This page contains definitions for every term used across the developer documentation — organized alphabetically. Specific, often capitalized, terms that appear elsewhere in the documents are defined here. Where a term has a specific technical meaning that differs from colloquial usage, that distinction is called out.
AAV — Accountholder Authentication Value. Mastercard's equivalent of the CAVV — a cryptographic token generated when a cardholder successfully authenticates via 3-D Secure (ID Check by Mastercard), included in the authorization to provide liability shift. See 3-D Secure.
Account — An internal ledger maintained by the platform, not addressable as a REST resource. Two kinds exist: the Cardholder Account (auto-created when a Cardholder is created, segregating that cardholder's funds at the platform level) and the Card Account (one per Card, representing the card's balance via ledgerBalance and availableBalance). See Accounts, Wallets & Deposit Addresses. Distinct from Wallet.
Acquirer — The financial institution (bank) that holds the merchant's account, contracts with merchants to accept card payments, and settles funds to the merchant. See Stakeholders in a Card Program.
Acquirer Processor — The technology platform on the acquiring side, operating on behalf of the Acquirer. See Stakeholders in a Card Program.
AML — Anti-Money Laundering. A framework of laws, regulations, and procedures designed to prevent the conversion of criminally obtained money into legitimate funds. Relevant to the platform in the context of unallocated deposits and Know-Your-Transaction obligations. See Suspense accounts.
API Key — The X-API-Key header required on every API request, alongside an mTLS client certificate. Comes in two scopes — Tenant-level (Account Management) and Program-level (the documented API) — and implicitly determines which Program a request applies to. See Authentication & Environments.
API User — A credential set (mTLS certificate + API key) under a Tenant, used to authenticate requests to either Account Management or the program-level API. Multiple API users can exist under one Tenant. See API Users, Tenants & Programs.
Authorization — The first phase of a card transaction lifecycle. A request is routed from merchant to acquirer to card network to issuer processor, which approves or declines it in real time (typically within seconds). An approved authorization places a hold on the cardholder's available funds without moving money. See The Card Transaction Lifecycle.
Authorization Hold — A reservation of funds on a Card Account following an approved authorization. Reduces availableBalance but the funds haven't left the account until clearing occurs.
availableBalance — The portion of a card's balance that is fully cleared and available to spend. Contrasts with ledgerBalance. See Accounts, Wallets & Deposit Addresses.
BIN — Bank Identification Number — the digits identifying the network member (which may be the Issuer, an Issuer Bank, or the Issuer Processor) through which a card program operates, cards are issued, and network routing occurs. See Stakeholders in a Card Program.
Card — A virtual or physical payment card issued to a Cardholder within a Program. Each card has its own Card Account, transaction limit, and set of Deposit Addresses. See Cards: Virtual & Physical.
Card Account — See Account.
Card Design — The visual and physical specification for a physical card. Each Program has six Card Design slots (0–5); slot 0 is mandatory. See Card Programs & Designs.
Card Network (also: Scheme) — Visa, Mastercard, or similar organizations that operate the switching infrastructure between acquirers and issuers, set interchange fee schedules, and define brand standards. See Stakeholders in a Card Program.
Cardholder — A natural person onboarded into a Program, subject to KYC/compliance review, and holding one or more Cards. Always a natural person — corporate entities are not Cardholders. See Program Architecture.
Cardholder Account — See Account.
CAVV — Cardholder Authentication Verification Value. Visa's cryptographic token proving a cardholder authenticated via 3-D Secure (Verified by Visa). Provides liability shift when included in an authorization. See 3-D Secure.
Clearing — The second phase of a card transaction lifecycle. Merchants submit authorized transactions in batches; the card network sorts these by issuer and presents each for posting. The authorization hold converts to a posted debit. See The Card Transaction Lifecycle.
CNP — Card Not Present. A transaction where the physical card is not presented — online purchases, phone orders, etc. Higher fraud risk than card-present transactions; 3-D Secure provides an authentication layer for CNP. See 3-D Secure.
