Product Documentation

    The GetCardCaptureData GCD) operation receives a card swipe (along with other parameters to authenticate and authorize the transaction), decodes it according to the manufacturer-specific definition of their swipe format, decrypts the track data using the DUKPT algorithm for data-decryption, and either tokenizes or returns the PAN (based on SAKA configuration parameters; by default, only a token is returned). It uses a previously stored BDK identified by the manufacturer ID. The web service operation requires six parameters:

    DID

    The unique encryption domain identifier.

    username

    The username (service-credential) within the encryption domain with the authorization to call this web service. The credential requires the Encryption privilege at a minimum, but may also require Decryption privileges within the encryption-domain if a plaintext PAN is to be returned.

    password

    The password of the username to authenticate the credential of the requester.

    ccd

    The hex-encoded data containing the captured data. Note that all CCS web services operate on hex-encoded data.

    mfr

    The numerical identifier of the manufacturer of the device that captured the card data.

    dsn

    The device serial number (DSN) of the device that captured the card data. This value is required, but only currently used for logging purposes.

    When SAKA receives the request, it verifies the credentials presented in the web service operation against its internal database, or an optional LDAP directory server, and then determines their authorization to request the GetCardCaptureData service by determining if they are a member of the EncryptionAuthorized group. Note that if using LDAP, this group and its members must be created in the LDAP directory as a distinct task of the installation process of SAKA; when using the SAKA internal database, this group is created automatically.

    If the requester is authorized, SAKA starts by decoding the ccd parameter based on the manufacturer-specific format. The manufacturer can be provided with the mfr parameter, or optionally set automatically via the SAKA configuration property strongkeylite.cfg.property.defaultmanufacturer. If the swipe is properly formatted and can be successfully decoded, the encrypted track data is decrypted using the BDK loaded for this manufacturer. The track data is then parsed to extract details such as Expiration Date, IssuerID, Cardholder Name, etc.

    By default, the PAN will be encrypted by the appliance and a token will be returned in the response. If tokenization is not desired, the SAKA configuration property strongkeylite.cfg.property.ccsautodelete must be set to true. Alternatively or in addition to returning a token, the PAN can be returned in a plaintext format if the SAKA configuration property strongkeylite.cfg.property.ccsplaintextpan is set to true. When strongkeylite.cfg.property.ccsplaintextpan is true, the service credential requesting the PAN must also be a member of the DecryptionAuthorized group in addition to being a member of the EncryptionAuthorized group.

    On success, the following will be returned, either as a JSON or XML string; in the case of SOAP, the JSON or XML string is embedded in the objectContent attribute of the CCReturnObject object:

    DID

    Unique encryption domain identifier for the domain that serviced this request.

    SRID

    Unique request identifier for this transaction.

    Token

    (Optional) If strongkeylite.cfg.property.ccsautodelete is set to false (default: false), a token value is returned that references the PAN. This token can always be supplied to the decrypt web service by authorized applications for recovery of the PAN.

    PAN

    (Optional) If strongkeylite.cfg.property.ccsplaintextpan is set to true (default: false), the plaintext PAN from the swipe is returned.

    ExpiryDate

    Four digits to represent the expiration month and expiration year of the card.

    ExpiryMonth

    Two digits to represent the expiration month of the card.

    ExpiryYear

    Two digits to represent the expiration year of the card.

    MaskedPAN

    Masked PAN as received in any available masked data provided in the swipe.

    Digest

    Always null. Reserved for future use.

    Valid

    True if this PAN conforms to the Luhn Algorithm.

    Exists

    (Optional) If strongkeylite.cfg.property.ccsautodelete is set to false (default: false), Exists will be true if this PAN is already encrypted by the appliance.

    AssociationID

    The Card Association ID recovered from the track data.

    IssuerID

    The Card Issuer ID recovered from the track data.

    CardholderName

    The full name of the cardholder.

    Firstname

    The first name of the cardholder.

    Lastname

    The last name of the cardholder.

    Track2

    (Optional)

    • If strongkeylite.cfg.property.ccsprocesstrack2 is set to true (default: false), track2 data will be returned.

    • If strongkeylite.cfg.property.ccsautodelete is false, the PAN portion of the track2 data will be replaced with a token.

    • If strongkeylite.cfg.property.ccsplaintextpan is true, the track2 data will be returned raw, even if strongkeylite.cfg.property.ccsautodelete is false.

    • If strongkeylite.cfg.property.ccsautodelete is true but strongkeylite.cfg.property.ccsplaintextpan is false, the Track2 element will be null as neither a token or the PAN is authorized for return.

    Notes

    Always null. Reserved for future use.