# Use cases

## Wallet SDK Initiated 

This section describes use cases which are initiated from Wallet SDK.

### Wallet SDK Setup

<span style="color: #171717;">Setup of Wallet SDK (both modules UCP SDK and MDC SDK) is main step which needs to be made at the very beginning. MDC SDK should be always setup at first because it is core module. During setup main configuration should be provided. Moreover there is some configuration which is related with HCE payments: MPA should be registered as default application for payment (Tap &amp; Pay) and also should implement HostApduService to emulate an NFC card inside an Android service component. Application has to consider scenario where is woken up by HostApduService. Please find more details in </span>*Wallet SDK API* document.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
participant "MPA" as mpa  
participant "Wallet SDK" as sdk  
mpa-&gt;sdk: 1. MDC::setup(configuration)  
mpa&lt;--sdk: 2. result  
mpa-&gt;sdk: 3. UCP::setup(configuration)  
mpa&lt;--sdk: 4. result  
@enduml

### Pair Device on Wallet Server

This section describes pairing device process. Device pairing is process which authenticates device in context of given user. During this process device data and keys used in communication are exchanged with Wallet Server. To make possible device pairing, user needs to be already registered on the Wallet Server. Every device is identified by unique identifier. After every pairing device request, Wallet Server gives unique installation identifier. It means that particular installation of the application installed on particular device belongs to given user. Different users can use same device for separate installations. If any active installation on given device already exists during pairing device, Wallet Server will delete and create new installation in context of new user. Only one active installation is possible on particular device. Registration and device pairing is done by SDK during IBAN digitization process.

#### Pair Device By Trusted Identity

Pairing is done automatically during IBAN digitization process and Trusted Identity is part of data passed to digitization. Pairing is described separately to show how User authentication mechanism works. Only User who is authenticated on Wallet Server may access to its own data. During pairing device process Wallet Server check whether previously on given device was installation which had device Payment Tokens, during pairing these device Payment Tokens are deleted asynchronously.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
participant "User" as user  
participant "MPA" as mpa  
participant "Wallet SDK" as sdk  
participant "Wallet Server" as ws  
participant "MDES" as mdes  
participant "AHI" as ahi  
sdk-&gt;ws: 1. pairDeviceByTrustedIdentity\\r(trustedIdentity, fcmRegistrationToken, deviceInfo)  
activate sdk  
activate ws  
ws-&gt;ws: 2. verify trusted identity  
alt isActiveInstallationOnGivenDevice  
ws-&gt;ws: 3. deleteActiveInstallation  
ws-&gt;mdes: 4. deleteDeviceTokens  
activate mdes  
deactivate mdes  
note left: asynchronous  
end  
ws-&gt;ws: 5. createNewDeviceInstallationRecordForUser  
ws--&gt;sdk: 6. response\\r (userSessionToken, installationId)  
deactivate ws  
sdk-&gt;sdk: 7. store userSessionToken  
sdk--&gt;mpa: 8. result  
deactivate mpa  
deactivate sdk  
@enduml

### IBAN Digitization

IBAN can be digitized for two different goals:

<div class="wiki-content" id="bkmrk-for-contactless-paym"><div class="wiki-content">1. For contactless payments, in this scenario device Payment Token is created.
2. For e-commerce payments, in this scenario static Payment Token is created.

</div></div>This section describes process related to IBAN digitization.

#### Device Token Digitization

IBAN digitization via Wallet SDK is process which performs digitization of given IBAN which is assigned to given user for contactless payments. Device token is created in INACTIVE state just after digitization. <span class="inline-comment-marker" data-ref="88cc7731-d4ac-41ac-9fc8-3eebfafc87f9">After profile provisioning device Payment Token status is changed to ACTIVE</span>.

Whole process of IBAN Digitization via Wallet SDK consists of some subprocesses, however whole complexity is behind the scene and MPA needs to call only one method to perform all needed steps. If any of the steps will fail, MPA will be notified and whole process can be retried. Since the mobile environment is not secure, Wallet Server expects signed data as JWT which should be passed via Wallet SDK.

It is possible to digitize many IBANs. For each IBAN, SDK digitization method should be called separately. One User (identified by user id) can have many IBANs and one IBAN can belong to many different Users.

In case when user (identified by user id) changes his device, whole process looks the same from MPA perspective.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant "MPA" as MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES as MDES  
participant "AHI" as AHIS  
User -&gt; MPA: 1. enableNFCForIBAN  
activate MPA  
MPA -&gt; AHIS: 2. createSignedAccountInfo  
activate AHIS  
AHIS -&gt; AHIS: 3. signDataAsJwt \\r (userId, iban(bank account number),\\r countryCode\\rphone/email)  
AHIS --&gt; MPA: 4. response (signedAccountInfo)  
deactivate AHIS  
MPA -&gt; MPA: 5. getFcmToken(walletFirebase)  
MPA -&gt; SDK: 6. UCP::digitizeIbanForDevice\\r(signedAccountInfo, fcmToken, userLanguageCode)  
activate SDK  
SDK -&gt; WS: 7. addUserWithIban\\r (signedAccountInfo)  
activate WS  
WS -&gt; WS: 8. createUserRecordAndIban  
WS --&gt; SDK: 9. response(userId, ibanId\\r (sha256(iban(bank account number)))  
SDK -&gt; SDK: 10. isDevicePaired  
alt isDevicePaired=false  
SDK-&gt; WS: 11. pairDeviceByTrustedIdentity\\r(signedAccountInfo, fcmRegistrationToken, deviceInfo)  
note over SDK, WS #1C1E3F: See Pair Device process for more details  
else isDevicePaired=true  
SDK -&gt; WS: 12. loginByTrustedIdenitity  
note over SDK, WS #1C1E3F: See Login process for more details  
end  
SDK -&gt; SDK: 13. isDeviceRegisteredForPayment  
alt isDeviceRegisteredForPayment=false  
SDK -&gt; WS: 14. getPkCertificate  
WS -&gt; MDES: 15. getPkCertificate  
activate MDES  
MDES --&gt; WS: 16. response(pkCertificate)  
WS --&gt; SDK: 17. response(pkCertificate)  
SDK -&gt; SDK: 18. prepareDataForRegistration(pkCertificate)  
SDK -&gt; WS: 19. registerDeviceForPayment\\r (paymentDeviceInfo, userSessionToken)  
WS -&gt; MDES: 20. registerMobilePaymentApplication\\r (paymentDeviceInfo)  
MDES --&gt; WS: 21. response(mobileKeys,\\r remoteManagementUrl)  
WS --&gt; SDK: 22. response(mobileKeys,\\r remoteManagementUrl)  
end  
SDK -&gt; WS: 23. digitizeIbanForDevice\\r (ibanId, userSessionToken, userLanguageCode)  
WS -&gt; MDES: 24. checkEligibility(iban(bank account number)\\r countryCode, ahiId, paymentAppIdForDevice,\\r paymentAppInstanceId)  
MDES --&gt; WS: 25. response (eligibilityReceipt)  
WS -&gt; MDES: 26. digitize(eligibilityReceipt)  
MDES --&gt; WS: 27. response  
deactivate MDES  
WS --&gt; SDK: 28. response\\r (devicePaymentTokenInfo)  
note over SDK, WS #1C1E3F: See Approved diagrams  
deactivate WS  
SDK --&gt; MPA: 29. result  
deactivate SDK  
MPA --&gt; User: 30. IBAN digitized, please wait for activation  
deactivate MPA  
@enduml

When digitization for DEVICE token is succeed, then profile provisioning takes place (See [Profile Provisioning](https://wiki.verestro.com/display/VPOP/Profile+Provisioning)).

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES as MDES  
group DEVICE digitization Approved  
MDES --&gt; WS : 1. responseFromDigitization(tokenInfo)  
activate MDES  
activate WS  
WS --&gt; SDK : 2. response  
activate SDK  
SDK --&gt; MPA : 3. result  
activate MPA  
MPA --&gt; User : 4. result  
MDES -&gt; SDK : 5. provision  
deactivate SDK  
deactivate MPA  
deactivate WS  
deactivate MDES  
... Profile Provisioning ...  
note over MPA, MDES #1C1E3F: See Profile Provisioning diagram  
end  
@enduml

#### Static Token Digitization  


IBAN digitization for a static token is a process where static Payment Token is created and can be used for e-commerce payments. Static Payment Token is created on MDES side where token PAN and expiration date is stored. Once token is created, MDES notifies Zapp which is responsible for CVC2 generation and storing for this particular token. There could be some circumstances where Zapp will not receive such notification and CVC2 will be not generated. For that reason Wallet Server introduces mechanism to delete such tokens after some period of time(see [Remove Static Tokens Without CVC2](https://wiki.verestro.com/display/VPOP/Remove+Static+Tokens+Without+CVC2)). Just after static token digitization token PAN and FPAN are enrolled to ACS(see [Enroll Static Token to ACS](https://wiki.verestro.com/display/VPOP/Enroll+Static+Token+to+ACS)).

