--- title: "Compliance with PCI DSS requirements" description: "Ask your users to sign the required PCI security questionnaires." url: "https://docs.adyen.com/platforms/onboard-users/pci-forms" source_url: "https://docs.adyen.com/platforms/onboard-users/pci-forms.md" canonical: "https://docs.adyen.com/platforms/onboard-users/pci-forms" last_modified: "2026-05-24T12:54:31+02:00" language: "en" --- # Compliance with PCI DSS requirements Ask your users to sign the required PCI security questionnaires. [View source](/platforms/onboard-users/pci-forms.md) ##### PCI DSS compliance Learn about PCI DSS compliance at Adyen in our [compliance guide](/development-resources/pci-dss-compliance-guide). Because your users have a direct connection with card schemes, they must comply with the requirements laid down in the Payment Card Industry Data Security Standards (PCI DSS) for collecting, processing, storing, and transmitting cardholder data in a secure environment. To prove their compliance, they must sign a Self-Assessment Questionnaire (SAQ) before they can start processing card payments. The questionnaire asks them to confirm the security of their cardholder data environment, which typically includes their website, web servers, and employees who can access them. Depending on your user's sales channels, they must sign one or more SAQs. The questionnaires that Adyen provides are simplified versions of the full SAQs. If multiple SAQs are required, Adyen provides all the questionnaires and your users will only need to sign once. ## Requirements Take into account the following requirements, limitations, and preparations | Requirement | Description | | -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Integration type** | You must have an Adyen for Platforms [platform setup](/platforms). | | **[API credentials](/development-resources/api-credentials/)** | You must have credentials for the [Legal Entity Management API](https://docs.adyen.com/api-explorer/legalentity/latest/overview). | | **[Webhooks](/development-resources/webhooks)** | You are subscribed to the [balancePlatform.accountHolder.updated](https://docs.adyen.com/api-explorer/#/balanceplatform-webhooks/latest/post/balancePlatform.accountHolder.updated) webhook. | | **Setup steps** | Before you begin, you must have already: - [Created a legal entity](/platforms/verification-requirements#legal-entity-type) for the main legal entity/user that has a contractual relationship with your platform and for the individual who will sign the PCI document. - Created business lines for the main legal entity/for the organization for all the sales channels that they support. The [salesChannels](https://docs.adyen.com/api-explorer/legalentity/latest/post/businessLines#request-salesChannels) determine which and how many PCI documents must be signed. - [Created an account holder](/platforms/onboard-users/onboarding-steps) for your user. | If you onboard your users using [hosted onboarding](/platforms/onboard-users), they sign SAQs in the hosted onboarding page. To show the questionnaires to them, you must either: * Add payment methods to the store of the user. * Require the user to sign questionnaires by using the [hosted onboarding settings](/platforms/onboard-users/customize-hosted-onboarding/#page-settings). If you are [building your own UI](/platforms/onboard-users), you must generate the required PCI SAQs, show these to your users, and ask them to sign by performing the following steps. Use the [Legal Entity Management API](https://docs.adyen.com/api-explorer/legalentity/latest/overview) to generate the required questionnaires and send the signed versions to Adyen. ## Step 1: Confirm PCI requirements When you create an account holder, certain [capabilities](/platforms/verification-overview/capabilities) are requested for them. To check whether your user must sign PCI documents, listen to [balancePlatform.accountHolder.updated](https://docs.adyen.com/api-explorer/#/balanceplatform-webhooks/latest/post/balancePlatform.accountHolder.updated) webhooks. If your user is required to sign PCI forms, it is indicated in the `verificationErrors` array. **balancePlatform.accountHolder.updated webhook - with verification errors array** ```json { "data":{ "accountHolder":{ "capabilities":{ "sendToTransferInstrument":{ "allowed":"false", "enabled":"true", "problems":[ { "entity":{ "id":"LE00000000000000000000001", "type":"LegalEntity" }, "verificationErrors":[ { "code":"2_901", "message":"PCI forms are not signed.", "remediatingActions":[ { "code":"2_901", "message":"Sign PCI" } ], "type":"" } ] } ], "requested":"true", "verificationStatus":"invalid" } }, "description":"Test Account holder", "reference":"YOUR_INTERNAL_IDENTIFIER", "id":"AH00000000000000000000001", "legalEntityId":"LE00000000000000000000001", "status":"Active" }, "balancePlatform":"YOUR_BALANCE_PLATFORM" }, "environment":"test", "type":"balancePlatform.accountHolder.updated" } ``` ## Step 2: Generate the questionnaires To generate simplified questionnaires, send a POST [/legalEntities/{id}/pciQuestionnaires/generatePciTemplates](https://docs.adyen.com/api-explorer/legalentity/latest/post/legalEntities/\(id\)/pciQuestionnaires/generatePciTemplates) request, specifying the legal entity [id](https://docs.adyen.com/api-explorer/legalentity/latest/post/legalEntities#responses-200-id) of the organization in the path. You can change the language of the questionnaire from the default English by sending the request with [language](https://docs.adyen.com/api-explorer/legalentity/latest/post/legalEntities/_id_/pciQuestionnaires/generatePciTemplates#request-language) set to the two-character [ISO 639-1](https://en.wikipedia.org/wiki/ISO_639-1) code of the desired language. For example, **fr**. In the body of the request, you can specify the following: | Parameter | Required | Description | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [additionalSalesChannels](https://docs.adyen.com/api-explorer/legalentity/latest/post/legalEntities/_id_/pciQuestionnaires/generatePciTemplates#request-additionalSalesChannels) | | An array of additional sales channels to generate PCI questionnaires. Include the relevant sales channels if you need your user to sign PCI questionnaires. You do not need to provide these if you create stores and add payment methods for your user before you generate the questionnaires. | **Generate the questionnaires in French** #### curl ```bash curl https://kyc-test.adyen.com/lem/v3/legalEntities/LE00000000000000000000001/pciQuestionnaires/generatePciTemplates \ -H 'x-api-key: ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY' \ -H 'content-type: application/json' \ -X POST \ -d '{ "language" : "fr" }' ``` #### Java ```java // Adyen Java API Library v33.0.0 import com.adyen.Client; import com.adyen.enums.Environment; import com.adyen.model.legalentitymanagement.*; import java.time.OffsetDateTime; import java.util.*; import com.adyen.service.legalEntityManagement.*; Client client = new Client("ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY", Environment.TEST); // Create the request object(s) GeneratePciDescriptionRequest generatePciDescriptionRequest = new GeneratePciDescriptionRequest() .language("fr"); // Send the request PciQuestionnairesApi service = new PciQuestionnairesApi(client); GeneratePciDescriptionResponse response = service.generatePciQuestionnaire("id", generatePciDescriptionRequest, null); ``` #### PHP ```php setXApiKey("ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY"); $client->setEnvironment(Environment::TEST); // Create the request object(s) $generatePciDescriptionRequest = new GeneratePciDescriptionRequest(); $generatePciDescriptionRequest ->setLanguage("fr"); // Send the request $service = new PCIQuestionnairesApi($client); $response = $service->generatePciQuestionnaire('id', $generatePciDescriptionRequest); ``` #### C\# ```cs // Adyen .net API Library v28.0.0 using Adyen; using Environment = Adyen.Model.Environment; using Adyen.Model; using Adyen.Model.LegalEntityManagement; using Adyen.Service.LegalEntityManagement; var config = new Config() { XApiKey = "ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY", Environment = Environment.Test }; var client = new Client(config); // Create the request object(s) GeneratePciDescriptionRequest generatePciDescriptionRequest = new GeneratePciDescriptionRequest { Language = "fr" }; // Send the request var service = new PCIQuestionnairesService(client); var response = service.GeneratePciQuestionnaire("id", generatePciDescriptionRequest); ``` #### NodeJS (JavaScript) ```js // Adyen Node API Library v23.3.0 const { Client, LegalEntityManagementAPI } = require('@adyen/api-library'); const client = new Client({ apiKey: "ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY", environment: "TEST" }); // Create the request object(s) const generatePciDescriptionRequest = { language: "fr" } // Send the request const legalEntityManagementAPI = new LegalEntityManagementAPI(client); const response = legalEntityManagementAPI.PCIQuestionnairesApi.generatePciQuestionnaire("id", generatePciDescriptionRequest); ``` #### Go ```go // Adyen Go API Library v17.0.0 import ( "context" "github.com/adyen/adyen-go-api-library/v17/src/common" "github.com/adyen/adyen-go-api-library/v17/src/adyen" "github.com/adyen/adyen-go-api-library/v17/src/legalEntityManagement" ) client := adyen.NewClient(&common.Config{ ApiKey: "ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY", Environment: common.TestEnv, }) // Create the request object(s) generatePciDescriptionRequest := legalEntityManagement.GeneratePciDescriptionRequest{ Language: common.PtrString("fr"), } // Send the request service := client.LegalEntityManagement() req := service.PCIQuestionnairesApi.GeneratePciQuestionnaireInput("id").GeneratePciDescriptionRequest(generatePciDescriptionRequest) res, httpRes, err := service.PCIQuestionnairesApi.GeneratePciQuestionnaire(context.Background(), req) ``` #### Python ```py # Adyen Python API Library v13.3.0 import Adyen adyen = Adyen.Adyen() adyen.client.xapikey = "ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY" adyen.client.platform = "test" # The environment to use library in. # Create the request object(s) json_request = { "language": "fr" } # Send the request result = adyen.legalEntityManagement.pci_questionnaires_api.generate_pci_questionnaire(request=json_request, id="id") ``` #### Ruby ```rb # Adyen Ruby API Library v10.1.1 require "adyen-ruby-api-library" adyen = Adyen::Client.new adyen.api_key = 'ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY' adyen.env = :test # Set to "live" for live environment # Create the request object(s) request_body = { :language => 'fr' } # Send the request result = adyen.legalEntityManagement.pci_questionnaires_api.generate_pci_questionnaire(request_body, 'id') ``` #### NodeJS (TypeScript) ```ts // Adyen Node API Library v23.3.0 import { Client, LegalEntityManagementAPI, Types } from "@adyen/api-library"; const client = new Client({ apiKey: "ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY", environment: "TEST" }); // Create the request object(s) const generatePciDescriptionRequest: Types.legalEntityManagement.GeneratePciDescriptionRequest = { language: "fr" }; // Send the request const legalEntityManagementAPI = new LegalEntityManagementAPI(client); const response = legalEntityManagementAPI.PCIQuestionnairesApi.generatePciQuestionnaire("id", generatePciDescriptionRequest); ``` The response returns the following information: | Parameter | Description | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [content](https://docs.adyen.com/api-explorer/legalentity/latest/post/legalEntities/_id_/pciQuestionnaires/generatePciTemplates#responses-200-content) | The