Unique Student Identifier

Transcription

1 Unique Student Identifier Technical Service Contract for the Unique Student Identifier Web Service Comprising the following service operations: Verify single USI Verify multiple USIs Create single USI Create multiple USIs (processed asynchronously) Retrieve the result of a request to create multiple USIs Update Personal Details Update Contact Details Get Non DVS Document Types Contract Version 1.5 February 2015 Copyright Commonwealth of Australia

2 Document Details Security classification Unclassified Dissemination limiting marking None Author Department of Industry Document Status Approved February 2015 Copyright Commonwealth of Australia

3 Document Administration Service Name Contract version 1.5 File Location File Name Revision History USI Web Service USI Document SharePoint Document: USI TSC.docx Diagram masters: USI TSC feeder.pptx Revision Date Author Details Oct 2012 Malcolm Young First Draft Dec 2012 Malcolm Young Added WSDL Dec 2012 Malcolm Young Review comments inc Dec 2012 Malcolm Young Final revision Dec 2012 Malcolm Young Updated following additional comments Feb 2013 Luke Elliott Fixed syntax errors, remove unnecessary fields, some clarification Feb 2013 Luke Elliott Major revision to the WSDL, XSD and various fields Mar 2013 Luke Elliott, Trent Kerin Updated WSDL and corrected details based on review feedback Mar 2013 Ben Bildstein Polish Apr 2013 Luke Elliott, Trent Kerin Actioning comments from USI Task Force Apr 2013 Ben Bildstein Polish May 2013 Ben Bildstein, David Spencer Incorporate David Spencer s changes May 2013 Ben Bildstein, Luke Elliott Bulk verify July 2013 Jason Chase Updated validation rules for DVS documents July 2013 Jason Chase Updated phone number minimum length validations July 2013 Patrick McNamara Added production end point addresses Aug 2013 Trent Kerin Added WSDL with WCF section Sep 2013 Jason Chase Updated Bulk Verify sections Oct 2013 Ben Bildstein Updated example requests and responses Nov 2013 Trent Kerin Removed Change of Name and Marriage documents Dec 2013 Trent Kerin Updated definition of ErrorType allowable codes. Mentioned that some of the codes in Fault Values appear as regular errors Dec 2013 Nick Evans Updated the Medicare card document type. And Updated the WSDL to match Jan 2014 Kurt Marr Updated to include contact details changes Jan 2014 Ben Bildstein Update to contract version Jan 2014 David Spencer Minor wording revisions Mar 2014 Harold Hotham Updates for ImmiCard, Error 1002 and new passport number Page 3 of 90 Version 1.5 February 2015

4 Mar 2014 Harold Hotham Update for WSDL and preferred contact method Apr 2014 Harold Hotham Update for unique address Apr 2014 Harold Hotham Contract version 1.2, some minor changes to field names and validation rules May 2014 Ben Bildstein Merged David Spencer s document version 1.21 with Harold Hotham s document version May 2014 Kurt Marr Modified UserReference Element May 2014 Patrick McNamara Update error code list May 2014 Trent Kerin Specify Visa CountryOfIssue as 1-80 chars May 2014 Trent Kerin Update WSDL endpoints and SOAP actions to target implementation. Added brief section about service identifiers June 2014 Trent Kerin, Neville Schroder Removed service identifiers section, in favour of the AppliesTo argument for STS being identical to the USI endpoint URL. Updated WSDL to reflect latest changes. Cut out most of Appendix D as the new WSDL now auto-configures everything except client certificate. Corrections to textual descriptions of DVSCheckRequired and FirstName and FamilyName elements in the Personal Details Type July 2014 Trent Kerin Fixed typo in single name Bulk Verify example July 2014 Harold Hotham Rewrite of birth certificate section to include conditional field info August 2014 Patrick McNamara Updated the validation rules for TownCityOfBirth, SuburbTownCity, Address1, Address2 and InternationalAddress. Removed blank Address2 from the sample requests. WSDL updated to reflected these changes September 2014 Harold Hotham Updated Endpoints and Operations section with prod urls October 2014 Patrick McNamara Added GetNonDvsDocumentType, UpdatePersonalDetails and UpdateContactDetails. Replaced wdsl xml in November December December 2014 Harold Hotham Kurt Marr Kurt Marr appendix to link to the real wsdl. Added Error 3250, this error already existed but did not have a code. Should be very difficult to hit this error. It represents an unexpected error when performing schema validation. Added error 3370 for suspended DVS document types Fixed Medicare IndividualRefNumber valid values Page 4 of 90 Version 1.5 February 2015

5 December Harold Hotham Dec. 14 Harold Hotham Updated VerifyUSIResponse to indicate fields are not mandatory Added Locate USI Page 5 of 90 Version 1.5 February 2015

6 Release notes 3PT Deployment date Production deployment date New features and enhancements 12/11/14 11/12/14 Description Breaking 1 / Non-breaking 2 1. New method for updating personal details via Web Service Non-breaking 2. New method for updating contact details via Web Service Non-breaking 3. New method to get a list of Non-DVS ID documents Non-breaking 4. Update to Create USI to handle two new claims for Non-DVS IDs Non-breaking Bug fixes None - Known issues None - 1 Breaking change - Indicates that this new feature/enhancement/bug fix must be implemented by the Production deployment date in order to continue using the USI Web Service. 2 Non-breaking change - Indicates this new feature/enhancement/bug fix is available, but can be adopted when appropriate. Page 6 of 90 Version 1.5 February 2015

7 Approvals Approved by: Name: Deborah Morgan Position: Manager, USI Project Signed: Date: Page 7 of 90 Version 1.5 February 2015

8 Terminology ABN ATO AUSkey Credential Device Key Digital Certificate DVS Identity Token OASIS RTO SAML SAML Assertion Security Token SMS SMS Vendor SOAP Australian Business Number Australian Taxation Office Australian Government issued digital certificate Something used to prove their digital identity AUSKey specifically for use with web services Proof of identity data Document Verification Service a service to verify evidence of identity documents. More information is available from See Security Token A standards body 'Organization for the Advancement of Structured Information Standards'. See Section 1.3, References and Related Documents. Registered Training Organisation. A provider of accredited VET courses and training. Secure Assertion Mark-up Language an OASIS standard A signed XML block asserting identity of a user. The XML conforms to the SAML Core schema. This is an industry term for an assertion about identity that is issued by an Identity Provider. In the context of this contract this is signed SAML assertion. Student management system Provider of student management systems to RTOs. Simple Object Access Protocol Student A person undertaking VET and who will require a USI from January TA State and Commonwealth authorities that oversee delivery of VET. TGA Token User USI Registrar USI Taskforce VET WS-Trust training.gov.au See Security Token An RTO staff member using an SMS to interact with the USI web services. A Registrar will be appointed, subject to legislation, to administer unique student identifiers for the VET sector. Responsible for implementation of the USI Program. Vocational Education and Training. A specification that deals with distribution of security tokens. Page 8 of 90 Version 1.5 February 2015

9 Contents 1 Introduction Purpose Audience References and Related Documents Business View Version Information About This Version Changes by Contract Version Overview and Broad Functionality Service Environments Third Party Testing Production Digital Certificate (AUSkey) Web Services Security Web Service Policy The Service Provider Interface Conditions of Use Pre-Conditions Service Call Process Post Conditions Endpoints and Operations Third Party Testing Production Message Structure Create Single USI Create Multiple USIs (BulkUpload) Retrieve create multiple USIs result (BulkUploadRetrieve) Verify a single USI Bulk Verify multiple USIs Get Non DVS Document Types Update Personal Details for USI Update Contact Details for USI Shared Data Types Fault Messages Page 9 of 90 Version 1.5 February 2015

10 4.4.1 Sample Fault Fault Values Addressing Policy Security Policy Appendix A WSDL Schema Appendix B USI Country List Appendix C Visa Country List Appendix D WSDL with a WCF Application Page 10 of 90 Version 1.5 February 2015

11 1 Introduction 1.1 Purpose The purpose of this document is to inform student management system (SMS) vendors, and RTO in house system developers about the USI web services available for their consumption. This interface description is called a 'Technical Service Contract' (TSC). 1.2 Audience This document is intended to be read by organisations and agencies intending to use the web services and covers both technical and business aspects of the services. Executive readers and business analysts should read Section 2 to gain an understanding of the business need that these services address. Technical staff implementing systems that consume the USI Web Services should read the whole document. 1.3 References and Related Documents Common Elements: Common Elements for Vanguard Services Document Revision V1.16 STS: VANguard Security Token Service Technical Service Contract v1.2 SAMLCore: Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V1.1. OASIS Standard, August WSSAML: Web Services Security: SAML Token Profile SOAP SOAP Version 1.2 Part 1: Messaging Framework (Second Edition) WSP: Web Services Policy Framework (WSPolicy) v1.2 WSECP: WS-SecurityPolicy WSEC: Web Services Security: SOAP Message Security WSA: Web Services Addressing 1.0 Core Page 11 of 90 Version 1.5 February 2015

12 2 Business View 2.1 Version Information About This Version This document describes version 1.5 of the USI Web Services. Since this document may change without impacting the service definition, i.e. non-technical changes, this document includes the date it was published (February 2015) separate to the contract version number Changes by Contract Version Important changes made in each version of the contract are listed below Version 1.1 The following changes may cause problems for implementations based on previous versions of this document: The Change of Name document type is no longer supported. The Marriage Certificate document type is no longer supported. If part of a postal address is specified, the complete postal address must now be specified. The following additions have also been made: Service for verifying multiple USIs Version 1.2 The following changes may cause problems for implementations based on previous versions of this document: The Address in Contact Details Type must now be unique in the USI Register for active USIs Version 1.3 The following changes may cause problems for implementations based on previous versions of this document: AppliesTo argument for STS being identical to the USI endpoint URL 2.2 Overview and Broad Functionality This document describes the system to system functions provided by the USI web services. The services discussed in this document allow an authorised consumer to perform the following actions: Create a USI record for an individual and receive an immediate response Submit a batch of USI creation requests for processing and (BulkUpload) Retrieve the results of a previously submitted batch request (BulkUploadRetrieve) Verify a USI for an individual and receive an immediate response Verify a batch of USIs and receive an immediate response. Added in version Service Environments The USI web services will be deployed in two distinct environments as detailed below. Page 12 of 90 Version 1.5 February 2015

13 2.3.1 Third Party Testing Third party testing is intended to allow software developers to integrate and test their software with a nonlive implementation of the USI web services that is guaranteed to behave the same as the live system. This environment is configured to use only test AUSkey certificates, org codes and mock version of the document verification system. Any USIs generated by the test environment are not valid in the live environment Testing Registration Developers wishing to access the third party testing environment must complete the enrolment process available from the USI Website. Once completed, participants will be issued with appropriate certificates, orgcodes and connection instructions Production Production is the live version of the USI Web Services once the scheme goes live Registration To use the USI web services in the production environment, RTOs must first be listed and current on Training.Gov.au (TGA). Other VET related organisations wishing to use web services or the web portal must register themselves with the USI Registrar. Registration will give organisations an OrgCode, from either TGA or the USI Registrar. The OrgCode must be supplied as a part of all web service calls. In the case where an ABN is associated with multiple registered organisations, it is the responsibility of the web service user to provide the appropriate OrgCode for each service call. Each organisation wishing to use the USI web services will also need to complete an additional enrolment process, agreeing to the terms and conditions of use, with the Registrar, before they can access the services in the production environment. 2.4 Digital Certificate (AUSkey) Consumers of the USI web services will require an AUSkey, and more specifically an AUSkey device credential, to verify their identity while interacting with the USI web services. These certificates can be obtained free of charge from the Australian Business Register by all ABN holders. Each organisation, RTO, VAB etc. will require their own AUSkey device credential and matching OrgCode before they can use the USI web services. Page 13 of 90 Version 1.5 February 2015