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant "MPA" as MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES as MDES  
participant "AHI" as AHIS  
User -&gt; MPA: 1. enableECommerceForIBAN  
activate MPA  
MPA -&gt; AHIS: 2. createSignedAccountInfo  
activate AHIS  
AHIS -&gt; AHIS: 3. signDataAsJwt \\r (userId, iban(bank account number),\\r countryCode\\rphone/email)  
AHIS --&gt; MPA: 4. response (signedAccountInfo)  
deactivate AHIS  
MPA -&gt; MPA: 5. getFcmToken(walletFirebase)  
MPA -&gt; SDK: 6. UCP::digitizeIbanForStatic\\r(signedAccountInfo, fcmToken, userLanguageCode)  
activate SDK  
SDK -&gt; WS: 7. addUserWithIban\\r (signedAccountInfo)  
activate WS  
WS -&gt; WS: 8. createUserRecordAndIban  
WS --&gt; SDK: 9. response(userId, ibanId\\r (sha256(iban(bank account number)))  
SDK -&gt; SDK: 10. isDevicePaired  
alt isDevicePaired=false  
SDK-&gt; WS: 11. pairDeviceByTrustedIdentity\\r(signedAccountInfo, fcmRegistrationToken, deviceInfo)  
note over SDK, WS #1C1E3F: See Pair Device process for more details  
else isDevicePaired=true  
SDK -&gt; WS: 12. loginByTrustedIdenitity  
note over SDK, WS #1C1E3F: See Login process for more details  
end  
SDK -&gt; SDK: 13. store userSessionToken  
SDK -&gt; WS: 14. digitizeIbanForStatic\\r (ibanId, userSessionToken, userLanguageCode)  
WS -&gt; MDES: 15. tokenize(iban(bank account number)\\r countryCode, ahiId)  
activate MDES  
MDES --&gt; WS: 16. response  
deactivate MDES  
WS --&gt; SDK: 17. response\\r (staticPaymentTokenInfo)  
deactivate WS  
SDK --&gt; MPA: 18. result  
deactivate SDK  
MPA --&gt; User: 19. digitization succeed  
deactivate MPA  
@enduml

### Enroll Static Token to ACS  


When merchant initiates 3DS authentication for static token, depending on the AHI and market requirement, challenge or step up might be required to be performed for transaction used initiated using static token. For the Step-Up to be initiated, ACS needs to have the following information available prior to the authentication so it can map and initiate the step up:

- FPAN,
- token PAN/DPAN – used for 3DS\_V1,
- User's credential required for the step-up (i.e, phone number/email).

To enable Step-Up all required information needs to be enrolled to ACS to perform the authentication challenge. Enrolment is done automatically and asynchronously after IBAN digitization for static token.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant "MPA" as MPA  
participant "Wallet Server" as WS  
participant MDES as MDES  
participant "ACS" as ACS  
MDES --&gt; WS: 1. response(staticToken)  
activate MDES  
activate WS  
deactivate MDES  
deactivate WS  
WS -&gt; MDES: 2. getTokenDetails(tokenUniqueReference)  
activate WS  
activate MDES  
MDES --&gt; WS: 3. response(FPAN, DPAN)  
deactivate MDES  
WS -&gt; ACS: 4. enroll(FPAN, DPAN, phone/email)  
activate ACS  
ACS --&gt;WS: 5. response  
deactivate ACS  
@enduml

### Unenroll Static Token from ACS

Static token which is deleted is also unenrolled from ACS automatically.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant "MPA" as MPA  
participant "Wallet Server" as WS  
participant MDES as MDES  
participant "ACS" as ACS  
MDES --&gt; WS: 1. response(staticTokenDeleted)  
activate MDES  
activate WS  
deactivate MDES  
deactivate WS  
WS -&gt; MDES: 2. getTokenDetails(tokenUniqueReference)  
activate WS  
activate MDES  
MDES --&gt; WS: 3. response(FPAN, DPAN)  
deactivate MDES  
WS -&gt; ACS: 4. unEnroll(FPAN, DPAN, phone/email)  
activate ACS  
ACS --&gt;WS: 5. response  
deactivate ACS  
@enduml

### Handle Message From Server

In whole system there are processes where server needs to send messages to the device. Wallet Server has separate component which is responsible for sending messages to the device. This component uses different channels for message delivery. There are two channels: SSE(Server Sent Events) and RNS(Remote Notification Service). When message is ready for delivery, Wallet Server uses both channels to deliver such message. In first versions of Wallet Server only RNS was used, however sometimes messages were not delivered and to improve delivery new SSE channel was introduced. This channel helps in processes which start from the device and device expects message from the server. Moreover device checks messages which are still not delivered on actions where such messages are expected. Below diagram describes how delivery message process works and how needs to be handled on MPA side.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant "MPA" as MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant "RNS" as RNS  
opt  
SDK -&gt; WS: 1. callActionAfterWhichMessageIsExpected  
WS --&gt; SDK: 2. response  
SDK -&gt; WS: 3. openSSEConnection  
end  
WS -&gt; WS: messageReadyForDelivery  
opt If device has opened connection  
WS -&gt; SDK: 4. deliverUsingSSE  
end  
WS -&gt; RNS: 5. deliverMessage  
RNS --&gt; WS: 6. response  
RNS -&gt; MPA: 7. deliverMessage  
MPA -&gt; MPA: 8. checkWalletSenderId  
MPA-&gt; SDK: 9. MDC:CloudMessage#process(pushData)  
SDK -&gt; SDK: 10. deduplicateMessage  
SDK -&gt; WS: 11. acknowledgeMessage  
WS --&gt; SDK: 12. response  
SDK -&gt; SDK: 13. processMessage  
...Obtain pending messages...  
MPA -&gt; SDK: 14. someActionWhereMessageMayBeStillPending  
SDK -&gt; SDK: 15. doAction  
SDK -&gt;&gt; WS: 16. getPendingMessages  
WS --&gt; SDK: 17. response  
SDK -&gt; SDK: do actions from 10 to 13

@enduml

### Update RNS Token

Wallet Server is responsible for sending push notifications to the Wallet SDK. For that reason RNS token is passed to Wallet Server during pairing device or in some cases is obtained by SDK from MPA whenere is needed. However this token can be <span class="inline-comment-marker" data-ref="7c0abc8d-e6eb-4ccd-bd51-3df8c31751fa">updated</span>. MPA will be notified when token is being updated and then needs to obtain new RNS token and update via Wallet SDK on Wallet Server. Retrieving push notifications and RNS tokens is responsibility of the MPA.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant "Remote Notification Service" as RNS  
activate RNS  
RNS -&gt; MPA: 1. onTokenRefresh  
deactivate RNS  
activate MPA  
MPA -&gt; MPA: 2. obtainNewToken(walletFirebase)  
MPA -&gt; SDK: 3. MDC::updateRegistrationToken(newRNSToken)  
activate SDK  
SDK -&gt; WS: 4. updateRNSToken(deviceInstallationId, newRNSToken)  
activate WS  
WS -&gt; WS: 5. updateRNSToken  
WS --&gt; SDK: 6. response  
deactivate WS  
SDK --&gt; MPA: 7. result  
deactivate SDK  
deactivate MPA  
deactivate RNS  
@enduml

