# DCS Technical Documentation ## DeCard-Managed ### Guides #### Getting Started - [Overview](https://docs.thedecard.com/en/decard-managed/getting-started/overview.md): The entry point for integrating with DeCard-Managed mode. It covers what the DCS platform is, how the managed model works, and which capabilities it provides. - [First Steps](https://docs.thedecard.com/en/decard-managed/getting-started/first-steps.md): Everything you need to settle before integrating with DCS: getting your Enterprise created, collecting your API Key and Secret Key, submitting your IP whitelist, and importing the Postman collection for integration testing. - [Quickstart](https://docs.thedecard.com/en/decard-managed/getting-started/quickstart.md): Issue your first working card in the sandbox along the shortest path: send an OTP → register the user → get the onboarding guidance link → receive the card-application Webhook → manage the card → fund it and simulate a purchase. #### Basic Concepts - [Overview (Access Credentials and Developer Configuration)](https://docs.thedecard.com/en/decard-managed/basic-concepts/overview.md): Covers the three developer configurations you complete before integration: apiKey / secretKey credential provisioning (including secure extraction in production), API IP whitelisting, and Webhook setup. - [Transaction Lifecycle · Overview](https://docs.thedecard.com/en/decard-managed/basic-concepts/transaction-lifecycle.md): The mental model for the transaction flow. It covers only how the core path, authorization (freeze) then settlement (posting), works under the DeCard-Managed model; endpoints, field tables and scenario-by-scenario walkthroughs are linked out to the How-to guides. - [Accounts and Asset Model](https://docs.thedecard.com/en/decard-managed/basic-concepts/ledgering-system.md): A concept page on the account and asset model: per-user balances (free / freeze / total), booking per user and per asset, and custody strategy. For the actual API calls and field details, go to the matching How-to page (see "Next steps" at the end). This page does not repeat the field tables. - [Compliance and the KYC flow](https://docs.thedecard.com/en/decard-managed/basic-concepts/compliance-kyc-flow.md): The material the KYC flow needs, the markets cards can be issued in and the per-region document requirements; statuses and error codes are covered in the related sub-pages. #### How to Use ##### Registration - [Signing Up a Customer · Overview](https://docs.thedecard.com/en/decard-managed/how-to-use/signing-up-a-customer/overview.md): Covers the two-step registration flow for end users under the DeCard-Managed model: request a verification code (SMS or email) first, then register with the OTP to obtain an externalUserId. Includes the code-sending and registration endpoints, their fields, encrypted transmission, and error handling… ##### Users - [Managing Users](https://docs.thedecard.com/en/decard-managed/how-to-use/managing-users/overview.md): Covers the day-to-day management that follows user creation: querying a user's current transaction restrictions (whether withdrawals or card transactions are blocked, GET /account/v1/user-status), and acting as the navigation hub for every capability across the user lifecycle. ##### Cards - [Managing Cards · Overview](https://docs.thedecard.com/en/decard-managed/how-to-use/managing-cards/overview.md): The landing page for the card management group: the two card forms (virtual and physical), the card state machine, and how capabilities such as freezing, unfreezing and reading card details are delivered along two different paths (REST endpoints and hosted guidance pages). - [Issuing Cards (Virtual and Physical)](https://docs.thedecard.com/en/decard-managed/how-to-use/managing-cards/issuing-cards.md): How to issue a virtual card (two options: the H5 hosted guidance page or the OPEN-API) and a physical card (hosted guidance page only) for a user who has passed KYC, including POA file exchange, application status lookups, and what to do once you have the card. - [Managing a Card's PIN](https://docs.thedecard.com/en/decard-managed/how-to-use/managing-cards/managing-a-cards-pin.md): Why setting and updating a PIN in the DeCard-Managed model runs through a hosted guidance page rather than a direct API, plus how to obtain the PIN guidance link (action=UPDATE_PIN), the full sequence, and how to handle errors. - [Viewing Encrypted Card Details](https://docs.thedecard.com/en/decard-managed/how-to-use/managing-cards/viewing-encrypted-card-details.md): How the one mechanism available in the DeCard-Managed model, the H5 hosted guidance page (action=CARD_INFO), securely shows the full PAN, CVV and expiry without the plaintext ever passing through the partner's backend: the three-step flow, the endpoint, and the messageDetail fields. - [Push Provisioning (Adding Cards to Apple Pay / Google Pay)](https://docs.thedecard.com/en/decard-managed/how-to-use/managing-cards/push-provisioning.md): How to let a cardholder add a DCS-issued Visa card to Apple Wallet or Google Wallet from inside the partner's app: the tokenization mental model, the commercial onboarding process, the runtime binding sequence, and