Issue Virtual Card

const response = await fetch('https://service.pcibooking.net/api/VirtualCard?tokenLocation=IE', {
  method: 'POST',
  headers: {
    'Authorization': 'APIKEY your-api-key',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    ProviderName: 'WEX',
    Credentials: {
      MerchantID: 'your-merchant-id',
      SharedSecret: 'your-shared-secret',
      Account: 'your-account',
      RebatePWD: 'your-rebate-password'
    },
    Request: {
      MaxValue: {
        Amount: 500.00,
        CurrencyCode: 'USD'
      },
      MinAuthDate: '2026-07-10T00:00:00Z',
      MaxAuthDate: '2026-08-10T00:00:00Z',
      UniqueReference: 'booking-98765'
    }
  })
});

const data = await response.json();
console.log(data);

import requests

response = requests.post(
    'https://service.pcibooking.net/api/VirtualCard',
    headers={
        'Authorization': 'APIKEY your-api-key',
        'Content-Type': 'application/json'
    },
    params={
        'tokenLocation': 'IE'
    },
    json={
        'ProviderName': 'WEX',
        'Credentials': {
            'MerchantID': 'your-merchant-id',
            'SharedSecret': 'your-shared-secret',
            'Account': 'your-account',
            'RebatePWD': 'your-rebate-password'
        },
        'Request': {
            'MaxValue': {
                'Amount': 500.00,
                'CurrencyCode': 'USD'
            },
            'MinAuthDate': '2026-07-10T00:00:00Z',
            'MaxAuthDate': '2026-08-10T00:00:00Z',
            'UniqueReference': 'booking-98765'
        }
    }
)

print(response.json())

{
    "CardToken": "tok_abc123def456",
    "ProviderResponse": {
        "Result": "Success",
        "Message": "Card issued successfully",
        "MaxValue": {
            "Amount": 500.00,
            "CurrencyCode": "USD"
        },
        "VirtualCard": {
            "Number": "411111******1234",
            "ExpirationMonth": 12,
            "ExpirationYear": 2027,
            "SecurityCode": "***"
        },
        "UniqueReference": "booking-98765",
        "CardId": "vcc_provider_id_123",
        "ProviderName": "WEX"
    }
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Virtual card provider with name [InvalidName] not found",
    "errorList": null
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected APIKEY",
    "errorList": null
}

POST

api

VirtualCard

const response = await fetch('https://service.pcibooking.net/api/VirtualCard?tokenLocation=IE', {
  method: 'POST',
  headers: {
    'Authorization': 'APIKEY your-api-key',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    ProviderName: 'WEX',
    Credentials: {
      MerchantID: 'your-merchant-id',
      SharedSecret: 'your-shared-secret',
      Account: 'your-account',
      RebatePWD: 'your-rebate-password'
    },
    Request: {
      MaxValue: {
        Amount: 500.00,
        CurrencyCode: 'USD'
      },
      MinAuthDate: '2026-07-10T00:00:00Z',
      MaxAuthDate: '2026-08-10T00:00:00Z',
      UniqueReference: 'booking-98765'
    }
  })
});

const data = await response.json();
console.log(data);

import requests

response = requests.post(
    'https://service.pcibooking.net/api/VirtualCard',
    headers={
        'Authorization': 'APIKEY your-api-key',
        'Content-Type': 'application/json'
    },
    params={
        'tokenLocation': 'IE'
    },
    json={
        'ProviderName': 'WEX',
        'Credentials': {
            'MerchantID': 'your-merchant-id',
            'SharedSecret': 'your-shared-secret',
            'Account': 'your-account',
            'RebatePWD': 'your-rebate-password'
        },
        'Request': {
            'MaxValue': {
                'Amount': 500.00,
                'CurrencyCode': 'USD'
            },
            'MinAuthDate': '2026-07-10T00:00:00Z',
            'MaxAuthDate': '2026-08-10T00:00:00Z',
            'UniqueReference': 'booking-98765'
        }
    }
)

print(response.json())

{
    "CardToken": "tok_abc123def456",
    "ProviderResponse": {
        "Result": "Success",
        "Message": "Card issued successfully",
        "MaxValue": {
            "Amount": 500.00,
            "CurrencyCode": "USD"
        },
        "VirtualCard": {
            "Number": "411111******1234",
            "ExpirationMonth": 12,
            "ExpirationYear": 2027,
            "SecurityCode": "***"
        },
        "UniqueReference": "booking-98765",
        "CardId": "vcc_provider_id_123",
        "ProviderName": "WEX"
    }
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Virtual card provider with name [InvalidName] not found",
    "errorList": null
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected APIKEY",
    "errorList": null
}

Issues a virtual card through a supported provider (e.g. WEX, Rapyd) and automatically stores the issued card as a PCI Booking token. The card number and CVV in the response are masked for security. The token URI is returned in the Location response header.

Error Responses

Code	HTTP Status	Condition
`-1003`	`401`	API key is missing or invalid.
`-125`	`400`	Invalid provider name, missing required fields, or credential validation failed.
`-125`	`400`	The `credentialsId` was provided but credentials were not found or could not be parsed.
`-150`	`500`	Virtual card was issued but could not be tokenized internally.

