Send CVV Capture Link

const response = await fetch('https://service.pcibooking.net/api/cardrequest/duplicate', {
  method: 'POST',
  headers: {
    'Authorization': 'APIKEY your-api-key',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    SenderID: 'myhotel',
    OriginCardUri: 'https://service.pcibooking.net/api/payments/paycard/d919fe8ee51c4adbbbc22cef85e736a6',
    DestinationType: 'email',
    Destination: 'guest@example.com',
    RecipientName: 'Jane Smith',
    RequestTTL: 12,
    Language: 'en',
    SenderReference: 'booking-12345',
    Description: 'CVV for reservation #12345',
    Amount: 250.00,
    Currency: 'USD',
    Success: 'https://yoursite.com/success',
    Failure: 'https://yoursite.com/failure'
  })
});

const requestUri = response.headers.get('Location');
console.log('Request URI:', requestUri);

import requests

response = requests.post(
    'https://service.pcibooking.net/api/cardrequest/duplicate',
    headers={
        'Authorization': 'APIKEY your-api-key',
        'Content-Type': 'application/json'
    },
    json={
        'SenderID': 'myhotel',
        'OriginCardUri': 'https://service.pcibooking.net/api/payments/paycard/d919fe8ee51c4adbbbc22cef85e736a6',
        'DestinationType': 'email',
        'Destination': 'guest@example.com',
        'RecipientName': 'Jane Smith',
        'RequestTTL': 12,
        'Language': 'en',
        'SenderReference': 'booking-12345',
        'Description': 'CVV for reservation #12345',
        'Amount': 250.00,
        'Currency': 'USD',
        'Success': 'https://yoursite.com/success',
        'Failure': 'https://yoursite.com/failure'
    }
)

request_uri = response.headers.get('Location')
print('Request URI:', request_uri)

Empty response body. The Location header contains the request URI:
Location: https://service.pcibooking.net/api/payments/paycard/CardForm/xLoat3F385vvFRbgI2usOeuXKXQoB8kv

{
    "code": -179,
    "message": "Bad input parameter",
    "moreInfo": "Bad input data",
    "errorList": [
        "Bad json format"
    ]
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected APIKEY",
    "errorList": null
}

POST

api

cardrequest

duplicate

const response = await fetch('https://service.pcibooking.net/api/cardrequest/duplicate', {
  method: 'POST',
  headers: {
    'Authorization': 'APIKEY your-api-key',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    SenderID: 'myhotel',
    OriginCardUri: 'https://service.pcibooking.net/api/payments/paycard/d919fe8ee51c4adbbbc22cef85e736a6',
    DestinationType: 'email',
    Destination: 'guest@example.com',
    RecipientName: 'Jane Smith',
    RequestTTL: 12,
    Language: 'en',
    SenderReference: 'booking-12345',
    Description: 'CVV for reservation #12345',
    Amount: 250.00,
    Currency: 'USD',
    Success: 'https://yoursite.com/success',
    Failure: 'https://yoursite.com/failure'
  })
});

const requestUri = response.headers.get('Location');
console.log('Request URI:', requestUri);

import requests

response = requests.post(
    'https://service.pcibooking.net/api/cardrequest/duplicate',
    headers={
        'Authorization': 'APIKEY your-api-key',
        'Content-Type': 'application/json'
    },
    json={
        'SenderID': 'myhotel',
        'OriginCardUri': 'https://service.pcibooking.net/api/payments/paycard/d919fe8ee51c4adbbbc22cef85e736a6',
        'DestinationType': 'email',
        'Destination': 'guest@example.com',
        'RecipientName': 'Jane Smith',
        'RequestTTL': 12,
        'Language': 'en',
        'SenderReference': 'booking-12345',
        'Description': 'CVV for reservation #12345',
        'Amount': 250.00,
        'Currency': 'USD',
        'Success': 'https://yoursite.com/success',
        'Failure': 'https://yoursite.com/failure'
    }
)

request_uri = response.headers.get('Location')
print('Request URI:', request_uri)

Empty response body. The Location header contains the request URI:
Location: https://service.pcibooking.net/api/payments/paycard/CardForm/xLoat3F385vvFRbgI2usOeuXKXQoB8kv

{
    "code": -179,
    "message": "Bad input parameter",
    "moreInfo": "Bad input data",
    "errorList": [
        "Bad json format"
    ]
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected APIKEY",
    "errorList": null
}

CVV Capture Guide

Collect CVV from cardholders via hosted forms

Use this endpoint to send a secure CVV capture link to a cardholder who has already provided their card details. The cardholder clicks the link to enter only their CVV, which PCI Booking combines with the original card data to create a new token. This is useful when you already have a stored card token but need the CVV for a subsequent transaction.