the dedicated Apple and Google wallet binding REST endpoints. ##### Transactions - [Managing Transactions · Overview](https://docs.thedecard.com/en/decard-managed/how-to-use/managing-transactions/overview.md): The starting point for retrieving end-user transaction data in the DeCard-Managed model: which endpoint serves each of the four views (card spending, statements, fiat transaction records, transaction ID resolution), and how to query and paginate them. - [Authorization (handled inside DCS, no partner decision required)](https://docs.thedecard.com/en/decard-managed/how-to-use/managing-transactions/authorizing-transactions.md): The how-to page for the authorization stage: how an authorization is completed inside DCS in the DeCard-Managed model, what you have to do, and how to verify it in the sandbox. For the mental model of the transaction flow (authorization then settlement, Outstanding, invariants), see the concept page… - [Settlement (handled inside DCS, plus statement queries)](https://docs.thedecard.com/en/decard-managed/how-to-use/managing-transactions/settlement.md): The how-to reference for the settlement stage: how the five settlement shapes and refunds are handled inside DCS, how to reconcile against the webhook that follows settlement, and how to query statements, line items, asset movements and the posting state of a given ID. For the semantics and mental m… - [3DS Strong Authentication](https://docs.thedecard.com/en/decard-managed/how-to-use/managing-transactions/3ds-forwarding.md): How 3DS strong authentication works in the DeCard-Managed model: DCS closes the loop directly with the card network, 3DS challenges are not forwarded to the partner, and the partner has no 3DS integration work to do. - [QR Pay](https://docs.thedecard.com/en/decard-managed/how-to-use/managing-transactions/qr-pay.md): QR Pay is a spending capability specific to the DeCard-Managed model: the three-step flow of decode, create and confirm, plus the order-list and order-detail queries, with the debit landing on the user's DeCard-Managed account balance. - [User Balance](https://docs.thedecard.com/en/decard-managed/how-to-use/managing-transactions/user-balance.md): The endpoint page for reading one user's per-currency wallet balances (free / freeze / total) in the DeCard-Managed model: how to call GET /user-asset/v1/balance, what the balance model means, and the custody arrangement that makes these balances queryable in the first place. - [Reporting Field Descriptions](https://docs.thedecard.com/en/decard-managed/how-to-use/managing-transactions/reporting-field-descriptions.md): The field dictionary for the Managing Transactions group. This page gathers the meaning, type, enumerated values and unit of every field returned when you query transactions and statements, so it can serve as the reference manual you use when storing data, reconciling, and displaying data to end use… ##### Deposits & Withdrawals - [Crypto Deposits (Deposit Addresses / Chain and Token Matrix)](https://docs.thedecard.com/en/decard-managed/how-to-use/virtual-accounts/crypto-deposit.md): The endpoint reference for on-chain crypto deposits under the DeCard-Managed model: confirm the chain and token (network-coin) → obtain a deposit address (deposit-address) → the user transfers funds and the balance is credited. Covers the chain and token matrix, confirmation counts, and simulated de… - [Crypto Withdrawals](https://docs.thedecard.com/en/decard-managed/how-to-use/virtual-accounts/withdraw-offramp.md): The endpoint reference for on-chain crypto withdrawals under the DeCard-Managed model: confirm the chain, token, and withdrawal switch (network-coin) → submit the on-chain withdrawal (/crypto/v1/withdraw-apply, with SMS verification) → track crediting through the transaction records. Covers SMS veri… - [Travel Rule](https://docs.thedecard.com/en/decard-managed/how-to-use/virtual-accounts/travel-rule.md): The Travel Rule is a compliance gate that stands apart from KYC: a user must upload Travel Rule information before any on-chain deposit address can be issued. This page covers three things: what the Travel Rule is, which capabilities the DeCard-Managed model provides, and one flow diagram. Details s… ##### Sandbox - [Simulating Transactions · Overview](https://docs.thedecard.com/en/decard-managed/how-to-use/simulating-transactions/overview.md): The overview of the sandbox simulation endpoints for the DeCard-Managed model: four simulation/ endpoints (KYC simulation token, deposit simulation, authorization simulation v1 and v2) that together cover the minimal KYC → deposit → authorized spend loop. Sandbox only. #### Integration Resources - [Authentication Guide](https://docs.thedecard.com/en/decard-managed/integration-resources/overview.md): This is the entry point for Integration Resources and the authoritative page on authentication: it covers API Key / Secret Key management and HMAC-SHA256 request signing end to end. Standalone capabilities such as IP whitelisting and the SessionId public key are covered in the sub-pages of this grou… - [IP Whitelisting](https://docs.thedecard.com/en/decard-managed/integration-resources/ip-whitelisting.md): This