Token Replacement to sFTP

const response = await fetch(
  'https://service.pcibooking.net/api/sftp/sftp.gateway.com:22/uploads/batch/PCIBTST.xml?filter=GBT',
  {
    method: 'PUT',
    headers: {
      'Authorization': 'Basic dXNlcm5hbWU6cGFzc3dvcmQ=',
      'X-PciBooking-carduri': '555fd7b49f134b42a5dbe4d576b2e527,1d12f1d2b51f489f811d4f4176fde5f2[2]',
      'Content-Type': 'text/plain'
    },
    body: fileContent // the file to upload, in the format named by the filter parameter
  }
);

console.log(response.status);

import requests

response = requests.put(
    'https://service.pcibooking.net/api/sftp/sftp.gateway.com:22/uploads/batch/PCIBTST.xml',
    params={'filter': 'GBT'},
    headers={
        'Authorization': 'Basic dXNlcm5hbWU6cGFzc3dvcmQ=',
        'X-PciBooking-carduri': '555fd7b49f134b42a5dbe4d576b2e527,1d12f1d2b51f489f811d4f4176fde5f2[2]',
        'Content-Type': 'text/plain'
    },
    data=file_content  # the file to upload, in the format named by the filter parameter
)

print(response.status_code)

File uploaded successfully. No content returned.

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "...",
    "errorList": null
}

Empty response body.
Authentication failed: the API key, session token or access token is missing or was not accepted.
See "Authentication and Permission Failures" on the Error Handling page.

PUT

api

sftp

{serverAddress}

{folderPath}

{fileName}

const response = await fetch(
  'https://service.pcibooking.net/api/sftp/sftp.gateway.com:22/uploads/batch/PCIBTST.xml?filter=GBT',
  {
    method: 'PUT',
    headers: {
      'Authorization': 'Basic dXNlcm5hbWU6cGFzc3dvcmQ=',
      'X-PciBooking-carduri': '555fd7b49f134b42a5dbe4d576b2e527,1d12f1d2b51f489f811d4f4176fde5f2[2]',
      'Content-Type': 'text/plain'
    },
    body: fileContent // the file to upload, in the format named by the filter parameter
  }
);

console.log(response.status);

import requests

response = requests.put(
    'https://service.pcibooking.net/api/sftp/sftp.gateway.com:22/uploads/batch/PCIBTST.xml',
    params={'filter': 'GBT'},
    headers={
        'Authorization': 'Basic dXNlcm5hbWU6cGFzc3dvcmQ=',
        'X-PciBooking-carduri': '555fd7b49f134b42a5dbe4d576b2e527,1d12f1d2b51f489f811d4f4176fde5f2[2]',
        'Content-Type': 'text/plain'
    },
    data=file_content  # the file to upload, in the format named by the filter parameter
)

print(response.status_code)

File uploaded successfully. No content returned.

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "...",
    "errorList": null
}

Empty response body.
Authentication failed: the API key, session token or access token is missing or was not accepted.
See "Authentication and Permission Failures" on the Error Handling page.

File Transfer Token Replacement Guide

Replace tokens with card data in SFTP file transfers

Performs token replacement on a file and uploads the result directly to an SFTP server. Use this when you need to send batch files containing card data to a payment processor or partner that accepts SFTP delivery. PCI Booking replaces all card tokens in the file body with the real card data before uploading.

Error Responses

Code	HTTP Status	Condition
none	`401`	Authorization token is missing or invalid. The response body is empty.
`-125`	`400`	Invalid host format (e.g. multiple colons in the server address).
`-125`	`400`	Invalid or missing Basic Auth credentials in the Authorization header.
`-125`	`400`	The requested filter name is not recognized.
`-125`	`400`	Token replacement could not be applied to the file content.
`-125`	`400`	At least one token in the file does not exist, was deleted, or is not accessible to you (`Attempt to access non-existing Tokens`). The response does not say which case applies.
`-1003`	`401`	SFTP login failed (invalid server credentials).
`-160`	`404`	File upload failed on the remote server.

Error detail

Each condition below gives the exact moreInfo text, why it happens and how to resolve it. The full set is on the Error Handling page.

-125 Bad input data - profile not found

HTTP status: 400message: Bad input datamoreInfo: the wording depends on which endpoint you called:

Couldn't fetch a valid screening profile:: <profileName>
Couldn't fetch a valid pciShield profile:: <profileName>

The first is returned by token replacement in a request (paycard/relay). The second is returned by tokenization on response (paycard/capture). They mean the same thing.Reason. The profileName you passed could not be resolved for the account making the request. In almost every case the profile does exist, but on a different account than the one your credentials belong to. A misspelled profile name produces the same error.How to resolve.A PCI Shield profile belongs to the account, not to the sub-user that calls the API. When a sub-user makes a request, the profile is looked up against that sub-user’s parent account. A profile configured on one account is never visible to a sub-user of a different account, and sandbox and production accounts are separate.To check which profiles your credential can see:

Identify the parent account of the sub-user whose credentials you are using.
Sign in to the PCI Booking portal as that account and open PCI Shield Settings > PCI Shield Profile Settings.
Confirm the profile name appears there, spelled exactly as you send it. Profile names are matched exactly.
If the profile is listed under a different account, switch your request to a sub-user of that account rather than copying the profile.

There is no API endpoint that lists the profiles on your own account. GET /api/booker returns the platform-wide preset tokenization profiles, which are a different set. Your own profiles are visible in the portal only.