This operation duplicates the original token. Once the cardholder enters the CVV, PCI Booking creates a new token with the original card details plus the captured CVV. The original token remains unchanged. Delete it if no longer needed, otherwise it will continue to incur monthly storage fees.

Error Responses

Code	HTTP Status	Condition
-179	400	Validation error: missing required fields, invalid field format, or malformed JSON body.
-1003	401	Missing or invalid API key in the `Authorization` header.
-1003	401	`SenderID` does not match the identity associated with the API key.
-150	500	Internal system error while creating the CVV request.

Parameter Constraints

Parameter	Constraint
`RequestTTL`	Integer, range 1 to 24 (hours).
`Destination`	Required. Max 255 characters.
`RecipientName`	Required. Max 70 characters.
`SenderReference`	Max 50 characters.
`Description`	Max 50 characters.
`CustomHeaderText`	Max 1000 characters.
`CustomFooterText`	Max 1000 characters.
`CustomerSupportPhone`	Max 20 characters.
`CustomerSupportEmail`	Max 50 characters.
`CustomerSupportLink`	Max 255 characters. Must be a valid URL.
`CustomerSupportLinkText`	Max 100 characters.
`LogoTitle`	Max 100 characters.
`SiteTitle`	Max 40 characters.

Parameters

Headers

Authorization

string

required

Your API key prefixed with APIKEY. Example: APIKEY your-api-key. See the Authentication guide.

Request Configuration

SenderID

string

required

The user ID of the booker.

OriginCardUri

string

required

The card URI is the resource identifier for the card location within PCI Booking.

Language

string

default:"EN"

The form’s language in ISO 639-1 (2-letter) format. See supported languages. If an unsupported language is received, English will be displayed. Languages can be added through the user’s control panel.

Css

string

The CSS resource name. Follow the guide on managing stylesheets. If not provided, PCI Booking will apply the default CSS.

CallBackURL

string

A URL where PCI Booking will push the status of the request.

RequestTTL

integer

required

The number of hours the request will be valid for. Minimum 1 hour, maximum 24 hours.

Delivery

DestinationType

string

required

How to send the link to the card capture form. Values: email or sms.

Destination

string

required

The destination email address or phone number. Phone numbers should be formatted as international dial numbers: Country code + area code + phone number.

RecipientName

string

required

The recipient’s name. Max 70 characters.

Description

string

Free text description of this request. Max 50 characters.

SenderReference

string

A reference value that can be used to query for this card token.

Transaction Details

Amount

double

The transaction amount. Required if Currency is provided.

Currency

string

The transaction currency in ISO 4217 (3-letter) format. Required if Amount is provided. An incorrect value returns error code 401 BAD DATA.

Branding

CustomerSupportLink, CustomerSupportLinkText, CustomerSupportEmail, and CustomerSupportPhone can also be set in your account settings. Values provided in the request override the account defaults.

URLs in the request body (e.g. ClientLogoURL, Success, Failure) should not be URL-encoded, since they are sent in JSON, not as query parameters.

ClientLogoURL

string

URL to the logo displayed in the Card By Link email and landing page. Submit with a null value to hide the logo. If not supplied, the logo from your Booker profile in the portal is used. Images must be publicly accessible via HTTPS URL.

LogoTitle

string

The title of the logo. If not provided, the booker name from the portal is used. Submit with a null value to hide the logo title. Max 100 characters.

FaviconURL

string

URL to the favicon displayed in the Card By Link landing page. If not supplied, the browser default favicon is used. Images must be publicly accessible via HTTPS URL in ico or png format, size 16x16 or 32x32.

SiteTitle

string

The page title to be displayed. Max 40 characters.