is the network configuration page of Integration Resources. It picks up the "provide your IP whitelist" step from First Steps and sets out which egress IPs a partner has to register with DCS, what each one is used for, and how sandbox is kept apart from production. Request headers and the signi… - [SessionId Public Key / Encryption](https://docs.thedecard.com/en/decard-managed/integration-resources/sessionid-keys.md): This is the key and encryption summary page of Integration Resources. It builds on the signing scheme in the Authentication Guide and the event signature verification in Webhook + WebSocket Notifications, and states factually which encryption and signing capabilities the DeCard-Managed model actuall… - [H5 KYC / Card Application Guidance Page](https://docs.thedecard.com/en/decard-managed/integration-resources/h5-kyc-guidance.md): DCS delivers a number of end-user interactions (KYC, card details, applying for and activating a physical card, updating a PIN, Travel Rule and more) as hosted H5 pages. This page explains how to issue a guidance link that sends an end user from your app or website on a temporary detour to a DCS-hos… - [Webhook + WebSocket Real-time Notifications](https://docs.thedecard.com/en/decard-managed/integration-resources/webhook-websocket.md): DCS keeps you in sync in real time with key events such as KYC status, asset movements, card transactions and order status, over two complementary channels: Webhook, where DCS pushes to your callback URL, and WebSocket, where you subscribe to a private channel and can replay by version. Both channel… ##### Reference Tables - [Card Application Data Dictionary](https://docs.thedecard.com/en/decard-managed/how-to-use/managing-cards/application-data-dictionary.md): To make the enum fields inside kycInfo on the virtual card application endpoint (POST /card/v1/virtual-card/apply) easier to fill in, this page lists every accepted value and what it means. Always submit the enum code (for example EMPLOYED, UTILITY_BILL), never the display label. For how these field… #### Customer Success - [Pre-Go-Live FAQ](https://docs.thedecard.com/en/decard-managed/customer-success/pre-go-live.md): Whether you are an exchange, a wallet or a platform, only a handful of things need to be in place before you go live: have DCS issue your access credentials and card configuration, agree with DCS on how KYC will be handled, send DCS your callback and whitelist details, and run the full "register → K… - [Post-Go-Live FAQ](https://docs.thedecard.com/en/decard-managed/customer-success/post-go-live.md): This page lists the front-line issues that come up most often once you are live, organized by scenario: cards that will not add to a digital wallet, cards that will not save at a merchant, declined transactions, frozen cards, refunds and reversals that have not landed, disputes and fraud claims, KYC… - [Overview](https://docs.thedecard.com/en/decard-managed/customer-success/faq-overview.md): The entry point for this FAQ section, bringing together the questions that come up most often when integrating and running the DeCard-Managed card issuing service, grouped by identity verification and compliance, physical card shipping, transactions and disputes, and escalation paths. - [Identity verification and compliance](https://docs.thedecard.com/en/decard-managed/customer-success/verification-and-compliance.md): A Q&A round-up of the questions we hear most often about end-customer identity verification (KYC) and compliance: reasons for rejection, KYC stuck in pending, AML hits, acceptable documents, Sumsub token modes, the Travel Rule and more. - [KYC document requirements](https://docs.thedecard.com/en/decard-managed/customer-success/kyc-documents.md): The identity documents (POI) accepted in each country or region, together with the validity and file requirements. - [KYC Rejections and Resubmissions](https://docs.thedecard.com/en/decard-managed/customer-success/kyc-rejections.md): When a KYC application does not pass, this page helps you tell two kinds of rejection apart from the API response: a fixable rejection (the problem can be corrected, and the application is re-reviewed once the documents are re-uploaded) and a REFUSE decision (the review has concluded and the applica… - [Sumsub Token Sharing](https://docs.thedecard.com/en/decard-managed/customer-success/kyc-vendor.md): If you already use Sumsub as your compliance vendor, token sharing lets you reuse the verification data you have already collected with DCS, so your users do not have to verify twice. This page covers the two sharing modes (agreed offline, not API fields), the two integration directions for a data p… - [Physical Card Shipping](https://docs.thedecard.com/en/decard-managed/customer-success/physical-card-shipping.md): Explains the shipping status state machine for physical cards, the shipping information query endpoint, and the real-time WebSocket push; it also marks the boundaries of the shipping capability in the DeCard-Managed model. - [Transaction Issues and Disputes](https://docs.thedecard.com/en/decard-managed/customer-success/transaction-issues-disputes.md): Explains how to handle a disputed