Token Replacement in Request

curl --request POST \
  --url https://service.pcibooking.net/api/payments/paycard/relay \
  --header 'Authorization: <api-key>'

import requests

url = "https://service.pcibooking.net/api/payments/paycard/relay"

headers = {"Authorization": "<api-key>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: '<api-key>'}};

fetch('https://service.pcibooking.net/api/payments/paycard/relay', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://service.pcibooking.net/api/payments/paycard/relay",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://service.pcibooking.net/api/payments/paycard/relay"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://service.pcibooking.net/api/payments/paycard/relay")
  .header("Authorization", "<api-key>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://service.pcibooking.net/api/payments/paycard/relay")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = '<api-key>'

response = http.request(request)
puts response.read_body

The third-party response is returned as-is. The format and content depend entirely on the destination API.

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected Temp Session or One-Time Accesss Token",
    "errorList": null
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Couldn't fetch a valid pciShield profile:: wsc",
    "errorList": null
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Invalid target Uri::",
    "errorList": null
}

POST

api

payments

paycard

relay

Token Replacement in Request

curl --request POST \
  --url https://service.pcibooking.net/api/payments/paycard/relay \
  --header 'Authorization: <api-key>'

import requests

url = "https://service.pcibooking.net/api/payments/paycard/relay"

headers = {"Authorization": "<api-key>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: '<api-key>'}};

fetch('https://service.pcibooking.net/api/payments/paycard/relay', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://service.pcibooking.net/api/payments/paycard/relay",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://service.pcibooking.net/api/payments/paycard/relay"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://service.pcibooking.net/api/payments/paycard/relay")
  .header("Authorization", "<api-key>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://service.pcibooking.net/api/payments/paycard/relay")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = '<api-key>'

response = http.request(request)
puts response.read_body

The third-party response is returned as-is. The format and content depend entirely on the destination API.

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected Temp Session or One-Time Accesss Token",
    "errorList": null
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Couldn't fetch a valid pciShield profile:: wsc",
    "errorList": null
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Invalid target Uri::",
    "errorList": null
}

Token Replacement Guide

Replace tokens with card data in API requests

This is PCI Booking’s core proxy feature. Instead of processing payments through PCI Booking’s gateway integrations, you send the exact API request your third-party system expects, with token placeholders where card data should go. PCI Booking swaps in the real card data and forwards the request transparently, so the third party receives a normal API call with real card details while you never handle sensitive data.

Error Responses

Code	HTTP Status	Condition
-125	400	httpMethod not POST/GET/PUT/PATCH/DELETE
-160	404	Card not found
-150	500	Card retrieval failed
-125	400	Profile name provided but profile not found
-125	400	Content replacement failed
-125	400	Empty content body
-125	400	Missing Content-Type header
-125	400	Target URI invalid
-1003	401	User not owner and not associated

Parameter Constraints

cardToken must contain a valid card URI with a 32-hex token.
targetUri is required.
httpMethod defaults to POST. Accepted values: POST, GET, PUT, PATCH, DELETE.
postResponseAction accepts ClearCVV or DeleteToken.

All URLs must be HTTPS. URL-encode all query string components.

Parameters

Authentication

This is a browser-facing endpoint. Use one of the authentication methods below instead of the API key shown above.

accessToken

string

Recommended. A long-lived token for browser-side calls. How to generate.

sessionToken

string

Alternative. Valid for 5 minutes. How to generate.

If both are provided, the session token takes precedence.

Query String

cardToken

string

required

The token URI identifying the card in PCI Booking.

targetURI

string

required

The HTTPS URL of the third party to relay the request to.

httpMethod

string

required

The HTTP method to use when calling the target URI. One of: POST, GET, PUT, PATCH, DELETE.

profileName

string

The ID of a target profile configured for this request. If omitted, PCI Booking uses placeholder-based replacement instead.

contentParam

string

For placeholder-based replacement: the key containing card data in form-data or query string. Ignored if profileName is provided. If omitted, PCI Booking searches the request body for placeholders.

postResponseAction

string

Action to perform after a successful relay. ClearCVV clears the CVV from the token. DeleteToken deletes the token entirely. If omitted, no action is taken.

timeout

int

Seconds to wait for the third-party response before timing out.

Headers

Content-Encoding

string

Compression format: gzip or deflate. Omit if no compression is needed.

Request Body

The request body is relayed to the third party as-is, with token placeholders replaced by real card data. Structure it as required by the third party’s API.