### Profile Provisioning

During this process digitized card profile is delivered to the device. This process is triggered automatically after successful digitization where outcome is APPROVED or REQUIRE\_ADDITIONAL\_AUTHENTICATION. It is not possible to retry provisioning itself. To retry provisioning, previous token needs to be deleted and new digitization called hence when SDK reports that provisioning has failed then given token is automatically deleted and User can perform digitization once again. During process there is few point of failures and provisioning can be not finished at all. In this scenario Payment Tokens which are not provisioned for long period of time are delete by Wallet Server (see Removing Not Provisioned Tokens). From User perspective it can be good approach to treat digitization and provisioning as one process and inform User about steps(if User has to wait long time without any information then can treat this as some failure). From MPA perspective can be also good approach to wait for provisioning status as long as User stays on view dedicated to it. If User wants to cancel the process because provisioning status is not available for long period of time it is recommended to delete Payment Token(see Delete Payment Token via SDK) once User click cancel or back. Thanks to deletion, new digitization can be called and User does not have to wait until Payment Token is deleted by Wallet Server due to lack of provisioning.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES as MDES  
MDES-&gt;WS: 1. sendRemoteNotificationMessage(mdesRemoteMessage)  
activate MDES  
deactivate MDES  
activate WS  
WS-&gt; SDK: 2. deliverMessage(mdesRemoteMessage)  
NOTE LEFT: See: Handle Message From Server  
deactivate WS  
activate SDK  
SDK-&gt; MDES: 3. provision  
activate MDES  
MDES --&gt; SDK: 4. response(cardProfile)  
SDK-&gt; MDES: 5. notify provisioning result  
MDES --&gt; SDK: 6. response  
deactivate MDES  
SDK -&gt; SDK: 7. store card profile  
SDK -&gt; WS: 8. confirmProvisioningStatus(SUCCESS/FAILURE)  
activate WS  
alt FAILURE  
WS -&gt; MDES: 9. deleteToken  
activate MDES  
MDES --&gt; WS: 10. response  
deactivate MDES  
WS --&gt; SDK: 11. response  
SDK -&gt; SDK: 12. deleteToken  
SDK -&gt; MPA: 13. onProvisioningFailure  
activate MPA  
MPA -&gt; User: 14. please try again  
deactivate MPA  
else SUCCESS  
WS --&gt; SDK: 15. response  
deactivate WS  
SDK -&gt; MPA: 16. onProvisioningSuccess(paymentInstrument)  
deactivate SDK  
activate MPA  
MPA -&gt; User: 17. card digitized successfully  
deactivate MPA  
end  
@enduml


### <span style="color: #141413;">Transaction Credentials </span>Replenishment

<span style="color: #141413;">Transaction Credentials are unique per transactions keys that are used to calculate cryptograms in transactions. Each set of credentials is linked with a unique Application Transaction Counter (ATC). Each set of credentials can only be used for one transaction. There is a limit (set on MDES onboarding) of transaction credentials stored on device. There are several types of replenishment:</span>

- <span style="color: #141413;">Initial</span>
- <span style="color: #141413;">Automatic</span>
- <span style="color: #141413;">Manual</span>

#### <span style="color: #141413;">Transaction Credentials - Automatic Replenishment</span>

After every transaction Wallet SDK checks if number of transaction credentials is below, <span class="inline-comment-marker" data-ref="2bbc5830-4941-47f2-bd97-a3a35569a276">preconfigured during SDK setup, threshold</span>. If yes then SDK will call replenish. During replenish process transaction credentials are being delivered to mobile <span class="inline-comment-marker" data-ref="b8671fd3-4188-4ecc-9fbb-0403986e0acc">application.</span>

<span class="inline-comment-marker" data-ref="b8671fd3-4188-4ecc-9fbb-0403986e0acc">@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES as MDES  
SDK-&gt;SDK: 1. detectTransactionCredentialsRemainingBelowThreshold  
alt Request session if required  
activate SDK  
SDK-&gt; MDES: 2. requestSession  
activate MDES  
MDES--&gt; SDK: 3. response  
MDES-&gt; WS: 4. sendRemoteNotificationMessage(mdesRemoteMessage)  
deactivate MDES  
activate WS  
WS -&gt; SDK: 5. deliverMessage(mdesRemoteMessage)  
NOTE LEFT: See: Handle Message From Server  
deactivate WS  
end  
SDK-&gt; MDES: 6. replenish  
activate MDES  
MDES-&gt; MDES: 7. checkIfPaymentTokenIsActive  
MDES--&gt;SDK: 8. response(transactionCredentials)  
deactivate MDES  
SDK-&gt;MPA: 9. onReplenishSuccess(paymentInstrument)  
deactivate SDK  
@enduml</span>

#### <span style="color: #141413;">Transaction Credentials - Initial Replenishment</span>

There are scenarios when automatic replenishment is not possible (lack of internet connection) and number of transaction credentials decrease to 0. In such case MPA should handle NO\_TRANSACTION\_CREDENTIALS error from transaction listener, show user proper alert and call replenish method manually. MPA can also check number of transaction credentials at any other time and do manual replenishment. It is not recommended call manual replenishment if number of transaction credentials is above threshold since in such case SDK will manage that.

Initial replenishment is process which starts directly after successful token activation. Wallet SDK is notified by Wallet Server using push notification or refreshing payment instruments. <span class="inline-comment-marker" data-ref="63c21bed-4be0-4176-9511-0039ab9652fe">No action is needed by MP</span>A.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES as MDES  
WS -&gt; SDK: 1. notifyTokenUpdated(Active)  
activate WS  
deactivate WS  
activate SDK  
alt Request session if required  
SDK-&gt; MDES: 2. requestSession  
activate MDES  
MDES--&gt; SDK: 3. response  
MDES-&gt; WS: 4. sendRemoteNotificationMessage(mdesRemoteMessage)  
deactivate MDES  
activate WS  
WS-&gt; SDK: 5. deliverMessage(mdesRemoteMessage)  
NOTE LEFT: See: Handle Message From Server  
deactivate WS  
end  
SDK-&gt; MDES: 6. replenish  
activate MDES  
MDES-&gt; MDES: 7. checkIfPaymentTokenIsActive  
MDES--&gt;SDK: 8. response(transactionCredentials)  
deactivate MDES  
SDK -&gt; MPA: 9. onReplenishSuccess(paymentInstrument)  
deactivate SDK  
@enduml

#### <span style="color: #141413;">Transaction Credentials - Manual Replenishment</span>

There are scenarios when automatic replenish is not possible <span class="inline-comment-marker" data-ref="59014813-e32f-41fd-bb97-2860cfca193d">(user is not able to connect with Internet)</span> and after some number of transactions, transaction credentials number will decrease to 0. In such case MPA should handle NO\_TRANSACTION\_CREDENTIALS error from transaction listener, show user proper alert and call replenish method manually. MPA can also check number of transaction credentials at any other time.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES as MDES  
MPA -&gt; SDK: 1. UCP::replenishCredentials(paymentInstrumentId)  
activate MPA  
deactivate MPA  
activate SDK  
alt Request session if required  
SDK-&gt; MDES: 2. requestSession  
activate MDES  
MDES--&gt; SDK: 3. response  
MDES-&gt; WS: 4. sendRemoteNotificationMessage  
deactivate MDES  
activate WS  
WS-&gt; SDK: 5. deliverMessage(mdesRemoteMessage)  
NOTE LEFT: See: Handle Message From Server  
deactivate WS  
end  
SDK-&gt; MDES: 6. replenish  
activate MDES  
MDES-&gt; MDES: 7. checkIfPaymentTokenIsActive  
MDES--&gt;SDK: 8. response(transactionCredentials)  
deactivate MDES  
SDK -&gt; MPA: 9. onReplenishSuccess(paymentInstrument)  
deactivate SDK  
@enduml


### Transacting  


Wallet SDK provides functionalities to make contactless payments (using HCE) and e-commerce using static Payment Token data.

#### <span class="inline-comment-marker" data-ref="b7d3ee33-9998-413f-8a70-ebd438c7a880">Contactless Transaction</span>

<span class="inline-comment-marker" data-ref="b7d3ee33-9998-413f-8a70-ebd438c7a880">Contactless transaction uses Android HCE. On MPA side HostApduService should be implemented. Depending on chosen</span> CDCVM and on how transaction is started, user experience is different and MPA should interact with Wallet SDK in different way. The final decision about transaction processing belongs to MPA. Wallet SDK provides transaction information and based on that and User authentication, MPA can advise to proceed, decline or require authentication(if User should be authenticated but was not). For contactless transaction Wallet SDK provides result of transaction. This result is only from the communication between <span class="inline-comment-marker" data-ref="fae99527-edc8-46b7-bebb-f80dd3ed609f">MPA</span> and Terminal. Transaction Processing with <span class="inline-comment-marker" data-ref="f5f5c410-628a-4113-bf98-2dbc95aeed51">Payment Network</span> is done separately (see Transaction Processing). Also after every contactless transaction, Transaction Credentials Replenishment is performed automatically by SDK if needed(see Transaction Credentials - Automatic Replenishment).

NOTE: The way of authentication depends on MPA. For transaction User may also choose specific card. If no card is chosen, SDK will use the one which is set as default for contactless payments. Whenever user is authenticated or chose card for payment MPA should pass this information when *onContactlessPaymentStarted* is called.