generated questionnaire in a base64 encoded format. Decode the content with the [Base64.Decoder](https://base64.guru/developers/java/examples/decode-pdf) class and present the questionnaires to your user. | | [language](https://docs.adyen.com/api-explorer/legalentity/latest/post/legalEntities/_id_/pciQuestionnaires/generatePciTemplates#responses-200-language) | The language of the questionnaire. The default value is **en**. | | [pciTemplateReferences](https://docs.adyen.com/api-explorer/legalentity/latest/post/legalEntities/_id_/pciQuestionnaires/generatePciTemplates#responses-200-pciTemplateReferences) | The array of Adyen-generated unique identifiers for the questionnaires. If the array is empty, the user is not required to sign questionnaires. You must include this information in the signing request. | **Generated questionnaires in French** ```json { "content": "l345JKNFj345FJLG3lk...", "language": "fr", "pciTemplateReferences": [ "PCIT-T7KC6VGL", "PCIT-PKB6DKS4" ] } ``` ## Step 3: Present the questionnaires to your user You need to ask your user to review and sign the questionnaires. When presenting them to your user in your website, you can render the documents using the Adyen Document Viewer. Decode the documents before passing them to the Adyen Document Viewer. ```js const documentViewer = new AdyenDocumentViewer('#test'); const document = JSON.parse(decodeURIComponent(escape(window.atob(pciTemplateReferences.document)))); documentViewer.render(document); ``` ### Tab: npm (Recommended) Install the [Adyen Document Viewer package](https://www.npmjs.com/package/@adyen/adyen-document-viewer): ```bash npm install @adyen/adyen-document-viewer --save ``` Import the Adyen Document Viewer Node package into your application. You can add your own styling by overriding the rules in the CSS file. ```js import AdyenDocumentViewer from '@adyen/adyen-document-viewer'; import '@adyen/adyen-document-viewer/dist/adyen-document-viewer.min.css'; ``` ### Tab: Embed script and stylesheet Include the script and stylesheet to a .html file **HTML** ```html ``` ## Step 4: Sign the questionnaires You must ask your user to declare that they comply with the scheme requirements by signing the generated questionnaires. To sign the questionnaires, send a POST [/legalEntities/{id}/pciQuestionnaires/signPciTemplates](https://docs.adyen.com/api-explorer/legalentity/latest/post/legalEntities/\(id\)/pciQuestionnaires/generatePciTemplates) request, specifying the [id](https://docs.adyen.com/api-explorer/legalentity/latest/post/legalEntities#responses-200-id) of the main legal entity in the path. In the body of the request, specify the following: | Parameter | Required | Description | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | [signedBy](https://docs.adyen.com/api-explorer/legalentity/latest/post/legalEntities/_id_/pciQuestionnaires/signPciTemplates#request-signedBy) | ![-white\_check\_mark-](/user/data/smileys/emoji/white_check_mark.png "-white_check_mark-") | The legal entity [id](https://docs.adyen.com/api-explorer/legalentity/latest/post/legalEntities#responses-200-id) of the individual who signed the questionnaires. | | [pciTemplateReferences](https://docs.adyen.com/api-explorer/legalentity/latest/post/legalEntities/_id_/pciQuestionnaires/signPciTemplates#request-pciTemplateReferences) | ![-white\_check\_mark-](/user/data/smileys/emoji/white_check_mark.png "-white_check_mark-") | The array of unique identifiers of the questionnaires. | The request submits the legal entity ID of the individual who signed the simplified questionnaires and populates the formal PCI SAQ with the legal entity data. **Sign the questionnaires** #### curl ```bash curl https://kyc-test.adyen.com/lem/v3/legalEntities/LE00000000000000000000001/pciQuestionnaires/signPciTemplates \ -H 'x-api-key: ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY' \ -H 'content-type: application/json' \ -X POST \ -d '{ "signedBy": "LE00000000000000000000002", "pciTemplateReferences": [ "PCIT-T7KC6VGL", "PCIT-PKB6DKS4" ] }' ``` #### Java ```java // Adyen Java API Library v33.0.0 import com.adyen.Client; import com.adyen.enums.Environment; import com.adyen.model.legalentitymanagement.