Compliance Decline — Cardholder status = 2. KYC review resulted in a decline by the compliance provider. May be retryable in some cases. See Cardholders & the Compliance Lifecycle.
Correspondent Banking — The network of interbank relationships that facilitates international fiat transfers. The clearing window for bank-rail deposits (~3–5 business days) reflects the time funds take to move through this network. See Funding & Deposits.
cryptoAddresses — The array of blockchain Deposit Addresses provisioned for a Card at issuance. Retrieved via GET /cards/{cardId} or GET /cards/{cardId}/details. See Funding & Deposits.
DCC — Dynamic Currency Conversion. Often, a merchant-side (not issuer-side) conversion at the point of sale, converting the transaction to the cardholder's home currency at the merchant's (often unfavorable) rate. In the platform context, also the dynamic conversion of any source fiat currency or digital asset to the card program's base currency. See Embedded FX & Cross-Border Fees.
Decimal-Implied Integer — The convention used for all monetary amounts in the API: the integer value represents the amount in the currency's smallest unit (cents for USD/CAD, pence for GBP, euro- cents for EUR). 1000 = $10.00 in USD. See ISO Code Conventions.
Deposit Address — A blockchain address auto-generated for a Card at issuance, one per supported chain/format. Used as a funnel for digital-asset straight-through processing (STP) into the Card Account. Not a balance-holding resource. Distinct from Wallet. See Accounts, Wallets & Deposit Addresses.
Didit — The default hosted KYC provider used in the standard compliance flow. After kyc-submit, an applicationLink pointing to a Didit-hosted session is returned for the cardholder to complete identity verification. See Cardholders & the Compliance Lifecycle.
FCrDNS — Forward-Confirmed Reverse DNS. A network-level security check that verifies a calling IP address has both an A record (domain → IP) and a PTR record (IP → domain) that are mutually consistent, and that the domain appears in the mTLS certificate's CN/SAN. See IP Allowlisting & Network Security.
Finality — The point at which a blockchain transaction is considered practically irreversible. Varies by chain. The availableBalance update for crypto deposits requires finality (plus successful off-ramp). See Digital-Asset Rails & Custody.
FX Spread — The markup applied to a currency conversion over the mid-market reference rate. The platform's embedded pool of liquidity partners and market makers applies a dynamic spread. See Embedded FX & Cross-Border Fees.
HD Wallet — Hierarchical Deterministic wallet. A cryptographic architecture that derives an effectively unlimited number of addresses from a single master seed, using standardized derivation paths. Underlies the platform's automatic per-card, per-chain deposit address generation. See Digital-Asset Rails & Custody.
HSM — Hardware Security Module. A physical device that generates, stores, and uses cryptographic keys in a tamper-resistant environment. Used in the platform's MPC/TSS custody architecture. See Security Compliance & Data Protection.
Idempotency — The property that retrying the same operation produces the same outcome as performing it once. All GET endpoints are safe to retry. Write operations have built-in platform-side idempotency mechanisms but do not expose an idempotency-key — double-check whether the operation succeeded before retrying, rather than retrying blindly. See Errors & Status Codes.
Interchange — A fee paid by a merchant's acquirer to a cardholder's issuer for each transaction, set by the card network. The platform replaces the traditional multi-party interchange-split model. See Interchange & Platform Economics.
ISO 3166-1 — The international standard for country codes, published in three formats: Alpha-2 (2-letter), Alpha-3 (3-letter), and Numeric (3-digit). See ISO Code Conventions.
Issuer — Often used interchangeably for the party that issues cards to cardholders (on this platform, the Tenant) and the issuer bank or licensed financial institution on the issuer-side; sometimes a direct or indirect member of the card network(s). In this platform model, the party that is authorized to issue cards to cardholders corresponds to the Tenant's legal entity (O field in the mTLS certificate). See Stakeholders in a Card Program.
Issuer Bank — A fully licensed, chartered financial institution that holds cardholder funds and processes transactions in a regulated capacity. Required somewhere within the issuer parties whenever the network member or another issuer party isn't itself a chartered bank — for example, when an issuer processor holds direct network membership but cannot itself hold deposits. See Stakeholders in a Card Program.