14 2.5 Web Services Security The USI Web Services are secured using the VANguard Security Token Service (STS). The STS is a WS-Trust compliant service used to validate digital credentials and generate security tokens which can then be used to create secure web service channels. A typical interaction is as follows: 1. The end user creates a request for security token message which is signed using their digital credential. This message is sent to the VANguard STS. 2. The STS validates the signature over the message and the digital credential used to sign it and returns a SAML security token. 3. This token is used to secure one or more messages sent to the USI Web Services. Request and receive security token from VANguard Security Token Service Use token obtained from VANguard to secure messages to and from USI web services. Figure 1: Interaction overview This document only describes the interaction between the client and the USI Web Services. Technical specifications for the VANguard STS are contained in the VANguard Security Token Service Technical Service Contract. Page 14 of 90 Version 1.5 February 2015

15 3 Web Service Policy All the USI services conform to the following standards: SOAP v1.2 [SOAP] WS-Policy v1.2 [WSP] WS-SecurityPolicy v1.2 [WSECP] WS-Security 1.1 [WSEC] WS-Addressing v1.0 [WSA] SAML Token Profile for WS-Security Detailed policy for all services is described in the WSDL for each service. Page 15 of 90 Version 1.5 February 2015

16 4 The Service Provider Interface 4.1 Conditions of Use Pre-Conditions In order to invoke any USI web service operation, the following conditions must be met depending on the environment the user wishes to access Third Party Testing Completing the third party testing enrolment process will result in participants being issued with the following required data: A set of organisation codes that can be used to test the web services with different organisation types (RTO, VAB etc). AUSkeys specifically for the third party testing environment Production RTOs must be listed and current on Training.Gov.au (TGA). Other VET related organisations must be registered with the USI Taskforce. The organisation will need to complete the web services enrolment process, agreeing to the web services terms and conditions of use, as specified by the Registrar. The organisation must hold a valid device AUSkey matching the ABN registered with TGA or the USI Taskforce Service Call Process Each call made to the USI web services must complete the following steps: 1. Obtain a valid and current SAML security token for the organisation from the VANguard Security Token Service (STS). This token can be used for multiple web service calls within the same session, until it expires. 2. Call the required USI web service attaching the SAML security token Post Conditions All service requests will be recorded for audit purposes. This audit log will not include any sensitive or personal information. A clear response will be provided to the client indicating success or failure. In the event of a failure to process or authenticate the request, a SOAP fault will be returned to indicate the nature of the problem. Page 16 of 90 Version 1.5 February 2015

17 4.2 Endpoints and Operations Third Party Testing Paths for the third party testing environment will be made available to participants after they have completed the enrolment process available from the USI website Production The endpoint URL for the USI Web Services is: The WSDL for the USI Web Services: The SOAP action for bulk create USI upload operation is: The SOAP action for bulk create USI retrieve operation is: The SOAP action for bulk verify USI retrieve operation is: /2013/ws/BulkVerifyUSI The SOAP action for the create USI operation is: The SOAP action for the verify USI operation is: The SOAP action for the get non-dvs document types operation is: The SOAP action for the update USI personal details operation is: The SOAP action for the update USI contact details operation is: Page 17 of 90 Version 1.5 February 2015

18 4.3 Message Structure This section details the message structures for each of the USI Web Services interfaces. The schema for all service calls is provided in Appendix A. Sample messages shown below include only the SOAP body for clarity Create Single USI The Create USI service allows a caller to submit a single application to create a USI in a synchronous manner Request Message Special Conditions It is important to note that when creating USIs, using both single and multiple create, the combination of RequestId and OrgCode must be unique for all calls to both these services and can never be reused irrespective of the outcome of the current request. Page 18 of 90 Version 1.5 February 2015

19 Create USI Sample A typical Create USI request message is shown below: <soap:body xmlns:soap=" <u:createusi xmlns:u=" <u:requestid>102</u:requestid> <u:orgcode>12345</u:orgcode> <u:application> <u:applicationid>102</u:applicationid> <u:dvscheckrequired>true</u:dvscheckrequired> <u:userreference>jsmith</u:userreference> <u:contactdetails> <u:preferredmethod> </u:preferredmethod> <u:countryofresidence>australia</u:countryofresidence> <u: address>[email protected]</u: address> <u:nationaladdress> <u:address1>71 Johns St</u:Address1> <u:suburbtowncity>wamboin</u:suburbtowncity> <u:state>nsw</u:state> <u:postcode>2620</u:postcode> </u:nationaladdress> </u:contactdetails> <u:personaldetails> <u:gender>m</u:gender> <u:firstname>max</u:firstname> <u:middlename>reginald</u:middlename> <u:familyname>white</u:familyname> <u:dateofbirth> </u:dateofbirth> <u:countryofbirth>australia</u:countryofbirth> <u:towncityofbirth>sydney</u:towncityofbirth> <u:countrystudyingin>australia</u:countrystudyingin> </u:personaldetails> <u:dvsdocument xmlns:xsi=" xsi:type="u:birthcertificatedocumenttype"> <u:registrationnumber>123</u:registrationnumber> <u:registrationstate>nsw</u:registrationstate> <u:registrationdate> </u:registrationdate> <u:registrationyear>1971</u:registrationyear> <u:dateprinted> </u:dateprinted> <u:certificatenumber>123</u:certificatenumber> </u:dvsdocument> </u:application> </u:createusi> </soap:body> Page 19 of 90 Version 1.5 February 2015

20 Create USI Request Description CreateUSI manages the information of who issued the call, a file identifier and any supporting information for the bulk load of applications. Attribute Constraints The combination of RequestId and OrgCode must be unique for all calls to all services that create USIs. Name Type Description Constraints RequestId string This contains the identifier that the organisation has nominated to identify the create USI request. OrgCode string Unique identifier for an organisation registered with training.gov.au or the USI Registrar. Application ApplicationType See section Application Type for details. Validation Rules: The value must not exceed 20 characters This identifier must never be re-used with the same OrgCode. A-Z, a-z, 0-9 Validation Rules: Must not exceed 6 characters Response Message Create USI Response Sample A typical response message from the Create USI service is shown below: <soap:body xmlns:soap=" <u:createusiresponse xmlns:u=" <u:requestid>12345</u:requestid> <u:application> <u:processeddate> t04:21: z</u:processeddate> <u:result>success</u:result> <u:identitydocumentverified></u:identitydocumentverified> <u:usi>h2289jj333</u:usi> <u:errors/> </u:application> </u:createusiresponse> </soap:body> Page 20 of 90 Version 1.5 February 2015

21 Create USI Response Type Description CreateUSIResponse returns the result of the USI application Constraints Attribute Name Type Description Constraints RequestId string This contains the identifier that the organisation has nominated for the create single USI request. Application ApplicationResponseType See section Application Response Type for details. Validation Rules: The value must not exceed 20 characters Page 21 of 90 Version 1.5 February 2015

22 4.3.2 Create Multiple USIs (BulkUpload) This service allows the caller to request the creation of multiple USIs, up to 500 per request. The USI applications are processed asynchronously. To retrieve the results of the request the caller must call the BulkUploadRetrieve service with the ReceiptNumber from the response of this service Request Message BulkUpload USI Sample A request to create multiple USIs is shown below: <soap:body xmlns:soap=" <u:bulkupload xmlns:u=" <u:orgcode>12345</u:orgcode> <u:requestid>123456</u:requestid> <u:noofapplications>1</u:noofapplications> <u:applications> <u:application> <u:applicationid>101</u:applicationid> <u:dvscheckrequired>true</u:dvscheckrequired> <u:userreference>jsmith</u:userreference> <u:contactdetails> <u:preferredmethod> </u:preferredmethod> <u:countryofresidence>australia</u:countryofresidence> <u: address>[email protected]</u: address> <u:nationaladdress> <u:address1>71 Johns St</u:Address1> <u:suburbtowncity>wamboin</u:suburbtowncity> <u:state>nsw</u:state> <u:postcode>2620</u:postcode> </u:nationaladdress> </u:contactdetails> <u:personaldetails> <u:gender>m</u:gender> <u:firstname>max</u:firstname> <u:middlename>reginald</u:middlename> <u:familyname>white</u:familyname> <u:dateofbirth> </u:dateofbirth> <u:countryofbirth>australia</u:countryofbirth> <u:towncityofbirth>sydney</u:towncityofbirth> <u:countrystudyingin>australia</u:countrystudyingin> </u:personaldetails> <u:dvsdocument xmlns:xsi=" xsi:type="u:birthcertificatedocumenttype"> <u:registrationnumber>123</u:registrationnumber> <u:registrationstate>nsw</u:registrationstate> <u:registrationdate> </u:registrationdate> <u:registrationyear>1971</u:registrationyear> <u:dateprinted> </u:dateprinted> <u:certificatenumber>123</u:certificatenumber> </u:dvsdocument> </u:application> </u:applications> </u:bulkupload> </soap:body> Although the example includes only one USI application, up to 500 applications may be submitted per request. Page 22 of 90 Version 1.5 February 2015

23 Only one form of identity document may be supplied for each application. However each application in a request can use a different document type. The XML Schema instance mechanism is used to assert the identity document type used in each application Bulk Upload Request Type Description Constraints Bulk create manages the information of who issued the call, a request identifier and any supporting information for the bulk creation of applications. RequestId and OrgCode together must be unique for each call to the service. The maximum number of applications in a single call must not exceed 500. Attribute Name Type Description Constraints OrgCode string Unique identifier for an organisation registered with TGA or the USI Registrar RequestId string This contains the identifier that the organisation has nominated to identify the bulk create request. This identifier must never be re-used with the same OrgCode. NoOfApplications int This contains the no. of applications to expect in the bulk upload file Applications List of ApplicationType items. See section Application Type for details. A-Z, a-z, 0-9 Validation Rules: Must not exceed 6 characters Validation Rules: The value must not exceed 20 characters 0-9 Validation Rules: The value must not exceed 500 Page 23 of 90 Version 1.5 February 2015

24 Response Message Bulk Upload Response Sample A typical response message from the Bulk Upload service is show below: <soap:body xmlns:soap=" <u:bulkuploadresponse xmlns:u=" <u:receiptnumber>a19f0fa9-c0eb-4878-aabe-9db0493b42f3</u:receiptnumber> </u:bulkuploadresponse> </soap:body> The receipt number is used to retrieve the response, using the Bulk Upload Retrieve service operation Bulk Upload Response Description BulkUploadResponse returns a receipt number that can be used to retrieve the results of the request once they have been processed. Constraints ReceiptNumber is unique to each request regardless of originating organisation. Attribute Name Type Description Constraints ReceiptNumber string Unique identifier used to retrieve the results of a bulk create request. Validation Rules: Must not exceed 36 characters Page 24 of 90 Version 1.5 February 2015

