# Use Cases

### What Enrollment Creates

<span lang="EN-US" style="color: #3d4a5c; mso-ansi-language: EN-US;">Enrolling a card into Click to Pay creates two linked artefacts within the TSP's SRC System:</span>

<span lang="EN-US" style="mso-ansi-language: EN-US;"><span style="mso-list: Ignore;">•<span style="font: 7.0pt 'Times New Roman';"> </span></span></span><span lang="EN-US" style="color: #3d4a5c; mso-ansi-language: EN-US;">A Consumer Profile (SRC Profile): Tied to the cardholder's verified identity (email address and/or phone number). A single consumer profile can hold multiple enrolled cards across multiple networks.</span>

<span lang="EN-US" style="mso-ansi-language: EN-US;"><span style="mso-list: Ignore;">•<span style="font: 7.0pt 'Times New Roman';"> </span></span></span><span lang="EN-US" style="color: #3d4a5c; mso-ansi-language: EN-US;">A Token (Network Token / DPAN): A surrogate value that replaces the PAN for use at Click to Pay checkout. The token is domain-controlled — it is only usable in the SRC context and is bound to the consumer's profile.</span>

<span lang="EN-US" style="color: #3d4a5c; mso-ansi-language: EN-US;">From an issuer's perspective, enrollment is the act of provisioning the cardholder's PAN and identity into the TMP API, which in turn creates or updates the SRC Profile and requests token issuance from the relevant network SRCS.</span>

### Available Enrollment Channels

<span lang="EN-US" style="color: #3d4a5c; mso-ansi-language: EN-US;">An issuer may offer Click to Pay enrollment through any or all of the following channels. The TMP API is the same regardless of channel; the channel determines how the cardholder's identity is verified and consent is captured before the API call is made.</span>

<table border="1" cellpadding="0" cellspacing="0" class="MsoTable15Grid1LightAccent5" id="bkmrk-channel-description-" style="width: 1040px; border-collapse: collapse; border: none;" width="623"><tbody><tr style="mso-yfti-irow: -1; mso-yfti-firstrow: yes; mso-yfti-lastfirstrow: yes; height: 31.35pt;"><td style="width: 210.458px; border-width: 1pt 1pt 1.5pt; border-style: solid; border-color: rgb(189, 214, 238) rgb(189, 214, 238) rgb(156, 194, 229); border-image: initial; background: rgb(28, 30, 63); padding: 5.65pt 5.4pt; height: 31.35pt;" width="141">**<span style="font-size: 10.0pt; color: white;">Channel</span>**

</td><td style="width: 165.255px; border-top: 1pt solid rgb(189, 214, 238); border-left: none; border-bottom: 1.5pt solid rgb(156, 194, 229); border-right: 1pt solid rgb(189, 214, 238); background: rgb(28, 30, 63); padding: 5.65pt 5.4pt; height: 31.35pt;" width="96">**<span style="font-size: 10.0pt; color: white;">Description</span>**

</td><td style="width: 455.661px; border-top: 1pt solid rgb(189, 214, 238); border-left: none; border-bottom: 1.5pt solid rgb(156, 194, 229); border-right: 1pt solid rgb(189, 214, 238); background: rgb(28, 30, 63); padding: 5.65pt 5.4pt; height: 31.35pt;" width="386">**<span style="font-size: 10.0pt; color: white;">Typical Consent Mechanism</span>**

</td></tr><tr style="mso-yfti-irow: 0;"><td style="width: 210.458px; border-right: 1pt solid rgb(189, 214, 238); border-bottom: 1pt solid rgb(189, 214, 238); border-left: 1pt solid rgb(189, 214, 238); border-image: initial; border-top: none; padding: 5.65pt 5.4pt;" valign="top" width="141">**<span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">Mobile Banking App</span>**