Issuer Processor — The technology platform that performs authorization, ledger management, and card lifecycle operations on behalf of the Issuer. The Axys platform orchestrates the issuer parties, including the issuer processor. See Stakeholders in a Card Program.
ITIL Priority Matrix — IT Infrastructure Library's framework for categorizing incidents by Urgency × Impact into Priority levels (P1–P5). Used for support ticket priority classification. See Support Tickets.
ITU — International Telecommunication Union. Maintains the international dialing code standards (E.164) used for callingCode fields. See ISO Code Conventions.
KYB — Know Your Business. The business-verification equivalent of KYC — confirming the legal existence, ownership structure, and beneficial owners of a corporate entity, as distinct from verifying an individual person.
KYC — Know Your Customer. The process of verifying a customer's identity, typically by checking government-issued photo ID, proof of address, and (for biometric systems like Didit) liveness verification. Required for all Cardholders. See Cardholders & the Compliance Lifecycle.
KYT — Know Your Transaction. A compliance framework requiring the monitoring and analysis of transaction activity to detect suspicious patterns. Relevant to unallocated deposits in suspense accounts. See Funding & Deposits.
ledgerBalance — The total balance on a Card Account including amounts that are in-process, pending, or on hold (authorization holds, uncleared deposits). Contrasts with availableBalance. See Accounts, Wallets & Deposit Addresses.
Liveness Verification — A biometric check (selfie or video) comparing the cardholder's real-time appearance against their submitted photo ID, used in the KYC process to prevent identity fraud. Part of the Didit-hosted KYC flow.
MCC — Merchant Category Code. A four-digit code assigned by the card network to classify a merchant's type of business. Used to determine interchange rates, authorization rules, and certain fraud risk assessments.
MDR — Merchant Discount Rate. The fee a merchant pays to their acquirer per transaction, which includes interchange, card network assessment fees, and the acquirer's own margin. See Interchange & Platform Economics.
Merchant — The business accepting the card payment at the "other end" of a transaction from the cardholder's perspective.
MPC — Multi-Party Computation. A cryptographic technique allowing multiple parties to jointly compute a function (in this case, a digital signature) without any single party having access to the complete private key. Underlies the platform's institutional custody architecture. See Security Compliance & Data Protection.
mTLS — Mutual TLS. A variant of TLS where both parties (client and server) present certificates, enabling mutual authentication. Required for every API call to the platform. See mTLS Certificates & CSR.
Network Member — The party holding direct (principal or affiliate) membership with a card network and the associated BIN. May be the Issuer, an Issuer Bank, the Issuer Processor, a Program Manager, or a third party — whichever party holds this membership is legally and financially liable for cards issued under it. See Stakeholders in a Card Program.
OFAC — Office of Foreign Assets Control. The US government agency that administers sanctions lists. All onboarded parties and transactions are screened programmatically against OFAC and equivalent international sanctions lists. Global onboarding is available except where OFAC sanctions apply (other restrictions may apply from time to time or on a case-by-case basis).
Off-Ramp — The conversion of a digital asset into fiat currency (the reverse of an on-ramp). In the platform's model, digital-asset deposits are off-ramped to the card's base currency automatically, typically at finality. See Funding & Deposits.
On-Ramp — The conversion of fiat currency into a digital asset. The reverse of an off-ramp.
OTP — One-Time Passcode. A short-lived, single-use code used for authentication. In the platform context, specifically the code delivered to a cardholder to complete a 3-D Secure challenge. See 3-D Secure.
PAN — Primary Account Number. The 16-digit card number. Handled as highly sensitive data — stored and transmitted under PCI-DSS requirements. See Cards: Virtual & Physical.
PCI-DSS — Payment Card Industry Data Security Standard. The security standard that governs how cardholder data (PAN, CVV, etc.) is handled. See Security Compliance & Data Protection.
PFX — PKCS#12 format, a bundle containing a certificate and private key in a single password-protected file. Suitable for development/Postman use; not recommended for production servers. See mTLS Certificates & CSR.