As was described above, the final decision(PROCEED, DECLINE, AUTHENTICATION\_REQUIRED) for given transaction is taken on MPA side based on transaction information and User authentication. Because of that reason there could be different scenarios which may occur and transaction experience will be single or double tap.

Sample scenarios:

- User can be already authenticated and if MPA will not decline transaction then will be processed as single tap,
- velocity check counters can be applied and even if User was not authenticated MPA can decide to proceed transaction without authentication, taking decision based on transaction information,
- User was not authenticated but MPA recognised transaction as authentication needed. MPA returns AUTHENTICATION\_REQUIRED decision and and SDK informs MPA that authentication is needed.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "HostApduService" as HAS  
participant "Wallet SDK" as SDK  
participant Terminal as TER  
opt User selects particular card for payment  
MPA -&gt; User: 1. showCards  
activate MPA  
User -&gt; MPA: 2. selectCard  
deactivate MPA  
end  
User -&gt; MPA: 3. pay  
User -&gt; TER : 4. contactless 1st tap  
activate TER  
loop  
TER -&gt; HAS: 5. processCommandApdu(commandApdu, extras)  
activate HAS  
HAS -&gt; SDK: 6. UCP::Pay#processHceApduCommand(apdu, extras)  
activate SDK  
group Select PPSE  
SDK -&gt; MPA: 7. onContactlessPaymentStarted()  
activate MPA  
MPA -&gt; MPA: 8. checkIsUserAuthenticated  
alt isAuthenticated=true  
MPA -&gt; SDK: 9. UCP::Pay#setUserAuthenticatedForPayment(paymentInstrumentId, pin?)  
end  
alt selectedCard == null  
SDK -&gt; SDK: 10. useDefaultPaymentInstrumentForContactless  
else selectedCard != null  
MPA -&gt; SDK: 11. UCP::Pay#selectForPayment(selectedPaymentInstrumentId)  
deactivate MPA  
end  
end  
group Generate AC command  
SDK -&gt; MPA: 12. getFinalDecisionForTransaction(isUserAuthenticated,recommendedAdvice, trxInfo)  
activate MPA  
MPA -&gt; MPA: 13. checkTrxAndAuthentication  
MPA --&gt; SDK: 14. result(advice)  
deactivate MPA  
end  
SDK --&gt; HAS: 15. responseApdu  
HAS --&gt; TER: 16. responseApdu  
deactivate HAS  
end  
alt advice=AUTHENTICATION\_REQUIRED  
SDK -&gt; MPA: 17. onAuthRequiredForContactless(paymentInstrument, trxInfo)  
activate MPA  
MPA -&gt; User: 18. show authentication view with trx info  
User -&gt; MPA: 19. authenticate  
User -&gt; TER: 20. contactless 2nd tap  
loop  
TER -&gt; HAS: 21. processCommandApdu(commandApdu, extras)  
activate HAS  
HAS -&gt; SDK: 22. UCP::Pay#processHceApduCommand(apdu, extras)  
group Select PPSE  
SDK -&gt; MPA: 23. onContactlessPaymentStarted()  
MPA -&gt; MPA: 24. checkIsUserAuthenticated  
alt isAuthenticated=true  
MPA -&gt; SDK: 25. UCP::Pay#setUserAuthenticatedForPayment(paymentInstrumentId, pin?)  
end  
alt selectedCard == null  
SDK -&gt; SDK: 26. useDefaultPaymentInstrumentForContactless  
else selectedCard != null  
MPA -&gt; SDK: 27. UCP::Pay#selectForPayment(selectedPaymentInstrumentId)  
end  
end  
group Generate AC command  
SDK -&gt; MPA: 28. getFinalDecisionForTransaction(isUserAuthenticated=true,recommendedAdvice, trxInfo)  
MPA -&gt; MPA: 29. checkTrxAndAuthentication  
MPA --&gt; SDK: 30. result(PROCEED)  
end  
SDK --&gt; HAS: 31. responseApdu  
HAS --&gt; TER: 32. responseApdu  
deactivate HAS  
deactivate TER  
end  
end  
SDK -&gt; MPA: 33. onContactlessPaymentCompleted(paymentInstrument, trxInfo, trxResult)  
deactivate SDK  
MPA -&gt; User: 34. show trx info view  
deactivate MPA  
...Transaction Processing ...  
note over HAS #1C1E3F: See Transaction Processing diagram  
...Transaction Credentials Automatic Replenishment ...  
note over HAS #1C1E3F: See Transaction Credentials Automatic Replenishment diagram  
@enduml

#### Transaction Processing

Transaction Processing starts after contactless communication between terminal and MPA. Then transaction authorization is performed. During this authorization ARQC is validated. After authorization MDES notifies Wallet Server about the result of the authorization and sends transaction information. Transaction information is sent to MPA using Remote Notification Service.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant Terminal as TER  
participant "Payment Network" as PN  
participant MDES  
participant Zapp  
participant AHI  
TER -&gt; PN: 1. authorizeTransaction(tokenPAN, cryptogram)  
activate PN  
activate TER  
PN -&gt; MDES: 2. detokenize  
activate MDES  
MDES -&gt; MDES: 3. lookup token mapping  
MDES --&gt; PN: 4. response(PAN)  
deactivate MDES  
PN -&gt; Zapp: 5. authorize(PAN)  
activate Zapp  
Zapp -&gt; AHI: 6. authorize  
activate AHI  
AHI --&gt; Zapp: 7. response  
deactivate AHI  
Zapp --&gt; PN: 8. response  
deactivate Zapp  
PN --&gt; TER: 9. response  
deactivate TER  
PN -&gt; MDES: 10. storeTransactionDetails  
deactivate PN  
activate MDES  
MDES -&gt; WS: 11. pushTransactionDetails  
deactivate MDES  
activate WS  
alt store transaction enabled  
WS -&gt; WS: 12. storeTransaction  
end  
WS-&gt; SDK: 13. deliverMessage(mdesRemoteMessage)  
NOTE LEFT: See: Handle Message From Server  
deactivate WS  
activate SDK  
SDK -&gt; MPA: 14. onNewTransaction(trxDetails)  
deactivate SDK  
activate MPA  
MPA -&gt; User: 15. showSystemNotification(trxDetails)  
deactivate MPA  
@enduml

#### Web/E-com Transaction  


In this process Wallet Server provides static token payment data for given IBAN id and user id, required for e-commerce transaction. Payment data contains static data like: token PAN, expiration date, CVC2. There might be scenario where even after successful IBAN digitization for static token, Zapp did not receive from MDES notification and static token payment date are not available. In such case User needs to be asked to wait additional time and Wallet Server responds with STATIC\_TOKEN\_PAYMENT\_DATA\_NOT\_AVAILABLE error.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
box "Consumer mobile android device" #white  
participant "Merchant App" as MA  
participant "MPA" as MPA  
participant "Wallet SDK" as SDK  
end box  
participant "Wallet Server" as WS  
participant "AHI" as AHIS  
participant Zapp  
participant "Acquirer Gateway" as AG  
User -&gt; MA: 1. checkOut  
activate MA  
MA -&gt; MPA: 2. openMPA  
activate MPA  
MPA --&gt; User: 3. requestAuthentication  
User -&gt; MPA: 4. presentCredentials  
MPA -&gt; AHIS: 5. authenticate  
activate AHIS  
AHIS --&gt; MPA: 6. response  
MPA -&gt; MPA: 7. prepareOrderUI  
MPA --&gt; User: 8. requestToConfirmOrderAndAuthorizePayment  
User -&gt; MPA: 9. confirmPayment  
MPA -&gt; AHIS: 10. createSignedIbanInfo  
AHIS -&gt; AHIS: 11. signDataAsJwt\\r (userId, ibanId(sha256(bank account number))  
AHIS --&gt; MPA: 12. response(signedIbanInfo)  
deactivate AHIS  
MPA -&gt; SDK: 13. UCP::getStaticTokenPaymentData(signedIbanInfo)  
activate SDK  
SDK -&gt; WS: 14. getStaticTokenPaymentData(signedIbanInfo)  
activate WS  
WS -&gt; WS: 15. getStaticTokenUniqueReferenceForMdes(userId, ibanId)  
WS -&gt; Zapp: 16. searchToken(tokenUniqueReference)  
activate Zapp  
Zapp --&gt; WS: 17. response(tokenPAN, expDate, CVC2)  
deactivate Zapp  
WS --&gt; SDK: 18. response(tokenPAN, expDate, CVC2)  
deactivate WS  
SDK --&gt; MPA: 19. result  
deactivate SDK  
MPA--&gt;MA: 20. result  
deactivate MPA  
MA -&gt; AG: 21. submitAuthTransaction(tokenPAN, expDate, CVC2)  
activate AG  
AG-&gt; AG: 22. bauAuthTransactionFlow  
AG--&gt; MA: 23. confirmAuthStatus  
deactivate AG  
MA--&gt; User: 24. confirmOrder  
deactivate MA  
deactivate Zapp  
@enduml