25 4.3.3 Retrieve create multiple USIs result (BulkUploadRetrieve) The Bulk Upload Retrieve service operation is invoked to return the processed results of a Bulk Upload request submitted earlier Request Message Bulk Upload Retrieve Sample A typical request message to the Bulk Upload Retrieve service is show below: <soap:body xmlns:soap=" <u:bulkuploadretrieve xmlns:u=" <u:receiptnumber>a19f0fa9-c0eb-4878-aabe-9db0493b42f3</u:receiptnumber> </u:bulkuploadretrieve> </soap:body> The receipt number is the value returned in the response from the Bulk Upload service Bulk Upload Retrieve Type Description Bulk create retrieve is used to request the asynchronously processed results of a batch create request. Constraints ReceiptNumber must match one issued to the requesting organisation. Attribute Name Type Description Constraints ReceiptNumber string Unique identifier used to retrieve the results of a bulk create request. See section Bulk Upload Response for details Validation Rules: Must not exceed 36 characters Response Message In the case of a valid receipt number the service will return one of the following results: If the upload batch has not been processed to completion then a SOAP fault will be returned with an error message containing the text: Batch Not Completed. If the processing of the batch has been completed then a message similar to one of the samples shown below will be returned. Page 25 of 90 Version 1.5 February 2015

26 Typical Bulk Upload Retrieve Response Sample The example shown below includes only one application. Up to 500 applications may be returned in a single response. <soap:body xmlns:soap=" <u:bulkuploadretrieveresponse xmlns:u=" <u:requestid>123456</u:requestid> <u:noofapplications>1</u:noofapplications> <u:noofapplicationsfailed>0</u:noofapplicationsfailed> <u:applications> <u:application> <u:processeddate> t04:36: z</u:processeddate> <u:applicationid>101</u:applicationid> <u:result>success</u:result> <u:identitydocumentverified></u:identitydocumentverified> <u:usi>h1289ff3333</u:usi> <u:errors/> </u:application> </u:applications> </u:bulkuploadretrieveresponse> </soap:body> Bulk Create USI Retrieve Response Sample with Unsuccessful Applications. If one or more applications within the batch were unsuccessful the results will be returned as below. <BulkUploadRetrieveResponse xmlns:xsi=" xmlns:xsd=" xmlns=" <RequestId>86044</RequestId> <NoOfApplications>1</NoOfApplications> <NoOfApplicationsFailed>1</NoOfApplicationsFailed> <Applications> <Application> <ProcessedDate> T04:36: Z</ProcessedDate> <ApplicationId>657061</ApplicationId> <Result>Failure</Result> <IdentityDocumentVerified>False</IdentityDocumentVerified> <Errors> <Error> <Code>1000</Code> <Message>The field is not a valid address.</message> </Error> </Errors> </Application> </Applications> </BulkUploadRetrieveResponse> Page 26 of 90 Version 1.5 February 2015

27 Bulk Create USI Retrieve Response Description Bulk create retrieve response returns the asynchronously processed results of a batch create request. Constraints This response will only be issued when the requested batch has completed processing. Attribute Name Type Description Constraints RequestId string This contains the identifier that the organisation has nominated to identify the bulk upload file. See section Bulk Upload Response for details NoOfApplications int The number of applications submitted for processing. NoOfApplicationsFailed int Applications List of ApplicationResponse Type The number of applications that failed processing. See section Application Response Type for details Validation Rules: The value must not exceed 20 characters Page 27 of 90 Version 1.5 February 2015

28 4.3.4 Verify a single USI This service allows a caller to submit a single student s USI and personal details in order to confirm their validity Request Message Verify USI Sample for two names A typical Verify USI message is shown below: <soap:body xmlns:soap=" <u:verifyusi xmlns:u=" <u:orgcode>123456</u:orgcode> <u:usi>abcdefghjk</u:usi> <u:firstname>john</u:firstname> <u:familyname>smith</u:familyname> <u:dateofbirth> </u:dateofbirth> </u:verifyusi> </soap:body> Verify USI Sample for a single name A typical Verify USI message for a student with a single name is shown below: <soap:body xmlns:soap=" <u:verifyusi xmlns:u=" <u:orgcode>123456</u:orgcode> <u:usi>abcdefghjk</u:usi> <u:singlename>fred</u:singlename> <u:dateofbirth> </u:dateofbirth> </u:verifyusi> </soap:body> Page 28 of 90 Version 1.5 February 2015

29 Verify USI Request Type Description Verify is used to ensure that the combination of USI, name(s) and DOB matches the USI record. Constraints When providing values for the name fields the consumer must provide either FirstName and Surname or SingleName Attribute Name Type Description Constraints OrgCode string Unique identifier for an organisation registered in the system. USI string Contains the USI value to be verified FirstName string The first name to be verified with the USI value. FamilyName string The family name to be verified with the USI value. SingleName string The single name to be verified with the USI value. A-Z, a-z, 0-9 Validation Rules: Must not exceed 6 characters Length = 10 characters Valid values upper case A-Z [ excluding O & I ], number 2-9 unless SingleName provided The value must not exceed 40 characters unless SingleName provided The value must not exceed 40 characters if FirstName and FamilyName have not been provided. False if either FirstName or FamilyName is provided. The value must not exceed 40 characters. Page 29 of 90 Version 1.5 February 2015

30 DateOfBirth Date The date of birth to be verified with the USI value. Format: yyyy-mm-dd Page 30 of 90 Version 1.5 February 2015

31 Response Message Verify USI Response Sample A typical response message is as follows: <soap:body xmlns:soap=" <u:verifyusiresponse xmlns:u=" <u:usistatus>valid</u:usistatus> <u:firstname>match</u:firstname> <u:familyname>match</u:familyname> <u:dateofbirth>match</u:dateofbirth> </u:verifyusiresponse> </soap:body> Verify USI Response Type Description Returns the result of an attempt to verify USI details Constraints If the USI field is invalid then all other fields will return no match. Returned names will match the request i.e. FirstName and FamilyName will be returned if these were the values passed in the request. Attribute Name Type Description Constraints USIStatus string Contains the result of locating or an alternate status of the USI Valid, Invalid, Deactivated FirstName string The first name result according to the USI. False Match, No Match Validation Rules: If the USI value is Invalid then this value will be No Match. FamilyName string The family name result according to the USI. False Match, No Match Page 31 of 90 Version 1.5 February 2015

32 Validation Rules: If the USI value is Invalid then this value will be No Match. SingleName string The single name result according to the USI. False Match, No Match Validation Rules: If the USI value is Invalid then this value will be No Match. DateOfBirth Date The date of birth result according to the USI. False Match, No Match Validation Rules: If the USI value is Invalid then this value will be No Match. Page 32 of 90 Version 1.5 February 2015

33 4.3.5 Bulk Verify multiple USIs The Bulk Verify USI service allows a caller to submit multiple USI details for verification in the same manner as Verify USI allows a single verification. A maximum of 500 USI verifications can be submitted in each batch request. The Bulk Verify USI service is a synchronous operation Request Message Bulk Verify USI Sample for two names A typical Bulk Verify USI message is shown below: <soap:body xmlns:soap=" <u:bulkverifyusi xmlns:u=" <u:orgcode>123456</u:orgcode> <u:noofverifications>2</u:noofverifications> <u:verifications> <u:verification> <u:recordid>1</u:recordid> <u:usi>abcdefghjk</u:usi> <u:firstname>john</u:firstname> <u:familyname>smith</u:familyname> <u:dateofbirth> </u:dateofbirth> </u:verification> <u:verification> <u:recordid>2</u:recordid> <u:usi>abcdefghj2</u:usi> <u:firstname>joe</u:firstname> <u:familyname>bloggs</u:familyname> <u:dateofbirth> </u:dateofbirth> </u:verification> </u:verifications> </u:bulkverifyusi> </soap:body> Bulk Verify USI Sample for a single name A typical Bulk Verify USI message is shown below: Page 33 of 90 Version 1.5 February 2015

34 <soap:body xmlns:soap=" <u:bulkverifyusi xmlns:u=" <u:orgcode>123456</u:orgcode> <u:noofverifications>2</u:noofverifications> <u:verifications> <u:verification> <u:recordid>1</u:recordid> <u:usi>abcdefghj2</u:usi> <u:singlename>joe</u:singlename> <u:dateofbirth> </u:dateofbirth> </u:verification> <u:verification> <u:recordid>2</u:recordid> <u:usi>abcdefgh22</u:usi> <u:singlename>fred</u:singlename> <u:dateofbirth> </u:dateofbirth> </u:verification> </u:verifications> </u:bulkverifyusi> </soap:body> Page 34 of 90 Version 1.5 February 2015

35 Bulk Verify USI Type Description Bulk Verify is used to ensure that the combination of USI, name(s) and DOB matches the USI records. Constraints When providing values for the name fields the consumer must provide either FirstName and Surname or SingleName Attribute Name Type Description Constraints OrgCode String Unique identifier for an organisation registered in the system. NoOfVerifications Int Number of verification requests in the batch. Verifications List of Verification Types See Verification Type below A-Z, a-z, 0-9 Validation Rules: Must not exceed 6 characters Validation Rules: Must be between 1 and 500. Page 35 of 90 Version 1.5 February 2015

36 Verification Type Description Contains the record data for each verification request in a Bulk Verify USI Request. Constraints Attribute Name Type Description Constraints RecordId Int A unique record identifier (within a request batch) used to identify verifications. USI string Contains the USI value to be verified. FirstName string The first name to be verified with the USI value. FamilyName string The family name to be verified with the USI value. SingleName string The single name to be verified with the USI value. Validation Rules: Must be unique within the batch. Length = 10 characters Valid values upper case A-Z [ excluding O & I ], number 2-9 unless SingleName provided The value must not exceed 40 characters unless SingleName provided The value must not exceed 40 characters if FirstName and FamilyName are not provided. False if FirstName or FamilyName is provided. The value must not exceed 40 characters. Page 36 of 90 Version 1.5 February 2015

37 DateOfBirth Date The date of birth to be verified with the USI value. Format: yyyy-mm-dd dd= mm= yyyy = from 110 years ago to 10 years ago Response Message Bulk Verify USI Response Sample A typical response message is as follows: <soap:body xmlns:soap=" <u:bulkverifyusiresponse xmlns:u=" <u:verificationresponses> <u:verificationresponse> <u:usistatus>valid</u:usistatus> <u:firstname>match</u:firstname> <u:familyname>match</u:familyname> <u:dateofbirth>match</u:dateofbirth> <u:usi>hgdfsgyhig</u:usi> <u:recordid>1</u:recordid> </u:verificationresponse> <u:verificationresponse> <u:usistatus>valid</u:usistatus> <u:firstname>match</u:firstname> <u:familyname>match</u:familyname> <u:dateofbirth>match</u:dateofbirth> <u:usi>jhabveuykj</u:usi> <u:recordid>2</u:recordid> </u:verifyusiresponse> <u:verificationresponse> <u:usistatus>valid</u:usistatus> <u:singlename>match</u:singlename> <u:dateofbirth>match</u:dateofbirth> <u:usi>abcdefgh22</u:usi> <u:recordid>3</u:recordid> </u:verifyusiresponse> </u:verificationresponses> </u:bulkverifyusiresponse> </soap:body> Page 37 of 90 Version 1.5 February 2015

