# Visa Platforms Login

## Workflow Reference

Select the appropriate workflow based on your business requirements and operational context.

| Business Goal | Recommended Workflow | Key Endpoints | Prerequisites |
| --- | --- | --- | --- |
| Standard user enrollment with email activation | User Registration Workflow | /user/registration → /user/activate-token → /user/site/{siteId}/login | Email delivery system, password management |
| Frictionless consumer opt-in through issuer channels | Guest Enrollment Workflow | /user/v2/enrollments → /user/change-password-from-passcode | CLIENT_ID header, OFAC compliance, consent management |
| Secure external partner enrollment | External Guest Enrollment | /user/external/guest/enrollments | Message-level encryption, external partner agreements |
| Email-based authentication without passwords | Passwordless Login | /user/pwless-login-send-otp → /user/site/{siteId}/login/pwless-otp | Email OTP delivery, domain validation |
| Enhanced security with two-factor authentication | MFA Setup Workflow | /user/mfa/totp/setup → /user/mfa/totp/enroll | TOTP application support, NOT_ENROLLED status |
| Bulk user data migration | Migration Workflow | /migrate → /migrate/status → /migrate/{migrationBatchId} | MIGRATE_USERS scope, batch processing capability |
| Customer service and support operations | Concierge Workflow | /concierge/cardholder-details → /concierge/send-code | SYSTEM_USER_R scope, issuer site association |

### User Account Workflows

#### New User Onboarding Sequence

1. `POST /user/registration` → Create account with email validation
2. Email activation link sent automatically by system
3. `POST /user/activate-token/{userId}` → Complete activation
4. `POST /user/site/{siteId}/login` → First authenticated login

**Critical Dependencies:** Account creation must complete before activation. Account activation must complete before login attempts.

#### Password Reset Workflow

1. `POST /user/send-passcode` → Request reset code
2. `POST /user/find-code` → Verify code validity
3. `POST /user/change-password-from-passcode` → Set new password

**Security Note:** Old password is not required for passcode-based password changes.

#### Site Registration Workflow

1. Verify user has existing GMAP account with active status
2. `POST /user/register/{siteId}` → Register user to specific site with attributes
3. User gains access to site-specific features and data

**Business Rule:** Site attributes are customizable per site configuration and isolated per site ID.

#### Passwordless Login Workflow

1. `POST /user/pwless-login-send-otp` → Send passwordless login OTP to user's email
2. `POST /user/site/{siteId}/login/pwless-otp` → Authenticate using OTP (no password required)

**Requirements:** Domain validation and lockout protection. Users may be locked out from passwordless login due to failed attempts.

#### Alias Management Workflow

1. `POST /user/alias` → Create or update user login alias
2. User can login with alias instead of primary identifier
3. `POST /user/alias/delete` → Remove alias when no longer needed

**Validation Rule:** User aliases must be unique within tenant scope and require proper user authentication for all operations.

### Administrative Workflows

#### User Revalidation Workflow

1. `POST /user/re-validate` or `POST /user/internal/batch/re-validate` to trigger revalidation
2. System calls OFAC screening, MOE sync, or program enrollment based on callType parameter
3. Background processing updates user status and attributes

**CallType Options:** OFAC (sanctions screening), MOE (system sync), ENROLL_PROGRAM_AND_MOE (combined program enrollment and sync).

#### Migration Workflow

1. `POST /migrate` to submit bulk user migration request with batch ID
2. System processes users and saves migration records with detailed status tracking
3. `GET /migrate/status` to check migration progress and error reporting
4. `POST /migrate/{migrationBatchId}` to retry failed migrations if needed

**Business Logic:** Failed migrations can be retried by batch ID without reprocessing successful records.

#### Duplicate Account Cleanup

1. Identify duplicate user accounts using `POST /user/queries`
2. `POST /user/internal/clean-duplicate-accounts` to merge duplicate accounts
3. System retains active or updated user and transfers unique data from deleted account

**Caution:** Duplicate cleanup operations may take extended time for complex merges and data transfers.

#### Concierge Customer Service Workflow

1. `GET /concierge/cardholder-details` → Look up customer information
2. `GET /concierge/cardholder-history` → Review customer interaction history
3. `POST /concierge/send-code` → Trigger password reset email for customer
4. Concierge can assist with account issues using administrative privileges

**Access Control:** Concierge access is restricted by issuer site associations and requires proper permissions for cardholder information access.

#### DTS Integration Workflow

1. `POST /dts/save` → Save DTS user details into user-mgmt database
2. `GET /dts/find` → Fetch DTS user details by userDetailsId
3. `GET /dts/find-for-update` → Retrieve DTS details for update operations
4. `DELETE /dts/delete` → Delete DTS user details when no longer needed

**Integration Note:** DTS tokens are managed separately from main user authentication and require USER-ATTRIBUTES_RW scope.

### Workflow Dependencies

#### Technical Prerequisites

- OAuth2 client credentials must be established before any API calls
- Site ID must be configured and known for authentication endpoints
- User account must exist and be activated before authentication attempts
- Valid session/token required for most user-specific operations

#### Sequential Dependencies

- **Account Creation:** /user/registration must complete before activation
- **Account Activation:** /user/activate-token/{userId} must complete before login
- **Authentication:** Login must complete before accessing protected resources
- **MFA Setup:** TOTP setup must complete before enrollment
- **Password Reset:** Passcode must be sent before verification/reset

#### Parallel Operations

- Multiple users can be registered simultaneously
- Profile updates and password changes are independent
- Administrative queries can run concurrently
- Migration batches can process in parallel