### Setting Defaults for Payment  


SDK manages default Payment Instrument for contactless payments. After digitization, if there is no default Payment Instrument, SDK sets digitized Payment Instrument after activation as default. In case where there are more than one active Payment Instruments and current default Payment Instrument is deleted or suspended, the SDK will set first active Payment Instrument as default. Default Payment Instrument can be changed at any time. Only active Payment Instrument can be set as default.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
MPA-&gt;User: 1. payment instrument list  
activate MPA  
User-&gt;MPA: 2. choose default for contactless payment)  
MPA-&gt;SDK: 3. UCP::setDefaultForContactless(paymentInstrumentId)  
activate SDK  
SDK-&gt; SDK: 4. storeDefault  
SDK--&gt;MPA: 5. result  
deactivate MPA  
deactivate SDK  
@enduml

### Login on Wallet Server

User data are protected by User session token which is issued by Wallet Server after providing authentication factor. Authentication factor is provided first in pairing device and then session is created. Since session has limited period of validity, it needs to be refreshed using login on Wallet Server methods.

#### Login on Wallet Server using Trusted Identity  


In the Integrated implementation model User authentication doesn't occur directly on Wallet Server. Wallet Server will require User authentication when some user data will be requested. If User session token is no longer valid, SDK will return USER\_UNATHORIZED error. In such case Trusted Identity needs to be prepared on AHI server and sent via Wallet SDK in loginByTrustedIdentity method. MPA can decide whether ask User to provide authentication data or not. The latter case regards situation when user is already authenticated and Trusted Identity can be immediately returned from AHI based on already valid session on AHI side. During login process Wallet Server checks if given device still exists, if not then responds with CANT\_FIND\_DEVICE status which is interpreted on SDK side as given device is deleted and all local data stored on SDK side are cleared.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant "AHI" as Issuer  
MPA -&gt; SDK: 1. invoke API  
activate MPA  
activate SDK  
SDK -&gt; WS: 2. invoke API  
activate WS  
WS --&gt; SDK: 3. response(USER\_UNATHORIZED)  
deactivate WS  
SDK --&gt; MPA: 4. result(USER\_UNATHORIZED)  
MPA-&gt;User: 5. show authenticate view  
User-&gt;MPA: 6. put authentication data  
MPA-&gt;Issuer: 7. authenticate  
activate Issuer  
Issuer -&gt; Issuer: 8. generateTrustedIdentity - signed user id  
Issuer --&gt; MPA: 9. response(trustedIdentity)  
deactivate Issuer  
MPA-&gt; SDK: 10. MDC::loginByTrustedIdentity(trustedIdentity)  
SDK-&gt; WS: 11. loginByTrustedIdentity(trustedIdentity)  
activate WS  
WS -&gt; WS: 12. check if device exists  
alt device exists  
WS-&gt; WS: 13. verify trusted identity  
WS --&gt; SDK: 14. response(userSessionToken)  
SDK -&gt; SDK: 15. store(userSessionToken)  
SDK--&gt;MPA: 16. result  
MPA -&gt; SDK: 17. invoke API  
else device not exists  
WS --&gt; SDK: 18. response(CANT\_FIND\_DEVICE)  
deactivate WS  
SDK -&gt; SDK: 19. clearAllLocalData  
SDK --&gt; MPA: 20. result(CANT\_FIND\_DEVICE)  
deactivate MPA  
deactivate SDK  
... Pair device ...  
note over MPA, WS #1C1E3F: See Pairing Device diagram  
MPA -&gt; SDK: 21. invoke API  
end  
@enduml

###   
Getting Payment Instrumets  


After digitization process, payment instrument is stored in UCP SDK module of Wallet SDK. Payment instrument in context of UCP SDK is digitized IBAN and contains information like:

- id (specified id which helps MPA to identify payment instrument which was digitized from MPA),
- status,
- transaction credentials count,
- paymentTokenId,
- staticTokenInfo.

MPA can get information about all Payment Instruments from the Wallet SDK at any time. Payment instruments will be retrieved only from local storage that is part of SDK. Payment Tokens for Payment Instruments can be refreshed/pulled from Wallet Server on demand. This scenario should be considered only when User e.g. makes swipe to refresh.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
MPA-&gt;SDK: 1. UCP::getAllPaymentInstruments(refresh)  
activate MPA  
alt refresh = true  
activate SDK  
SDK -&gt; WS: 2. getAllPaymentTokens(userSessionToken)  
activate WS  
WS -&gt; SDK: 3. response(deviceAndStaticPaymentTokens)  
deactivate WS  
SDK -&gt; SDK: 4. updateLocalStorage  
end  
SDK --&gt; MPA: 5. result(paymentInstrumentList)  
deactivate SDK  
deactivate MPA  
@enduml

### Getting Transaction History  


It is possible that transaction history will be stored on Wallet Server for infinite time. This should be specified during onboarding. If this options is enabled, MPA can retrieve transaction history for given user and filtering. Transactions are returned in corresponding parts for better user experience. If next part is available then response from previous part contain information needed for requesting next part. MPA should check if next part is not empty and then make another request.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
loop next != null  
MPA-&gt;SDK: 1. MDC::getTransactionHistory(limit, next?, ...)  
activate MPA  
activate SDK  
SDK -&gt; WS: 2. getTransactionHistory(limit, next?, userSessionToken, ...)  
activate WS  
WS -&gt; SDK: 3. response(transactionHistoryList, next?)  
deactivate WS  
SDK --&gt; MPA: 4. result(transactionHistoryList, next?)  
deactivate SDK  
deactivate MPA  
end  
@enduml

### Payment Token Lifecycle Management via SDK

Payment Token lifecycle management can be done via SDK.

#### Delete Device Payment Token via SDK

Device Payment Token can be deleted using SDK.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES  
User -&gt; MPA: 1. Delete payment token  
activate MPA  
MPA -&gt; SDK: 2. UCP::delete(paymentInstrumentId, reason)  
deactivate MPA  
activate SDK  
SDK -&gt; WS: 3. deletePaymentToken(userSessionToken, paymentTokenId, reason)  
activate WS  
WS -&gt; MDES: 4. Delete token  
activate MDES  
MDES -&gt; MDES: 5. Delete token mapping  
MDES --&gt; WS: 6. response  
deactivate MDES  
WS --&gt; SDK: 7. response  
deactivate WS  
alt Request session if required  
SDK -&gt; MDES: 8. request session  
activate MDES  
MDES --&gt; SDK: 9. response  
MDES -&gt; WS: 10. sendRemoteNotificationMessage  
deactivate MDES  
activate WS  
WS -&gt; SDK: 11. deliverMessage(mdesRemoteMessage)  
NOTE LEFT: See: Handle Message From Server  
deactivate WS  
end  
SDK -&gt; MDES: 12. delete(tokenUniqueReference)  
activate MDES  
MDES --&gt; SDK: 13. response  
deactivate MDES  
SDK -&gt; SDK: 14. Delete transaction credentials, card profile  
SDK -&gt; MPA: 15. onPaymentInstrumentStatusChanged(id, status)  
deactivate SDK  
MPA --&gt; User: 16. show update view  
deactivate MPA  
@enduml

#### Delete Static Token via SDK

A User may report that given static token was compromised or just to disable e-commerce payments. To do that SDK exposes method for static token deletion. After token deletion all corresponding data are deleted from acs (see [Unenroll Static Token from ACS](https://wiki.verestro.com/display/VPOP/Unenroll+Static+Token+from+ACS)).

