Issue Virtual Card

const response = await fetch('https://service.pcibooking.net/api/VirtualCard?tokenLocation=IE', {
  method: 'POST',
  headers: {
    'Authorization': 'APIKEY your-api-key',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    ProviderName: 'WEX',
    Credentials: {
      OrgGroupLoginId: 'your-org-group-login-id',
      UserName: 'your-username',
      Password: 'your-password'
    },
    Request: {
      MaxValue: {
        Amount: 500.00,
        CurrencyCode: 'USD'
      },
      MinAuthDate: '2026-07-10T00:00:00Z',
      MaxAuthDate: '2026-08-10T00:00:00Z',
      UniqueReference: 'booking-98765'
    }
  })
});

const data = await response.json();
console.log(data);

import requests

response = requests.post(
    'https://service.pcibooking.net/api/VirtualCard',
    headers={
        'Authorization': 'APIKEY your-api-key',
        'Content-Type': 'application/json'
    },
    params={
        'tokenLocation': 'IE'
    },
    json={
        'ProviderName': 'WEX',
        'Credentials': {
            'OrgGroupLoginId': 'your-org-group-login-id',
            'UserName': 'your-username',
            'Password': 'your-password'
        },
        'Request': {
            'MaxValue': {
                'Amount': 500.00,
                'CurrencyCode': 'USD'
            },
            'MinAuthDate': '2026-07-10T00:00:00Z',
            'MaxAuthDate': '2026-08-10T00:00:00Z',
            'UniqueReference': 'booking-98765'
        }
    }
)

print(response.json())

{
    "CardToken": "555fd7b49f134b42a5dbe4d576b2e527",
    "ProviderResponse": {
        "Result": "Success",
        "Message": "Card issued successfully",
        "MaxValue": {
            "Amount": 500.00,
            "CurrencyCode": "USD"
        },
        "VirtualCard": {
            "Number": "411111******1234",
            "ExpirationMonth": 12,
            "ExpirationYear": 2027,
            "SecurityCode": "***"
        },
        "UniqueReference": "booking-98765",
        "CardId": "vcc_provider_id_123",
        "ProviderName": "WEX"
    }
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Virtual card provider with name [InvalidName] not found",
    "errorList": null
}

Empty response body.
Authentication failed: the API key, session token or access token is missing or was not accepted.
See "Authentication and Permission Failures" on the Error Handling page.

POST

api

VirtualCard

const response = await fetch('https://service.pcibooking.net/api/VirtualCard?tokenLocation=IE', {
  method: 'POST',
  headers: {
    'Authorization': 'APIKEY your-api-key',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    ProviderName: 'WEX',
    Credentials: {
      OrgGroupLoginId: 'your-org-group-login-id',
      UserName: 'your-username',
      Password: 'your-password'
    },
    Request: {
      MaxValue: {
        Amount: 500.00,
        CurrencyCode: 'USD'
      },
      MinAuthDate: '2026-07-10T00:00:00Z',
      MaxAuthDate: '2026-08-10T00:00:00Z',
      UniqueReference: 'booking-98765'
    }
  })
});

const data = await response.json();
console.log(data);

import requests

response = requests.post(
    'https://service.pcibooking.net/api/VirtualCard',
    headers={
        'Authorization': 'APIKEY your-api-key',
        'Content-Type': 'application/json'
    },
    params={
        'tokenLocation': 'IE'
    },
    json={
        'ProviderName': 'WEX',
        'Credentials': {
            'OrgGroupLoginId': 'your-org-group-login-id',
            'UserName': 'your-username',
            'Password': 'your-password'
        },
        'Request': {
            'MaxValue': {
                'Amount': 500.00,
                'CurrencyCode': 'USD'
            },
            'MinAuthDate': '2026-07-10T00:00:00Z',
            'MaxAuthDate': '2026-08-10T00:00:00Z',
            'UniqueReference': 'booking-98765'
        }
    }
)

print(response.json())

{
    "CardToken": "555fd7b49f134b42a5dbe4d576b2e527",
    "ProviderResponse": {
        "Result": "Success",
        "Message": "Card issued successfully",
        "MaxValue": {
            "Amount": 500.00,
            "CurrencyCode": "USD"
        },
        "VirtualCard": {
            "Number": "411111******1234",
            "ExpirationMonth": 12,
            "ExpirationYear": 2027,
            "SecurityCode": "***"
        },
        "UniqueReference": "booking-98765",
        "CardId": "vcc_provider_id_123",
        "ProviderName": "WEX"
    }
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Virtual card provider with name [InvalidName] not found",
    "errorList": null
}

Empty response body.
Authentication failed: the API key, session token or access token is missing or was not accepted.
See "Authentication and Permission Failures" on the Error Handling page.

Virtual Card Issuance Guide

Issue virtual cards through connected providers

Requests a virtual card from a connected issuing provider - see List Virtual Card Providers for the current list - and automatically stores the issued card as a PCI Booking token. The provider issues the card; PCI Booking does not. The card number and CVV in the response are masked for security. The token URI is returned in the Location response header.