38 Bulk Verify USI Type Description Bulk Verify response returns the result of an attempt to verify USI details in bulk. Constraints Attribute Name Type Description Constraints VerificationResponses List of VerificationResponse Types See Verification Response below Verification Response Type Description Contains the record data for each verification response from a Bulk Verify USI Request. Constraints If the USI field is invalid then all other fields will return no match. Returned names will match the request i.e. FirstName and LastName will be returned if these were the values passed in the request. Attribute Name Type Description Constraints RecordId Int A unique record identifier (within a response batch) used to identify verification results. USI string Contains the USI value that was verified. USIStatus string Contains the result of locating or an alternate status of the USI Validation Rules: Must be unique within the batch. Length = 10 characters Valid values upper case A-Z [ excluding O & I ], number 2-9 Valid, Invalid, Deactivated Page 38 of 90 Version 1.5 February 2015

39 FirstName string The first name result according to the USI. FamilyName string The family name result according to the USI. SingleName string The single name result according to the USI. DateOfBirth Date The date of birth result according to the USI. Match, No Match Validation Rules: If the USI value is Invalid then this value will be No Match. Match, No Match Validation Rules: If the USI value is Invalid then this value will be No Match. Match, No Match Validation Rules: If the USI value is Invalid then this value will be No Match. Match, No Match Validation Rules: If the USI value is Invalid then this value will be No Match. Page 39 of 90 Version 1.5 February 2015

40 4.3.6 Get Non DVS Document Types The Get Non DVS Document Types service allows a caller to retrieve a list of Non DVS documents that can then be used when overriding DVS for Create USI and Update Personal detail methods. The Get Non DVS Document Types service is a synchronous operation Request Message Get Non DVS Document Types Request Sample A typical request message to the Get Non DVS Document Types for USI service is show below: <s:body xmlns:xsi=" xmlns:xsd=" <GetNonDvsDocumentTypes xmlns=" <OrgCode>0001</OrgCode> </GetNonDvsDocumentTypes> </s:body> Get Non DVS Document Types Request Description GetNonDvsDocumentTypes manages the information of who issued the call. Constraints Nil Attribute Name Type Description Constraints OrgCode string Unique identifier for an organisation registered with training.gov.au or the USI Registrar Response Message Get Non DVS Document Types Request Response A-Z, a-z, 0-9 Validation Rules: Must not exceed 6 characters A typical response message from the Get Non DVS Document Types service is shown below: <s:body xmlns:xsi=" xmlns:xsd=" <GetNonDvsDocumentTypesResponse xmlns=" <NonDvsDocumentTypes> <NonDvsDocumentType> <Id>1</Id> <DocumentType>Other</DocumentType> <SortOrder>9000</SortOrder> </NonDvsDocumentType> Page 40 of 90 Version 1.5 February 2015

41 <NonDvsDocumentType> <Id>4</Id> <DocumentType>Proof of Age Card</DocumentType> <SortOrder>1000</SortOrder> </NonDvsDocumentType> <NonDvsDocumentType> <Id>5</Id> <DocumentType>Student Card</DocumentType> <SortOrder>1000</SortOrder> </NonDvsDocumentType> <NonDvsDocumentType> <Id>6</Id> <DocumentType>International Drivers Licence</DocumentType> <SortOrder>1000</SortOrder> </NonDvsDocumentType> <NonDvsDocumentType> <Id>7</Id> <DocumentType>International Birth Certificate</DocumentType> <SortOrder>1000</SortOrder> </NonDvsDocumentType> </NonDvsDocumentTypes> </GetNonDvsDocumentTypesResponse> </s:body> Get Non DVS Document Types Response Description GetNonDvsDocumentTypesResponse returns an array of current Non-DVS Document Types. Constraints Nil Attribute Name Type Description Constraints NonDvsDocu menttypes List of Non Dvs Document Types See section Non DVS Document Type below for details. Page 41 of 90 Version 1.5 February 2015

42 4.3.7 Update Personal Details for USI The Update Personal Details for USI service allows a caller to update personal details for a USI for which they have update permission. Only one field can be updated per request. The Update Personal Details for USI service is a synchronous operation Request Message Update Personal Details for USI Request Sample A typical request message to the Update Personal Details for USI service is show below: <s:body> <UpdateUSIPersonalDetails xmlns:xsi=" xmlns=" <OrgCode>0001</OrgCode> <USI>CMUQX5HRTA</USI> <DVSCheckRequired>true</DVSCheckRequired> <UserReference>23319</UserReference> <PersonalDetailsModifier>FirstName</PersonalDetailsModifier> <PersonalDetailsUpdate> <FirstName>Henry</FirstName> </PersonalDetailsUpdate> <DVSDocument xsi:type="driverslicencedocumenttype"> <LicenceNumber>111111</LicenceNumber> <State>ACT</State> </DVSDocument> </UpdateUSIPersonalDetails> </s:body> Update USI Personal Details Request Description UpdateUSIPersonalDetails manages the information of who issued the call, the USI being updated and the personal detail being updated. Attribute Constraints The personal detail being updated must be supplied. Any other personal details supplied will be ignored. Name Type Description Constraints OrgCode string Unique identifier for an organisation registered with training.gov.au or the USI Registrar. A-Z, a-z, 0-9 Validation Rules: Must not exceed 6 characters Page 42 of 90 Version 1.5 February 2015

43 USI string The USI being updated. DVSCheckRequired boolean Allows the organisation to override the DVS identity verification check. NonDvsDocumentTyp eid NonDvsDocumentTyp eother int string This value should only be set to false if the organisation has DVS override permission or the personal detail being updated does not require a DVS check. When overriding DVS this is the other document viewed to prove the students identity. Is the document used to verify a students identity when it is not listed in the non-dvs document list. Length = 10 characters Valid values upper case A-Z [ excluding O & I ], number 2-9 true, false (lower case only) False Must match one of the IDs returned from GetNonDvsDocumentTypes web method. when NonDvsDocumentTypeId = 1 (Other) Validation Rules: The value cannot exceed 50 characters. UserReference string This value contains the identifier of the user who created the application Validation Rules: The value cannot exceed 40 characters. Page 43 of 90 Version 1.5 February 2015

44 PersonalDetailsModifier PersonalDetailsModifi er PersonalDetailsUpdat e PersonalDetailsType The personal detail being updated. See section Personal Details Type below DVSDocument DVSDocumentType See section DVS Document Type below FirstName, MiddleName, FamilyName, SingleName, DateOfBirth, CountryOfBirth, TownCityOfBirth, Gender, CountryStudyingIn Note: The field being updated is mandatory. Any other supplied fields are ignored. if DVSCheckRequired is Response Message Update Personal Details for USI Response A typical response message from the Update Personal Details service is shown below: <s:body xmlns:xsi=" xmlns:xsd=" <UpdateUSIPersonalDetailsResponse xmlns=" <Result>Success</Result> <IdentityDocumentVerified></IdentityDocumentVerified> </UpdateUSIPersonalDetailsResponse> </s:body> Update USI Personal Details ResponseType Description UpdateUSIPersonalDetailsResponse returns the result of the Update Personal Details for USI Constraints Attribute Name Type Description Constraints Page 44 of 90 Version 1.5 February 2015

45 Result string Whether the USI Record has been updated successfully or not. IdentityDocu mentverified string If the identity document provided was verified successfully. Errors List of Error items See Error Type for details Success, Failure, False, NotVerified if Result is Failure. Page 45 of 90 Version 1.5 February 2015

46 4.3.8 Update Contact Details for USI The Update Contact Details for USI service allows a caller to update the contact details for USI for which they have update permission. Any contact details supplied will be updated on the USI record. Existing values cannot be cleared. The Update Contact Details for USI service is a synchronous operation Request Message Update Contact Details for USI Request Sample A typical request message to the Update Contact Details for USI service is show below: <s:body> <UpdateUSIContactDetails xmlns:xsi=" xmlns=" <OrgCode>0001</OrgCode> <USI>CMUQX5HRTA</USI> <UserReference>58775</UserReference> <ContactDetailsUpdate> <PreferredMethod> </PreferredMethod> <CountryOfResidence>Australia</CountryOfResidence> < Address>[email protected]</ Address> <Phone> <Home> </Home> <Mobile> </Mobile> </Phone> <NationalAddress> <Address1>12 Main St</Address1> <SuburbTownCity>Page</SuburbTownCity> <State>ACT</State> <PostCode>2614</PostCode> </NationalAddress> </ContactDetailsUpdate> </UpdateUSIContactDetails> </s:body> Update USI Contact Details Request Description UpdateUSIContactDetails manages the information of who issued the call, the USI being updated and the contact details being updated. Attribute Constraints The address details supplied must be appropriate for the Country of Residence of the student (Australian address vs International address). If preferred contact method is changed, the selected contact method must have a value set. Name Type Description Constraints Page 46 of 90 Version 1.5 February 2015

47 OrgCode string Unique identifier for an organisation registered with training.gov.au or the USI Registrar. USI string The USI being updated. A-Z, a-z, 0-9 Validation Rules: Must not exceed 6 characters Length = 10 characters Valid values upper case A-Z [ excluding O & I ], number 2-9 UserReference string This value contains the identifier of the user who created the application Validation Rules: The value cannot exceed 40 characters. ContactDetailsUpdate ContactDetailsUpdate Type See section Contact Details Type below (same fields as this type) Note: Only fields being updated are mandatory Response Message Update Contact Details for USI Response A typical response message from the Update Contact Details service is shown below: <s:body xmlns:xsi=" xmlns:xsd=" <UpdateUSIContactDetailsResponse xmlns=" <Result>Success</Result> </UpdateUSIContactDetailsResponse> </s:body> Update USI Contact Details ResponseType Description Constraints Page 47 of 90 Version 1.5 February 2015

48 UpdateUSIContactDetailsResponse returns the result of the Update Contact Details for USI Attribute Name Type Description Constraints Result string Whether the USI Record has been updated successfully or not. Errors List of Error items See Error Type for details Success, Failure if Result is Failure Locate USI The Locate USI service allows and organisation to find a student s USI Request Message Locate USI Request Sample <LocateUSI xmlns:xsi=" xmlns=" <OrgCode>0001</OrgCode> <UserReference>userRef</UserReference> <PersonalDetails> <Gender>M</Gender> <FirstName>Bob</FirstName> <MiddleName>James</MiddleName> <FamilyName>Smith</FamilyName> <DateOfBirth> </DateOfBirth> <CountryOfBirth>Australia</CountryOfBirth> <TownCityOfBirth>Sydney</TownCityOfBirth> </PersonalDetails> <ContactDetails> < Address>[email protected]</ Address> </ContactDetails> </LocateUSI> Locate USI Request Page 48 of 90 Version 1.5 February 2015