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES  
User -&gt; MPA: 1. Report compromised static token  
activate MPA  
MPA -&gt; SDK: 2. UCP::deleteStaticToken(paymentInstrumentId)  
activate SDK  
SDK -&gt; WS: 3. Delete payment token(userSessionToken, paymentTokenId)  
activate WS  
WS -&gt; MDES: 4. Delete token  
activate MDES  
MDES -&gt; MDES: 5. Delete token mapping  
MDES --&gt; WS: 6. response  
deactivate MDES  
WS --&gt; SDK: 7. response  
deactivate WS  
SDK --&gt; MPA: 8. result  
deactivate SDK  
MPA --&gt; User: 9. result  
deactivate MPA  
deactivate WS  
...Unenroll static token...  
note over WS, MDES #1C1E3F: See Unenroll Static Token Diagram  
@enduml

### Errors Reporting

Wallet SDK performs some security checks to prevent data stole. When any issue is detected, Wallet SDK reports error to Wallet Server and clears own data - all Payment Tokens, Device and User information will be removed from local storage. MPA should inform user about incident. MPA should not perform more actions on SDK until application restart. When any SDK method is called it finishes with error and status SECURITY\_EVENT\_OCCURRED.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
SDK -&gt; SDK: 1. detectSecurityIssue  
activate SDK  
SDK -&gt; SDK: 2. clearSDKData  
SDK -&gt; WS: 3. reportSecurityIssue  
activate WS  
deactivate WS  
SDK -&gt; MPA: 4. onSecurityIssueAppeared  
deactivate SDK  
activate MPA  
MPA -&gt; User: 5. show information  
deactivate MPA  
@enduml

### Device Unpairing  


Unpairing device clears all modules data and report that fact only if possible to server. If server receives this signal then removes all device data including provisioned device Payment Tokens. If not then data are cleared locally only - similar like during app uninstallation. This can be used for scenario when MPA does not want to use SDK at all or for scenario when MPA supports switching between users accounts on the same installation. If MPA detects that new User is trying to log into application in case when previous had digitized cards, immediately should clear all data from previous, since SDK stores data in context of one User only.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
MPA -&gt; SDK: 1. MDC::unpairDevice  
activate MPA  
activate SDK  
opt  
SDK -&gt; WS: 2. unpairDevice  
activate WS  
WS --&gt; SDK: 3. response  
deactivate WS  
end  
SDK -&gt; SDK: 4. clearAllData  
SDK --&gt; MPA: 5. result  
deactivate SDK  
deactivate MPA  
@enduml

## Wallet Server VCP Issuer API Initiated

This section describes use cases which are initiated from server VCP Issuer API which is dedicated only for IBANs.

### IBAN Digitization via Server

<span style="color: #000000;">IBAN can be also digitized via Server API for static token. After digitization static token is enrolled to ACS(see [Enroll Static Token to ACS](https://wiki.verestro.com/display/VPOP/Enroll+Static+Token+to+ACS)).</span>

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant "AHI App" as AHIAPP  
participant "AHI Server API " as AHIS  
participant "Wallet Server" as WS  
participant MDES  
User -&gt; AHIAPP: 1. openBankApplication  
activate AHIAPP  
AHIAPP --&gt; User: 2. requireAuthentication  
User -&gt; AHIAPP: 3. presentAuthCredentials  
AHIAPP -&gt; AHIS: 4. authenticate  
activate AHIS  
AHIS -&gt; AHIS: 5. authenticate  
AHIS --&gt; AHIAPP: 6. response  
AHIAPP -&gt; AHIAPP: 7. isPbAEnabled  
AHIAPP --&gt;User: 8. presentPbAT&amp;C  
AHIAPP -&gt; AHIS: 9. digitizeBankAccountNumber  
AHIS -&gt; AHIS: 10. signDataAsJwt\\r (userId, iban(bank account number),\\r countryCode,\\remail/phone)  
AHIS -&gt; WS: 11. digitizeIbanForStatic(signedAccountInfo)  
activate WS  
WS -&gt; WS: 12. createUserRecordAndIban  
WS -&gt; MDES: 13. tokenize(iban(bank account number)\\r countryCode, ahiId)  
activate MDES  
MDES --&gt; WS: 14. response  
deactivate MDES  
WS --&gt; AHIS: 15. response  
deactivate WS  
AHIS --&gt; AHIAPP: 16. response  
deactivate AHIS  
AHIAPP -&gt; User: 17. digitization succeed  
deactivate AHIAPP  
...Enroll static token to ACS...  
note over WS, MDES #1C1E3F: See Enroll Static Token diagram  
@enduml

### Web/E-commerce Transaction via Server

In this process Wallet Server provides for given User Id and IBAN id static payment data needed for e-commerce transaction.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant "Merchant App" as MA  
participant "AHI App" as AHIAPP  
participant "AHI Server API " as AHIS  
participant "Wallet Server" as WS  
participant Zapp  
participant "Acquirer Gateway" as AG  
User -&gt; MA: 1. checkOut  
activate MA  
MA -&gt; AHIAPP: 2. openAhiApp  
activate AHIAPP  
AHIAPP --&gt; User: 3. requestCredentials  
User -&gt; AHIAPP: 4. presentCredentials  
AHIAPP -&gt; AHIS: 5. authenticate  
activate AHIS  
AHIS --&gt; AHIAPP: 6. response  
AHIAPP -&gt; AHIAPP: 7. prepareOrderUI  
AHIAPP --&gt; User: 8. requestToConfirmOrderAndAuthorizePayment  
User -&gt; AHIAPP: 9. confirmPayment  
AHIAPP -&gt; AHIS: 10. confirmPayment  
AHIS -&gt; AHIS: 11. signDataAsJwt(userId, ibanId(sha256(bank account number))  
AHIS -&gt; WS: 12. getStaticTokenPaymentData(signedIbanInfo)  
activate WS  
WS -&gt; WS: 13. getStaticTokenUniqueReferenceForMdes(userId, ibanId)  
WS -&gt; Zapp: 14. searchToken(tokenUniqueReference)  
activate Zapp  
Zapp --&gt; WS: 15. response(tokenPAN, expDate, CVC2)  
deactivate Zapp  
WS --&gt; AHIS: 16. response(tokenPAN, expDate, CVC2)  
deactivate WS  
AHIS --&gt; AHIAPP: 17. response  
deactivate AHIS  
AHIAPP--&gt;MA: 18. response  
deactivate AHIAPP  
MA -&gt; AG: 19. submitAuthTransaction(tokenPAN, expDate, CVC2)  
activate AG  
AG-&gt; AG: 20. bauAuthTransactionFlow  
AG--&gt; MA: 21. confirmAuthStatus  
deactivate AG  
MA--&gt; User: 22. confirmOrder  
deactivate MA  
@enduml

### Payment Token Lifecycle Management via Server

This section describes payment token lifecycle management performed via Server.

#### Delete Device Payment Token via Server

Device Payment Token can be deleted using server API.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES  
participant AHI  
AHI -&gt; WS: 1. deletePaymentToken(paymentTokenId)  
activate AHI  
activate WS  
WS -&gt; MDES: 2. Delete token  
activate MDES  
MDES -&gt; MDES: 3. Delete token mapping  
MDES --&gt; WS: 4. response  
deactivate MDES  
WS --&gt; AHI: 5. response  
deactivate AHI  
WS -&gt; SDK: 6. deliverMessage(paymentTokenDeleted)  
deactivate WS  
NOTE LEFT: See: Handle Message From Server  
activate SDK  
deactivate WS  
deactivate MDES  
alt Request session if required  
SDK -&gt; MDES: 7. request session  
activate MDES  
MDES --&gt; SDK: 8. response  
MDES -&gt; WS: 9. sendRemoteNotificationMessage  
deactivate MDES  
activate WS  
WS -&gt; SDK: 10. deliverMessage(mdesRemoteMessage)  
NOTE LEFT: See: Handle Message From Server  
deactivate WS  
deactivate MPA  
end  
SDK -&gt; MDES: 11. delete(tokenUniqueReference)  
activate MDES  
MDES --&gt; SDK: 12. response  
deactivate MDES  
SDK -&gt; SDK: 13. Delete transaction credentials, card profile  
SDK -&gt; MPA: 14. onPaymentInstrumentStatusChanged(id, status)  
deactivate SDK  
MPA --&gt; User: 15. show update view  
deactivate MPA  
@enduml

#### Delete Static Payment Token via Server

Static token may also be deleted via Server API. After token deletion, static token related data are unenrolled from ACS(see [Unenroll Static Token from ACS](https://wiki.verestro.com/display/VPOP/Unenroll+Static+Token+from+ACS)).