Error Responses

Code	HTTP Status	Condition
none	`401`	API key is missing or invalid. The response body is empty.
`-125`	`400`	Invalid provider name, missing required fields, or credential validation failed.
`-125`	`400`	The `credentialsId` was provided but credentials were not found or could not be parsed.
`-150`	`500`	Virtual card was issued but could not be tokenized internally.

Parameters

Authentication

API key only. This endpoint does not accept access tokens or session tokens.

string

required

Your API key prefixed with APIKEY. Example: APIKEY your-api-key. The x-pcibooking-api-key header is also accepted. See the Authentication guide.

Query String

string

The ID of stored credentials for a virtual card provider. When provided, ProviderName and Credentials in the request body are ignored.

string

The region where the virtual card data is stored. One of: US, IN, AU, JP, CA, IE, GB, BR. If omitted, the card is stored in Ireland. Your account’s default region is not used. See Card Storage Regions.

Request Body

string

required

The virtual card provider name (e.g. WEX). See List Virtual Card Providers for available providers. Not required when credentialsId is provided.

object

Provider-specific credential key-value pairs. Not required when credentialsId is provided. See the provider’s credential structure for required fields.

object

required

The virtual card issuance request.

Show Properties

object

Maximum amount that can be charged on the virtual card.

Show Properties

number

required

The maximum charge amount.

string

required

ISO 4217 currency code (e.g. USD, EUR).

string

Earliest date the card can be authorized. ISO 8601 format.

string

Latest date the card can be authorized. ISO 8601 format.

string

Your own reference for this virtual card. If omitted, the provider assigns one.

object

Arbitrary provider-specific data.

const response = await fetch('https://service.pcibooking.net/api/VirtualCard?tokenLocation=IE', {
  method: 'POST',
  headers: {
    'Authorization': 'APIKEY your-api-key',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    ProviderName: 'WEX',
    Credentials: {
      OrgGroupLoginId: 'your-org-group-login-id',
      UserName: 'your-username',
      Password: 'your-password'
    },
    Request: {
      MaxValue: {
        Amount: 500.00,
        CurrencyCode: 'USD'
      },
      MinAuthDate: '2026-07-10T00:00:00Z',
      MaxAuthDate: '2026-08-10T00:00:00Z',
      UniqueReference: 'booking-98765'
    }
  })
});

const data = await response.json();
console.log(data);

import requests

response = requests.post(
    'https://service.pcibooking.net/api/VirtualCard',
    headers={
        'Authorization': 'APIKEY your-api-key',
        'Content-Type': 'application/json'
    },
    params={
        'tokenLocation': 'IE'
    },
    json={
        'ProviderName': 'WEX',
        'Credentials': {
            'OrgGroupLoginId': 'your-org-group-login-id',
            'UserName': 'your-username',
            'Password': 'your-password'
        },
        'Request': {
            'MaxValue': {
                'Amount': 500.00,
                'CurrencyCode': 'USD'
            },
            'MinAuthDate': '2026-07-10T00:00:00Z',
            'MaxAuthDate': '2026-08-10T00:00:00Z',
            'UniqueReference': 'booking-98765'
        }
    }
)

print(response.json())

Response

201 - Virtual card issued and tokenized. The Location header contains the PCI Booking token URI.

Response Fields

string

The PCI Booking token for the issued virtual card.

object

The virtual card provider’s response.

Show Properties

string

The outcome. One of: Success, Accepted, Rejected, TemporaryFailure, FatalFailure.

string

Detailed explanation of the result.

object

The maximum value set on the issued card.

object

The issued card details (number and CVV are masked).

string

The reference for this virtual card.

string

The unique ID assigned by the virtual card provider.

string

The name of the virtual card provider.

{
    "CardToken": "555fd7b49f134b42a5dbe4d576b2e527",
    "ProviderResponse": {
        "Result": "Success",
        "Message": "Card issued successfully",
        "MaxValue": {
            "Amount": 500.00,
            "CurrencyCode": "USD"
        },
        "VirtualCard": {
            "Number": "411111******1234",
            "ExpirationMonth": 12,
            "ExpirationYear": 2027,
            "SecurityCode": "***"
        },
        "UniqueReference": "booking-98765",
        "CardId": "vcc_provider_id_123",
        "ProviderName": "WEX"
    }
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Virtual card provider with name [InvalidName] not found",
    "errorList": null
}

Empty response body.
Authentication failed: the API key, session token or access token is missing or was not accepted.
See "Authentication and Permission Failures" on the Error Handling page.

Start Here

Authentication & General

Capture Cards

Manage Tokens

Use Tokens

Additional Functions

Payments Library

Virtual Card Issuance Guide

Error Responses

Parameters

Authentication

Query String

Request Body

Response

Response Fields

Virtual Card Issuance Guide

​Error Responses

​Parameters

​Authentication

​Query String

​Request Body

​Response

​Response Fields

Error Responses

Parameters

Authentication

Query String

Request Body

Response

Response Fields