Introduction
Welcome to QI Tech's Card Issuance Fraud Prevention API! You can use our API to access the endpoints in order to receive the response of a transaction, as well as to update the status of a transaction.
Please note that this API is intended for card issuers — that is, companies that put the card in the cardholder's hands so they can transact. Its purpose is to perform all security analysis on your client's transactions, preventing fraud and other types of incidents (transactions resulting from robberies, for example).
How it works
The integration has three calls. All of them use the same API Key in the Authorization header.
| Step | Call | What it does |
|---|---|---|
| 1 | POST /card_issuance/transaction | Sends the transaction before authorization and returns the recommendation in fraud_status. |
| 2 | PUT /card_issuance/transaction/{id} | Reports the actual outcome (captured, cancelled, chargeback). Feeds the model back. |
| 3 | GET /card_issuance/transaction/{id} | Retrieves the current state and the event history. |
In addition, behavioral alerts about the cardholder are delivered through Webhook.
The fraud_status returned in step 1 takes one of these values:
| Value | Recommended action |
|---|---|
automatically_approved | Generate the authorization code. |
automatically_declined | Decline the authorization. |
not_analyzed | The request used analyze=false; follow your own decision. |
The Transaction page opens with a minimum payload of 13 fields and brings ready-to-use examples in Python, PHP, Node.js, Java, C# and curl.
Issues?
We're not a company that hides behind an API! Reach out to our support team and we'll get back to you as soon as possible. Feel free to give us a call if you want a quicker answer!
We love feedback
Even if you've already solved your issue or it is something very simple (even a typo or a poorly organized section that you already figured out), send us an email. That way we make the documentation more and more practical, and the next person won't have to go through the same difficulties you faced!
Environments
We provide two environments for our clients. The base URLs for the APIs are:
- Production -
https://api.caas.qitech.app/card_issuance/ - Sandbox -
https://api.sandbox.caas.qitech.app/card_issuance/
Real personal or company data must not be used in QI Tech's Sandbox environments.
In the Sandbox environment, submitted analyses are not charged and are responded to according to predefined rules.
For transaction analysis, the following rule is applied based on the transaction amount:
| Minimum | Maximum | Decision |
|---|---|---|
| 10000 | - | automatically_approved |
| 0 | 9999 | automatically_declined |
Only HTTPS
For security reasons, all communication with QI Tech's APIs must be conducted over HTTPS. To ensure that no HTTP calls are made, whether by oversight or any other reason, this server only makes port 443 available with TLS 1.2 communication. Requests using other protocols will be automatically rejected.
Authentication
To authenticate a request, use the following code:
# In the shell, you only need to add the appropriate header to each request
curl "api_endpoint_here"
-H "Authorization: EXAMPLE-OF-API-KEY"
Replace the API key 'EXAMPLE-OF-API-KEY' with your own key, obtained from our support team.
We use an API Key to grant access to our API. It was likely already sent to you by email. If you haven't received your key yet, please send an email to suporte.caas@qitech.com.br.
Our API expects to receive the API Key in all requests to our server in a header like the one below:
Authorization: EXAMPLE-OF-API-KEY
You must replace EXAMPLE-OF-API-KEY with the API Key received from support.