# Token Management Platform

Integrate MDES, VTS, Apple Pay, Google Pay and other X-pays. Issue and manage card tokens.

# Introduction

Token Management Platform enables a quick implementation of multiple tokenization solutions. It will help you launch your Apple Pay or Google Pay program in maximum 2-3 months at an affordable price.

Key features:

- The platform is integrated with Mastercard MDES and VISA VTS.
- Full certification of Mastercard, VISA, Apple Pay, Google Pay, Samsung Pay, X-Pays.
- Enables all mandatory and optional processes required by payment schemes.
- Simplifies encryption mechanisms required by X-Pays.
- It can be hosted by Verestro in private cloud in EU or on AWS or Azure at any location in the world.
- Full coverage of Apple mandatory requirements and certifications.
- Platform includes Administration Panel for token management.
- Token Connect and MDES-4-Merchants can be included into the project scope.
- Guaranteed implementation time - 3 months.

Please check product overview and technical APIs for more details about the product.

# Overview

Verestro Token Management Platform is a solution created in order to allow much easier connection to Token Service Providers (TSP) - MDES, VTS. That can be used for card „pre-digitization” from all Token requestors with minimum development on <span class="inline-comment-marker" data-ref="95f02d1c-ecdb-4cf3-a6ec-297befad55fa">the issuer side</span>. It <span class="tlid-translation translation" lang="en"><span title="">consists of the following parts</span></span>:

- Predigitization API -<span class="tlid-translation translation" lang="en"><span title=""> set of processes and requirements that must happen before the payment token becomes ready for use - it will be possible to make payments.</span></span>
- LifeCycle API - Mastercard or Visa API that TMP connects to in order to manage token life cycle.
- Admin Panel - Administration Panel for creating/fetching reports and managing token life cycle - can be used by Issuer Customer Service.
- PushProvisioning API - allow card issuers the ability to initiate the card provisioning process for Apple/Google Wallet directly from app.

## Benefits for issuing bank or fintech partner

- <span class="tlid-translation translation" lang="en"><span title="">TMP is created to connect to TSP(MDES/VTS) and enable much easier integration for the Issuer. </span></span>
- <span class="tlid-translation translation" lang="en"><span title="">TMP integrates with Token Service Providers (Mastercard MDES, Visa VTS) and provides a single interface for the issuers, so issuers don't have to integrate with both TSP.</span></span>
- <span class="tlid-translation translation" lang="en"><span title="">TMP supports various Token Requestors.</span></span>
- <span class="tlid-translation translation" lang="en"><span title="">TMP supports different requirements and implementations recommended by Token Requestors.</span></span>
- <span class="tlid-translation translation" lang="en"><span title="">TMP has audit and reporting capabilities for the Issuer including Apple Pay reports.</span></span>
- <span class="tlid-translation translation" lang="en"><span title="">TMP provides the Token and Card Lifecycle Management API.</span></span>
- <span class="tlid-translation translation" lang="en"><span title="">TMP provides Admin Panel.</span></span>
- TMP supports notifications including reminders for the users.
- TMP supports token requestor based velocity controls.
- TMP supports automated token lifecycle management.
- TMP supports Push Provisioning.

## High Level Overview

[![image-1654848100925.png](https://developer.verestro.com/uploads/images/gallery/2022-06/scaled-1680-/image-1654848100925.png)](https://developer.verestro.com/uploads/images/gallery/2022-06/image-1654848100925.png)

### Key components

<table border="1" id="bkmrk-component-descriptio"><tbody><tr><td>**Component**</td><td>**Description**  
</td></tr><tr><td class="confluenceTd">Bank Customer Service</td><td class="confluenceTd">Service that allows direct one-on-one interaction between a consumer using a card and a representative of the bank.

