generate_pin_data ¶

def generate_pin_data(
    self,
    generation_key_identifier: "capo_payment_cryptography_data.types.key_arn_or_key_alias_type.KeyArnOrKeyAliasType",
    encryption_key_identifier: "capo_payment_cryptography_data.types.key_arn_or_key_alias_type.KeyArnOrKeyAliasType",
    generation_attributes: "capo_payment_cryptography_data.types.pin_generation_attributes.PinGenerationAttributes",
    pin_block_format: "capo_payment_cryptography_data.types.pin_block_format_for_pin_data.PinBlockFormatForPinData",
    *,
    config_overrides: Optional[PaymentCryptographyDataClientConfig] = None,
    pin_data_length: Optional[
        "capo_payment_cryptography_data.types.integer_range_between4_and12.IntegerRangeBetween4And12"
    ] = None,
    primary_account_number: Optional[
        "capo_payment_cryptography_data.types.primary_account_number_type.PrimaryAccountNumberType"
    ] = None,
    encryption_wrapped_key: Optional[
        "capo_payment_cryptography_data.types.wrapped_key.WrappedKey"
    ] = None,
) -> "capo_payment_cryptography_data.types.generate_pin_data_output.GeneratePinDataOutput":
    """<p>Generates pin-related data such as PIN, PIN Verification Value (PVV), PIN Block, and PIN Offset during new card issuance or reissuance. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/generate-pin-data.html">Generate PIN data</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <p>PIN data is never transmitted in clear to or from Amazon Web Services Payment Cryptography. This operation generates PIN, PVV, or PIN Offset and then encrypts it using Pin Encryption Key (PEK) to create an <code>EncryptedPinBlock</code> for transmission from Amazon Web Services Payment Cryptography. This operation uses a separate Pin Verification Key (PVK) for VISA PVV generation. </p> <p>Using ECDH key exchange, you can receive cardholder selectable PINs into Amazon Web Services Payment Cryptography. The ECDH derived key protects the incoming PIN block. You can also use it for reveal PIN, wherein the generated PIN block is protected by the ECDH derived key before transmission from Amazon Web Services Payment Cryptography. For more information on establishing ECDH derived keys, see the <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/create-keys.html">Generating keys</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <p>For information about valid keys for this operation, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/keys-validattributes.html">Understanding key attributes</a> and <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/crypto-ops-validkeys-ops.html">Key types for specific data operations</a> in the <i>Amazon Web Services Payment Cryptography User Guide</i>.</p> <p> <b>Cross-account use</b>: This operation supports cross-account use when the key has a resource-based policy that grants access. For more information, see <a href="https://docs.aws.amazon.com/payment-cryptography/latest/userguide/security_iam_resource-based-policies.html">Resource-based policies</a>.</p> <p> <b>Related operations:</b> </p> <ul> <li> <p> <a>GenerateCardValidationData</a> </p> </li> <li> <p> <a>TranslatePinData</a> </p> </li> <li> <p> <a>VerifyPinData</a> </p> </li> </ul>

    Args:
        generation_key_identifier: <p>The <code>keyARN</code> of the PEK that Amazon Web Services Payment Cryptography uses for pin data generation.</p>
        encryption_key_identifier: <p>The <code>keyARN</code> of the PEK that Amazon Web Services Payment Cryptography uses to encrypt the PIN Block. For ECDH, it is the <code>keyARN</code> of the asymmetric ECC key.</p>
        generation_attributes: <p>The attributes and values to use for PIN, PVV, or PIN Offset generation.</p>
        pin_data_length: <p>The length of PIN under generation.</p>
        primary_account_number: <p>The Primary Account Number (PAN), a unique identifier for a payment credit or debit card that associates the card with a specific account holder.</p>
        pin_block_format: <p>The PIN encoding format for pin data generation as specified in ISO 9564. Amazon Web Services Payment Cryptography supports <code>ISO_Format_0</code>, <code>ISO_Format_3</code> and <code>ISO_Format_4</code>.</p> <p>The <code>ISO_Format_0</code> PIN block format is equivalent to the ANSI X9.8, VISA-1, and ECI-1 PIN block formats. It is similar to a VISA-4 PIN block format. It supports a PIN from 4 to 12 digits in length.</p> <p>The <code>ISO_Format_3</code> PIN block format is the same as <code>ISO_Format_0</code> except that the fill digits are random values from 10 to 15.</p> <p>The <code>ISO_Format_4</code> PIN block format is the only one supporting AES encryption.</p>

    Raises:
        capo_payment_cryptography_data.errors.access_denied_exception.AccessDeniedException: <p>You do not have sufficient access to perform this action.</p>
        capo_payment_cryptography_data.errors.internal_server_exception.InternalServerException: <p>The request processing has failed because of an unknown error, exception, or failure.</p>
        capo_payment_cryptography_data.errors.resource_not_found_exception.ResourceNotFoundException: <p>The request was denied due to an invalid resource error.</p>
        capo_payment_cryptography_data.errors.throttling_exception.ThrottlingException: <p>The request was denied due to request throttling.</p>
        capo_payment_cryptography_data.errors.validation_exception.ValidationException: <p>The request was denied due to an invalid request error.</p>
        capo_payment_cryptography_data.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_payment_cryptography_data.types.generate_pin_data_input.GeneratePinDataInput]",
    ) -> OperationResponse[
        "capo_payment_cryptography_data.types.generate_pin_data_output.GeneratePinDataOutput"
    ]:
        import capo_payment_cryptography_data._operations.payment_cryptography_data_plane.generate_pin_data

        output, http_response = (
            capo_payment_cryptography_data._operations.payment_cryptography_data_plane.generate_pin_data.generate_pin_data(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    def _redact_input(
        input_: "capo_payment_cryptography_data.types.generate_pin_data_input.GeneratePinDataInput",
    ) -> dict[str, Any]:
        import capo_payment_cryptography_data.types.generate_pin_data_input

        return capo_payment_cryptography_data.types.generate_pin_data_input.redact_sensitive(
            input_
        )

    def _redact_output(
        output: "capo_payment_cryptography_data.types.generate_pin_data_output.GeneratePinDataOutput",
    ) -> dict[str, Any]:
        import capo_payment_cryptography_data.types.generate_pin_data_output

        return capo_payment_cryptography_data.types.generate_pin_data_output.redact_sensitive(
            output
        )

    interceptors_, options_ = self.operation_options(
        config_overrides,
        OperationLogging(
            "GeneratePinData",
            redact_input=_redact_input,
            redact_output=_redact_output,
        ),
    )
    input_: capo_payment_cryptography_data.types.generate_pin_data_input.GeneratePinDataInput = {
        "generation_key_identifier": generation_key_identifier,
        "encryption_key_identifier": encryption_key_identifier,
        "generation_attributes": generation_attributes,
        "pin_block_format": pin_block_format,
    }
    if pin_data_length is not None:
        input_["pin_data_length"] = pin_data_length
    if primary_account_number is not None:
        input_["primary_account_number"] = primary_account_number
    if encryption_wrapped_key is not None:
        input_["encryption_wrapped_key"] = encryption_wrapped_key

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output