Skorcard, as a co-brand partner of the bank, allows users to digitally apply for a credit card. Once approved by the bank, users receive a virtual card in the Skorcard app, while a physical card is mailed to their registered address.
\nThe Skorcard app enables users to track all credit card transactions, including online, offline, and ATM activities. Additionally, it maintains a ledger of Skorpoints, awarded for every successful transaction and for completing specific promos or missions. Users can redeem Skorpoints to pay bills or for various rewards, such as miles and special offers.
\nThe credit card is branded as the “Bank Skorcard”—in this case, the “MNC Skorcard.”
\nThe following are the modules involved in an end to end scenario
\nMobile App - Facilitates user onboarding, card viewing, transactions, and rewards management.
\nSkorcard LOS - The orchestration engine connecting the mobile app with various external systems, including KYC providers, banks, fraud detection systems, SMS/WhatsApp gateways, email services, video calling systems, and more.
\nSkorcard Underwriting System - A flexible, plug-and-play underwriting module developed in collaboration with the bank to assess customer profiles and assign credit limits.
\nBanks LMS - The bank’s credit card management system that integrates with Skorcard LOS for:
\nCard creation
\nAML (Anti-Money Laundering) checks
\nCredit bureau checks
\nCard account management
\nRewards points payments
\nCard detail retrieval
\nAnd more.
\nIn addition, the LMS oversees core credit card functions such as statement generation, billing, and apportionment.
\nSkorcard Reward System - A custom-built system handling the accrual (earn) and redemption (burn) of reward points.
\nThe APIs described in this document serve two main purposes:
\nAPIs Exposed by Bank’s LMS: These are consumed by the Skorcard LOS system (located in the folder “MNC LMS API”).
\nAPIs Exposed by Skorcard LOS: These are consumed by the Bank’s LMS system (located in the folder “Skorcard LOS API”).
\nThe document provides detailed explanations of all involved APIs.
\nThe APIs are accessible only via an IPSec VPN, ensuring they are available on a private DNS/IP with no public access (from either MNC or Skorcard).
\nAuthorization mechanisms must be in place for all APIs, with credentials updated regularly (at least once per quarter) and immediately in case of a breach. If a breach occurs, the APIs must stop responding and return a 403 HTTP error code.
\nThe APIs follow a RESTful architecture, using HTTP methods (POST, PUT, GET) to manipulate objects. For example, the MNC LMS API exposes a POST request to the /card endpoint for creating new card objects.
\nAll APIs must use HTTPS with a minimum of TLS 1.2, though TLS 1.3 is preferred for enhanced security.
\nThe end point creates a JWT Token and returns that back.
\nTo accurately identify a client or partner and generate the token, MNC Bank provides the following details:
\nUnique Client Key: This key is unique to each partner. In the MNC system, a partner is identified by an ID (e.g., 78787887), and a unique client key is created specifically for that partner.
\nUnique Signature Value: This is another unique field provided to the client at regular intervals (e.g., every 3 or 6 months) to establish an authentication mechanism for the client.
\nThese details are essential for secure communication and authorization between MNC Bank and its partners.
\n","_postman_id":"1c6f1c39-b6c7-41c5-878d-bb95dd459920"},{"name":"Core Objects API","item":[{"name":"dedup-check","id":"7dd4c8ab-f6b4-4335-8bf3-8b9635c905c3","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"method":"POST","header":[{"key":"Authorization","value":"Bearer eyJraWQiOiJzc29zIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiI0YmQxNzIyYi1lNDk1LTQ1MDEtOGE3ZC1mMTc5MGY0ODE2Y2YiLCJhdWQiOiI0YmQxNzIyYi1lNDk1LTQ1MDEtOGE3ZC1mMTc5MGY0ODE2Y2YiLCJpc3MiOiJtYXlhcGFkYSIsImV4cCI6MTY5NjMwNDY3NCwiYXBwX2lkIjoiNGJkMTcyMmItZTQ5NS00NTAxLThhN2QtZjE3OTBmNDgxNmNmIiwiaWF0IjoxNjk2MzAxMDc0fQ.mhPfDEoqIxocy61ndkbZWKbN0woZo_3R74RqPE8-89eHmiJRwG3xilpFF4T1r6fZZkkTjV7kaCepeN1uItxb0P7TbbnoGE5oyOlaiv13QtNDdeK3BrcdL_TOoNW07WfvQE9jzcubYmzKYeoiKxC_Ki4Y_B937VX94EPkpdutsYmiClA4ryAeVXU732YX63td6DZVxedF8Ksp6ETpyrJ0jcB-elWF4XAw53Zh4q5Tw4-TJ_JYRFSaGtM8vlu3PDTKc5mAbqC-qDga6juI-WLy6zgavdml-SLilGaZgcl97kmdFneBkXdegZfSu_Ex5T3sSoJ2FsJIk7R_0qlwR0JoOQ","type":"text"},{"key":"X-TIMESTAMP","value":"2023-10-03T01:57:08.191Z","type":"text"},{"key":"X-PARTNER-ID","value":"5d3b6b5a-2be0-4ab2-b130-c1ac1717db1c","type":"text"},{"key":"ORIGIN","value":"skorcard.app","type":"text"},{"key":"CHANNEL-ID","value":"99125","type":"text"}],"body":{"mode":"raw","raw":"{\n \"partnerReferenceNo\": \"651480898172\",\n \"transactionDate\": \"20231003024434\",\n \"ktp\": \"3171070808951002\",\n \"email\": \"xyz@skor.app\",\n \"phoneNumber\": \"8108008080\"\n}","options":{"raw":{"language":"json"}}},"url":"https://sandbox.mnc.id/api/v1.0/api/ProfileDedupCheck/v1.0/dedup-check","description":"The Dedup Check API verifies whether the provided NIK exists in the bank and if a credit card has been issued for the customer. There are no additional headers required for this API.