</td></tr><tr><td class="confluenceTd">Bank SMS/Email Gateway</td><td class="confluenceTd">Bank Service to send OTP via SMS or e-mail to users. Used only when Issuer wants to send sms/email by self.</td></tr><tr><td class="confluenceTd">Verestro SMS/Email Gateway</td><td class="confluenceTd">Verestro TMP gateway to send OTP via SMS or e-mail to users.</td></tr><tr><td class="confluenceTd">Bifrost Service (Verestro TMP backend)</td><td class="confluenceTd">Component responsible for the pre-digitization, token/card lifecycle, reports and push provisioning.</td></tr><tr><td class="confluenceTd">Push Provisioning ApplePay/GooglePay</td><td class="confluenceTd">Allows a mobile application to push a card to a token requestor.</td></tr><tr><td class="confluenceTd">Issuer</td><td class="confluenceTd">The bank or institution responsible for issuing the cardholder their card (debit, credit, prepaid).</td></tr><tr><td class="confluenceTd">MDES/VTS</td><td class="confluenceTd">Token Service Provider which supports digitization (transforming the card into payment token) and is responsible for management, generation and provisioning of transaction credentials to Token Requestor to enable simpler and more secure digital payment experience.</td></tr><tr><td class="confluenceTd">MDES Pre-digitization</td><td class="confluenceTd">MasterCard <span class="st">Digital Enablement Service </span>API with methods to perform pre-digitization process.</td></tr><tr><td class="confluenceTd">Verestro TMP Admin Panel</td><td class="confluenceTd">Panel that can be used by bank for token LifeCycle management, administration and viewing reports.</td></tr><tr><td class="confluenceTd">Token Requestor</td><td class="confluenceTd">Is an entity that requests payment tokens for end-users. Some examples of TRs include digital wallet providers, payment enablers, merchants and IoT manufacturers.

</td></tr></tbody></table>

## Verestro TMP solution

Verestro Token Management Platform is solution <span class="tlid-translation translation" lang="en"><span title="">which has been developed to facilitate the process of pre-digitizing cards for the Issuer.</span></span>

Solution consists of:

<div class="wiki-content" id="bkmrk-token-management-pla">- Token Management Platform (Server solution) - backend component.
- Wallet Admin Panel - frontend component.

</div>### Architecture

[![image-1654848249152.png](https://developer.verestro.com/uploads/images/gallery/2022-06/scaled-1680-/image-1654848249152.png)](https://developer.verestro.com/uploads/images/gallery/2022-06/image-1654848249152.png)

### Pre-digitization

Pre-digitization is a set of processes that allows to a generation of digital payment tokens to enable simpler and secure digital payment experiences. Simply it turns a payment card into a digital token. In this process, Verestro TMP is taking care of all the requirements from Token Requestors.

For this process, the Issuer needs to expose one API method, which will return card verification result or security code verification result.

**Tokenization process**  
1\. User enters the card into Apple Pay/Google Pay or another Token Requestor wallet.

2\. TMP receives Authorize Service request from TSP(MDES/VTS) on Pre-digitization API with Card Number, CVC, Exp Date, Device Score, and other tokenization data provided by Token Requestor.

3\. TMP checks device score, number of already active tokens, and velocity controls.

4\. TMP sends a request to Issuer Card Verification API with a Card Number and receives the Card Status, Card ID, User Phone Number, CVC validation Result, Product Category.

5\. TMP returns the decision to TSP (APPROVED/REQUIRE\_ADDITIONAL\_AUTHENTICATION/DECLINED).

**Token activation**  
If the decision is APPROVED - token activated instantly after Authorize Service response. Verestro TMP can also notify the issuer if required.

If the decision is REQUIRE\_ADDITIONAL\_AUTHENTICATION - The message will be displayed to the user with activation options (ex. SMS OTP). After the user selects the activation type, TSP will send a DeliverActivationCode to Verestro TMP. Verestro TMP will send the OTP activation code to the user. After the user enters the OTP, TSP activates the token. The token can also be activated manually via the Administration Panel.

If the decision is DECLINE - a token becomes INACTIVE and cannot be activated again.

When a token is activated, Verestro TMP will receive a notifyServiceActivated call from TSP.

