eCBSV Technical Information
eCBSV Registration & Enrollment
Permitted Entity Registration Process
eCBSV Technical Specifications
Recommended Technical Expertise
To Access Entity Registration and Enrollment
eCBSV Guide to eCBSV Written Consent
What is Written Consent in the eCBSV Context?
What is an Electronic Signature?
What are Acceptable Forms of Electronic Signatures?
How Do I Attach or Associate the Electronic Signature to the Written Consent?
Written Consent Incorporated into the Financial Institution’s Business Process
Written Consent Template Must Haves
Recommended Technical Expertise:
- Social Security recommends that each directly enrolled eCBSV Permitted Entity have familiarity with the following concepts:
- Extended Validation SSL certificates
- OpenID Connect specification (OIDC), including Discovery, Dynamic Client Registration, and Authorization Code Flow
- JSON Web Tokens (JWTs)
- OAuth 2, including JWT client assertion
- Understanding of REST API requests and responses (JSON) and headers
- JSON Web Encryption (JWE)
To Access Permitted Entity Registration and Enrollment:
SSA will provide an OpenID Connect and OAuth 2.0 solution for authentication and authorization to SSA’s Verification application programming interface (API). To access eCBSV, permitted entities must:
- Implement the required OpenID Connect/OAuth 2.0 configurations.
- Assign and manage all end-user permissions, which will be provided as attributes in the OpenID Connect assertion.
- Obtain API keys from SSA according to industry best practices.
- Entities wishing to enter into an agreement with SSA to use eCBSV are required to complete the OpenID Connect (OIDC) technical specifications before attempting to complete the eCBSV Online Registration.
To Submit and Obtain SSN Verifications:
- SSN Verifications will be provided via an application programming interface (API).
- The Verification API will verify that the number holder’s SSN, name, and date of birth matches or does not match the data in the Social Security Administration’s records.
- The Verification API will return a verification response of “yes” or “no.” If our records show that the SSN holder is deceased, the API will return a death indicator.
- Permitted entities will have the ability to submit individual or multiple verification requests to the Verification API for real-time results.
- The Verification API will return an error message if the service is unavailable or the transaction cannot be processed.
- eCBSV services will not be available if your company does not have a current/valid signed agreement in place or if your company exceeds your selected tier level for the 365-day period.
- eCBSV services will not be provided without successful authentication and authorization.
- See technical specifications for calling the API.
To Access the External Testing Environment:
- SSA will provide an External Testing Environment (ETE) for the eCBSV service so that clients in development can connect to this test environment and perform interface testing of their software with the eCBSV service.
- To register, you will need to provide the ODIC Issuer URL and if necessary, the optional Dynamic Client Registration Authorization Header Credentials, for your TEST environment. Upon successful registration, we will return the ETE OAuth Client ID.
- SSA recommends that entities set up and configure an independent test environment to connect to SSA’s ETE.
- The test environment must replicate the Production environment, including network connectivity, network security, and SSN Verifications to ensure proper handling of the responses returned to the client software.
- The ETE should not be used for high volume performance testing.
- View the technical specifications for accessing and testing ETE and ETE test cases.