\n*Please note: All these fields are just an indication. MNC has the full flexibility to change/add new fields here
\nBlacklist Check Api accepts a few/all PII data of the customer and try to figure out at MNC side whether there is any data in blacklist or not.
\nThere are no additional header for this api.
\n*Please note: All these fields are just an indication. MNC has the full flexibility to change/add new fields here
\nThis API allows MNC to retrieve a customer’s credit report using search and reference information. No additional headers are required for this API.
\n*Please note: All these fields are just an indication. MNC has the full flexibility to change/add new fields here
\nThis API enables MNC to retrieve a customer’s credit report using search and reference information.
\nNo additional headers are required for this API.
\n*Please note: All these fields are just an indication. MNC has the full flexibility to change/add new fields here
\nThis API allows MNC to issue a credit card.
\nNo additional headers are required for this API.
\nThe Credit Card Activation API allows MNC to activate a new credit card. No additional headers are required for this API.
\n*Please note: All these fields are just an indication. MNC has the full flexibility to change/add new fields here
\nThe Credit Card Inquiry API allows MNC to retrieve real-time details about a credit card. No additional headers are required for this API
\n*Please note: All these fields are just an indication. MNC has the full flexibility to change/add new fields here
\nThe Credit Card CVV Inquiry API allows MNC to fetch a credit card’s CVV. No additional headers are required for this API.
\n*Please note: All these fields are just an indication. MNC has the full flexibility to change/add new fields here
\nCC Unblock Api allows reactive the blocked card
\nThere are no additional header for this api.
\n*Please note: All these fields are just an indication. MNC has the full flexibility to change/add new fields here
\nThe Credit Card Transaction History Inquiry API allows MNC to check the transaction history of a credit card. No additional headers are required for this API.
\n*Please note: All these fields are just an indication. MNC has the full flexibility to change/add new fields here
\nThe Credit Card Statement Inquiry API allows MNC to fetch the credit card statement. No additional headers are required for this API.
\n*Please note: All these fields are just an indication. MNC has the full flexibility to change/add new fields here
\nThis API allows the user to convert reward points into cash credited to their credit account. No additional headers are required for this API.
\n*Please note: All these fields are just an indication. MNC has the full flexibility to change/add new fields here
\nThis API checks whether a transaction is eligible for EMI and returns the applicable scheme. No additional headers are required for this API.
\n*Please note: All these fields are just an indication. MNC has the full flexibility to change/add new fields here
\nThis API enables the conversion of a specific transaction into EMI. No additional headers are required for this API.
\n*Please note: All these fields are just an indication. MNC has the full flexibility to change/add new fields here
\nThe following APIs are essential for various operations related to customer PII data validation and card management:
\nValidate PII data (blacklist checks, deduplication, etc.)
\nCreate a core customer object and associated card in the MNC system
\nManage the card account
\nInquiry on transactions and statements
\nActivate, block, freeze, or unfreeze the card
\nAll APIs in this section require the “Authorization” header with the bearer token from the Create JWT Token API, along with additional headers to identify the client/partner and the request channel. Common header parameters will be specified, with any extras noted in individual APIs.
\n*As mentioned above, any header that is specific to the API shall be mentioned in the API itself
\nThese core object APIs are designed for onboarding, underwriting, card maintenance, account management, and transaction handling. In a typical scenario, the following order should be followed when calling these APIs
\n","_postman_id":"be9d2a55-b510-420b-a651-9765f31de17b"}],"id":"1634c8a9-6120-43f0-8b97-95fb31d9ebee","description":"As mentioned above, these APIs are exposed by MNC Bank and are consumed by the Skorcard LOS orchestration system.