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant "Wallet Server" as WS  
participant MDES  
participant AHI  
User -&gt; AHI: 1. Report compromised static token  
activate AHI  
AHI -&gt; WS: 2. deleteStaticToken(paymentTokenId)  
activate WS  
WS -&gt; MDES: 3. Delete token  
activate MDES  
MDES -&gt; MDES: 4. Delete token mapping  
MDES --&gt; WS: 5. response  
deactivate MDES  
WS --&gt; AHI: 6. result  
deactivate AHI  
deactivate WS  
deactivate WS  
...Unenroll static token...  
note over WS, MDES #1C1F3E: See Unenroll Static Token Diagram  
@enduml

#### Suspend Device Payment Token via Server

Payment Token can be suspended using server API.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES  
participant AHI  
AHI -&gt; WS: 1. suspendPaymentToken(paymentTokenId)  
activate AHI  
activate WS  
WS -&gt; MDES: 2. suspendToken(tokenUniqueReference)  
activate MDES  
MDES -&gt; MDES: 3. suspendToken  
MDES --&gt; WS: 4. response  
deactivate MDES  
WS --&gt; AHI: 5. response  
deactivate AHI  
WS -&gt; SDK: 6. deliverMessage(paymentTokenSuspended)  
deactivate WS  
activate SDK  
NOTE LEFT: See: Handle Message From Server  
SDK -&gt; SDK: 7. suspendToken  
SDK -&gt; MPA: 8. onPaymentInstrumentStatusChanged(id, status)  
deactivate WS  
deactivate SDK  
deactivate MPA  
@enduml

#### Suspend Static Payment Token via Server

Static token may be suspended via Server.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
participant "Wallet Server" as WS  
participant MDES  
participant "AHI" as AHI  
AHI -&gt; WS: 1. suspendStaticToken(paymentTokenId)  
activate AHI  
activate WS  
WS -&gt; MDES: 2. Suspend token  
activate MDES  
MDES -&gt; MDES: 3. Suspend token  
MDES --&gt; WS: 4. response  
deactivate MDES  
WS --&gt; AHI: 5. response  
deactivate AHI  
deactivate WS  
deactivate WS  
@enduml

##### Unsuspend Device Payment Token via Server

Payment Token can be unsuspended using server API.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES  
participant AHI  
AHI -&gt; WS: 1. unsuspendPaymentToken(paymentTokenId)  
activate AHI  
activate WS  
WS -&gt; MDES: 2. unuspendToken(tokenUniqueReference)  
activate MDES  
MDES -&gt; MDES: 3. checkPermissions  
MDES -&gt; MDES: 4. unsuspendToken  
MDES --&gt; WS: 5. response  
deactivate MDES  
WS --&gt; AHI: 6. response  
deactivate AHI  
WS -&gt; SDK: 7. deliverMessage(mdesRemoteMessage)  
NOTE LEFT: See: Handle Message From Server  
activate SDK  
deactivate WS  
SDK -&gt; SDK: 8. activateToken  
SDK -&gt; MPA: 9. onPaymentInstrumentStatusChanged(id, status)  
deactivate WS  
deactivate SDK  
... Replenishment ...  
note over SDK, MDES #1C1E3F: Just after token activation transaction credentials replenishment is performed by SDK\\r. See Transaction Credentials Automatic Replenishment diagram  
@enduml

#### Unsuspend Static Payment Token via Server

Static token may be unsuspended via Server.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
participant "Wallet Server" as WS  
participant MDES  
participant "AHI" as AHI  
AHI -&gt; WS: 1. unsuspendStaticToken(paymentTokenId)  
activate AHI  
activate WS  
WS -&gt; MDES: 2. Unsuspend token  
activate MDES  
MDES -&gt; MDES: 3. Unsuspend token  
MDES --&gt; WS: 4. response  
deactivate MDES  
WS --&gt; AHI: 5. response  
deactivate AHI  
deactivate WS  
deactivate WS  
@enduml

### Getting Payment Tokens  


AHI can retrieve information about Payment Tokens via Server.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant "Wallet Server" as WS  
participant "AHI " as AHIS  
AHIS -&gt; WS: 1. getPaymentTokens(ibanId)  
activate WS  
activate AHIS  
WS --&gt; AHIS: 2. response(paymentTokens)  
deactivate WS  
deactivate AHIS  
@enduml

### Update Email/Phone

With static token User credentials(phone/email) are enrolled to ACS. User can change those credentials and this change needs to be updated on ACS side.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant "AHI " as AHIS  
participant "Wallet Server" as WS  
participant ACS  
AHIS -&gt; WS: 1. updateUser(userId, phone/email)  
activate WS  
activate AHIS  
WS --&gt; AHIS: 2. response  
deactivate AHIS  
WS -&gt; WS: 3. getAllEnrolledStaticTokensForGivenUser  
loop For every enrolled static token  
WS -&gt; ACS: 4. update(FPAN, DPAN, phone/email)  
activate ACS  
ACS --&gt; WS: 5. response  
deactivate ACS  
end  
deactivate WS  
@enduml

## Wallet Server Initiated  


### Remove Static Tokens Without CVC2

Wallet Server checks after IBAN digitization for static token whether static token has CVC2 available on the Zapp side, since there might be scenarios where even static token is created on MDES side, it is not created on the Zapp side. If it is not available for some period of time, Wallet Server deletes static token, unenrolls from ACS and User have to digitize IBAN for static token once again.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant "Wallet Server" as WS  
participant MDES  
participant Zapp  
WS -&gt; WS: 1. getStaticTokensWithoutConfirmedCVC2OnZapp  
activate WS  
WS -&gt; Zapp: 2. searchToken(tokenUniqueReference)  
activate Zapp  
Zapp --&gt; WS: 3. response  
deactivate Zapp  
alt CVC2 available on Zapp  
WS -&gt; WS: 4. confirmStaticTokenHasCVC2  
else CVC2 not available  
alt CVC2 not available for some period of time  
WS -&gt; MDES: 5. deleteStaticToken  
activate MDES  
MDES --&gt; WS: 6. response  
deactivate MDES  
deactivate WS  
note over WS, MDES #1C1E3F: Unenroll Static Token from ACS  
end  
end  
@enduml

### Removing Not Provisioned Device Tokens  


Wallet Server checks periodically device Payment Tokens and verify if provisioning is completed. These Payment Tokens which have provisioning status in progress for long period of time are deleted automatically and from User perspective process needs to be started again.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES  
WS -&gt; WS: 1. find not provisioned payment tokens for a\\r long period of time  
activate WS  
loop Not provisioned payment tokens for a long period of time  
WS -&gt; MDES: 2. Delete token  
activate MDES  
MDES -&gt; MDES: 3. Delete token mapping  
MDES --&gt; WS: 4. response  
deactivate MDES  
WS -&gt; SDK: 5. deliverMessage(mdesRemoteMessage)  
NOTE LEFT: See: Handle Message From Server  
deactivate WS  
activate SDK  
alt Request session if required  
SDK -&gt; MDES: 6. request session  
activate MDES  
MDES --&gt; SDK: 7. response  
MDES -&gt; WS: 8. sendRemoteNotificationMessage  
deactivate MDES  
activate WS  
WS -&gt; SDK: 9. deliverMessage(mdesRemoteMessage)  
NOTE LEFT: See: Handle Message From Server  
deactivate WS  
end  
SDK -&gt; MDES: 10. delete(tokenUniqueReference)  
activate MDES  
MDES --&gt; SDK: 11. response  
deactivate MDES  
SDK -&gt; SDK: 12. Delete transaction credentials, card profile  
SDK -&gt; MPA: 13. onPaymentInstrumentStatusChanged(id, status)  
deactivate SDK  
end  
deactivate MPA  
@enduml

## Wallet Server Admin API Initiated  


### Admin Device Deletion

During this process all data related to given device are deleted. Payment Tokens are deleted asynchronously.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES  
participant "Admin Panel" as AP  
AP -&gt; WS: 1. deleteDevice(deviceInstallationId)  
activate AP  
activate WS  
WS --&gt; AP: 2. response  
deactivate AP  
loop All device Payment Tokens for given device  
WS -&gt; MDES: 3. delete token  
activate MDES  
MDES --&gt; WS: 4. response  
deactivate MDES  
deactivate WS  
end  
@enduml

