# Bulk Card Enrollment
source: https://developer.mastercard.com/consent-management/documentation/use-cases/transaction-notifications/bulk-card-enrolment/index.md

## Overview {#overview}

If you are acting on behalf of an issuer or a co-brand partner, consent to share data with your service may have already been obtained by the issuer with the explicit permission of the cardholder as part of the card agreement. If this is the case, you may be allowed to register cards for Transaction Notifications API without having to re-obtain consent from cardholders.

Once you have confirmed consent to access a cardholder's transaction data, you can use the same [Consent and Authentication APIs](https://developer.mastercard.com/consent-management/documentation/api-reference/index.md#authentication-consent-management) to register their cards for transaction notifications, without the need to authenticate the cardholder. This not only saves time and effort for both the issuer and the cardholder, but also ensures a seamless and secure process for enrolling cards into the Transaction Notifications API.

It is important to note that permission to access transaction data must only be used for the approved purpose of providing transaction notifications and not for any other purposes without the cardholder's explicit consent. Additionally, you must comply with all applicable laws and regulations, including data privacy requirements, when accessing and using transaction data.

The following sequence shows the bulk-card enrollment flow using the Mastercard Consent Management \& Enrollment API:
Diagram behalf_of_banks

1. The issuer calls the `cards/bulk` endpoint, specifying multiple PANs:
   API Reference: `POST /cards/bulk`

2. The Consent Management \& Enrollment API returns the `cardReference` for all added cards. If a card is not added, an `errorCode` and error are returned.
3. The issuer calls the `cards/bulk-revokes` endpoint, specifying multiple PANs to revoke consent:
   API Reference: `POST /cards/bulk-revokes`

4. The Consent Management \& Enrollment API returns the `consentIds` for all revoked cards.