**<span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">(user initiated)</span>**

</td><td style="width: 165.255px; border-top: none; border-left: none; border-bottom: 1pt solid rgb(189, 214, 238); border-right: 1pt solid rgb(189, 214, 238); padding: 5.65pt 5.4pt;" valign="top" width="96"><span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">Cardholder opts in via the issuer's iOS or Android app.</span>

</td><td style="width: 455.661px; border-top: none; border-left: none; border-bottom: 1pt solid rgb(189, 214, 238); border-right: 1pt solid rgb(189, 214, 238); padding: 5.65pt 5.4pt;" valign="top" width="386"><span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">In-app consent screen + biometric or PIN confirmation.</span>

<span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;"> </span>

**<span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">Channel supported by synchronous card enrollment endpoint.</span>**

</td></tr><tr style="mso-yfti-irow: 1;"><td style="width: 210.458px; border-right: 1pt solid rgb(189, 214, 238); border-bottom: 1pt solid rgb(189, 214, 238); border-left: 1pt solid rgb(189, 214, 238); border-image: initial; border-top: none; padding: 5.65pt 5.4pt;" valign="top" width="141">**<span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">Internet web banking</span>**

**<span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">(user initiated)</span>**

</td><td style="width: 165.255px; border-top: none; border-left: none; border-bottom: 1pt solid rgb(189, 214, 238); border-right: 1pt solid rgb(189, 214, 238); padding: 5.65pt 5.4pt;" valign="top" width="96"><span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">Cardholder opts in via the issuer's online banking portal</span>

</td><td style="width: 455.661px; border-top: none; border-left: none; border-bottom: 1pt solid rgb(189, 214, 238); border-right: 1pt solid rgb(189, 214, 238); padding: 5.65pt 5.4pt;" valign="top" width="386"><span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">Web consent form + OTP or step-up authentication</span>

**<span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;"> </span>**

**<span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">Channel supported by synchronous card enrollment endpoint.</span>**

</td></tr><tr style="mso-yfti-irow: 2;"><td style="width: 210.458px; border-right: 1pt solid rgb(189, 214, 238); border-bottom: 1pt solid rgb(189, 214, 238); border-left: 1pt solid rgb(189, 214, 238); border-image: initial; border-top: none; padding: 5.65pt 5.4pt;" valign="top" width="141">**<span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">Card management portal</span>**

**<span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">(user initiated)</span>**

</td><td style="width: 165.255px; border-top: none; border-left: none; border-bottom: 1pt solid rgb(189, 214, 238); border-right: 1pt solid rgb(189, 214, 238); padding: 5.65pt 5.4pt;" valign="top" width="96"><span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">Standalone issuer-hosted portal for card services</span>

</td><td style="width: 455.661px; border-top: none; border-left: none; border-bottom: 1pt solid rgb(189, 214, 238); border-right: 1pt solid rgb(189, 214, 238); padding: 5.65pt 5.4pt;" valign="top" width="386"><span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">Portal login + SMS OTP or email OTP</span>

**<span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;"> </span>**

**<span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">Channel supported by synchronous card enrollment endpoint.</span>**

</td></tr><tr style="mso-yfti-irow: 3; mso-yfti-lastrow: yes;"><td style="width: 210.458px; border-right: 1pt solid rgb(189, 214, 238); border-bottom: 1pt solid rgb(189, 214, 238); border-left: 1pt solid rgb(189, 214, 238); border-image: initial; border-top: none; padding: 5.65pt 5.4pt;" valign="top" width="141">**<span style="font-size: 10.0pt; color: #3d4a5c;">No UI, auto enrollment </span>**

**<span style="font-size: 10.0pt; color: #3d4a5c;">(issuer initiated)</span>**

</td><td style="width: 165.255px; border-top: none; border-left: none; border-bottom: 1pt solid rgb(189, 214, 238); border-right: 1pt solid rgb(189, 214, 238); padding: 5.65pt 5.4pt;" valign="top" width="96"><span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">Issuer pushes enrollment without a real-time cardholder session</span>