### Admin Device Token Deletion

Device Payment Token can be deleted via admin panel.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES  
participant "Admin Panel" as AP  
AP -&gt; WS: 1. deletePaymentToken(paymentTokenId)  
activate AP  
activate WS  
WS -&gt; MDES: 2. Delete token  
activate MDES  
MDES -&gt; MDES: 3. Delete token mapping  
MDES --&gt; WS: 4. response  
deactivate MDES  
WS --&gt; AP: 5. response  
deactivate AP  
WS -&gt; SDK: 6. deliverMessage(paymentTokenDeleted)  
NOTE LEFT: See: Handle Message From Server  
deactivate WS  
activate SDK  
deactivate MDES  
alt Request session if required  
SDK -&gt; MDES: 7. request session  
activate MDES  
MDES --&gt; SDK: 8. response  
MDES -&gt; WS: 9. sendRemoteNotificationMessage  
deactivate MDES  
activate WS  
WS -&gt; SDK: 10. deliverMessage(mdesRemoteMessage)  
NOTE LEFT: See: Handle Message From Server  
deactivate WS  
end  
SDK -&gt; MDES: 11. delete(tokenUniqueReference)  
activate MDES  
MDES --&gt; SDK: 12. response  
deactivate MDES  
SDK -&gt; SDK: 13. Delete transaction credentials, card profile  
SDK -&gt; MPA: 14. onPaymentInstrumentStatusChanged(id, status)  
deactivate SDK  
MPA --&gt; User: 15. show update view  
deactivate MPA  
@enduml

### Admin Device Token Suspension  


Payment Token can be suspended via admin panel.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES  
participant "Admin Panel" as AP  
AP -&gt; WS: 1. suspendToken(paymentTokenId)  
activate WS  
activate AP  
WS -&gt; MDES: 2. suspend token  
activate MDES  
MDES -&gt; MDES: 3. Suspend token  
MDES --&gt; WS: 4. response  
deactivate MDES  
WS --&gt; AP: 5. response  
deactivate AP  
WS -&gt; SDK: 6. deliverMessage(paymentTokenSuspend)  
NOTE LEFT: See: Handle Message From Server  
deactivate WS  
activate SDK  
SDK -&gt; SDK: 7. suspend  
SDK -&gt; MPA: 8. onPaymentInstrumentStatusChanged(id, status)  
deactivate SDK  
deactivate MPA  
@enduml

### Admin Device Token Unsuspension

Payment Token can be unsuspended via admin panel.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES  
participant "Admin Panel" as AP  
AP -&gt; WS: 1. unsuspendToken(paymentTokenId)  
activate WS  
activate AP  
WS -&gt; MDES: 2. unsuspend token  
activate MDES  
MDES -&gt; MDES: 3. Unsuspend token  
MDES --&gt; WS: 4. response  
deactivate MDES  
WS --&gt; AP: 5. response  
deactivate AP  
WS -&gt; SDK: 6. deliverMessage(paymentTokenUnsuspend)  
NOTE LEFT: See: Handle Message From Server  
deactivate WS  
activate SDK  
SDK -&gt; SDK: 7. activate  
SDK -&gt; MPA: 8. onPaymentInstrumentStatusChanged(id, status)  
deactivate SDK  
deactivate MPA  
... Replenishment ...  
note over SDK, MDES #1C1E3F: Just after token activation transaction credentials replenishment is performed by SDK\\r. See Transaction Credentials Automatic Replenishment diagram  
@enduml

### Admin IBAN Deletion

IBAN is stored in context of given User. Because of that IBAN is always deleted in context of User which belongs to. If other User also has the same IBAN then it is not deleted.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES  
participant "Admin" as AP  
AP -&gt; WS: 1. deleteIban(userId, ibanId)  
activate AP  
activate WS  
WS -&gt; WS: 2. deleteIbanForUser  
WS --&gt; AP: 3. response  
deactivate AP  
WS -&gt; WS: 4. getAllPaymentTokensForUserAndIban  
loop All Payment Tokens for given User and IBAN  
WS -&gt; MDES: 5. Delete token  
activate MDES  
MDES -&gt; MDES: 6. Delete token mapping  
MDES --&gt; WS: 7. response  
deactivate MDES  
alt Device Payment Token  
WS -&gt; SDK: 8. deliverMessage(paymentTokenDeleted)  
NOTE LEFT: See: Handle Message From Server  
deactivate WS  
activate SDK  
deactivate MDES  
alt Request session if required  
SDK -&gt; MDES: 9. request session  
activate MDES  
MDES --&gt; SDK: 9. response  
MDES -&gt; WS: 14. sendRemoteNotificationMessage  
deactivate MDES  
activate WS  
WS -&gt; SDK: 10. deliverMessage(mdesRemoteMessage)  
NOTE LEFT: See: Handle Message From Server  
deactivate WS  
end  
SDK -&gt; MDES: 11. delete(tokenUniqueReference)  
activate MDES  
MDES --&gt; SDK: 12. response  
deactivate MDES  
SDK -&gt; SDK: 13. Delete transaction credentials, card profile  
SDK -&gt; MPA: 14. onPaymentInstrumentStatusChanged(id, status)  
deactivate SDK  
MPA --&gt; User: 15. show update view  
deactivate MPA  
else Static Payment Token  
note over WS, MDES #1C1E3F: Unenroll Static Token from ACS  
end  
end  
@enduml

### Admin Static Token Deletion

Static Payment Token may be deleted via admin panel.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
participant "Wallet Server" as WS  
participant MDES  
participant "Admin Panel" as AP  
AP -&gt; WS: 1. deleteStaticToken(paymentTokenId)  
activate AP  
activate WS  
WS -&gt; MDES: 2. Delete token  
activate MDES  
MDES -&gt; MDES: 3. Delete token mapping  
MDES --&gt; WS: 4. response  
deactivate MDES  
WS --&gt; AP: 5. response  
deactivate AP  
deactivate WS  
deactivate WS  
...Unenroll static token...  
note over WS, MDES #1C1E3F: See Unenroll Static Token Diagram  
@enduml

### Admin Static Token Suspension

Static Payment Token may be suspended via admin panel.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
participant "Wallet Server" as WS  
participant MDES  
participant "Admin Portal" as AP  
AP -&gt; WS: 1. suspendStaticToken(paymentTokenId)  
activate AP  
activate WS  
WS -&gt; MDES: 2. Suspend token  
activate MDES  
MDES -&gt; MDES: 3. Suspend token  
MDES --&gt; WS: 4. response  
deactivate MDES  
WS --&gt; AP: 5. response  
deactivate AP  
deactivate WS  
deactivate WS  
@enduml

### Admin Static Token Unsuspension

Static Payment Token may be unsuspended via admin panel.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
participant "Wallet Server" as WS  
participant MDES  
participant "Admin Panel" as AP  
AP -&gt; WS: 1. unsuspendStaticToken(paymentTokenId)  
activate AP  
activate WS  
WS -&gt; MDES: 2. Unsuspend token  
activate MDES  
MDES -&gt; MDES: 3. Unsuspend token  
MDES --&gt; WS: 4. response  
deactivate MDES  
WS --&gt; AP: 5. response  
deactivate AP  
deactivate WS  
deactivate WS  
@enduml

### Admin User Deletion

During this process all data related to given User are deleted. Payment Tokens are deleted asynchronously.

@startuml  
skinparam ParticipantPadding 30  
skinparam BoxPadding 30  
skinparam noteFontColor #FFFFFF  
skinparam noteBackgroundColor #1C1E3F  
skinparam noteBorderColor #1C1E3F  
skinparam noteBorderThickness 1  
skinparam sequence {  
ArrowColor #1C1E3F  
ArrowFontColor #1C1E3F  
ActorBorderColor #1C1E3F  
ActorBackgroundColor #FFFFFF  
ActorFontStyle bold  
ParticipantBorderColor #1C1E3F  
ParticipantBackgroundColor #1C1E3F  
ParticipantFontColor #FFFFFF  
ParticipantFontStyle bold  
LifeLineBackgroundColor #1C1E3F  
LifeLineBorderColor #1C1E3F  
}  
actor User  
participant MPA  
participant "Wallet SDK" as SDK  
participant "Wallet Server" as WS  
participant MDES  
participant "Admin Panel" as AP  
AP -&gt; WS: 1. deleteUser(userId)  
activate AP  
activate WS  
WS -&gt; WS: 2. delete ibans, devices  
WS --&gt; AP: 3. response  
deactivate AP  
loop All Payment Tokens for given User  
WS -&gt; MDES: 4. delete token  
activate MDES  
MDES --&gt; WS: 5. response  
alt Static Token  
note over WS, MDES #1C1E3F: Unenroll Static Token from ACS  
end  
deactivate WS  
deactivate MDES  
end  
@enduml

<div class="wiki-content" id="bkmrk--2"></div><div class="wiki-content" id="bkmrk--3"></div><div class="wiki-content" id="bkmrk--4"></div><div class="wiki-content" id="bkmrk--5"></div>