*; import java.time.OffsetDateTime; import java.util.*; import com.adyen.service.legalEntityManagement.*; Client client = new Client("ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY", Environment.TEST); // Create the request object(s) PciSigningRequest pciSigningRequest = new PciSigningRequest() .signedBy("LE00000000000000000000002") .pciTemplateReferences(Arrays.asList("PCIT-T7KC6VGL", "PCIT-PKB6DKS4")); // Send the request PciQuestionnairesApi service = new PciQuestionnairesApi(client); PciSigningResponse response = service.signPciQuestionnaire("id", pciSigningRequest, null); ``` #### PHP ```php setXApiKey("ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY"); $client->setEnvironment(Environment::TEST); // Create the request object(s) $pciSigningRequest = new PciSigningRequest(); $pciSigningRequest ->setSignedBy("LE00000000000000000000002") ->setPciTemplateReferences(array("PCIT-T7KC6VGL", "PCIT-PKB6DKS4")); // Send the request $service = new PCIQuestionnairesApi($client); $response = $service->signPciQuestionnaire('id', $pciSigningRequest); ``` #### C\# ```cs // Adyen .net API Library v28.0.0 using Adyen; using Environment = Adyen.Model.Environment; using Adyen.Model; using Adyen.Model.LegalEntityManagement; using Adyen.Service.LegalEntityManagement; var config = new Config() { XApiKey = "ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY", Environment = Environment.Test }; var client = new Client(config); // Create the request object(s) PciSigningRequest pciSigningRequest = new PciSigningRequest { SignedBy = "LE00000000000000000000002", PciTemplateReferences = { "PCIT-T7KC6VGL", "PCIT-PKB6DKS4" } }; // Send the request var service = new PCIQuestionnairesService(client); var response = service.SignPciQuestionnaire("id", pciSigningRequest); ``` #### NodeJS (JavaScript) ```js // Adyen Node API Library v23.3.0 const { Client, LegalEntityManagementAPI } = require('@adyen/api-library'); const client = new Client({ apiKey: "ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY", environment: "TEST" }); // Create the request object(s) const pciSigningRequest = { signedBy: "LE00000000000000000000002", pciTemplateReferences: [ "PCIT-T7KC6VGL", "PCIT-PKB6DKS4" ] } // Send the request const legalEntityManagementAPI = new LegalEntityManagementAPI(client); const response = legalEntityManagementAPI.PCIQuestionnairesApi.signPciQuestionnaire("id", pciSigningRequest); ``` #### Go ```go // Adyen Go API Library v17.0.0 import ( "context" "github.com/adyen/adyen-go-api-library/v17/src/common" "github.com/adyen/adyen-go-api-library/v17/src/adyen" "github.com/adyen/adyen-go-api-library/v17/src/legalEntityManagement" ) client := adyen.NewClient(&common.Config{ ApiKey: "ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY", Environment: common.TestEnv, }) // Create the request object(s) pciSigningRequest := legalEntityManagement.PciSigningRequest{ SignedBy: "LE00000000000000000000002", PciTemplateReferences: []string{ "PCIT-T7KC6VGL", "PCIT-PKB6DKS4", }, } // Send the request service := client.LegalEntityManagement() req := service.PCIQuestionnairesApi.SignPciQuestionnaireInput("id").PciSigningRequest(pciSigningRequest) res, httpRes, err := service.PCIQuestionnairesApi.SignPciQuestionnaire(context.Background(), req) ``` #### Python ```py # Adyen Python API Library v13.3.0 import Adyen adyen = Adyen.Adyen() adyen.client.xapikey = "ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY" adyen.client.platform = "test" # The environment to use library in. # Create the request object(s) json_request = { "signedBy": "LE00000000000000000000002", "pciTemplateReferences": [ "PCIT-T7KC6VGL", "PCIT-PKB6DKS4" ] } # Send the request result = adyen.legalEntityManagement.pci_questionnaires_api.sign_pci_questionnaire(request=json_request, id="id") ``` #### Ruby ```rb # Adyen Ruby API Library v10.1.1 require "adyen-ruby-api-library" adyen = Adyen::Client.new adyen.api_key = 'ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY' adyen.env = :test # Set to "live" for live environment # Create the request object(s) request_body = { :signedBy => 'LE00000000000000000000002', :pciTemplateReferences => [ 'PCIT-T7KC6VGL', 'PCIT-PKB6DKS4' ] } # Send the request result = adyen.legalEntityManagement.pci_questionnaires_api.sign_pci_questionnaire(request_body, 'id') ``` #### NodeJS (TypeScript) ```ts // Adyen Node API Library v23.3.0 import { Client, LegalEntityManagementAPI, Types } from "@adyen/api-library"; const client = new Client({ apiKey: "ADYEN_LEGAL_ENTITY_MANAGEMENT_API_KEY", environment: "TEST" }); // Create the request object(s) const pciSigningRequest: Types.legalEntityManagement.PciSigningRequest = { signedBy: "LE00000000000000000000002", pciTemplateReferences: ["PCIT-T7KC6VGL", "PCIT-PKB6DKS4"] }; // Send the request const legalEntityManagementAPI = new LegalEntityManagementAPI(client); const response = legalEntityManagementAPI.PCIQuestionnairesApi.signPciQuestionnaire("id", pciSigningRequest); ``` The response returns an array of the unique identifiers of the signed SAQ documents. **List of signed questionnaires** ```json { "pciQuestionnaireIds": [ "PCID422GZ22322565HHMH48CW63CPH", "PCID422GZ22322565HHMH49CW75Z9H" ], "signedBy": "LE00000000000000000000002" } ``` ## Step 5: Get a list of signed SAQs To retrieve a list of the documents signed by your user, send a GET [/legalEntities/{id}/pciQuestionnaires](https://docs.adyen.com/api-explorer/legalentity/latest/get/legalEntities/\(id\)/pciQuestionnaires) request, specifying the [id](https://docs.adyen.com/api-explorer/legalentity/latest/post/legalEntities#responses-200-id) of the main legal entity in the path. **Get a list of SAQs** ```json { "data": [ { "createdAt": "2023-03-02T17:54:19.538365Z", "id": "PCID422GZ22322565HHMH48CW63CPH", "validUntil": "2024-03-01T17:54:19.538365Z" }, { "createdAt": "2023-03-02T17:54:19.538365Z", "id": "PCID422GZ22322565HHMH49CW75Z9H", "validUntil": "2024-03-01T17:54:19.538365Z" } ] } ``` ## Step 6: Download a signed questionnaire To download a signed SAQ, send a GET [/legalEntities/{id}/pciQuestionnaires/{pciid}](https://docs.adyen.com/api-explorer/legalentity/latest/get/legalEntities/\(id\)/pciQuestionnaires/\(pciid\)) request, specifying the following parameters in the path: | Path parameter | Required | Description | | --------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | ---------------------------------------- | | [id](https://docs.adyen.com/api-explorer/legalentity/latest/post/legalEntities#responses-200-id) | ![-white\_check\_mark-](/user/data/smileys/emoji/white_check_mark.png "-white_check_mark-") | The legal entity ID of the organization. | | [pciid](https://docs.adyen.com/api-explorer/legalentity/latest/get/legalEntities/_id_/pciQuestionnaires/_pciid_#path-pciid) | ![-white\_check\_mark-](/user/data/smileys/emoji/white_check_mark.png "-white_check_mark-") | The ID of the signed questionnaire. | The response returns the base64 encoded form of the signed document in PDF format in the [content](https://docs.adyen.com/api-explorer/legalentity/latest/get/legalEntities/_id_/pciQuestionnaires/_pciid_#responses-200-content) field. To present the document to your user, use the [Base64.Decoder](https://base64.guru/developers/java/examples/decode-pdf) class. **Signed questionnaire** ```json { "content":"JVBERi0xLjUKJdDUxdgKMTAg.....", "createdAt":"2023-03-02T17:54:19.538365Z", "id":"PCID422GZ22322565HHMH48CW63CPH", "validUntil":"2024-03-01T17:54:19.538365Z" } ```