[![image-1654848303648.png](https://developer.verestro.com/uploads/images/gallery/2022-06/scaled-1680-/image-1654848303648.png)](https://developer.verestro.com/uploads/images/gallery/2022-06/image-1654848303648.png)

#### User authentication

<span class="tlid-translation translation" lang="en"><span title="">There are 4 authentication paths for the user</span></span>:

<div class="wiki-content" id="bkmrk-green-path---path-wi"><div class="wiki-content">- Green Path - Path without user confirmation (authentication) during the token activation process. The payment token is automatically activated.
- Yellow Path - Path with user confirmation (authentication) during the token activation process. Payment token is activated after correct OTP is provided.
- Orange Path - Path with user confirmation (authentication) during the token activation process. Payment token is activated by the Bank after the user's request via call.
- Red Path - Path when the Issuer rejected activation payment token during the token activation process.

</div></div>Pre-digitization API Sequence Diagram

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
title Green Path  
actor User  
'comment: actor boundary control entity  
User -&gt; "Token Requestor": 1. Tokenize Card  
activate "Token Requestor"  
"Token Requestor" -&gt; "MDES": 2. AuthorizeService request  
activate "MDES"  
"MDES" -&gt; "TMP": 3. AuthorizeService request  
activate "TMP"  
"MDES" &lt;-- "TMP": 4. AuthorizeService response (APPROVED)  
"Token Requestor" &lt;-- "MDES": 5. AuthorizeService response (APPROVED)  
User &lt;-- "Token Requestor": 6. APPROVED  
"MDES" --&gt; "TMP": 7. NotifyServiceActivated  
deactivate "TMP"  
"MDES" --&gt; "Token Requestor": 8. Service Activated  
deactivate "MDES"  
"Token Requestor" --&gt; User: 9. Service Activated  
deactivate "Token Requestor"  
@enduml

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
title Yellow Path  
actor User  
'comment: actor boundary control entity  
User -&gt; "Token Requestor": 1. Tokenize Card  
activate "Token Requestor"  
"Token Requestor" -&gt; "MDES": 2. AuthorizeService request  
activate "MDES"  
"MDES" -&gt; "TMP": 3. AuthorizeService request  
activate "TMP"  
"MDES" &lt;-- "TMP": 4. AuthorizeService response (RAA)  
"Token Requestor" &lt;-- "MDES": 5. AuthorizeService response (RAA)  
User &lt;-- "Token Requestor": 6. Activation Methods  
User -&gt; "Token Requestor": 7. Choose Activation Method  
"Token Requestor" -&gt; "MDES": 8. Choose Activation Method  
"MDES" -&gt; "TMP": 9. DeliverActivationCode  
"TMP" --&gt; User: 10. DeliverActivationCode (SMS, EMAIL)  
deactivate "TMP"  
User -&gt; "Token Requestor": 11. Enter activation code  
"Token Requestor" -&gt; "MDES": 12. Validate activation code  
"MDES" --&gt; "Token Requestor": 13. Service Activated  
deactivate "MDES"  
"Token Requestor" --&gt; User: 14. Service Activated  
deactivate "Token Requestor"  
@enduml

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
title Red Path  
actor User  
'comment: actor boundary control entity  
User -&gt; "Token Requestor": 1. Tokenize Card  
activate "Token Requestor"  
"Token Requestor" -&gt; "MDES": 2. AuthorizeService request  
activate "MDES"  
"MDES" -&gt; "TMP": 3. AuthorizeService request  
activate "TMP"  
"MDES" &lt;-- "TMP": 4. AuthorizeService response (DECLINE)  
deactivate "TMP"  
"Token Requestor" &lt;-- "MDES": 5. AuthorizeService response (DECLINE)  
deactivate "MDES"  
User &lt;-- "Token Requestor": 6. Decline  
deactivate "Token Requestor"  
@enduml

Deliver activation code.

This method is called when authorize service returned decision: REQUIRE\_ADDITIONAL\_AUTHNETICATION(Yellow Path). Account Holder needs to verify himself with one of the available activation methods (e.g. OTP code or call to call center). OTP code can be generated by Verestro TMP or TSP(preferred option).

