Home › PCI compliance API for ISOs

A PCI compliance API for ISOs: merchant PCI inside your own systems

Your sponsor bank expects every merchant you board to validate PCI DSS compliance, and it expects you to know who has. If today that means invitation emails, a vendor login merchants forget, and a spreadsheet someone rebuilds before every sponsor review, an API lets you move merchant PCI into the systems you already run: boarding, your merchant portal and your CRM.

Short answer

A PCI compliance API lets an ISO run its merchant PCI program from its own systems: create the merchant at boarding, determine the right Self-Assessment Questionnaire (SAQ) for each way the merchant takes cards, have the merchant answer and sign under the ISO's brand, and receive the filled-in SAQ and Attestation of Compliance (AoC). Status changes arrive as webhooks, so compliance lives in the ISO's CRM and onboarding tools instead of a separate portal and a spreadsheet, and reporting to the sponsor bank becomes an export.

Where merchant PCI goes wrong at an operating ISO

It starts too late. PCI shows up months after boarding as an email from an unfamiliar sender. By then the merchant has moved on.
The merchant picks the wrong SAQ. A merchant with a counter terminal and an online store has two channels to cover, and most owners don't know how their terminal connects.
Your team answers the questions. Merchants call support to ask what a question means, which is time your staff could spend boarding merchants.
Status lives somewhere else. Your CRM says one thing, the vendor portal says another, and the spreadsheet is from last month.
Renewals lapse. Validation is annual, and nobody sees the expiry coming.
Reporting is a project. Every sponsor request means pulling, cleaning and reconciling data by hand.

What a merchant PCI program should look like inside an ISO

PCI is a step in boarding, using what underwriting already captured about how the merchant takes cards.
Every payment method gets its own SAQ, and the merchant answers in plain English.
The merchant sees your brand in the questions, the emails and the documents.
The signed SAQ and AoC are stored against the merchant record in your systems.
Status updates arrive in your CRM on their own.
Ops can see who is stuck, who is done and who expires next quarter.
Your sponsor report is an export, in the format your sponsor bank agreed.

Choose a delivery path by the team you have

If your ISO has…	Start with
No engineers to spare	Bulk CSV merchant invites: upload your merchant list and merchants complete their assessment under your brand.
A merchant portal and a web team	A platform redirect (hand off and return the merchant to your portal), or the embedded white-label iframe so merchants never leave your site.
Product and engineering	The REST API (OpenAPI 3.1): create merchants and payment methods at boarding, determine each SAQ, run the questions in your own interface, collect the signature and download the SAQ and AoC PDFs.
An AI assistant or chatbot	The MCP server, so an AI agent can run the assessment with the merchant conversationally.

Many ISOs start with invites for the existing book and move new boardings onto the redirect, iframe or API. The PCI compliance API page shows what a merchant sees and the first API calls.

Wiring it into the systems you already run

At boarding: create the merchant and add a payment method for each way it takes cards. The SAQ for each is determined from the merchant's own description, with a plain-English follow-up only when needed. We cover this pattern in embedding SAQ completion in merchant onboarding.
For gateway merchants: an Authorize.Net connection reads how the merchant takes payments, so the assessment starts from accurate facts. The merchant still reviews and answers everything.
In your CRM: signed webhooks report status changes, such as a completed assessment, so the merchant record updates itself.
For your ops team: portfolio endpoints show invited, started, in progress, completed, expiring and expired merchants, and annual renewal tracking shows who is coming due.
For your sponsor bank: the same portfolio data exports as a CSV.

If you are new to the idea, start with what an API for PCI compliance is. If you are launching a new ISO, the starting an ISO guide covers the rest of the setup.

The non-compliance fee works better with an easy way to finish

Many ISOs charge merchants a monthly fee until they validate. Whether you charge one, and how you disclose it, is a business and legal decision for you, your sponsor bank and your counsel. Whatever you decide, merchants who can finish in plain English under your brand have less reason to call about it. Merchants who search for the charge land on pages like this explanation of the PCI non-compliance fee.

Questions to ask any ISO PCI compliance software

Can we start the assessment from our own boarding flow, or only from your portal?
How is the SAQ chosen for a merchant that takes cards more than one way?
Whose brand does the merchant see?
How does status reach our CRM, and are the notifications signed?
Can we export portfolio status for our sponsor bank whenever we need it?
How are annual renewals tracked?
Can our engineers try it today without a sales call?

For a fuller list, see how to choose a merchant PCI compliance program, or estimate what automation is worth to you with the ROI calculator.

What Compliance Assessment Tool is and is not

CAT determines which of the nine merchant SAQs applies to each payment method under PCI DSS v4.0.1, asks the questions in plain English, collects the merchant's signature and produces the official PCI SSC SAQ and AoC. It is not a Qualified Security Assessor, it does not certify compliance, it does not scan networks and it does not measure fraud or disputes. Your acquirer decides which SAQ each merchant must submit.

Try it on your own merchant descriptions

Free sandbox credentials as soon as you verify your email, plus a ready-to-run Postman collection and examples on GitHub. $25 per completed assessment in production.

Get a free sandbox → Read the docs

Also see: PCI compliance for PayFacs · Merchant PCI programs for sponsor banks.

Common questions

What is a PCI compliance API for ISOs?

A set of endpoints that lets an ISO create merchants, add each payment method, determine the SAQ, run the questions, collect the merchant's signature and download the filled-in SAQ and AoC from its own systems. Compliance Assessment Tool also offers an embeddable iframe, a platform redirect and an MCP server for AI agents, all under the ISO's brand.

Do we need developers to use it?

Not to start. Bulk CSV merchant invites need no code at all. A platform redirect needs one link and a return page, and the iframe drops into an existing merchant portal. The REST API is for ISOs that want a fully custom flow inside their own product.

How is the SAQ chosen for a merchant with a terminal and a website?

Each way the merchant takes cards is a separate payment method with its own SAQ, determined from the merchant's own description, with a plain-English follow-up question when one is needed. Your acquirer decides whether it wants one SAQ per payment method or a combined one, and has the final say on which SAQ applies.

Can PCI status flow into our CRM?

Yes. Signed webhooks report status changes, such as an assessment being completed, so your CRM or onboarding system can update the merchant record without anyone checking a portal.

How do we report merchant PCI status to our sponsor bank?

Portfolio endpoints give a funnel across your merchants (invited, started, in progress, completed, expiring and expired) and the same data exports as a CSV. Agree the format and frequency your sponsor bank wants, then send the export on that schedule.

What does it cost?

$25 per completed merchant assessment. The sandbox is free and issued the same day, and documents produced in the sandbox are watermarked as test documents.

Does Compliance Assessment Tool provide ASV scans?

No. CAT handles SAQ selection, the plain-English questions, the signature and the official SAQ and AoC. It does not scan networks, so merchants whose SAQ requires quarterly external scans still need an Approved Scanning Vendor.

Sources

This page is general information, not legal advice. Card-brand rules and your sponsor or acquirer agreements set your obligations and each merchant's validation requirements; the acquirer decides which SAQ applies. Compliance Assessment Tool facilitates merchant PCI DSS self-assessment under PCI DSS v4.0.1. It is not a Qualified Security Assessor and does not certify or guarantee compliance. Third-party names are trademarks of their owners.