PaymentEncryptionKeyEntry
A model the API reference uses in a request or a response. The operation pages link every field typed as this model here.
One key serial identifier entry on a `MerchantPaymentEncryptionBinding`: the map from a terminal's key serial number to the HSM key that decrypts what the terminal sent.
Values
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Fields
| Field | Type | Description | ||||
|---|---|---|---|---|---|---|
ksi
required |
string | The key serial identifier: six to ten significant hex characters, stored upper-case with leading
`F` padding stripped. Unique within a binding.
Conditional: When Ksi is not empty.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
| ||||
label
required |
string | An operator-facing label for this key, such as the device family it was injected into. Shown
wherever the key reference itself must not be.
nullablemax length 100
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
| ||||
scheme
required |
PaymentEncryptionScheme PaymentEncryptionScheme | Which encryption scheme the terminals under this key produce.
Required: When Status != Deactivated.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
| ||||
dukptMode
required |
PaymentEncryptionDukptMode PaymentEncryptionDukptMode | The DUKPT key derivation algorithm this key uses.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
| ||||
aesWorkingKeyType
required |
string | The AES working-key type, required when `dukptMode` is
`Aes` and meaningless otherwise. A provider token value
rather than an enum, because the vocabulary belongs to the vendor's command set.
Required: When DukptMode == Aes.
Conditional: When DukptMode is not null and DukptMode != Aes.
nullablemax length 16
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
| ||||
keyReference
required |
string | The HSM key reference: a storage-table slot or a wrapped key block. <b>Always stored encrypted,
and never returned on a read that leaves the server.</b>
nullablemax length 1024
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
| ||||
isKeyReferenceConfigured
required |
boolean | Whether a key reference is stored, set on reads so an operator can tell a configured key from an
empty one without the reference ever being sent. Server-owned: the save paths ignore whatever
arrives here.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
| ||||
majorKey
required |
string | The major key the reference is stored under, in the provider's own token vocabulary. Null leaves
the provider's default in force.
nullablemax length 16
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
| ||||
onGuardExtendedEncryption
required |
boolean | On-Guard extended encryption, when the device family uses it. Meaningful only when
`scheme` is `OnGuard`.
Conditional: When Scheme is not null and Scheme != OnGuard.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
| ||||
onGuardEndingPanDigitsEncrypted
required |
boolean | Whether the device family encrypts the ending PAN digits. Meaningful only for
`OnGuard`.
Conditional: When Scheme is not null and Scheme != OnGuard.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
| ||||
onGuardClearPanDigits
required |
integer (int32) | How many leading PAN digits the device family leaves in the clear. Meaningful only for
`OnGuard`.
Conditional: When Scheme is not null and Scheme != OnGuard.
Conditional: When OnGuardClearPanDigits is not null. Range: 0 to 6.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
| ||||
status
required |
PaymentEncryptionKeyEntryStatus PaymentEncryptionKeyEntryStatus | Whether the entry may be matched. Null reads as
`Deactivated`: an entry whose status nobody set has
not been through the boarding step that activates it, and matching it would use a key the
platform cannot confirm is live.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
| ||||
requireMac
required |
boolean | Reserved: whether the device family attaches a MAC that should be verified during decryption.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
| ||||
createdAtUtc
required |
string (date-time) | When the entry was created, in UTC.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
| ||||
statusChangedAtUtc
required |
string (date-time) | When `status` last changed, in UTC. Separate from the audit log because it is shown
on the key table itself, where an operator decides whether a key is still in rotation.
nullable
Values:
Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
|
This model has no documented fields.