**Verification steps:**

<div class="wiki-content" id="bkmrk-verestro-tmp%C2%A0-sends-"><div class="wiki-content">- Verestro TMP sends OTP code via SMS or email (configurable option) to the Account Holder, but there is also possibility to do that by the Issuer, in that case Verestro TMP will notify the Issuer and then Issuer sends it to the Account Holder,
- Account Holder is entering received OTP and TSP or Verestro TMP(configurable) is validating it,
- When OTP code is correct, notifyServiceActivated method is called which means that token is activated and ready to use.

</div></div>#### MDES Pre-digitization API technical

<span class="tlid-translation translation" lang="en"><span title="">The process of predigitization presents a set of methods by which Issuer can easily digitize his card.</span></span> <span class="tlid-translation translation" lang="en"><span title="">The process of predigitization presents a set of methods by which Issuer can easily digitize his card. The diagram below shows the flow from the moment the User starts digitizing his card, through its authentication with the activation code ([Deliver Activation Code](https://wiki.verestro.com/display/TMP/Deliver+Activation+Code)) to the activation of the payment token.</span></span>

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant "Token Requestor" as TR  
participant "Mastercard Digital Enablement Service" as MDES  
participant "Token Management Platform" as TMP  
participant Issuer as Issuer  
User -&gt; TR: 1. Digitize  
activate TR  
TR -&gt; MDES: 2. Digitize  
activate MDES  
MDES -&gt; TMP: 3. AuthorizeService  
activate TMP  
TMP -&gt; Issuer: 4. CardValidation  
activate Issuer  
Issuer --&gt; TMP: 5. Card Validation Response  
deactivate Issuer  
TMP --&gt; MDES: 6. Decision and List of Activation Methods  
deactivate TMP  
MDES --&gt; TR: 7. List of Activation Methods  
deactivate MDES  
TR --&gt; User: 8. List of Activation Methods  
deactivate TR  
deactivate User  
note left: Activation method selected  
User -&gt; TR: 9. Deliver Activation Code  
activate TR  
TR -&gt; MDES: 10. Deliver Activation Code  
activate MDES  
MDES -&gt; TMP: 11. Deliver Activation Code  
activate TMP  
TMP -&gt; Issuer: 12. Deliver Activation Code  
activate Issuer  
Issuer --&gt; User: 13. Send activation code using preferred channel  
Issuer --&gt; TMP: 14. Activation Code Delivered  
deactivate Issuer  
TMP --&gt; MDES: 15. Activation Code Delivered  
deactivate TMP  
MDES --&gt; TR: 16. Activation Code Delivered  
deactivate MDES  
TR --&gt; User: 17. Activation Code Delivered  
deactivate TR  
User -&gt; TR: 18. Enter activation code  
activate TR  
TR-&gt; MDES: 19. Activate  
activate MDES  
MDES -&gt; MDES: 20. Token  
MDES -&gt; MDES: 21. Token activated (TUR)  
MDES -&gt; TMP: 22. NotifyTokenUpdated (TUR, Active)  
activate TMP  
MDES -&gt; TMP: 23. NotifyServiceActivated  
TMP -&gt; Issuer: 24. NotifyServiceActivated  
deactivate TMP  
MDES -&gt; TR: 25. NotifyServiceActivated  
deactivate MDES  
TR --&gt; User: 26. Token Activated  
deactivate TR  
@enduml

#### Lifecycle

Token lifecycle support token management which can be use directly by user, issuer or customer service using Admin Panel. This feature provides action on token to change token status. Actions what can happened are:

Acivate token → change token status to Active,  
Suspend token → change token status to Suspended,  
Unsuspend token → change token status to Active,  
Delete token → change token status to Deactivated,  
The diagram below shows the transitions between payment token statuses.

[![image-1654848584556.png](https://developer.verestro.com/uploads/images/gallery/2022-06/scaled-1680-/image-1654848584556.png)](https://developer.verestro.com/uploads/images/gallery/2022-06/image-1654848584556.png)

Automatic lifecycle management is supported via Verestro TMP API. Issuer can call Verestro TMP API to perform any lifecycle actions on card with will result on lifecycle action on all tokens assigned for the card.

