const params = new URLSearchParams({
  cardUri: 'https://service.pcibooking.net/api/payments/paycard/865ed8bec1f84366b97112a69cdbf915',
  cvv: '123',
  ref: 'booking-12345',
  merchant: 'hotel-sunrise'
});

const response = await fetch(
  `https://service.pcibooking.net/api/payments/paycard/duplicate?${params}`,
  {
    method: 'POST',
    headers: {
      'Authorization': 'APIKEY your-api-key'
    }
  }
);

const newTokenUri = response.headers.get('Location');
console.log('New token URI:', newTokenUri);

import requests

response = requests.post(
    'https://service.pcibooking.net/api/payments/paycard/duplicate',
    headers={'Authorization': 'APIKEY your-api-key'},
    params={
        'cardUri': 'https://service.pcibooking.net/api/payments/paycard/865ed8bec1f84366b97112a69cdbf915',
        'cvv': '123',
        'ref': 'booking-12345',
        'merchant': 'hotel-sunrise'
    }
)

new_token_uri = response.headers.get('Location')
print('New token URI:', new_token_uri)

<?xml version='1.0' encoding='utf-8'?>
<BankCard>
    <Type>Visa</Type>
    <Number>491891******5005</Number>
    <NameOnCard>Juan Dela Cruz</NameOnCard>
    <ExpirationDate>
        <Month>07</Month>
        <Year>2020</Year>
    </ExpirationDate>
    <IssueNumber>2</IssueNumber>
</BankCard>

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected APIKEY or Temp Session or One-Time Accesss Token",
    "errorList": null
}