Diagram illustrating the APDU command and response structure

APDU is an application-level protocol, defined in ISO 7816-4, used between a smart card and a POS, ATM, etc.

There are two types of APDU:

  • Command APDU
  • Response APDU

The structure of the APDU is given below:

Command APDU structure

Mandatory HeaderMandatory HeaderMandatory HeaderMandatory HeaderOptional bodyOptional bodyOptional body
CLAINSPP2LcData FieldLe
Diagram of the Command APDU structure fields: CLA, INS, P1, P2, Lc, Data Field, Le

The first four sections, namely CLA , INS , P1 and P2 are mandatory in all APDU commands, and each one is one byte long . These one-byte-long sections respectively represent Class, Instruction, Parameter 1, and Parameter 2.

The last three sections, namely Lc, CData and Le are optional.

  1. Command APDU (C-APDU): This command is used by the host application to send a command to the card.
    1. Header: consists of 4 bytes:
      1. Class (CLA)
      2. Instruction code (INS)
      3. Parameters: P1 and P2
    2. Optional body: varies in length.
      1. Lc = indicates the length (in bytes) of the optional body, or data field.
      2. Le = indicates the data length, or the number of bytes the host expects in response to the command sent.
      3. The data field contains the data sent to the card to execute the instruction specified in the header.
  2. Response APDU (R-APDU): This command is used by the card to respond to the command sent by the host application.
    1. Optional body: consists of the data field, whose length is specified by Le
    2. Trailer: consists of two words, SW1 and SW2, called the status words, which indicate the processing status on the card after the APDU command has been executed.

Response APDU structure

Optional bodyMandatory TrailerMandatory Trailer
Data FieldSW1SW1
Diagram of the Response APDU structure fields: Data Field, SW1, SW2
  • A command is always paired with an APDU response.
  • The data field is optional in both the APDU command and the APDU response.

APDU categories

There are four types of APDU categories:

  1. There is no data transfer to or from the card
    1. C-APDU: contains only the header.
    2. R-APDU: contains only the trailer information.
  2. There is no data transfer to the card, but data is returned from the card.
    1. C-APDU: contains only Le, which indicates the number of data bytes expected in the corresponding APDU response.
  3. Data is transferred to the card, but no data is returned from the card.
    1. C-APDU: contains Lc, which indicates the length of the data field, and the data field itself.
    2. R-APDU: contains the trailer status words SW1 and SW2.
  4. Data is transferred to the card and data is returned from the card.
    1. C-APDU: contains Lc, the data field, and Le.
    2. R-APDU: contains the optional body and the trailer status words SW1 and SW2.