Example: User looses his card and calls bank customer services to block the card, bank blocks user's card and automatically calls Verestro TMP to blocks all the tokens for the same card. This solution is compliant with apple automated lifecycle management requirements

**Payment Token Lifecycle Management**

These diagrams show what the 4 authentication paths look like for a user:

This section describes payment token lifecycle management performed via Issuer or Admin Panel.

Token lifecycle options:

– Token can be suspended/deleted from the consumer app (Apple Pay/ Google Pay). Verestro TMP will receive a TokenUpdate notification from TSP.

– Token can be activated/suspended/unsuspended/deactivated from Administration Panel UI by the Issuer Customer Service Support team.

– Token can be activated/suspended/unsuspended/deactivated via Verestro TMP API.

– All card tokens can be suspended/unsuspended/deactivated via Verestro TMP API. Card renew and replace is also supported.

Thera are a possibility to turn on an automatic notifications depends on any actions on token e. g token was activated or customer didn't finalize token activation.

**Suspend, Unsuspend, Deactivate the token**

Payment token can be suspended by the Issuer or the Admin Panel.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant "Token Requestor" as TR  
participant "Mastercard Digital Enablement Service" as MDES  
participant "Token Management Platform" as TMP  
participant "Admin Panel" as AP  
AP -&gt; TMP: 1. suspend/unsuspend/deactivate token  
activate AP  
activate TMP  
TMP -&gt; TMP: 2. check the permissions  
alt if permissions are compatible  
TMP -&gt; MDES: 3. suspend/unsuspend/deactivate token  
activate MDES  
else if permissions disagree  
TMP --&gt; AP: 4. response  
end  
MDES -&gt; MDES: 5. suspend/unsuspend/deactivate token  
MDES --&gt; TMP: 6. response  
TMP --&gt; AP: 7. response  
deactivate AP  
deactivate TMP  
MDES -&gt; TR: 8. token suspend/unsuspend/deactivate  
deactivate MDES  
activate TR  
TR -&gt; TR: 9. suspend/unsuspend/deactivate token  
TR --&gt; User: 10. notification  
deactivate TR  
@enduml

Payment token can be suspended by the Issuer.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant "Token Requestor" as TR  
participant "Mastercard Digital Enablement Service" as MDES  
participant "Token Management Platform" as TMP  
participant Issuer as Issuer  
Issuer -&gt; TMP: 1. suspend/unsuspend/deactivate token  
activate Issuer  
activate TMP  
TMP -&gt; TMP: 2. check the permissions  
TMP -&gt; MDES: 3. suspend/unsuspend/deactivate token  
activate MDES  
MDES -&gt; MDES: 4. suspend/unsuspend/deactivate token  
MDES --&gt; TMP: 5. response  
TMP --&gt; Issuer: 6. token suspended/unsuspended/deactivated  
deactivate Issuer  
deactivate TMP  
MDES -&gt; TR: 7. token suspend/unsuspend/deactivate  
deactivate MDES  
activate TR  
TR -&gt; TR: 8. suspend token  
TR --&gt; User: 9. notification  
deactivate TR  
@enduml

**Replace and renew the token**

Replace/renew payment token is the process with consists of updating payment token data. Every payment token has an expiry date and linked PAN. When the token is expiring, the Issuer can change the token expiration date.

When a cardholder has a new card (new PAN) and wants to keep the digital token active, it can be achieved by doing "PAN swap" for a token. The issuer can do it for one or all payment tokens associated with one PAN set to the new data. A new product configuration ID can also be associated with one or all tokens associated with a PAN.