See also: Content Filters, Target Profiles

-125 Bad input data - card data could not be substituted

HTTP status: 400message: Bad input datamoreInfo:

Replacement of content failed
Could not apply token replacement onto content

Reason. The body parsed, but the profile’s selectors did not match anything in it, so no card data was substituted. The request was not relayed. This is a mismatch between the profile and the payload, not a problem with the token.How to resolve.

Compare the profile’s selectors against the exact payload you sent. A selector that assumes a different nesting depth or element name matches nothing.
Check the namespaces. For XML and SOAP, a selector written without namespace handling will not match a namespaced document.
Confirm the body is the format the profile was written for. A profile written for XML will not match a JSON body.
Test the profile against a saved copy of a real request before using it in production.

See also: Content Filters

-175 Request timed out - third party did not respond in time

HTTP status: 504message: Request timed outmoreInfo: not populated for this condition. The code and the endpoint are the only signal.Reason. PCI Booking relayed your request but the target server did not answer within the timeout. The failure is on the far side, not in PCI Booking. Card data may already have reached the third party, so the operation cannot be assumed not to have happened.How to resolve.

Check how long the third party takes to respond. The complete round trip must finish within 29 seconds, so raising timeout beyond that does not help. If the third party regularly needs longer, contact support@pcibooking.net for an alternative setup.
Confirm the target host is reachable and not rate limiting or blocking the call. PCI Booking calls the third party from its own addresses, which the third party may need to allow.
Do not blind retry a charge. Query the third party for the outcome first. A timeout is an unknown result, not a failure.

See also: Outbound IPs

Parameter Constraints

serverAddress: Format is hostname or hostname:port. Only one colon is allowed. Default port is 22.
filter: Must be one of: GBT, SIMPLECSV, SIMPLEJSON, AIR, IUR, TADC, CSV. Case-insensitive.
Authorization header: Must contain valid Basic Auth credentials (username:password) for the SFTP server.

Parameters

Authentication

Access token or session token. This endpoint does not accept the API key. Generate a token with your API key and pass it as a query parameter. Send one of the two.

string

Generated on your side. Single use, and valid for up to 72 hours. How to generate.

string

Returned by an API call. Valid for 5 minutes, and can be used more than once within that time. How to generate.

Path Parameters

string

required

The sFTP server address. This can be an IP address or domain name. Add the port number with a colon if required. For example: fsgatewaytest.aexp.com:22 or 10.200.1.10.

string

required

The folder path where the file should be uploaded to. This can be an individual folder or a full path.

string

required

The file name for the content being uploaded, including extension. For example: PCIBTST.xml.

Query String

string

required

Indicates the format of the file being sent. Read more on Supported Formats.

string

The timeout, in seconds, for the sFTP server to respond.

Headers

string

required

Comma-separated token values to insert into the file. Tokens should be listed in the order of their appearance. For tokens appearing multiple times, include the number of occurrences in square brackets. Full token URIs or bare 32-character token IDs are both accepted. If fewer tokens are listed than there are card locations in the file, the last token is repeated for all remaining locations.

string

required

The authorization parameter used to authenticate to the sFTP server.

string

Supported compression formats: gzip and deflate. Omit this header if no compression is needed.

Request Body

The request body contains the raw file content as text, in the format named by the filter parameter. The preset filter determines where card data belongs in that format; PCI Booking inserts the card details of the tokens listed in X-PciBooking-carduri, in order, then uploads the result to the sFTP server.

const response = await fetch(
  'https://service.pcibooking.net/api/sftp/sftp.gateway.com:22/uploads/batch/PCIBTST.xml?filter=GBT',
  {
    method: 'PUT',
    headers: {
      'Authorization': 'Basic dXNlcm5hbWU6cGFzc3dvcmQ=',
      'X-PciBooking-carduri': '555fd7b49f134b42a5dbe4d576b2e527,1d12f1d2b51f489f811d4f4176fde5f2[2]',
      'Content-Type': 'text/plain'
    },
    body: fileContent // the file to upload, in the format named by the filter parameter
  }
);

console.log(response.status);

import requests

response = requests.put(
    'https://service.pcibooking.net/api/sftp/sftp.gateway.com:22/uploads/batch/PCIBTST.xml',
    params={'filter': 'GBT'},
    headers={
        'Authorization': 'Basic dXNlcm5hbWU6cGFzc3dvcmQ=',
        'X-PciBooking-carduri': '555fd7b49f134b42a5dbe4d576b2e527,1d12f1d2b51f489f811d4f4176fde5f2[2]',
        'Content-Type': 'text/plain'
    },
    data=file_content  # the file to upload, in the format named by the filter parameter
)

print(response.status_code)

Response

File uploaded successfully. No content returned.

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "...",
    "errorList": null
}

Empty response body.
Authentication failed: the API key, session token or access token is missing or was not accepted.
See "Authentication and Permission Failures" on the Error Handling page.

Start Here

Authentication & General

Capture Cards

Manage Tokens

Use Tokens

Additional Functions

Payments Library

Token Replacement to sFTP

File Transfer Token Replacement Guide

Error Responses

Error detail

Parameter Constraints

Parameters

Authentication

Path Parameters

Query String

Headers

Request Body

Response

File Transfer Token Replacement Guide

​Error Responses

​Error detail

​Parameter Constraints

​Parameters

​Authentication

​Path Parameters

​Query String

​Headers

​Request Body

​Response

Error Responses

Error detail

Parameter Constraints

Parameters

Authentication

Path Parameters

Query String

Headers

Request Body

Response