49 Description Locate USI allows an Organisationto locate a student s USI. The organisation does not need to have permission to view that USI record. Attribute Constraints All personal details and one matching contact detail must be provided for the USI to be returned. Name Type Description Constraints OrgCode string Unique identifier for an organisation registered with training.gov.au or the USI Registrar. A-Z, a-z, 0-9 Validation Rules: Must not exceed 6 characters UserReference string This value contains the identifier of the user who created the application Validation Rules: The value cannot exceed 40 characters. PersonalDetails PersonalDetailsLocate Type This contains the personal details. ContactDetails ContactDetailsLocateT ype This contains the personal details Personal Details Locate Type Description Contains the details of what defines the relevant information for a person. Constraints When providing values for the name fields the consumer must provide values for either FirstName, MiddleName and FamilyName or SingleName. Name Type Description Constraints Gender char The gender of the applicant. M (denotes Male), F (denotes Female), X (Unspecified) Page 49 of 90 Version 1.5 February 2015

50 FirstName string The first name of the applicant. MiddleName string The middle name(s) of the applicant, separated by spaces. FamilyName string The family name of the applicant. SingleName string The applicant only has a single name with no middle name or family name. DateOfBirth Date The day, month and year of birth of the Applicant unless SingleName provided The value must not exceed 40 characters False The value must not exceed 80 characters unless SingleName provided The value must not exceed 40 characters. if FirstName and Family Name are not supplied. False if FirstName and FamilyName are supplied. The value must not exceed 40 characters. Format: yyyy-mm-dd CountryOfBirth string The country where the applicant was born. TownCityOfBirth string The town or city where the applicant was born See Appendix B - USI Country List The value must not exceed 50 characters Page 50 of 90 Version 1.5 February 2015

51 Contact Details Locate Type Description Contains the contact details for a student. Constraints One contact detail must be supplied. If either International address or National Address is specified then the Country of Residence must be specified. Attribute Name Type Description Constraints CountryOfResidence string Contains the applicant's primary country of residence. Address string This will identify the address for the applicant. Phone PhoneType See Phone Type for details If address is specified, then, else false See Appendix B - USI Country List False Must comply with the flowing internet standards: 1. RFC RFC2821 Validation Rules: The value must not exceed 254 characters and addresses must be unique for each USI record. False InternationalAddress string The address of an applicant that has been identified as residing overseas. NationalAddress National Address Type See National Address Type for details False Validation Rules: The value must not exceed 250 characters False Page 51 of 90 Version 1.5 February 2015

52 Response Message Locate USI Response Sample A typical response from Locate USI <LocateUSIResponse xmlns:xsd=" xmlns:xsi=" xmlns=" <Result>SingleNoContactMatch</Result> <ContactDetailsMessage>The student last updated their details in November The contact details we have stored are: Address. </ContactDetailsMessage> </LocateUSIResponse> Locate USI Response Description The locate USI response provides the located USI, or if the USI could not be located some reasons why. Constraints Attribute Name Type Description Constraints Result LocateResultType The result of the query. See the LocateResultType description below for more detail. USI USIType The USI if it could be located ContactDetailsMessage String If the personal details matched one record this will contain a message to indicate when the contact details were last updated and which contact details the system holds. Errors Array of Errors This may contain messages when the request could not be processed. Mandatory Mandatory False This is only returned when the result is ExtactMatch Mandatory False This will only be provided when the result is SingleNoContactMatch Locate USI Result Type Page 52 of 90 Version 1.5 February 2015

53 Description This specifies the result of the locate request. Constraints Attribute Value Exact Definition One exact match was found, the USI will be provided. MultipleExact More than one exact match was located, you may need to contact the service desk. SingleNoContactMatch The personal details matched a single record, but none of the contact details matched. A message is returned to indicate what contact details are held (eg. Phone and ) and when they were last updated. (Eg Nov 2013) MultipleNoContactMatch The personal details matched multiple records, but the contact details did not match for any records. NoMatch The details matched no records. NoIdenticalStrongPartial There were no exact matches, however the details were very close to a record we hold, confirm the details with the student and once updated try again Shared Data Types Data types that are shared across multiple messages are detailed below Application Type Description This contains the data for an application that is to be processed. Constraints Attribute Name Type Description Constraints ApplicationId string A unique identifier (within a batch) for the specific application nominated by the Page 53 of 90 Version 1.5 February 2015

54 submitting organisation. The reference number must not exceed 20 characters DVSCheckRequired boolean Allows the organisation to override the DVS identity verification check. NonDvsDocumentTyp eid NonDvsDocumentTyp eother int string This value should only be set to false if the organisation has DVS override permission. When overriding DVS this is the other document viewed to prove the students identity. Is the document used to verify a students identity when it is not listed in the non-dvs document list. true, false (lower case only) False Must match one of the IDs returned from GetNonDvsDocumentTypes web method. when NonDvsDocumentTypeId = 1 (Other) Validation Rules: The value cannot exceed 50 characters. UserReference string This value contains the identifier of the user who created the application Validation Rules: The value cannot exceed 40 characters. ContactDetails ContactDetailsType See section Contact Details Type below PersonalDetails PersonalDetailsType See section Personal Details Type below DVSDocument DVSDocumentType See section DVS Document Type below if DVSCheckRequired is Contact Details Type Page 54 of 90 Version 1.5 February 2015

55 Description Contains the contact details for a student. Attribute Constraints If the CountryOfResidence is not Australia and the preferred contact method is Mail the International Address field is mandatory If both InternationalAddress and NationalAddress are supplied, only the one that is consistent with the country of residence will be kept. Name Type Description Constraints PreferredMethod string This will identify the preferred contact method for the applicant. CountryOfResidence string Contains the applicant's primary country of residence. Address string This will identify the address for the applicant. Phone PhoneType See Phone Type for details Mobile, , Mail See Appendix B - USI Country List If the Preferred Method is else False. Must comply with the flowing internet standards: 1. RFC RFC2821 Validation Rules: The value must not exceed 254 characters and addresses must be unique for each USI record. If the Preferred Method is Mobile else False Page 55 of 90 Version 1.5 February 2015

56 InternationalAddress string The address of an applicant that has been identified as residing overseas. NationalAddress National Address Type See National Address Type for details If the Preferred Method is Mail and Country of Residence is not 'Australia' else False Validation Rules: The value must not exceed 250 characters If the Preferred Method is Mail and Country of Residence is 'Australia' else False Phone Type Description Contains the details of what defines a phone number. Constraints If preferred contact method is SMS this type is mandatory and the Mobile field must be completed. Attribute Name Type Description Constraints Home string This contains the home phone number for the applicant False Validation Rules: 1. First character can be a "+" 2. Supported characters are 0-9 numeric, spaces, parentheses and hyphon in the User Interface 3. Minimum of 10 numeric digits 4. Maximum length of 20 Note: Spaces, parentheses and hyphon characters will be stripped when storing the numbers. Mobile string This contains the mobile phone number for the applicant If the PreferredMethod is Mobile Page 56 of 90 Version 1.5 February 2015

57 else False Validation Rules: Must be between 10 and 20 characters. 1. First character can be a "+" 2. Supported characters are 0-9 numeric, spaces, parentheses and hyphon in the User Interface 3. Minimum of 10 numeric digits 4. Maximum length of 20 Note: Spaces, parentheses and hyphon characters will be stripped when storing the numbers. Page 57 of 90 Version 1.5 February 2015

58 National Address Type Description Contains the details of what defines a national address. Constraints Population Rules: If the Contact Details.Country of Residence is 'Australia' then contents for a national address is expected. If both InternationalAddress and NationalAddress are supplied, only the one that is consistent with the country of residence will be kept. If any of the Address, Suburb/Town/City, State or Postcode have been populated then all of these fields become required. This also applies even if the preferred contact method is not Mail. The Suburb/Town/City, Postcode and State combination needs to be a valid Australian Post combination. Attribute Name Type Description Constraints Address1 string Line one of the applicant's residential address. Address2 string Line two of the applicant's residential address. SuburbTownCity String The suburb/town/city address for the Applicant's home residence State String The state abbreviation of the Applicant's home residence. Validation Rules: The value must not exceed 50 characters False Validation Rules: The value must not exceed 50 characters Validation Rules: The value must not exceed 50 characters NSW, VIC, QLD, SA, WA, TAS, NT, ACT Page 58 of 90 Version 1.5 February 2015

59 PostCode String The postcode of the Applicant's home residence Personal Details Type Description Contains the details of what defines the relevant information for a person. Constraints When providing values for the name fields the consumer must provide values for either FirstName, MiddleName and Surname or SingleName. Attribute Name Type Description Constraints Gender char The gender of the applicant. FirstName string The first name of the applicant. MiddleName string The middle name(s) of the applicant, separated by spaces. FamilyName string The family name of the applicant. M (denotes Male), F (denotes Female) unless SingleName provided The value must not exceed 40 characters False The value must not exceed 80 characters unless SingleName provided The value must not exceed 40 characters. Page 59 of 90 Version 1.5 February 2015

60 SingleName string The applicant only has a single name with no middle name or family name. DateOfBirth Date The day, month and year of birth of the Applicant if FirstName and Family Name are not supplied. False if FirstName and FamilyName are supplied. The value must not exceed 40 characters. Format: yyyy-mm-dd dd= mm= yyyy = from 110 years ago to 10 years ago CountryOfBirth string The country where the applicant was born. TownCityOfBirth string The town or city where the applicant was born CountryStudyingIn string The country that the applicant is studying in. See Appendix B - USI Country List The value must not exceed 50 characters See Appendix B - USI Country List Non DVS Document Type Description This type contains details a Non DVS Document Type Constraints Page 60 of 90 Version 1.5 February 2015

61 Attribute Name Type Description Constraints Id int A numerical unique identifier for the Non DVS Document Type DocumentType string A description of the document type SortOrder Int The sort order for displaying the Non DVS Document Type in a list The value must not exceed 50 characters. Page 61 of 90 Version 1.5 February 2015

62 DVS Document Type When creating a USI consumers may be required to provide details from a document that can be validated using the document verification service (DVS). The details required to validate each document are given in the following sections. It should be noted that the student s First Name, Last Name and Date of Birth from personal details will also be used as part of the document validation process and must match the document being used for verification to be successful. In some instances middle name, middle initial and gender are also used to verify the document DVS Document Type Sample This sample demonstrates the use of the XML Schema instance mechanism used to assert the DVS document type to be used in an application. <u:dvsdocument xmlns:xsi=" xsi:type="u:birthcertificatedocumenttype"> <u:registrationnumber>123</u:registrationnumber> <u:registrationstate>nsw</u:registrationstate> <u:registrationdate> </u:registrationdate> <u:registrationyear>1971</u:registrationyear> <u:dateprinted> </u:dateprinted> <u:certificatenumber>123</u:certificatenumber> </u:dvsdocument> DVS Document Type Details Description Contains the type reference for the DVS document that will be used in an application. Constraints This is an abstract base type that contains no attributes. It cannot be used directly in an application. Page 62 of 90 Version 1.5 February 2015

