Information for Developers

1.1 Application Program Interfaces (API’s)

1.1.1 A number of APIs are available to enable third parties to read and capture data from CSCS smartcards for use in their own applications. The following platforms are covered:

  • Windows PC
  • Android
  • Linux

1.1.2 To obtain a licence to embed one of the APIs in your application, contact Andy Puttock by email andyputtock@cscs.co.uk or mobile 07703 210737. There is a one-off licence administration fee of £500 plus VAT.

1.1.3 CSCS offers an online service for obtaining the serial number of cancelled CSCS smartcards. The instructions for using the service are in the CSCS Database API Specification.

1.2 Smart Functionality

1.2.1 One of the primary features of the CSCS smartcard is that it is a multi-purpose card that can be used for secondary applications such as access control and storing details of in-house training. To keep the options for secondary applications as broad as possible, CSCS smartcards have two different types of smart capability: firstly they are Java smartcards that can utilise Java applets for the management and manipulation of data; secondly they are MIFARE smartcards compatible with most MIFARE readers such as those commonly used in access control systems. Third parties may use these technologies as follows:

1.2.1.1 Use of MIFARE sectors

1.2.1.1.1 MIFARE sector 0 on the CSCS card contains information about the cardholder in a form that is publically readable. Qualifications are stored as codes. There is a dynamic look up table for the codes, which can be accessed through an API. Instructions for accessing the API are in the CSCS Database API Specification. Owing to the limited space available, only a subset of the qualifications can be stored on a card. The cardholder’s photograph is not included in the MIFARE data. Please note, there is no data in the MIFARE sector when the card is first issued; the data is added the first time it is read online.

1.2.1.1.2 MIFARE sector 15 contains three ready-made unique numbers of differing lengths, to fit with each of the Wiegand standards. These can be read using public read keys. (Please note there are no Wiegand numbers in the MIFARE sector when the card is first issued; the numbers are added the first time the card is read online.) Alternatively, every CSCS smartcard has a unique publicly readable 4 byte MIFARE UID that can be used for applications such as access control.

1.2.1.1.3 There are currently a number of unused MIFARE sectors on the CSCS smartcard. Each sector comprises 4×16 byte blocks, with 3 of these available for use. Control of these sectors is managed through the allocation of MIFARE keys (stored in the trailing block). If you wish to use one of the MIFARE sectors for your own purposes – for example, to hold codes that will work with your access control system – please contact Andy Puttock as above. Each set of keys will be licensed to only one user organisation and the holder of the keys to a particular sector gains control of that sector for all CSCS smartcards. Allocation is on a first come, first served basis until licenses for all the sectors have been issued.

1.2.1.2 Use of Java Applets

1.2.1.2.1 A Javacard Applet is a small Java Application designed specifically for the Javacard platform. Such Applets usually provide persistent secure storage for a limited amount of data which can be updated at any time.

1.2.1.2.2 The CSCS smartcard is designed with the capability for third parties to install their own Applets on smartcards of their choosing, subject to having the cardholder’s permission. There are two ways to use Applets with CSCS smartcards. One option is that some additional data about the cardholder can be put on the card such that the data can be read alongside the core CSCS data when reading a CSCS smartcard using the CSCS go smart software (free-of charge PC and smart device CSCS smartcard reader software). A CSCS Technology Partner can provide guidance for implementing such a solution as well as designing a suitable Applet for you. The second option is for you to create your own standalone Javacard Applet and card reading software. Again our technology partners can offer guidance for undertaking such an exercise.  Any organisation wishing to put an Applet on CSCS smartcards will need a licence from CSCS. There is a one-off Applet establishment fee of £1,000 plus VAT for issuing the licence which includes the cost of developing a basic Applet. Thereafter, there is an annual licence fee of £500 plus VAT. There is no restriction on the number of CSCS smartcards on which an Applet can be deployed.

2. CSCS Smartcard Checking

2.1 CSCS smartcards can be checked electronically as follows:

 2.1.1 Online

2.1.1.1 Connect a card reader to your PC and install go-smart which you can download here.

2.1.1.2 Download the go-smart app from Google Play to your Android device from here. Please note that this requires a device with near field communications (NFC) capability.

2.1.1.3 Download the go-smart app from the Windows App Store to your Windows mobile device (you will need a device with compliant NFC capability).

2.1.2 Offline

2.1.2.1 Connect a card reader to your PC and install go smart as above.

2.1.2.2 Download the go smart app from Google Play to your Android device (you will need a device with NFC capability).

2.1.2.3    Download the go smart app from the Windows App Store to your Windows mobile device (you will need a device with NFC capability).

2.1.3 Note: Apple has introduced NFC capability to its latest iPhones but has not released a software developer’s kit (SDK) to enable third parties such as CSCS to write an app capable of reading smartcards. For the time being therefore, it is not possible to check smartcards electronically with an iPhone. As soon as Apple releases a suitable SDK, we will make an app available.

3. Other Uses of CSCS Smartcards

3.1 Apps

3.1.1 For Android smart devices that have NFC capability, two additional apps for use with CSCS smartcards are available from Google Play.

These are:

  • The Time and Attendance app for registering people entering and leaving a site which is available here.
  • The Onsite Training Register app for logging the names of people who have attended an onsite training event which is available here.