The same situation may occur when the cardholder receives a new card (PAN) due to fraud / theft. The issuer changes the payment token data in the same way.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant "Token Requestor" as TR  
participant "Mastercard Digital Enablement Service" as MDES  
participant "Token Management Platform" as TMP  
participant Issuer as Issuer  
Issuer -&gt; TMP: 1. replace/renew token  
activate Issuer  
activate TMP  
TMP -&gt; TMP: 2. check the permissions  
TMP -&gt; MDES: 3. replace/renew token  
activate MDES  
MDES -&gt; MDES: 4. replace/renew token  
MDES --&gt; TMP: 5. response  
deactivate MDES  
TMP --&gt; Issuer: 6. token replaced/renewed  
deactivate Issuer  
TMP -&gt; TR: 7. replace/renew token  
deactivate TMP  
activate TR  
TR -&gt; TR: 8. replace/renew token  
TR --&gt; User: 9. notification  
deactivate TR  
@enduml

**Payment Card Lifecycle Management**

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
participant "Issuer" as Issuer  
participant "Verestro Token Management Platform" as TMP  
participant "Customer Service API" as CSAPI  
Issuer -&gt; TMP: 1. Suspend card (CardId)  
activate Issuer  
activate TMP  
TMP -&gt; TMP: 2. Find all tokens for card  
TMP --&gt; CSAPI: 3. Suspend tokens  
activate CSAPI  
TMP --&gt; Issuer: 4. Token Suspended  
@enduml

#### Push Provisioning

Push Provisioning provides the ability to initiate the card provisioning process for Apple/Google Wallet directly from the issuer’s app.

Users will find the Push Provisioning feature an extremely convenient method to provision their cards or passes into their devices by avoiding the need to input those details manually.

[![image-1654849038427.png](https://developer.verestro.com/uploads/images/gallery/2022-06/scaled-1680-/image-1654849038427.png)](https://developer.verestro.com/uploads/images/gallery/2022-06/image-1654849038427.png)

Verestro TMP Push Provisioning module API:

1. Check if card is tokenized.
2. Sign card .

Verestro TMP Push Provisioning module allows the following flow:

1. Check if card is tokenized - Return information if a card is tokenized on the device, so the Issuer's mobile application can show "Add to Apple/Google pay" button.
2. Sign card - Prepare encrypted and signed payload which can be used by the Issuer's mobile application.
3. Initiate Push Provisioning with Apple Pay/Google Pay SDK.
4. Authorize Service to Verestro TMP.
5. Tokenization Decision returned to TSP (APPROVE/DECLINE).

**Admin Panel**

Admin Panel for Verestro Token Management Platform is an user interface thanks to we can manage and view tokens and transaction data.

Due to admin panel administrators can:

- browse tokens list and see token details,
- change/manage tokens statuses,
- browse transactions list and see transaction details (including statuses).

Moreover is a simple way to generate reports.

Can be used by Issuer Customer Service.

More information we can find in the Verestro TMP Admin Panel Product Overview documentation.

**Additional Features**

Reports.

Verestro TMP can generate various types of reports: ApplePay, Tokens, Transactions, Activity audit. Reports can be downloaded or generated from Admin Panel. Some of the reports can be generated automatically by Verestro TMP.

User notifications.

Verestro TMP can send custom notifications to Issuer, like:

<div class="wiki-content" id="bkmrk-otp-code-for-additio"><div class="wiki-content">- OTP code for additional authentication.
- Notifications when a token is activated or deleted.
- Notifications to inactive customers, which didn't perform any transactions after token activation.
- Notifications on abandoned provisioning, when a user didn't finish the full process of token activation.

</div></div>Jobs.

Verestro TMP can generate/notify or do some other custom task automatically, like:

<div class="wiki-content" id="bkmrk-delete-inactive-toke"><div class="wiki-content">- Delete inactive tokens after a configured time.
- Generate reports.
- Send notifications.
- Fetch transactions from Customer Service, which can be used for reporting and accessible from administration panel.

</div></div>Monitoring and Alerting:

<div class="wiki-content" id="bkmrk-grafana-dashboard-wi"><div class="wiki-content">- Grafana dashboard with tokenization activity and performance metrics.
- Statistics.
- Error and warning alerting.

</div></div>Security:

- IP whitelist for API communication.
- Role based access to lifecycle and reporting features.
- VPN tunnel support.
- OAuth when connecting to Issuer API.

# Use Cases

This section is dedicated to describe different use cases of Verestro Token Management Platform.