\nMNC Bank should enable both Sandbox and Live system URLs, ensuring that:
\nSandbox environment: Used for development and testing purposes.
\nLive environment: Enabled after successful completion of UAT (User Acceptance Testing).
\nSample base URLs:
\nSandbox URL: https://sandbox-partner-card.mnc.id/api/v1.0/
\nAt any point, both URLs should remain active for their respective purposes.
\nSince the APIs exposed by MNC will ultimately call the core banking APIs of MNC, the security of these APIs is crucial. Several authorization methods could be used, such as:
\nBasic authorization, with regularly changing parameters.
\nJWT (JSON Web Token) based authorization (bearer token).
\nOAuth authorization, among others.
\nIn this document, we have proposed a JWT based authorization where the token is valid for some 30 minutes only. So before calling any API on the MNC LMS System, Skorcard LOS orchestration system will first get the \"access token - JWT\" by calling another api and then call all other APIs using that access token. As 30 minutes lapse or the MNC api's start giving 403 HTTP error code, Skorcard LOS orchestration system has to call the access token api again and get a new access token.
\nDivision of APIs
\nThe MNC APIs are divided into two categories:
\nToken Folder: Contains APIs that create the JWT access token.
\nMain API Folder: Contains the actual APIs that require the token (obtained from the Token API) to interact with MNC systems.
\nThe responses from these APIs follow a standardized format. The general structure of the response body is:
\n\n\n{
\n
\"success\": true,
\"error\":{
\"code\":\"code\",
\"message\":\"message\"
},
\"message\":\"\",
...other parameteres of the josn
}
In case of HTTP errors like 401, 403, or 404, the response structure will look like this:
\n\n\n{
\n
\"success\": false,
\"error\":{
\"code\":\"Forbidden\",
\"message\":\"The data is incorrect\"
}
}
For an HTTP success response (200), the response structure can vary depending on the API, but will follow the general format described below.
\n*MNC Needs to send out the detailed error code list to Skorcard.
\n","_postman_id":"1634c8a9-6120-43f0-8b97-95fb31d9ebee"},{"name":"Skorcard LOS Api","item":[{"name":"authorize_transaction","id":"6b7b6c56-a1de-492c-bc9d-e2df7b7537ad","protocolProfileBehavior":{"disableBodyPruning":true},"request":{"auth":{"type":"basic","basic":{"basicConfig":[{"key":"username","value":"Allows MNC service to determine whether the transaction to be authorise / decline
\n*Please note: All these fields are just an indication. MNC has the full flexibility to change/add new fields here
\nAllows MNC service to push the transaction data as transaction happened
\nThere are no additional header for this api.
\nAllows MNC service to push the transaction data as transaction happened
\nThere are no additional header for this api.
\n*Please note: All these fields are just an indication. MNC has the full flexibility to change/add new fields here
\nAs transactional data (payments made via credit card) is displayed on the Skorcard app, the following APIs facilitate the real-time transfer of this data from the bank system to Skorcard.
\nSkorcard expects the bank to call these APIs immediately after a credit card transaction (offline, online, ATM, or international) or payment, ensuring that data is available on the customer’s app and notifications are sent promptly.
\nAPIs are available in both Sandbox and Live systems, enabling MNC Bank to interact with Skorcard’s API for testing and production purposes. The Sandbox system is designated for User Acceptance Testing (UAT), while the Live system will be activated after UAT completion.
\nBase URL for Sandbox: https://staging.skor.co/api/v1.0/
\nBase URL for Live: https://skor.co/api/v1.0/
\nAPIs exposed to MNC Bank use Basic Authorization for secure access. Authentication tokens are generated based on dynamic parameters that change periodically for enhanced security.
\nAuthorization Type: Basic Authorization
\nAuthentication Process: The client must provide a valid username and password, encrypted in Base64 format, in the HTTP Authorization header.
\nThe system will return appropriate error messages and HTTP response codes for various issues, including:
\n401 Unauthorized: Indicates authorization failure due to expired or incorrect tokens.
\n400 Bad Request: Occurs when required parameters are missing or malformed in the request.
\n500 Internal Server Error: Signifies an issue on Skorcard’s side while processing the request.
\nEnsure that your implementation gracefully handles these errors.
\nThere are two APIs in this segment
\nauthorize_transaction
\nThis API handles remote host authorization.
\nThe bank’s host receives a transaction from VISA/Mastercard
\nPerforms authentication checks (PIN, limits, fraud checks)
\nCalls the Skorcard API for additional authorization.
\nBased on Skorcard’s response, the bank either approves or rejects the transaction and communicates the result to VISA/Mastercard.
\ntransaction_webhook
\n