Parameters

Headers

Authorization

string

required

Your API key prefixed with APIKEY. Example: APIKEY your-api-key. See the Authentication guide.

Query String

credentialsId

string

The ID of stored credentials for a virtual card provider. When provided, ProviderName and Credentials in the request body are ignored.

tokenLocation

string

Token storage region. One of: US, IN, AU, JP, CA, IE, GB, BR. If omitted, uses the account default.

Request Body

ProviderName

string

required

The virtual card provider name (e.g. WEX, Rapyd). See List Virtual Card Providers for available providers. Not required when credentialsId is provided.

Credentials

object

Provider-specific credential key-value pairs. Not required when credentialsId is provided. See the provider’s credential structure for required fields.

Request

object

required

The virtual card issuance request.

Show Properties

Request.MaxValue

object

Maximum amount that can be charged on the virtual card.

Show Properties

Request.MaxValue.Amount

number

required

The maximum charge amount.

Request.MaxValue.CurrencyCode

string

required

ISO 4217 currency code (e.g. USD, EUR).

Request.MinAuthDate

string

Earliest date the card can be authorized. ISO 8601 format.

Request.MaxAuthDate

string

Latest date the card can be authorized. ISO 8601 format.

Request.UniqueReference

string

Your own reference for this virtual card. If omitted, the provider assigns one.

Request.CustomData

object

Arbitrary provider-specific data.

const response = await fetch('https://service.pcibooking.net/api/VirtualCard?tokenLocation=IE', {
  method: 'POST',
  headers: {
    'Authorization': 'APIKEY your-api-key',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    ProviderName: 'WEX',
    Credentials: {
      MerchantID: 'your-merchant-id',
      SharedSecret: 'your-shared-secret',
      Account: 'your-account',
      RebatePWD: 'your-rebate-password'
    },
    Request: {
      MaxValue: {
        Amount: 500.00,
        CurrencyCode: 'USD'
      },
      MinAuthDate: '2026-07-10T00:00:00Z',
      MaxAuthDate: '2026-08-10T00:00:00Z',
      UniqueReference: 'booking-98765'
    }
  })
});

const data = await response.json();
console.log(data);

import requests

response = requests.post(
    'https://service.pcibooking.net/api/VirtualCard',
    headers={
        'Authorization': 'APIKEY your-api-key',
        'Content-Type': 'application/json'
    },
    params={
        'tokenLocation': 'IE'
    },
    json={
        'ProviderName': 'WEX',
        'Credentials': {
            'MerchantID': 'your-merchant-id',
            'SharedSecret': 'your-shared-secret',
            'Account': 'your-account',
            'RebatePWD': 'your-rebate-password'
        },
        'Request': {
            'MaxValue': {
                'Amount': 500.00,
                'CurrencyCode': 'USD'
            },
            'MinAuthDate': '2026-07-10T00:00:00Z',
            'MaxAuthDate': '2026-08-10T00:00:00Z',
            'UniqueReference': 'booking-98765'
        }
    }
)

print(response.json())

Response

201 - Virtual card issued and tokenized. The Location header contains the PCI Booking token URI.

Response Fields

CardToken

string

The PCI Booking token for the issued virtual card.

ProviderResponse

object

The virtual card provider’s response.

Show Properties

ProviderResponse.Result

string

The outcome. One of: Success, Accepted, Rejected, TemporaryFailure, FatalFailure.

ProviderResponse.Message

string

Detailed explanation of the result.

ProviderResponse.MaxValue

object

The maximum value set on the issued card.

ProviderResponse.VirtualCard

object

The issued card details (number and CVV are masked).

ProviderResponse.UniqueReference

string

The reference for this virtual card.

ProviderResponse.CardId

string

The unique ID assigned by the virtual card provider.

ProviderResponse.ProviderName

string

The name of the virtual card provider.

{
    "CardToken": "tok_abc123def456",
    "ProviderResponse": {
        "Result": "Success",
        "Message": "Card issued successfully",
        "MaxValue": {
            "Amount": 500.00,
            "CurrencyCode": "USD"
        },
        "VirtualCard": {
            "Number": "411111******1234",
            "ExpirationMonth": 12,
            "ExpirationYear": 2027,
            "SecurityCode": "***"
        },
        "UniqueReference": "booking-98765",
        "CardId": "vcc_provider_id_123",
        "ProviderName": "WEX"
    }
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Virtual card provider with name [InvalidName] not found",
    "errorList": null
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected APIKEY",
    "errorList": null
}

Get Virtual Card Provider Retrieve Credential Structure

Start Here

Authentication & General

Capture Cards

Manage Tokens

Use Tokens

Additional Functions

Payments Library

Error Responses

Parameters

Headers

Query String

Request Body

Response

Response Fields

​Error Responses

​Parameters

​Headers

​Query String

​Request Body

​Response

​Response Fields

Error Responses

Parameters

Headers

Query String

Request Body

Response

Response Fields