## Activating a Token

During digitization cardholder have to activate his token by Customer Service. The cardholder calls the Customer Service of their bank to activate the token.

Admin Panel for Verestro TMP which can be used by Issuer Customer Service allows tokens activated e.g. when at the end of the pre-digitalization activities cardholder have to call his bank to complete the activation digital card.

[![image-1654849186718.png](https://developer.verestro.com/uploads/images/gallery/2022-06/scaled-1680-/image-1654849186718.png)](https://developer.verestro.com/uploads/images/gallery/2022-06/image-1654849186718.png)

## Updating a Token

The cardholder wants to replace his existing card e.g. existing card expiry date is coming to the end.

Admin Panel for Verestro Token Management Platform which can be used by Issuer Customer Service allows tokens provisioned against that device to be update.

[![image-1654849244315.png](https://developer.verestro.com/uploads/images/gallery/2022-06/scaled-1680-/image-1654849244315.png)](https://developer.verestro.com/uploads/images/gallery/2022-06/image-1654849244315.png)

## Deleting a Token

A cardholder notifies their bank that a phone with their tokenized account been lost or stolen. To avoid fraud the cardholder wants to delete all digital cards provisioned into the device wallets.

Admin Panel for Verestro TMP which can be used by Issuer Customer Service allows tokens provisioned against that device to be deactivated preventing further transactions from being performed and therefore preventing fraud.

[![image-1654849257588.png](https://developer.verestro.com/uploads/images/gallery/2022-06/scaled-1680-/image-1654849257588.png)](https://developer.verestro.com/uploads/images/gallery/2022-06/image-1654849257588.png)

## Token Suspend by Customer Service

A cardholder notifies their bank that a phone with their tokenized account been lost or stolen.

Admin Panel for Verestro Token Management Platform which can be used by Issuer Customer Service allows tokens provisioned against that device to be suspended preventing further transactions from being performed and therefore strongly reducing the risk of fraud, in case the phone has been stolen.

[![image-1654849319677.png](https://developer.verestro.com/uploads/images/gallery/2022-06/scaled-1680-/image-1654849319677.png)](https://developer.verestro.com/uploads/images/gallery/2022-06/image-1654849319677.png)

## Token Unsuspend by Customer Service

Cardholder informs their bank that he finds device (after losing their mobile phone). Cardholder request the bank to resume digital cards related to his mobile phone.

Admin Panel for Verestro TMP which can be used by Issuer Customer Service allows tokens to be unsuspended in case the risk of fraud has been eliminated e.g. the phone has been found.

[![image-1654849348887.png](https://developer.verestro.com/uploads/images/gallery/2022-06/scaled-1680-/image-1654849348887.png)](https://developer.verestro.com/uploads/images/gallery/2022-06/image-1654849348887.png)

## Information on status history

There is a suspicion of fraud on one digital card. The Issuer was informed and wants to get more information before make any actions.

Admin Panel for Verestro Token Management Platform which can be used by Issuer Customer Service allows get information and details about tokens and transaction history.

[![image-1654849363337.png](https://developer.verestro.com/uploads/images/gallery/2022-06/scaled-1680-/image-1654849363337.png)](https://developer.verestro.com/uploads/images/gallery/2022-06/image-1654849363337.png)

## Searching for information

The cardholder has difficulties with card digitalization. The cardholder calls their bank to get information what is wrong.

Admin Panel for Verestro TMP which can be used by Issuer Customer Service allows to identify the token in question and check the status. Thanks to this the cardholder may be informed what was happened and take actions.

[![image-1654849375850.png](https://developer.verestro.com/uploads/images/gallery/2022-06/scaled-1680-/image-1654849375850.png)](https://developer.verestro.com/uploads/images/gallery/2022-06/image-1654849375850.png)

# Technical documentation

# Technical documentation part.1

## Issuer API Specification

@swagger="https://s3.verestro.dev/valinor-public/issuer\_api\_1.3.1.yaml"

# Technical documentation part.2

## TMP API Specification

@swagger="https://s3.verestro.dev/valinor-public/tmp\_api\_1.1.1.yaml"