transaction in the DeCard-Managed model: how to tell a refund or reversal (credited automatically by the system) apart from a dispute or chargeback (handled through the operations channel), how to contain losses from unauthorized use by freezing the card, and how di… - [Escalations and Support Paths](https://docs.thedecard.com/en/decard-managed/customer-success/escalations-and-support-paths.md): Explains when and how to escalate an issue to DCS: the escalation channel and the reference fields to include, the categories of scenarios worth reporting, emergency response to unauthorized use, how disputes are handled, and a self-service troubleshooting index. ## Partner-Managed ### Guides #### Getting Started - [Overview](https://docs.thedecard.com/en/partner-managed/getting-started/overview.md): An overview of the DCS card issuing platform and the Partner-Managed model. This is the entry point for the whole integration guide. - [First Steps](https://docs.thedecard.com/en/partner-managed/getting-started/first-steps.md): The second page of Getting Started, following Overview and leading into Quickstart. - [Quickstart](https://docs.thedecard.com/en/partner-managed/getting-started/quickstart.md): The third page of Getting Started. It walks you through issuing your first virtual card in the sandbox using the step-by-step path we recommend: create the customer, apply for a KYC ticket, then apply for the virtual card. #### Basic Concepts - [Authorization Forwarding Model](https://docs.thedecard.com/en/partner-managed/basic-concepts/auth-forwarding-model.md): The core idea behind Partner-Managed: the partner owns the spending limits, and the partner makes a real-time decision on every authorization. - [Fund Model: User Wallets vs the Enterprise Security Deposit](https://docs.thedecard.com/en/partner-managed/basic-concepts/fund-model.md): The funding mental model behind Partner-Managed mode: the two-leg liability (an authorization hold followed by a settlement debit) and the payout rhythm (DCS pays the card network on T+1, you replenish the security deposit on T+X). - [Transaction lifecycle](https://docs.thedecard.com/en/partner-managed/basic-concepts/transaction-lifecycle.md): The end-to-end path of money on a card, from the authorization hold to the settlement debit. This is the foundation on which you build your own reconciliation and limit logic. - [Compliance and the KYC flow](https://docs.thedecard.com/en/partner-managed/basic-concepts/compliance-kyc-flow.md): The material the KYC flow needs, the markets cards can be issued in and the per-region document requirements; statuses and error codes are covered in the related guides. #### How to Use ##### Users - [Create a user](https://docs.thedecard.com/en/partner-managed/how-to-use/users/create-customer.md): How-to task page: how a partner creates a user (customer), the first business action after integration. It sets out what DCS and the partner each do, then gives the minimum request/response and the next step. - [Query a user](https://docs.thedecard.com/en/partner-managed/how-to-use/users/query-customer.md): How-to task page: query a user's latest status by user ID (or by the idempotency key you used when creating them). Organized as task steps plus a minimum request/response and who does what, with the field table and the common response envelope filled in from the source, and a next-step call to actio… - [Send an OTP](https://docs.thedecard.com/en/partner-managed/how-to-use/users/send-otp.md): How-to task page: how a partner calls POST /open-api/customer/v1/send-otp to deliver an OTP it generated itself to a user over the DCS SMS or email channel. ##### KYC - [Apply for KYC](https://docs.thedecard.com/en/partner-managed/how-to-use/kyc/apply-kyc.md): Submit a user's KYC information to DCS in a single API call and receive a kycTicketId, the ticket you will quote when issuing the card; it accepts a Sumsub Share Token or direct document upload. - [Query a user's KYC information](https://docs.thedecard.com/en/partner-managed/how-to-use/kyc/kyc-info.md): How-to task page: query the KYC summary per user (GET /open-api/kyc/v1/detail). Focuses on how it differs from querying a KYC ticket (both are called "querying KYC" and are easily confused), and routes kycRenewalRequired=true to the renewal page. - [Query KYC](https://docs.thedecard.com/en/partner-managed/how-to-use/kyc/query-kyc.md): How-to task page: use the KYC ticket ID (or the idempotency key you supplied when applying) to retrieve the latest status and outcome of a KYC verification. Organized as task steps plus a minimal request/response and a who-does-what note; the status machine table and the rejection reasons follow the… - [Updating KYC information](https://docs.thedecard.com/en/partner-managed/how-to-use/kyc/kyc-renewal.md): How-to task page: guide the user through re-verification after documents / KYC data expire (kycApplyMode=H5-RENEWAL / guide page type=8). Entry point is kycRenewalRequired=true; organized as a two-step flow, including the retry loop after a rejection and when the restriction is lifted. - [KYC information migration](https://docs.thedecard.com/en/partner-managed/how-to-use/kyc/kyc-migration.md): How-to