63 Birth Certificate Document Type (Australian) The rules for verifying a birth certificate cannot be easily defined based on web service schema because they vary depending on the data submitted. At the time of writing, consumers will need to supply optional data as in the table below to successfully verify a birth certificate. Any fields not required to validate a given certificate are not submitted as they may cause the verification to fail even if all other fields are correct. (Eg. Certificate number for an ACT birth certificate printed before 1 May 2002 will not be submitted for verification) Description Constraints This type contains the additional information required to verify an Australian Birth Certificate. Attribute Name Type Description Constraints RegistrationNumber string The registration number issued on the identifying document. NSW, VIC, WA, SA, ACT, NT, QLD if Registration Date on or after 2 July 1996, TAS if Registration Date on or after 1 Nov 1999 RegistrationState StateList The state abbreviation where the certificate was issued The value must not exceed 10 characters NSW, VIC, QLD, SA, WA, TAS, NT, ACT RegistrationDate Date The day, month and year that the certificate was registered on the identifying document. QLD and TAS Format: yyyy-mm-dd from current date to 110 years ago. Validation Rules: Not after today, not before date of birth RegistrationYear YearList The year that the certificate was registered on the identifying document. NSW, VIC and WA TAS if Registration Date on or after 1 Nov Must be 4 characters Validation Rules: Not after today, not before date of birth Page 63 of 90 Version 1.5 February 2015

64 DatePrinted Date The day, month and year that the certificate was printed on the identifying document. SA, ACT, NT Format: yyyy-mm-dd from current date to 110 years ago. Validation Rule: Not after today, not before date of birth CertificateNumber string The certificate number issued on the identifying documentcertificate NSW if Date Printed on or after 1 July 2010 SA if Date Printed on or after 1 Nov 1999 ACT if Date Printed on or after 1 May 2002 NT if Date Printed on or after 12 July 1999 A-Z, a-z, 0-9 Must be between 1 and 11 characters Certificate of Registration by Descent Document Type This type contains the additional information required to verify a Certificate of Registration by Descent. Attribute Name Type Description Constraints AcquisitionDate Date The day, month and year of the acquisition date on the identifying document Format: yyyy-mm-dd dd = mm = yyyy = from 110 years ago to the current year Page 64 of 90 Version 1.5 February 2015

65 Citizenship Certificate Document Type (Australian) Description This type contains the additional information required to verify a citizenship certificate. Constraints The document cannot have a status of void Attribute Name Type Description Constraints StockNumber string The stock number issued on the identifying document AcquisitionDate Date The day, month and year of the acquisition date of the identifying document -, A-Z, a-z, 0-9,/ Can be between 4 and 11 characters Format: yyyy-mm-dd From current date 110 years to current date. Page 65 of 90 Version 1.5 February 2015

66 Drivers Licence Document Type (Australian) Description This type contains the additional information required to verify an Australian driver s licence. Constraints The driver s licence must be current and valid, i.e. not expired or cancelled. Attribute Name Type Description Constraints LicenceNumber string The licence number issued on the identifying document State StateList The state abbreviation where the identifying document was issued Can be between 1 and 10 characters NSW, VIC, SA, WA, TAS, NT, ACT, QLD Page 66 of 90 Version 1.5 February 2015

67 Medicare Document Type When using a Medicare card to verify the applicant s Identity the caller should supply only the names of the student as they appear on the card. Multiple lines are available for students that have very long names but care must be taken to match exactly what is shown the card. An application made using a Medicare card will be rejected if the name listed on the card does not match the name on the USI application. Description This type contains the additional information required to verify a medicare card. Attribute Constraints The applicant s name(s), in the personal details type, must match the name lines supplied for the Medicare card. The card must be current and valid, i.e. not expired or cancelled. Name Type Description Constraints MedicareCardNumber string The Medicare card number issued on the identifying document IndividualRefNumber string The individual ref number issued on the identifying document ExpiryDate string The expiry date on the identifying document CardColour string Card colour of the identifying document 0-9 Length = 10 characters 1-9 The value must not exceed 1 character yyyy-mm when Card Colour is Green yyyy-mm-dd when Card Colour is Blue or Yellow Green, Blue, Yellow Page 67 of 90 Version 1.5 February 2015

68 NameLine1 String Applicant s first name line on the Medicare card NameLine2 String Applicant s second name line on the Medicare card NameLine3 String Applicant s third name line on the Medicare card NameLine4 String Applicant s fourth name line on the Medicare card Can be between 1 and 27 characters False Can be between 0 and 25 characters False Can be between 0 and 23 characters False Can be between 0 and 21 characters Page 68 of 90 Version 1.5 February 2015

69 Passport Document Type (Australian) Description This type contains the additional information required to verify an Australian passport. Attribute Constraints Must be an Australian passport. See the Visa document type for foreign passport holders. The passport must be current or expired for less than two years. Name Type Description Constraints DocumentNumber string The document number issued on the identifying document Visa Document Type - 1 or 2 A-Z Characters followed by 7 digits The value must not exceed 9 characters It is important to note that when verifying a Visa, the details of the passport the visa has been issued against is verified, not a visa number. This means that even a visa that was automatically issued can be verified. Description Attribute Constraints Name Type Description Constraints Description This type contains the additional information required to verify an Australian visa. Constraints The visa must be current and valid. Expired and cancelled visas cannot be verified. Attribute Name Type Description Constraints PassportNumber string The passport number the visa was issued to. CountryOfIssue string The Country that issued the passport -, A-Z, a-z, 0-9 The value must not exceed 14 characters Validation Rules: Can be between 1 and 80 characters. Page 69 of 90 Version 1.5 February 2015

70 See Appendix C - Visa Country List Page 70 of 90 Version 1.5 February 2015

71 ImmiCard Document Type Description This DVS document type contains the additional information required to verify an ImmiCard using DVS Constraints Attribute Name Type Description Constraints ImmiCardNumber string The ImmiCard number issued on the identifying document. - 1 st 2 nd and 3 rd Characters must be A-Z followed by 6 digits The value must be 9 characters Application Response Type ApplicationResponseType is a container for the outcome of an application for a new USI and is referenced by: Create USI Response Type Description CreateUSIResponse returns the result of the USI application Constraints Attribute Name Type Description Constraints RequestId string This contains the identifier that the organisation has nominated for the create single USI request. Application ApplicationResponseType See section Application Response Type for details. Validation Rules: The value must not exceed 20 characters Page 71 of 90 Version 1.5 February 2015

72 Bulk Upload Response Description This is the response to a single USI create or part of Bulk USI response Constraints Attribute Name Type Description Constraints ProcessedDate datetime Time of processing application Formatted as UTC ApplicationId string A unique identifier (within a batch) for the specific application nominated by the submitting organisation. Result string If the USI record was successfully created, is Success. Otherwise, it is Failure, unless a single duplicate was found, then it is MatchFound. IdentityDocumentVerifie d string USI string The USI created if successful, or if Result is MatchFound, the USI of the duplicate record. Errors List of Error items See Error Type for details Only present for bulk create, not single create The reference number must not exceed 20 characters Success, Failure, MatchFound If the identity document provided was verified successfully., False, NotVerified if Result is not Failure. Length = 10 characters Valid values upper case A-Z [ excluding O & I ], number 2-9 if Result is Failure. Page 72 of 90 Version 1.5 February 2015

73 Error Type Description This type contains details of why a Create USI request failed Constraints Attribute Name Type Description Constraints Code string The code for this type of failure Valid values Some codes are defined in section Message string Description of the fault. The value must not exceed 255 characters. Page 73 of 90 Version 1.5 February 2015

74 4.4 Fault Messages SOAP faults can be returned from each service method and wrap around an Error object. The Error object contains a Code, Title, and Message Sample Fault Here are some sample Fault errors: <Fault xmlns=" <Code> <Value>Sender</Value> </Code> <Reason> <Text xml:lang="en-au">an error has occured. See <detail> for more information.</text> </Reason> <Detail> <ErrorInfo xmlns:i=" xmlns=" "> <Code>2002</Code> <Message>The organisation was not verified as an authorised body/organisation in the system.</message> <Title>Organisation failed authorisation</title> </ErrorInfo> </Detail> </Fault> <Fault xmlns=" <Code> <Value>Sender</Value> </Code> <Reason> <Text xml:lang="en-au">qld birth certificates earlier than 1974 are not supported. Please select another document type.</text> </Reason> <Detail> <ArrayOfErrorInfo xmlns:i=" xmlns=" <ErrorInfo> <Code>1002</Code> <Title>Generic Validation</Title> <Message>QLD birth certificates earlier than 1974 are not supported. Please select another document type.</message> <MemberNames> <string xmlns=" r</string> </MemberNames> </ErrorInfo> </ArrayOfErrorInfo> </Detail> </Fault> Page 74 of 90 Version 1.5 February 2015

75 4.4.2 Fault Values The details of various errors returned by service methods are below. Some of these error codes may be returned in an Error element in a non-fault response. Error ERR-1000 Unexpected ERR-1001 Service Unavailable ERR-1002 Generic Validation ERR-2000 Communication Error ERR-2001 Batch Data Is Invalid. ERR-2002 Organisation was not authorised ERR-2003 Incorrect Receipt Number ERR-2004 Unverified Identity ERR-2005 Failed To Create USI Record Already Exists Description Error Code: 1000 Error Title: Unexpected. Error Message: An unexpected error has occurred. Error Code: 1001 Error Title: Service Unavailable. Error Message: The service is currently not available. Error Code: 1002 Error Title: Generic Validation. Error Message:<detail of generic validation message> Error Code: 2000 Error Title: Communication Error. Error Message: A communication error has occurred. Please try again at a later time. Error Code: 2001 Error Title: Batch Data Is Invalid. Error Message: The batch contains invalid data and has not been processed. Error Code: 2002 Error Title: Organisation Failed Authorisation. Error Message: The organisation was not verified as an authorised body/organisation in the system. Error Code: 2003 Error Title: Incorrect Receipt Number. Error Message: The receipt number was badly formatted or could not be found. Error Code: 2004 Error Title: Unverified Identity. Error Message: The system could not verify the identity based on the supplied information. Error Code: 2005 Error Title: Failed To Create USI Record Already Exists. Error Message: The system found multiple existing records with the same information. The record has not been created. Page 75 of 90 Version 1.5 February 2015

76 ERR-2006 DVS Service Unvailable ERR-2007 Request No Is Not Unique ERR-2008 No Of Applications Invalid ERR-2009 Batch Not Completed ERR-2010 DVS Bypass Not Authorised ERR-2019 Single Name Invalid ERR-2022 DVS Check Required Missing ERR-2030 Invalid Operation ERR-2050 File Structure Is Invalid ERR-2060 USI Not Found ERR-2095 USI Deactivated ERR-2098 USI Suspended Error Code: 2006 Error Title: DVS Service Unvailable. Error Message: The system could not connect to the DVS service. Error Code: 2007 Error Title: Request No Is Not Unique. Error Message: The system has received the same reference no. from this organisation on a previous occasion. The file will not be processed. Error Code: 2008 Error Title: No Of Applications Invalid. Error Message: The no. of applications must be less than 500, and must match the actual number of applications in upload. Error Code: 2009 Error Title: Batch Not Completed. Error Message: The batch is still being processed. Please try again later. Error Code: 2010 Error Title: DVS Bypass Not Authorised. Error Message: The organisation does not have the authority to bypass the DVS check. Error Code: 2019 Error Title: Single Name Invalid. Error Message: You cannot supply first, middle or family name with a single name. Error Code: 2022 Error Title: DVS Check Required Missing Error Message: Please specify DVS Check Required. Error Code: 2030 Error Title: Invalid Operation Error Message: You do not have permission for this operation. Error Code: 2050 Error Title: File Structure Is Invalid. Error Message: The file provided did not conform to the defined structure. Error Code: 2060 Error Title: USI Not Found Error Message: USI not found. Error Code: 2095 Error Title: USI Deactivated Error Message: USI is deactivated. Error Code: 2098 Error Title: USI Suspended Error Message: USI is suspended. Page 76 of 90 Version 1.5 February 2015