Program — A configured card program under a Tenant, with its own base currency, transaction limit ceiling, card designs, fee structure, and program-level API credentials. The scope implicit in every program-level API call. See Program Architecture and Card Programs & Designs.
Program Manager — The entity that designs and commercially operates a card program, holds and manages the stakeholder relationships, in collaboration with an Issuer and other issuer parties. This platform facilitates the program management as a service. See Stakeholders in a Card Program.
PTR record — Pointer record in DNS. The reverse DNS record that maps an IP address back to a hostname. Required for the FCrDNS check that the platform applies to all incoming API requests. See IP Allowlisting & Network Security.
SAN — Subject Alternative Name. An extension to an X.509 certificate listing additional hostnames and/or IP addresses the certificate is valid for. Every domain and IP that will call the API must be listed as a SAN. No wildcards are accepted. See mTLS Certificates & CSR.
Settlement — The third phase of a card transaction lifecycle — actual fund movement between parties, reconciling the obligations created during clearing. Traditional timing: T+1 to T+5 business days. The platform generally settles T+0. See The Card Transaction Lifecycle and Interchange & Platform Economics.
SOC 2 — Service Organization Control 2. An independent audit of a service provider's controls over security, availability, and confidentiality. The platform infrastructure holds Type I and Type II SOC 2 certifications. See Security Compliance & Data Protection.
SoF — Source of Funds. A compliance requirement to verify that the origin of deposited funds is legitimate. Unallocated deposits in suspense accounts trigger SoF investigation obligations. See Funding & Deposits.
STP — Straight-Through Processing. Automated processing of a transaction from receipt to completion without manual intervention. In the platform context, the automatic detection, confirmation, off-ramp, and balance credit of digital-asset deposits. See Funding & Deposits.
SumSub — An alternative KYC provider supported by the platform when sumsubEnabled = 1. Uses a token-based SDK flow rather than the Didit-hosted redirect URL. See Cardholders & the Compliance Lifecycle.
Suspense Account — A holding account for inbound deposits that cannot be automatically matched and routed to a specific Card or Wallet. Carries AML/KYT/SoF compliance obligations and uncertain resolution timelines. See Funding & Deposits.
T+0 — Settlement on the same business day as the transaction. The platform generally settles at T+0, contrasting with the T+1 to T+5+ timelines typical of traditional card programs. See Interchange & Platform Economics.
TEE — Trusted Execution Environment. A hardware-isolated, tamper-resistant environment (e.g. Intel SGX) where cryptographic operations can be performed without the key material being accessible even to the operating system. Used in the platform's MPC/TSS key-share architecture. See Security Compliance & Data Protection.
Tenant — The authorized entity that holds a direct relationship with the Platform, creates and manages Programs, and provides the Program sponsorship or platform relationship. Corresponds to the O field in the mTLS certificate. See Program Architecture.
Trace Notification — An optional API call (POST /cards/{cardId}/bank-deposit or POST /wallets/{walletId}/bank-deposit) informing the platform of an inbound bank transfer before it arrives, to expedite straight-through processing. See Funding & Deposits.
TSS — Threshold Signature Scheme. A cryptographic protocol in which a minimum threshold (M) of key-share holders out of a total set (N) must participate to generate a valid signature. Used in the platform's MPC architecture to prevent any single party from unilaterally moving funds. See Security Compliance & Data Protection.
VASP — Virtual Asset Service Provider. A regulated entity that provides services involving digital assets. Operating a digital-asset custody service may require VASP licensing in various jurisdictions.
Wallet — An explicitly created (POST /wallets), named, fiat-only sub-ledger within a Program. Used for corporate fund pools, departmental budgets, or family accounts. Always the source in a transfer (never the destination in the destinationType context). Distinct from Deposit Address and Account. See Accounts, Wallets & Deposit Addresses.
Webhook — An HTTP callback from the platform to a URL registered by the integrator, delivering event notifications. Currently used for 3-DS OTP delivery and certificate expiry reminders. See Webhooks & Callback Notifications.