task page: let a user who already completed KYC under the DeCard-Managed model reuse that data when applying for a card under Partner-Managed (kycApplyMode=H5-MIGRATION / guide page type=9). Organized as a two-step flow with request fields and a minimal request; the three ticket statuses and… - [H5 KYC guidance page](https://docs.thedecard.com/en/partner-managed/how-to-use/kyc/h5-kyc-guidance.md): Whether you want to hand the whole KYC experience over to us or simply want no documents and no face data anywhere near your own backend, the H5 KYC guidance page is the answer: send the user to a DCS-hosted H5 page where they select their nationality, upload their document, complete the face scan a… ##### Cards - [Card issuing flow](https://docs.thedecard.com/en/partner-managed/how-to-use/cards/card-issuing.md): The end-to-end integration path for issuing a card to your customers: create the customer record, submit a KYC ticket, await KYC approval, then apply for a virtual card. Each stage below sets out what you call, what DCS handles, and the status transitions to expect. - [Card profile (profileId)](https://docs.thedecard.com/en/partner-managed/how-to-use/cards/card-profiles.md): How profileId and cardProfileId are used, and how they are assigned offline. - [Card management (freeze / unfreeze / replacement / PIN)](https://docs.thedecard.com/en/partner-managed/how-to-use/cards/card-management.md): Clears up the ambiguity of freeze and unfreeze sharing one endpoint by spelling out the boolean switch. - [Virtual card](https://docs.thedecard.com/en/partner-managed/how-to-use/cards/virtual-card.md): Redundant screenshots removed - [Physical card](https://docs.thedecard.com/en/partner-managed/how-to-use/cards/physical-card.md): Redundant screenshots removed. - [Velocity limit query](https://docs.thedecard.com/en/partner-managed/how-to-use/cards/velocity-limits.md): Explains how velocity limits work (transaction type × time period × amount or count cap), how to query them, and what each response field means. - [Retrieving secure card details](https://docs.thedecard.com/en/partner-managed/how-to-use/cards/secure-card.md): The two paths: PCI and SecureToken - [Push Provisioning / Digital Wallets](https://docs.thedecard.com/en/partner-managed/how-to-use/cards/push-provisioning.md): How to let cardholders add a DCS-issued card to Apple Wallet or Google Wallet with a single tap inside your app. - [Card application error codes](https://docs.thedecard.com/en/partner-managed/how-to-use/cards/card-order-codes.md): The card application error codes from the original data dictionary, broken out into the card domain. ##### Transactions - [Authorization (forwarded decision)](https://docs.thedecard.com/en/partner-managed/how-to-use/transactions/authorization.md): Where the direction / authType and related enumerations live. - [Authorization and settlement: every scenario](https://docs.thedecard.com/en/partner-managed/how-to-use/transactions/auth-and-settlement.md): Mapped to the nine Auth scenarios. - [Transaction records](https://docs.thedecard.com/en/partner-managed/how-to-use/transactions/transaction.md): Where multiClearInd and the related enumerations live. - [Capture scenarios: partial, excess and multiple](https://docs.thedecard.com/en/partner-managed/how-to-use/transactions/capture-scenarios.md): Mapped to multi / partial / over-capture. - [3DS forwarding](https://docs.thedecard.com/en/partner-managed/how-to-use/transactions/3ds.md): Adds the sequence diagrams and the webhook fields. ##### Disputes - [Dispute Handling](https://docs.thedecard.com/en/partner-managed/how-to-use/disputes.md): The paths available today, and the information they require, when a cardholder disputes a settled transaction (goods not received, wrong amount, fraudulent use). ##### Webhooks - [Webhook configuration](https://docs.thedecard.com/en/partner-managed/how-to-use/webhooks/configuration.md): Fills in self-service configuration and HMAC signature verification. ##### Reports - [Reconciliation overview](https://docs.thedecard.com/en/partner-managed/how-to-use/reports/overview.md): Presigned URL, valid for 120 seconds - [Authorization report](https://docs.thedecard.com/en/partner-managed/how-to-use/reports/authorization-report.md): Covers the daily authorization report file itself: where it sits in the funds lifecycle, the authType / transactionType / approveFlag enumerations, how to download it, the >-delimited field layout, and how to read a sample line. For the shared mechanism used to retrieve any report, see Reconciliatio… - [Transaction report](https://docs.thedecard.com/en/partner-managed/how-to-use/reports/transaction-report.md): Covers the transaction report file itself: how it is generated, how to download it, the >-delimited field layout, and how to read a sample line. The concept of transaction flow and where it sits in the funds lifecycle is covered in Transaction flow and is not repeated here. ##### Sandbox - [Sandbox and testing overview](https://docs.thedecard.com/en/partner-managed/how-to-use/sandbox/overview.md): An overview of the sandbox: which simulation capabilities the backend supports, the sandbox and production base