PCI Statuses Export Data

The PCIStatuses export provides the current Payment Card Industry Data Security Standard (PCI DSS) compliance status for each merchant location in your ISO portfolio. Each record identifies whether the merchant has passed or failed PCI validation, the SAQ type applicable to their processing environment, the PCI DSS version used, scan results, and the certificate expiry date. Use this file to monitor compliance health and trigger renewal workflows.

Endpoint

GET /download/YYYYMMDD/PCIStatuses

Authentication

Basic HTTP Authentication required.
Encode username:password in Base64 and pass in the Authorization header:

Authorization: Basic {base64(username:password)}

When to use

Use this file to monitor portfolio-wide PCI DSS compliance, identify non-compliant merchants (pciStatus: Fail), track certificate expiry dates for renewal outreach, and report compliance statistics to card networks. Process it regularly — at minimum monthly — to catch expiring certificates before they lapse and trigger non-compliance fees.

Query Parameters

None. The file is identified by the date path segment (YYYYMMDD) and delivered via SFTP.

Response

200 OK — Returns structured data with the following fields per record:

PCI Status Reference:

SAQ Type Reference:

[
  {
    "id": 48291,
    "dba": "Acme Retail Store",
    "mid": "9180000000001234",
    "pciStatus": "Pass",
    "confirmedDate": "2026-03-06T00:00:00Z",
    "saqType": "BIP",
    "version": "v4.0",
    "scanner": "Trustwave",
    "scanPassed": true,
    "scanDate": "2026-03-01T00:00:00Z",
    "contactName": "Jane Smith",
    "email": "[email protected]",
    "address": "100 Commerce Blvd",
    "city": "Miami",
    "state": "FL",
    "zipCode": "33101",
    "saqStatus": "Pass",
    "saqStatusDate": "2026-03-06T00:00:00Z",
    "saqDueDate": "2027-03-06T00:00:00Z",
    "scanStatus": "Pass",
    "nextScanDate": "2026-09-01T00:00:00Z",
    "statusDate": "2026-03-06T00:00:00Z",
    "sourceType": "Conformance",
    "merchantProfileId": 71103
  }
]

Error Codes

Common Mistakes

• Using only pciStatus: Pass or Fail — the status field has many intermediate values (e.g. ConfirmedExpiredScan, FinishedOpenTasks) that require different follow-up actions.
• Ignoring saqDueDate — merchants approaching their SAQ deadline need proactive outreach before the status rolls to Expired.
• Treating scanStatus: NA as a failure — NA indicates the merchant's SAQ type does not require an external vulnerability scan (e.g. A, B).
• Not tracking nextScanDate — merchants requiring quarterly ASV scans must be monitored between export files.

Related Endpoints

• GET /download/YYYYMMDD/TINMismatch — IRS TIN compliance status
• GET /api/export/MerchantProfile — full merchant profile with service acceptance flags
• GET /download/YYYYMMDD/ReserveFunding — reserve account data for merchants in compliance remediation

Example

curl -X GET "https://hq.staging.netevia.dev/download/20260528/PCIStatuses" \
  -H "Authorization: Basic $(echo -n 'username:password' | base64)"