</td><td style="width: 455.661px; border-top: none; border-left: none; border-bottom: 1pt solid rgb(189, 214, 238); border-right: 1pt solid rgb(189, 214, 238); padding: 5.65pt 5.4pt;" valign="top" width="386"><span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">Prior consent captured (T&amp;Cs presented alongside card activation, opt-in campaign, card issuance agreement)</span>

<span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;"> </span>

<span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;"> </span>

**<span lang="EN-US" style="font-size: 10.0pt; color: #3d4a5c; mso-ansi-language: EN-US;">Channel supported by asynchronous bulk enrollment endpoint.</span>**

</td></tr></tbody></table>

### Identity Verification and Authentication Requirements

<span lang="EN-US" style="color: #3d4a5c; mso-ansi-language: EN-US;">The SRC specification requires that a cardholder's identity be verified before their card is enrolled. This is the issuer's responsibility. The TMP carries the verified identity attributes in the enrollment request payload but does not perform identity verification itself.</span>

<span lang="EN-US" style="mso-ansi-language: EN-US;"><span style="mso-list: Ignore;">•<span style="font: 7.0pt 'Times New Roman';"> </span></span></span><span lang="EN-US" style="color: #3d4a5c; mso-ansi-language: EN-US;">For user-initiated flows: The issuer's banking application must authenticate the cardholder (e.g., via app PIN, biometric, or step-up OTP) before submitting the enrollment API request. The authentication assurance level must meet the network's minimum requirement.</span>

<span lang="EN-US" style="mso-ansi-language: EN-US;"><span style="mso-list: Ignore;">•<span style="font: 7.0pt 'Times New Roman';"> </span></span></span><span lang="EN-US" style="color: #3d4a5c; mso-ansi-language: EN-US;">For issuer-initiated async flows: The issuer must hold a record of prior consent. This is typically captured at card issuance via terms and conditions, an explicit opt-in campaign, or a standing mandate. Regulatory requirements (e.g., GDPR, PSD2) govern the validity of this prior consent.</span>

### How to Implement User Initiated Enrollment

#### Sequence diagram, happy path

<span lang="EN-US" style="mso-ansi-language: EN-US;"> </span>

[![Click 2 pay diagram.png](https://developer.verestro.com/uploads/images/gallery/2026-03/scaled-1680-/click-2-pay-diagram.png)](https://developer.verestro.com/uploads/images/gallery/2026-03/click-2-pay-diagram.png)

#### API Documentation

API technical documentation can be found on: [TMP API](https://developer.verestro.com/books/token-management-platform/page/tmp-api) and [Issuer API](https://developer.verestro.com/books/token-management-platform/page/issuer-api) pages. Details may differ, depending on implementation approach, but core APIs are:

1. **TMP API:** POST [/issuer/push-provisioning/c2p](https://developer.verestro.com/books/token-management-platform/page/tmp-api#operations-tag-Click_To_Pay) Issuer mobile app backend calls Verestro TMP to enroll a card to Click 2 pay.
2. **TMP API:** POST [/issuer/push-provisioning/tokens/searches](https://developer.verestro.com/books/token-management-platform/page/tmp-api#operations-tag-Get_Tokens) Issuer mobile app backend calls Verestro TMP to check existing token statuses and display or hide "Add to Click to Pay" button in mobile application for better user experience, base on the response. If the card has active Click to Pay token, user shouldn't be able to click "Add to Click to Pay" button.
3. **ISSUER API:** POST [/card-verifications](https://developer.verestro.com/books/token-management-platform/page/issuer-api#operations-tag-card-verifications) Verestro TMP will call Issuer/Processor Card Management System to verify card details and status during predigitization, after enrollment initiation.
4. **TMP API:** POST [/issuer/v2/card-events](https://developer.verestro.com/books/token-management-platform/page/tmp-api#operations-tag-Card_Events) Card Management System (issuer or processor) calls Verestro TMP to keep us synchronised with token status in MDES/VTS. TMP also performs token lifecycle actions in MDES/VTS, basing on this request.