77 ERR-3000 Invalid Schema ERR-3010 Invalid AusKey Token Type ERR Xml Schema Validation Fail ERR Xml Schema Validation Fail ERR Address Not Unique ERR Non DVS Document Not Found ERR Invalid Source For Update USI Contact Details ERR Document Type Not Found ERR Document Type Not Valid For Modifier ERR DVS Override cannot be used for this USI. ERR DVS Document Type Not Available. Error Code: 3000 Error Title: Invalid Schema. Error Message: <detail of schema errors> Error Code: 3010 Error Title: Invalid AusKey Token Type. Error Message: Invalid AusKey token type. Error Code: 3200 Error Title: Xml Schema Validation Fail. Error Message: <detail of xml schema validation errors> Error Code: 3250 Error Title: Xml Validation Failure. Error Message: <detail of xml schema validation errors> Error Code: 3300 Error Title: Address Not Unique. Error Message: Address is not unique. Error Code: 3310 Error Title: Non DVS Document Not Found Error Message: Non DVS Document not found. Error Code: 3312 Error Title: Invalid Source For Update USI Contact Details Error Message: The specified source should not update USI contact details. Error Code: 3330 Error Title: Document Type Not Found Error Message: Document Type Not Found. Error Code: 3340 Error Title: Document Type Not Valid For Modifier Error Message: The Document type is not valid for this operation. Error Code: 3350 Error Title: DVS Override Cannot Be Used For USI Error Message: DVS Override cannot be used for this USI. Error Code: 3370 Error Title: Document Type Not Available. Error Message: The DVS Document Type is currently unavailable for use. Please select another document type. Page 77 of 90 Version 1.5 February 2015

78 5 Addressing Policy The USI Web Services make use of the WS-Addressing 1.0 standards. All messages sent to the USI Web Services MUST contain the following WS-Addressing headers: An Action header indicating the action to invoke on the server, A To header describing the destination of the message, A MessageID header containing a unique identifier for the message; and A ReplyTo header. As all web services are invoked using a request-reply model this should always be set to: Where clients have been generated using the WSDL for the services, these headers should be handed automatically by the web service stack. Page 78 of 90 Version 1.5 February 2015

79 6 Security Policy All USI Web Services are secured using the OASIS Web Services Security: SAML Token Profile 1.1. SAML security tokens are obtained using the WS-Trust standard from the VANguard Security Token Service (STS). Information regarding the STS is provided in the STS Technical Service Contract. The USI Web Service channel uses SSL/TLS as the means of authenticating the server and providing a secure channel between the client and server. The client is authenticated using the SAML security token obtained from the STS. The key returned from the STS is used to sign the WS-Security timestamp in messages sent to the service. An example security header is shown below: <s:envelope xmlns:s=" xmlns:a=" xmlns:u=" <s:header> <a:action s:mustunderstand="1"> <a:messageid>urn:uuid:bd309d41-ba73-45ed-b1c5-08c4c8c3c217</a:messageid> <a:replyto> <a:address> </a:replyto> <a:to s:mustunderstand="1"> </a:to> <o:security s:mustunderstand="1" xmlns:o=" <u:timestamp u:id="_0"> <u:created> t11:17:08.255z</u:created> <u:expires> t11:22:08.255z</u:expires> </u:timestamp> <xenc:encrypteddata Type=" xmlns:xenc=" <xenc:encryptionmethod Algorithm=" cbc"></xenc:encryptionmethod> <KeyInfo xmlns=" <e:encryptedkey xmlns:e=" <e:encryptionmethod Algorithm=" <DigestMethod Algorithm=" </e:encryptionmethod> <KeyInfo> <o:securitytokenreference> <X509Data> <X509IssuerSerial> <X509IssuerName>CN=USI.gov.au</X509IssuerName> <X509SerialNumber> </X509SerialNumber> </X509IssuerSerial> </X509Data> </o:securitytokenreference> </KeyInfo> <e:cipherdata> <e:ciphervalue>tv3t4cy7banamantvruo2wfq+9hkurzxqn+ec+8nxs6i4jv2otivivuwtq8dxc3r+2 WGXUCcU2yvOedI2vQB4/i5huQMkc51pAcmXemxjejs1D3QL0nqWA3NtyMFCpbQTpfbC88hYfrkSJy4tlj IvCF+L348NydAiYokI1PmR3Qh2us4NyEbo0vg3n9VL6PmzbuQ05wkRaUM4OfDkU0rDy1PYk0TmuLfSsoF d66cm41aqecetwn+tyevapcdl2awjvzay0dnbi/8estuvulpysbndjcjsoklfmo1ytuln5nqaesk2iqlc 2aPVLMYvXDXv96sX5dGjsPE+HZGda1HGQ==</e:CipherValue> </e:cipherdata> </e:encryptedkey> </KeyInfo> <xenc:cipherdata> Page 79 of 90 Version 1.5 February 2015

80 <xenc:ciphervalue>nczykpgz7afhd 5Gyv6R/5s5Pw==</xenc:CipherValue> </xenc:cipherdata> </xenc:encrypteddata> <Signature xmlns=" <SignedInfo> <CanonicalizationMethod Algorithm=" <SignatureMethod Algorithm=" <Reference URI="#_0"> <Transforms> <Transform Algorithm=" </Transforms> <DigestMethod Algorithm=" <DigestValue>3d5GbpTJJ2uX3t4fJz3oT3TuaUA=</DigestValue> </Reference> </SignedInfo> <SignatureValue>Jrq3DeudNH48fFf7IaKRTKfq/+g=</SignatureValue> <KeyInfo> <o:securitytokenreference k:tokentype=" xmlns:k=" <o:keyidentifier ValueType=" profile-1.0#samlassertionid">_586b f-4a34-a7f5-2697fd0542ad</o:keyidentifier> </o:securitytokenreference> </KeyInfo> </Signature> </o:security> </s:header> <s:body> </s:body> </s:envelope> The key components of the message are: An encrypted SAML security token. This should be included in the WS-Security header exactly as returned from the STS (with no additional whitespace or line breaks). A signature that covers (at minimum) the timestamp of the message. The signature should be made using the symmetric key retuned from the STS. The signature includes a key reference that is also returned in the response from the STS. In cases where clients are being developed using a platform with WS-Security support (e.g..et, Java etc.), the web service stack will in most cases be able to automate the task of calling the STS and signing the message to the service by simply building the client form the WSDL for the service. In cases where this is not possible then at minimum the client will need to generate an XML digital signature using the HMAC-SHA1 algorithm. It is recommended that where the message must be composed manually, no entropy is provided to the STS when requesting the security token and key. This approach means the STS will return the exact key required to sign the message and removes the need for the client to compute the key based on a combined entropy algorithm (such as PSHA). As the server is authenticated using transport security, response messages from the server are in plain text and do not include any message level security. Page 80 of 90 Version 1.5 February 2015

81 7 Appendix A WSDL Schema The WSDL provided below provides a formal definition for all request and response messages for the USI Web Services. The production WSDL can be found at: The third-party WSDL can be found at: Page 81 of 90 Version 1.5 February 2015

82 8 Appendix B USI Country List This is the list of acceptable country names for the fields: Country of Residence in ContactDetailsType Country of Birth in Personal DetailsType Country of Study in Personal DetailsType The country name must match exactly for the relationship to be defined, though the matching is caseinsensitive. This list will change over time. For the most up to date version, please visit the USI website. Country Name Country Name Country Name Country Name Australia Dominican Republic Liberia Saudi Arabia Adelie Land (France) Ecuador Libya Scotland Afghanistan Egypt Liechtenstein Senegal Aland Islands El Salvador Lithuania Serbia Albania England Luxembourg Seychelles Algeria Equatorial Guinea Macau (SAR of China) Sierra Leone Andorra Eritrea Madagascar Singapore Angola Estonia Malawi Sint Maarten (Dutch part) Anguilla Ethiopia Malaysia Slovakia Antigua and Barbuda Falkland Islands Maldives Slovenia Argentina Faroe Islands Mali Solomon Islands Argentinian Antarctic Territory Fiji Malta Somalia Armenia Finland Marshall Islands South Africa Aruba Former Yugoslav Republic of Macedonia (FYROM) Martinique South America, nec Australian Antarctic Territory France Mauritania South Sudan Australian External Territories, nec French Guiana Mauritius Southern and East Africa, nec Austria French Polynesia Mayotte Spain Azerbaijan Gabon Mexico Spanish North Africa Page 82 of 90 Version 1.5 February 2015

83 Bahamas Bahrain Gambia Micronesia, Federated States of Sri Lanka Gaza Strip and West Bank Moldova St Barthelemy Bangladesh Georgia Monaco St Helena Barbados Germany Mongolia St Kitts and Nevis Belarus Ghana Montenegro St Lucia Belgium Gibraltar Montserrat St Martin (French part) Belize Greece Morocco St Pierre and Miquelon Benin Greenland Mozambique Bermuda Grenada Namibia Sudan St Vincent and the Grenadines Bhutan Guadeloupe Nauru Suriname Bolivia, Plurinational State of Guam Nepal Swaziland Bonaire, Sint Eustatius and Saba Guatemala Netherlands Sweden Bosnia and Herzegovina Guernsey New Caledonia Switzerland Botswana Guinea New Zealand Syria Brazil Guinea-Bissau Nicaragua Taiwan British Antarctic Territory Guyana Niger Tajikistan Brunei Darussalam Haiti Nigeria Tanzania Bulgaria Holy See Niue Thailand Burkina Faso Honduras Norfolk Island Timor-Leste Burma (Republic of the Union of Myanmar) Burundi Hong Kong (SAR of China) Northern Ireland Togo Hungary Northern Mariana Islands Tokelau Cambodia Iceland Norway Tonga Cameroon India Oman Trinidad and Tobago Canada Indonesia Pakistan Tunisia Cape Verde Iran Palau Turkey Cayman Islands Iraq Panama Turkmenistan Page 83 of 90 Version 1.5 February 2015