URLs, what you need in place before you simulate, and a minimal request and response for the fund-auth simulation endpoint. For scenario-by-scenario cases, see Simulating transactions. - [Simulating transactions: authorization, clearing, refunds, partial, multi-part, 3DS](https://docs.thedecard.com/en/partner-managed/how-to-use/sandbox/simulating-transactions.md): Walks through the fund-auth simulation endpoint scenario by scenario: authentication and request headers, request and response fields, which scenarios each of the three authorization directions (EXPEND / REFUND / REVERSAL) can drive, a recommended regression order, and the scenarios that have no ded… #### Integration Resources - [Authentication Guide](https://docs.thedecard.com/en/partner-managed/integration-resources/authentication.md): Everything in one place: apiKey/secret/signing (P0 revision) + secure retrieval of production credentials + RSA key generation + the three IP whitelists ##### Reference Tables - [KYC application parameter dictionary](https://docs.thedecard.com/en/partner-managed/how-to-use/kyc/kyc-application-fields.md): The complete dictionary of enumerated values accepted by the KYC application endpoint, so that you can fill each field in by code. - [KYC reject codes](https://docs.thedecard.com/en/partner-managed/how-to-use/kyc/kyc-reject-codes.md): The KYC error codes from the original data dictionary, broken out into the KYC domain; 60+ reject codes grouped into buckets, plus actionable columns. - [Authorization declines and error codes](https://docs.thedecard.com/en/partner-managed/how-to-use/transactions/decline-codes.md): Decline reasons; where the general and authorization error codes live. - [Events and data structures](https://docs.thedecard.com/en/partner-managed/how-to-use/webhooks/events-and-schema.md): Event list, the common envelope, the data structure of each event, and the key points on idempotency and decryption. For configuration and signature verification, see Webhook configuration. - [Report field reference](https://docs.thedecard.com/en/partner-managed/how-to-use/reports/field-dictionary.md): This page collects the field-by-field meaning of both daily settlement files (the authorization report and the transaction report) in one place, as the reference you load your reconciliation against. For how to retrieve the reports, see Reconciliation overview; for how each file is generated and wha… #### Customer Success - [Pre-Go-Live FAQ](https://docs.thedecard.com/en/partner-managed/customer-success/pre-go-live.md): Answers the questions we are asked most often before go-live on the Partner-Managed model: how the launch track is divided between the two sides, the DCS configuration items (apiKey/secretKey/webhookUrl/authUrl/externalPublicKey), the three IP allowlists, RSA public key generation, how to integrate… - [Post-Go-Live FAQ](https://docs.thedecard.com/en/partner-managed/customer-success/post-go-live.md): Lists the most common front-line issues you will meet in day-to-day operations after go-live, organized by scenario (digital wallet provisioning failures, card-on-file failures, declines, frozen or blocked cards, refunds that have not arrived, disputes and fraud, KYC stuck in review, changing a ship… - [Escalation and Support Path](https://docs.thedecard.com/en/partner-managed/customer-success/support-escalation.md): A single page on the operational escalation path: when to escalate, who to escalate to (your DCS Customer Success contact channel), what reference details to bring with you (transactionId/authId/outsId/panLast4/cardId/customerId/kycTicketId and so on), how disputes and fraud are handled today, and w… - [KYC document requirements](https://docs.thedecard.com/en/partner-managed/customer-success/faq-kyc-documents.md): The identity documents (POI) accepted in each country or region, together with the validity and file requirements. - [About the KYC Vendor](https://docs.thedecard.com/en/partner-managed/customer-success/faq-kyc-vendor.md): Explains which KYC vendor DCS uses, how you establish the sharing relationship with DCS in the Sumsub console, and the token requirements for the UAT and production environments. ## Corporate Cards ### Guide #### Getting Started - [Overview](https://docs.thedecard.com/en/corporate-card/getting-started/overview.md): What the Corporate Card Open Platform is: embed card issuing into your product and issue globally accepted corporate cards to your business customers — the three-tier identity model, two funding modes, four card types and the security and compliance boundary. - [First steps](https://docs.thedecard.com/en/corporate-card/getting-started/first-steps.md): What to prepare before integrating: the six stages from contract to launch, environment isolation and credential handling, three ground rules that run through everything, and the conventions shared by every endpoint. - [Quickstart](https://docs.thedecard.com/en/corporate-card/getting-started/quickstart.md): Run the onboarding → funding → issuing → spending loop in nine steps along the shortest issuing path: implement request signing, make the calls and receive the webhooks. #### Basic Concepts - [Overview](https://docs.thedecard.com/en/corporate-card/basic-concepts/overview.md): The corporate-card object model at a glance: the partner → company → employee structure, the core objects and ID conventions that run through every endpoint, and the reading path across the concept pages. - [Holders and the funding model](https://docs.thedecard.com/en/corporate-card/basic-concepts/identity-and-funding.md): "Who holds the card" and "which account pays" are two independent axes: the holder-to-owner mapping is decided by the balance mode; both funding modes are fund-first, spend-second. - [State machines and freezing](https://docs.thedecard.com/en/corporate-card/basic-concepts/states-and-freezing.md): The four state sets in one place: the application state machine shared by companies, employees and cards; the merged company/employee status view; the 7-state card machine; and the set semantics of the 5 freeze capability domains. - [The transaction life cycle](https://docs.thedecard.com/en/corporate-card/basic-concepts/transaction-lifecycle.md): A transaction's full journey from authorization hold (UNPOSTED) to settlement posting (POSTED), plus the fund semantics of reversals, refunds and chargebacks, and debt. - [Compliance and KYC](https://docs.thedecard.com/en/corporate-card/basic-concepts/compliance-kyb-kyc.md): KYB for companies, KYC for employees: review flows and the shared application state machine, resubmission under the same application ID, global uniqueness and sanctions screening, custodians, freeze sources and card data protection. - [Limits and statements](https://docs.thedecard.com/en/corporate-card/basic-concepts/limits-and-billing.md): Velocity rules: many-to-many binding with the strictest value winning per dimension; statements issued automatically per calendar month, with the settled statement as the final word. #### How to Use ##### Companies - [Companies · Overview](https://docs.thedecard.com/en/corporate-card/how-to-use/managing-companies.md): Onboard and maintain your business customers: KYB application, querying and resubmission, freeze/unfreeze, low-balance alerts — with the key parameters and the idempotency and dedup rules. - [Company onboarding and review](https://docs.thedecard.com/en/corporate-card/how-to-use/company-onboarding.md): Submit a company onboarding application for asynchronous KYB review, query the progress and outcome, and resubmit a rejected application under the same organizationApplyId — with full field tables, request/response examples and error codes. - [Company status and alerts](https://docs.thedecard.com/en/corporate-card/how-to-use/company-maintenance.md): Query an onboarded company's details, freeze and unfreeze it by capability domain (idempotent set semantics), and set per-currency low-balance alerts on its funding pools (full-replacement semantics) — with field tables, examples and error codes. ##### Employees - [Employees · Overview](https://docs.thedecard.com/en/corporate-card/how-to-use/managing-employees.md): Create and maintain employees under an ACTIVE organization: KYC submission, querying and resubmission, one update endpoint per category, freeze/unfreeze — with the uniqueness and re-review rules. - [Creating an employee](https://docs.thedecard.com/en/corporate-card/how-to-use/employee-onboarding.md): The full call-level detail of the employee application: every apply field with the shipping-address structure, the email/phone uniqueness rules, tracking progress with query-apply, and resubmitting after a rejection. - [Employee information and status](https://docs.thedecard.com/en/corporate-card/how-to-use/employee-maintenance.md): The full call detail for maintaining existing employees: query for details (including the address array), one endpoint each for name / phone / email / address, and update-restrictions to freeze and unfreeze by capability code. ##### Cards - [Cards · Overview](https://docs.thedecard.com/en/corporate-card/how-to-use/managing-cards.md): Issue virtual cards to companies or employees, query cards, open receiving accounts for dedicated-balance cards, retrieve secure card details, and run the full virtual-to-physical chain (production → shipping → activation → PIN). - [Applying for a virtual card](https://docs.thedecard.com/en/corporate-card/how-to-use/applying-virtual-cards.md): Issue a virtual card to a company or employee with apply: the full field reference (subjectType/cardProfileId matching, company-card custodian, ruleIds binding), the complete error codes, and querying progress, single cards and card lists with query-apply / query / list. - [Retrieving secure card details](https://docs.thedecard.com/en/corporate-card/how-to-use/secure-card-details.md): PCI DSS-allowlisted partners call retrieve-secure-card for ciphertext-level PAN / CVV2 / expiry and decrypt them in their own frontend under the AES-GCM contract; plus the cardholder data protection requirements and opening receiving accounts for dedicated-balance cards (open-va). - [Physical cards](https://docs.thedecard.com/en/corporate-card/how-to-use/physical-cards.md): The four-step chain that upgrades an ACTIVE virtual card to a physical card under the same number: the virtual-to-physical