Thredd

Thredd (formerly Global Processing Services / GPS) is a London-headquartered issuer-processor and next-generation payments technology company, founded in 2007, rebranded to Thredd in 2023, and backed by Advent International. It provides card issuing and issuer processing for fintechs, neobanks, banking-as-a-service platforms, and program managers across Mastercard, Visa, and Discover, spanning 40+ countries, with real-time transaction authorization (External Host Interface / EHI), digital-wallet tokenization (Apple Pay, Google Pay), 3-D Secure / strong customer authentication, card controls, and fraud / scam detection. Its home market is the United Kingdom. Thredd ships a genuine public developer surface: a self-serve Developer Portal (devportal.thredd.com) that grants a sandbox client id and secret, an API Hub REST API at api.thredd.com, and a ReadMe-hosted API reference (cardsapidocs.thredd.com) documenting roughly 129 endpoints across more than a dozen product OpenAPI definitions (core cards, transactions, credit, custom PAN, card limits, card controls, digital wallets, 3DS, ACH, open banking, alias directory, and web services). Authentication is FAPI-grade OAuth2 client-credentials using private_key_jwt client assertions over mutual TLS, brokered by Cloudentity with Raidiam Connect acting as the certificate authority; webhooks and event subscriptions are supported. The underlying OpenAPI files render only through the hub and are not anonymously downloadable.

Kin Score

This is the API Evangelist rating — a single, repeatable read computed from the artifacts on this page. Green fill is points earned; the red track is points possible, so every bar shows earned-versus-possible at a glance.

How we profile Thredd

Each block below is one kind of artifact we hold for Thredd. For each we say what it is and why it earns a place in the profile, then list every one we've indexed — capped at two rows, scroll within the panel for the rest.

APIs 10

Each API is captured as its own OpenAPI definition — every operation, parameter, and response. This is the single most useful machine-readable description of what an API does, and it's what lets us score, lint, mock, and generate against it without asking the provider for anything.

Individual APIs this provider publishes, each with its own machine-readable definition.

Thredd Cards API

Create, retrieve, update, renew, replace, and convert physical and virtual cards; manage card status, cardholder details, card images, encrypted card data, and bulk card creatio...

Thredd Card Transactions API

Retrieve card transactions and transaction history, including load / unload operations and balances, for cards managed on the Thredd platform.

Thredd Card Controls & Limits API

List and update card control groups, manage merchant allow / disallow lists and card acceptors, and configure card spend limits at the product level.

Thredd 3-D Secure (SCA) API

Create, list, update, and delete 3-D Secure credentials and configuration for strong customer authentication (SCA) on issued cards.

Thredd PIN & CVV Management API

Set, retrieve, and unblock cardholder PINs, and retrieve and unblock CVV2 values and their status, over the Thredd API Hub.

Thredd Digital Wallets API

Enroll and provision cards into Apple Pay and Google Pay, generate wallet web-provisioning tokens, and manage payment-instrument tokenization for digital wallets.

Thredd Webhooks & Event Subscriptions API

Create and manage webhooks and event subscriptions to receive asynchronous notifications of card, transaction, and account events from the Thredd platform.

Thredd Credit API

Credit account and credit-program endpoints for managing credit overviews and related credit issuing capabilities on the Thredd platform.

Thredd Custom PAN API

Create customisable card numbers (custom PAN) so programs can define specific primary account number patterns for their issued cards.

Thredd Accounts API

Account-level endpoints supporting account records and money-movement flows (including ACH / micro-deposit verification) on the Thredd platform.

Scroll within the panel for all 10 ·

MCP Servers 1

Model Context Protocol servers expose these APIs directly to AI agents. We profile them because agent-native access is the fastest-growing way this provider's capabilities actually get used.

Model Context Protocol servers that expose these APIs to AI agents.

thredd-mcp.yml

MCP SERVER

Event Specifications 1

Not every API is request/response. AsyncAPI describes the event-driven and streaming side — the webhooks and channels — so the asynchronous half of the interface is documented the same way the synchronous half is.

AsyncAPI definitions for this provider's event-driven and streaming APIs.

Thredd Webhooks

ASYNCAPI

Security Posture 2

Authentication, domain security, vulnerability disclosure, and trust-center signals — the evidence that a provider takes security seriously enough to document it. We profile it because you can't govern what you can't see.

Authentication, domain security, vulnerability disclosure, and trust-center signals.

Thredd Authentication

oauth2/mutualTLS · 3 schemes

SECURITY

Thredd Domain Security

TLSv1.3 · HSTS · DMARC

SECURITY

Scopes 1

OAuth scopes are the vocabulary of least-privilege access. Profiling them shows exactly what an integration — or an agent acting on a user's behalf — is allowed to do.

OAuth scopes governing access to this provider's APIs.

Thredd Scopes

6 scopes

6 scopes

SCOPES

Resources

Every other property we hold for Thredd — documentation, portals, status pages, policies, and corporate surface — grouped by the job it does, following the integrator's arc from getting started to running in production.

← All providers · Data indexed from github.com/api-evangelist/thredd · machine-readable index on apis.io