CustomHeaderText

string

Text displayed in the header of the message to the recipient. Max 1000 characters. If RecipientName, Amount, and Currency placeholders are not listed in the CustomHeaderText or in the portal customizations but are provided in the request parameters, they will still be displayed in the email.

CustomFooterText

string

Text displayed in the footer of the message to the recipient. Max 1000 characters. If CustomerSupportEmail and CustomerSupportPhone placeholders are not listed in the CustomFooterText or in the portal customizations but are provided in the request parameters, they will still be displayed in the email.

CustomerSupportPhone

string

Phone number displayed in the email and landing page. Max 20 characters.

CustomerSupportEmail

string

Email address displayed in the email and landing page. Max 50 characters.

CustomerSupportLink

string

URL for customer support displayed in the email and landing page. Max 255 characters. Required if CustomerSupportLinkText is provided.

CustomerSupportLinkText

string

Display name for the customer support URL in the email and landing page. Max 100 characters. Required if CustomerSupportLink is provided.

Redirect URLs

Success

string

URL where a successful response will be redirected to. See setting up success/failure redirection pages.

Failure

string

URL where a failed response will be redirected to. See setting up success/failure redirection pages.

const response = await fetch('https://service.pcibooking.net/api/cardrequest/duplicate', {
  method: 'POST',
  headers: {
    'Authorization': 'APIKEY your-api-key',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    SenderID: 'myhotel',
    OriginCardUri: 'https://service.pcibooking.net/api/payments/paycard/d919fe8ee51c4adbbbc22cef85e736a6',
    DestinationType: 'email',
    Destination: 'guest@example.com',
    RecipientName: 'Jane Smith',
    RequestTTL: 12,
    Language: 'en',
    SenderReference: 'booking-12345',
    Description: 'CVV for reservation #12345',
    Amount: 250.00,
    Currency: 'USD',
    Success: 'https://yoursite.com/success',
    Failure: 'https://yoursite.com/failure'
  })
});

const requestUri = response.headers.get('Location');
console.log('Request URI:', requestUri);

import requests

response = requests.post(
    'https://service.pcibooking.net/api/cardrequest/duplicate',
    headers={
        'Authorization': 'APIKEY your-api-key',
        'Content-Type': 'application/json'
    },
    json={
        'SenderID': 'myhotel',
        'OriginCardUri': 'https://service.pcibooking.net/api/payments/paycard/d919fe8ee51c4adbbbc22cef85e736a6',
        'DestinationType': 'email',
        'Destination': 'guest@example.com',
        'RecipientName': 'Jane Smith',
        'RequestTTL': 12,
        'Language': 'en',
        'SenderReference': 'booking-12345',
        'Description': 'CVV for reservation #12345',
        'Amount': 250.00,
        'Currency': 'USD',
        'Success': 'https://yoursite.com/success',
        'Failure': 'https://yoursite.com/failure'
    }
)

request_uri = response.headers.get('Location')
print('Request URI:', request_uri)

Response

201 - Empty body. A Location header is returned with the URI for this card request. Use this URI to retrieve the request status or delete the request.

Remember to set the CVV Retention Policy on the new token once the CVV is captured.

Empty response body. The Location header contains the request URI:
Location: https://service.pcibooking.net/api/payments/paycard/CardForm/xLoat3F385vvFRbgI2usOeuXKXQoB8kv

{
    "code": -179,
    "message": "Bad input parameter",
    "moreInfo": "Bad input data",
    "errorList": [
        "Bad json format"
    ]
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected APIKEY",
    "errorList": null
}

Send Card Capture Link Retrieve Request

Start Here

Authentication & General

Capture Cards

Manage Tokens

Use Tokens

Additional Functions

Payments Library

Send CVV Capture Link

CVV Capture Guide

Error Responses

Parameter Constraints

Parameters

Headers

Request Configuration

Delivery

Transaction Details

Branding

Redirect URLs

Response

CVV Capture Guide

​Error Responses

​Parameter Constraints

​Parameters

​Headers

​Request Configuration

​Delivery

​Transaction Details

​Branding

​Redirect URLs

​Response

Error Responses

Parameter Constraints

Parameters

Headers

Request Configuration

Delivery

Transaction Details

Branding

Redirect URLs

Response