application (cardLayoutCode, embossing names, address snapshot) → shipping-info tracking → activate (idempotent) → set-pin (AES-GCM encrypted upload). ##### Limits - [Limits · Overview](https://docs.thedecard.com/en/corporate-card/how-to-use/spend-limits.md): Control spending and withdrawals with velocity rules: rule creation (five control groups), full-replacement updates with optimistic locking, batch bind/unbind with partial-success semantics, and querying merged effective quotas. - [Creating velocity rules](https://docs.thedecard.com/en/corporate-card/how-to-use/creating-rules.md): Full field reference for creating a velocity rule: purchase and withdrawal amount/count limits, currency, MCC and region lists, ruleRef idempotency, and every error code. - [Binding and unbinding](https://docs.thedecard.com/en/corporate-card/how-to-use/binding-and-unbinding.md): Bind velocity rules to cards or employees: batch bind/unbind with partial-success semantics, batch-level and per-item errors, and binding queries in both directions. - [Quota query and adjustment](https://docs.thedecard.com/en/corporate-card/how-to-use/quota-and-adjustment.md): Query a card's or employee's merged effective limits and current usage (query-quota quota objects explained), plus rule update, enable/disable, detail and list queries. ##### Funding - [Funding · Overview](https://docs.thedecard.com/en/corporate-card/how-to-use/funding-and-reconciliation.md): Fund the company pool and dedicated-balance cards, transfer between pool and cards, query balances, and reconcile on three levels: deposit records, transaction records and statements. - [Deposits](https://docs.thedecard.com/en/corporate-card/how-to-use/deposits.md): The full deposit chain: fetch the receiving virtual account, have the customer wire the funds, get notified on arrival and reconcile the deposit records — deposit-info, the BANK_TRANSFER_INFO webhook and deposit-records. - [Balances and Transfers](https://docs.thedecard.com/en/corporate-card/how-to-use/balances-and-transfers.md): Query a funding owner's per-currency balances (availableAmount and the authorization gate), and move funds between the company pool and dedicated-balance cards in a same-currency closed loop: submitting with transfer and polling the result with transfer-query. - [Statements and Transactions](https://docs.thedecard.com/en/corporate-card/how-to-use/statements-and-transactions.md): Pull monthly statements by company or by card (statements / statement-detail) and transaction records unbounded by billing cycles (transactions): the statement header, per-currency summary and transaction-line fields, plus how amount due and overpaymentAmount are computed. ##### Transactions - [Transactions · Overview](https://docs.thedecard.com/en/corporate-card/how-to-use/authorization-and-3ds.md): Real-time authorization completes on the DCS side with results pushed as CARD_TRANSACTION; 3DS challenges follow one of three modes, with the authenticate endpoint returning OOB results; settlement and debt arrive as events. - [Real-Time Authorization and Settlement](https://docs.thedecard.com/en/corporate-card/how-to-use/realtime-authorization.md): Authorization runs a real-time check chain on the DCS side — entity status, limits, balance — and places a hold (UNPOSTED); results arrive as CARD_TRANSACTION, settlement posts via CARD_TRANSACTION_SETTLEMENT, and debt is flagged by CARD_TRANSACTION_DEBT. - [Handling 3DS Challenges](https://docs.thedecard.com/en/corporate-card/how-to-use/3ds-challenges.md): All fields of the AUTHORISATION_3DS_CHALLENGE event with OOB and OTP_DELEGATE payload examples; the division of work across the three authentication modes; OOB results return via the authenticate endpoint, idempotent on repeat. ##### Webhooks - [Webhook configuration](https://docs.thedecard.com/en/corporate-card/how-to-use/webhooks/configuration.md): How to register the callback URL, recompute and verify X-Signature with sortedCompactJson, deduplicate by webhookId, and what the delivery and retry windows are. - [Events and data structures](https://docs.thedecard.com/en/corporate-card/how-to-use/webhooks/events-and-schema.md): The envelope fields, businessId mapping and per-event data structures for all 18 corporate card outbound webhook events; configuration and signature verification are covered in Webhook configuration. #### Customer Success - [FAQ](https://docs.thedecard.com/en/corporate-card/customer-success/faq.md): The questions that come up most before and after launch: onboarding turnaround, resubmission after KYB/KYC rejection, uniqueness rules, card count caps, obtaining PANs, custodians, physical upgrades, choosing a funding mode and webhook fallbacks. - [Error code dictionary](https://docs.thedecard.com/en/corporate-card/customer-success/error-codes.md): The complete set of error codes for the Corporate Card open API: 11 general codes, 52 business codes, and the rules for branching on them. > The links below point to documentation indexes. Follow each `/_llms/` index recursively until you reach documentation pages. ## Indexes - [Chinese (123 pages)](https://docs.thedecard.com/_llms/zh.md): Documentation for Chinese.