Request Example

Send a JSON payment request to a third-party API, with PCI Booking replacing the card placeholders with real data before forwarding:

curl
Node.js
Python

curl -X POST "https://service.pcibooking.net/api/payments/paycard/relay?cardToken=https%3A%2F%2Fservice.pcibooking.net%2Fapi%2Fpayments%2Fpaycard%2Ftok_abc123&targetURI=https%3A%2F%2Fapi.thirdparty.com%2Fv1%2Fpayments&httpMethod=POST" \
  -H "Authorization: APIKEY your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 250.00,
    "currency": "USD",
    "card": {
      "number": "{{CardNo}}",
      "expMonth": "{{ExpMonth}}",
      "expYear": "{{ExpYear}}",
      "cvv": "{{Cvv}}",
      "holderName": "{{NameOnCard}}"
    },
    "reference": "order-98765"
  }'

const params = new URLSearchParams({
  cardToken: "https://service.pcibooking.net/api/payments/paycard/tok_abc123",
  targetURI: "https://api.thirdparty.com/v1/payments",
  httpMethod: "POST"
});

const response = await fetch(
  `https://service.pcibooking.net/api/payments/paycard/relay?${params}`,
  {
    method: "POST",
    headers: {
      "Authorization": "APIKEY your-api-key",
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      amount: 250.00,
      currency: "USD",
      card: {
        number: "{{CardNo}}",
        expMonth: "{{ExpMonth}}",
        expYear: "{{ExpYear}}",
        cvv: "{{Cvv}}",
        holderName: "{{NameOnCard}}"
      },
      reference: "order-98765"
    })
  }
);

const data = await response.text();
console.log(data);

import requests

response = requests.post(
    "https://service.pcibooking.net/api/payments/paycard/relay",
    params={
        "cardToken": "https://service.pcibooking.net/api/payments/paycard/tok_abc123",
        "targetURI": "https://api.thirdparty.com/v1/payments",
        "httpMethod": "POST"
    },
    headers={
        "Authorization": "APIKEY your-api-key",
        "Content-Type": "application/json"
    },
    json={
        "amount": 250.00,
        "currency": "USD",
        "card": {
            "number": "{{CardNo}}",
            "expMonth": "{{ExpMonth}}",
            "expYear": "{{ExpYear}}",
            "cvv": "{{Cvv}}",
            "holderName": "{{NameOnCard}}"
        },
        "reference": "order-98765"
    }
)

print(response.text)

PCI Booking replaces the {{CardNo}}, {{ExpMonth}}, {{ExpYear}}, {{Cvv}}, and {{NameOnCard}} placeholders with the actual card data from the token before forwarding the request to api.thirdparty.com. To use a target profile (pre-configured replacement rules) instead of inline placeholders:

curl
Node.js
Python

curl -X POST "https://service.pcibooking.net/api/payments/paycard/relay?cardToken=https%3A%2F%2Fservice.pcibooking.net%2Fapi%2Fpayments%2Fpaycard%2Ftok_abc123&targetURI=https%3A%2F%2Fapi.thirdparty.com%2Fv1%2Fpayments&httpMethod=POST&profileName=my-thirdparty-profile" \
  -H "Authorization: APIKEY your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 250.00,
    "currency": "USD",
    "reference": "order-98765"
  }'

const params = new URLSearchParams({
  cardToken: "https://service.pcibooking.net/api/payments/paycard/tok_abc123",
  targetURI: "https://api.thirdparty.com/v1/payments",
  httpMethod: "POST",
  profileName: "my-thirdparty-profile"
});

const response = await fetch(
  `https://service.pcibooking.net/api/payments/paycard/relay?${params}`,
  {
    method: "POST",
    headers: {
      "Authorization": "APIKEY your-api-key",
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      amount: 250.00,
      currency: "USD",
      reference: "order-98765"
    })
  }
);

const data = await response.text();
console.log(data);

import requests

response = requests.post(
    "https://service.pcibooking.net/api/payments/paycard/relay",
    params={
        "cardToken": "https://service.pcibooking.net/api/payments/paycard/tok_abc123",
        "targetURI": "https://api.thirdparty.com/v1/payments",
        "httpMethod": "POST",
        "profileName": "my-thirdparty-profile"
    },
    headers={
        "Authorization": "APIKEY your-api-key",
        "Content-Type": "application/json"
    },
    json={
        "amount": 250.00,
        "currency": "USD",
        "reference": "order-98765"
    }
)

print(response.text)

Response

200 - The third-party response, relayed back as-is.

Consider adding business logic based on the CVV retention policy status after a token replacement request.

The third-party response is returned as-is. The format and content depend entirely on the destination API.

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected Temp Session or One-Time Accesss Token",
    "errorList": null
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Couldn't fetch a valid pciShield profile:: wsc",
    "errorList": null
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Invalid target Uri::",
    "errorList": null
}

Use Tokens API Reference Token Replacement to sFTP

Start Here

Authentication & General

Capture Cards

Manage Tokens

Use Tokens

Additional Functions

Payments Library

Token Replacement in Request

Token Replacement Guide

Error Responses

Parameter Constraints

Parameters

Authentication

Query String

Headers

Request Body

Request Example

Response

Token Replacement Guide

​Error Responses

​Parameter Constraints

​Parameters

​Authentication

​Query String

​Headers

​Request Body

​Request Example

​Response

Error Responses

Parameter Constraints

Parameters

Authentication

Query String

Headers

Request Body

Request Example

Response