) record. If a report was filed with law enforcement, the case number associated with the report.
Example: "2340987" | |
| Product-id | object
Group of data elements tied to product id. |
| | | |
| --- | --- |
| requestCategory | string or null \[ 0 .. 4 \] characters
If subscriber request is related to issuing new card or adding services to an existing card, the card type associated with request - credit, debit etc. Value will be numeric.
Example: "10" | |
| Request-key | object
Group of data elements tied to request key. |
| | | |
| --- | --- |
| activityDate
required | string 8 characters
Date of application activity/Inquiry/fraud in YYYYMMDD format.
Example: "20210929" |
| issuingBIN
required | string \[ 6 .. 8 \] characters
Issuing BIN (Bank Identification Number) or Processing ID assigned by Visa. Values can be 6 or 8 numeric bytes.
Example: "55501235" |
| locatorNumber
required | string \[ 1 .. 11 \] characters
Unique for record by Issuing BIN and date; Must fill all 11 numeric bytes using leading zeros where necessary; May not be spaces or all zeros.
Example: "22531066015" |
| internalTraceNumber | string or null \[ 0 .. 6 \] characters
Trace number (numeric) within the subscriber's business solution, like application ID. This is not the ID for a JSON request.
Example: "333333" |
| issuingBID | string or null \[ 0 .. 8 \] characters
Business ID or member ID assigned to subscriber by Visa.
Example: "99901235" |
| processorBIN | string or null \[ 0 .. 6 \] characters
Processing ID (numeric) if using processor for reporting data.
Example: "77701235" |