84 Central African Republic Ireland Papua New Guinea Turks and Caicos Islands Chad Isle of Man Paraguay Tuvalu Chile Israel Peru Uganda Chilean Antarctic Territory Italy Philippines Ukraine China (excludes SARs and Taiwan) Jamaica Pitcairn Islands United Arab Emirates Colombia Japan Poland Comoros Jersey Polynesia (excludes Hawaii), nec United States of America Uruguay Congo, Democratic Republic of Jordan Portugal Uzbekistan Congo, Republic of Kazakhstan Puerto Rico Vanuatu Cook Islands Kenya Qatar Costa Rica Cote d'ivoire Croatia Cuba Kiribati Queen Maud Land (Norway) Venezuela, Bolivarian Republic of Vietnam Korea, Democratic People's Republic of (North) Reunion Virgin Islands, British Korea, Republic of (South) Kosovo Romania Ross Dependency (New Zealand) Virgin Islands, United States Wales Curacao Kuwait Russian Federation Wallis and Futuna Cyprus Kyrgyzstan Rwanda Western Sahara Czech Republic Laos Samoa Yemen Denmark Latvia Samoa, American Zambia Djibouti Lebanon San Marino Zimbabwe Dominica Lesotho Sao Tome and Principe Page 84 of 90 Version 1.5 February 2015

85 9 Appendix C Visa Country List This is the list of acceptable country names for the field Country of Issue in VisaDocumentType. The country name must match exactly for the relationship to be defined, though the matching is caseinsensitive. This list will change over time. For the most up to date version, please visit the USI Agency website. Country Name Country Name Country Name Country Name AFGHANISTAN DEMOCRATIC REPUBLIC OF TIMOR-LESTE LITHUANIA SAUDI ARABIA ALBANIA DENMARK LUXEMBOURG SENEGAL ALGERIA DJIBOUTI MACAU SERBIA AND MONTENEGRO AMERICAN SAMOA DOMINICA MADAGASCAR SEYCHELLES ANDORRA DOMINICAN REPUBLIC MALAWI SIERRA LEONE ANGOLA EAST TIMOR MALAYSIA SINGAPORE ANGUILLA ECUADOR MALDIVES SLOVAK REPUBLIC ANTARCTICA EGYPT MALI SLOVENIA ANTIGUA AND BARBUDA EL SALVADOR MALTA SOLOMON ISLANDS ARGENTINA EQUATORIAL GUINEA MARSHALL ISLANDS SOMALIA ARMENIA ERITREA MARTINIQUE SOUTH AFRICA ARUBA ESTONIA MAURITANIA SOUTH GEORGIA AND THE SOUTH SANDWICH ISLANDS AUSTRALIA ETHIOPIA MAURITIUS SOVIET UNION AUSTRIA FALKLAND ISLANDS (MALVINAS) MAYOTTE SPAIN AZERBAIJAN FAROE ISLANDS MEXICO SRI LANKA BAHAMAS BAHRAIN BANGLADESH FIJI FINLAND FORMER YUGOSLAV REPUBLIC OF MACEDONIA MICRONESIA, FEDERATED STATES OF MOLDOVA, REPUBLIC OF MONACO ST HELENA ST PIERRE AND MIQUELON ST VINCENT AND THE GRENADINES BARBADOS FRANCE MONGOLIA STATELESS PERSON Page 85 of 90 Version 1.5 February 2015

86 BELARUS FRANCE, METROPOLITAN MONTSERRAT SUDAN BELGIUM FRENCH GUIANA MOROCCO SURINAME BELIZE FRENCH POLYNESIA MOZAMBIQUE BENIN SVALBARD AND JAN MAYEN ISLANDS FRENCH SOUTHERN TERRITORIES MYANMAR SWAZILAND BERMUDA GABON NAMIBIA SWEDEN BHUTAN GAMBIA NAURU SWITZERLAND BOLIVIA GEORGIA NEPAL SYRIAN ARAB REPUBLIC BOSNIA AND HERZEGOVINA GERMANY NETHERLANDS ANTILLES BOTSWANA GERMANY (DEMOCRATIC REPUBLIC OF) NETHERLANDS, KINGDOM OF THE TAIWAN, PROVINCE OF CHINA TAJIKISTAN BOUVET ISLAND GHANA NEUTRAL ZONE THAILAND BRAZIL GIBRALTAR NEW CALEDONIA TOGO BRITISH -CITIZEN GREECE NEW ZEALAND TOKELAU BRITISH DEPENDENT TERRITORIES CITIZEN GREENLAND NICARAGUA TONGA BRITISH INDIAN OCEAN TERRITORY GRENADA NIGER TRINIDAD AND TOBAGO BRITISH -NATIONAL (OVERSEAS) GUADELOUPE NIGERIA TUNISIA BRITISH -OVERSEAS CITIZEN GUAM NIUE TURKEY BRITISH -PROTECTED PERSON GUATEMALA NORFOLK ISLAND TURKMENISTAN BRITISH -SUBJECT GUINEA NORTHERN MARIANA ISLANDS BRUNEI DARUSSALAM GUINEA-BISSAU NORWAY TUVALU BULGARIA GUYANA OMAN UGANDA BURKINA FASO HAITI PAKISTAN UKRAINE BURKINA FASO BURMA TURKS AND CAICOS ISLANDS HEARD AND MCDONALD ISLANDS PALAU UNITED ARAB EMIRATES HONDURAS PALESTINIAN AUTHORITY UNITED NATIONS AGENCY Page 86 of 90 Version 1.5 February 2015

87 BURUNDI HONG KONG PANAMA BYELORUSSIAN - SOVIET SOCIALIST REPUBLIC HUNGARY PAPUA NEW GUINEA UNITED NATIONS ORGANISATION UNITED REPUBLIC OF TANZANIA CAMBODIA ICELAND PARAGUAY UNITED STATES CAMEROON INDIA PERU CANADA INDONESIA PHILIPPINES CAPE VERDE IRAN, ISLAMIC REPUBLIC OF PITCAIRN UNITED STATES MINOR OUTLYING ISLANDS UNMIK TRAVEL DOC - UNITED NATIONS INTERIM ADMINISTRATION MISSION IN KOSOVO UNSPECIFIED NATIONALITY CAYMAN ISLANDS IRAQ POLAND URUGUAY CENTRAL AFRICAN REPUBLIC IRELAND PORTUGAL UZBEKISTAN CHAD ISRAEL PUERTO RICO VANUATU CHILE ITALY QATAR CHINA CHRISTMAS ISLAND COCOS (KEELING) ISLANDS COLOMBIA JAMAICA JAPAN JORDAN KAZAKHSTAN REFUGEE AS PER ARTICLE 1, 1951 CONVENTION REFUGEE OTHER THAN ARTICLE 1 OF 1951 CONVENTION REPUBLIC OF KOREA (SOUTH) REPUBLIC OF MONTENEGRO COMOROS KENYA REPUBLIC OF SERBIA CONGO KIRIBATI COOK ISLANDS KOSOVO REUNION REPUBLIC OF SOUTH SUDAN VATICAN CITY STATE (HOLY SEE) VENEZUELA VIET NAM VIRGIN ISLANDS (BRITISH) VIRGIN ISLANDS (U.S) WALLIS AND FUTUNA ISLANDS WESTERN SAHARA YEMEN (DEMOCRATIC PEOPLES REPUBLIC) COSTA RICA KUWAIT ROMANIA YEMEN, REPUBLIC OF COTE D'IVOIRE KYRGYZSTAN ROMANIA PRE 1/2/2002 YUGOSLAVIA CROATIA LAO PEOPLES DEMOCRATIC REPUBLIC RUSSIAN FEDERATION ZAIRE Page 87 of 90 Version 1.5 February 2015

88 CUBA LATVIA RWANDA ZAMBIA CYPRUS LEBANON SAINT KITTS AND NEVIS ZIMBABWE CZECH REPUBLIC LESOTHO SAINT LUCIA CZECHOSLOVAKIA LIBERIA SAMOA DEMOCRATIC PEOPLES REPUBLIC OF KOREA (NORTH) LIBYAN ARAB JAMAHIRIYA SAN MARINO DEMOCRATIC REPUBLIC OF THE CONGO LIECHTENSTEIN SAO TOME & PRINCIPE Page 88 of 90 Version 1.5 February 2015

89 10 Appendix D WSDL with a WCF Application When using the Add Service Reference function of Visual Studio 2012 to build a WCF service client from the WSDL in Appendix A, the resulting service client requires some extra configuration. This extra configuration is detailed in the following steps. These changes are specific to Visual Studio 2012, but are expected to be relevant to other versions also. Perform these steps on the web.config or app.config file of the application where Add Service Reference has been performed. A full example is presented at the end of this section: 1. Add an endpoint behavior that contains the client certificate to be used in authenticating to the service (NOTE This takes advantage of the default behaviour config functionality in.net 4.0) : <behaviors> <endpointbehaviors> <behavior > <clientcredentials supportinteractive="false" useidentityconfiguration="true"> <clientcertificate findvalue="[insert your certificate thumbprint here]" x509findtype="findbythumbprint" storelocation="localmachine" storename="my"/> </clientcredentials> </behavior> </endpointbehaviors> </behaviors> 2. If targeting a non-production environment: a. Change to in the address attribute of these elements i. <issuer> ii. <issuermetadata> b. Change the address attribute of the client endpoint to match the target environment. Here is a full example of a config file that works in the USI Dev environment, using VANguard STS in the third party environment: <?xml version="1.0" encoding="utf-8"?> <configuration> <startup> <supportedruntime version="v4.0" sku=".netframework,version=v4.5" /> </startup> <system.servicemodel> <behaviors> <endpointbehaviors> <behavior> <clientcredentials supportinteractive="false" useidentityconfiguration="true"> <clientcertificate findvalue="ddf1f9fbea6ea1e64a0fd8767b160847fdb4bf5a" x509findtype="findbythumbprint" storelocation="localmachine" storename="my"/> </clientcredentials> </behavior> </endpointbehaviors> </behaviors> <bindings> <ws2007federationhttpbinding> Page 89 of 90 Version 1.5 February 2015

90 <binding name="ws2007federationhttpbinding_iusiservice"> <security mode="transportwithmessagecredential"> <message establishsecuritycontext="false"> <issuer address=" binding="ws2007httpbinding" bindingconfiguration="s007securitytokenserviceendpoint" /> <issuermetadata address=" /> <tokenrequestparameters> <trust:secondaryparameters xmlns:trust=" <trust:keytype> <trust:keysize>256</trust:keysize> <trust:keywrapalgorithm> <trust:claims Dialect=" xmlns:wsid=" <wsid:claimtype Uri=" /> <wsid:claimtype Uri=" /> </trust:claims> <trust:encryptwith> cbc</trust:encryptwith> <trust:signwith> <trust:canonicalizationalgorithm> <trust:encryptionalgorithm> cbc</trust:encryptionalgorithm> </trust:secondaryparameters> </tokenrequestparameters> </message> </security> </binding> </ws2007federationhttpbinding> <ws2007httpbinding> <binding name="s007securitytokenserviceendpoint"> <security mode="transportwithmessagecredential"> <transport clientcredentialtype="none" proxycredentialtype="none" realm="" /> <message clientcredentialtype="certificate" negotiateservicecredential="false" algorithmsuite="default" establishsecuritycontext="false" /> </security> </binding> </ws2007httpbinding> </bindings> <client> <endpoint address=" binding="ws2007federationhttpbinding" bindingconfiguration="ws2007federationhttpbinding_iusiservice" contract="generatedbatchwsdl.iusiservice" name="ws2007federationhttpbinding_iusiservice" /> </client> </system.servicemodel> </configuration> Page 90 of 90 Version 1.5 February 2015