Request a Card Entry Form

curl --request GET \
  --url https://service.pcibooking.net/api/payments/capturecard \
  --header 'Authorization: <api-key>'

const options = {method: 'GET', headers: {Authorization: '<api-key>'}};

fetch('https://service.pcibooking.net/api/payments/capturecard', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://service.pcibooking.net/api/payments/capturecard",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://service.pcibooking.net/api/payments/capturecard"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://service.pcibooking.net/api/payments/capturecard")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = '<api-key>'

response = http.request(request)
puts response.read_body

GET

api

payments

capturecard

Request a Card Entry Form

curl --request GET \
  --url https://service.pcibooking.net/api/payments/capturecard \
  --header 'Authorization: <api-key>'

const options = {method: 'GET', headers: {Authorization: '<api-key>'}};

fetch('https://service.pcibooking.net/api/payments/capturecard', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://service.pcibooking.net/api/payments/capturecard",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://service.pcibooking.net/api/payments/capturecard"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://service.pcibooking.net/api/payments/capturecard")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = '<api-key>'

response = http.request(request)
puts response.read_body

Hosted Card Entry Form Guide

Embed a secure card capture form in your website

This is not a typical API call that you make from your server. Instead, you build a URL with query parameters and use it in one of two ways:

iframe: set it as the src attribute of an iframe element on your page
Redirect: redirect the cardholder’s browser to this URL as a standalone page

The URL renders a secure card capture form hosted by PCI Booking. When the cardholder submits the form, PCI Booking tokenizes the card and redirects to your success URL with the token details, or to your failure URL if something goes wrong. For the element IDs and classes you can target with custom CSS, see the form structure reference.

https://service.pcibooking.net/api/payments/capturecard?accessToken=YOUR_TOKEN&brand=YOUR_BRAND&language=en&autoDetectCardType=true&success=https://yoursite.com/success&failure=https://yoursite.com/failure&postMessageHost=yoursite.com

All parameter values must be URL-encoded.
All URLs you pass (success, failure, postMessageHost) must use HTTPS.
See the Hosted Card Entry Form guide for a visual preview of the rendered form.

If you prefer a clean iframe URL without query parameters, use the session-based card entry form instead. That method sends parameters in a server-side POST and returns a ready-to-use iframe URL.

Parameters

Authentication

This is a browser-facing endpoint. Use one of the authentication methods below instead of the API key shown above.

string

Recommended. A long-lived token for browser-side calls. How to generate.

string

Alternative. Valid for 5 minutes. How to generate.

If both are provided, the session token takes precedence. All parameters are passed as query string parameters in the URL.

Core Parameters

string

Access token for authentication. Recommended over session token.

string

Session token for authentication.

string

required

Your PCI Booking username, used to identify your account.

string

required

Form language in ISO 639-1 format (e.g. en, fr, de). Unsupported languages fall back to English. See custom translations.

string

required

The origin URL of the host page where the iframe is displayed, URL-encoded (e.g. https%3A%2F%2Fwww.yoursite.com). Required for postMessage communication between the form and your page.

string

URL to redirect to after successful card capture. The token details are appended as query parameters. Strongly recommended. See success/failure URLs.

string

URL to redirect to if the card capture fails. See success/failure URLs.

string

A reference value you define, which you can later use to query for this token.

Card Form Display

boolean

default:"false"

When true, the form detects the card type from the card number automatically. When false, a dropdown menu is shown for manual card type selection.

string

Which card type is pre-selected in the dropdown menu (only relevant when autoDetectCardType is false).

string

Comma-separated list of accepted card types. If omitted or no valid types are found, all card types are shown.

boolean

default:"false"

Show an “Owner ID” field on the form. Required in some countries.

string

default:"numbers"

Format of the expiration month dropdown. numbers shows 01, 02, ..., names shows January, February, ...

string

Minimum allowed expiration date in mmyyyy format (e.g. 012027). Useful when the card must be valid past a check-in date.

string

Additional validation for the Name on Card field. NO_DIGITS prevents digits in the name.

boolean

default:"true"

Auto-focus the first form field when the page loads. Focuses the card number field if autoDetectCardType is true, or the card type dropdown otherwise.

Styling

string

CSS resource name. See managing stylesheets. If omitted, PCI Booking’s default stylesheet is used.

boolean

default:"false"

When true, removes PCI Booking’s base CSS entirely. The base CSS does not collide with your site’s styles, so this is rarely needed.

CVV

boolean

default:"false"

When true, saves the CVV in PCI Booking’s vault alongside the card. Remember to set a CVV Retention Policy to control how long the CVV is stored.

3D Secure

If you enable 3D Secure, the challenge window has a 5-minute timeout. If the cardholder does not complete the challenge in time, the authentication is rejected.

boolean

default:"false"

Enable 3D Secure authentication after card entry. If using access token auth, provide two access tokens (see Authentication section above).

string

default:"Accept"

What to do if the 3DS service is unavailable. Accept: skip 3DS and tokenize the card anyway. Reject: do not tokenize, redirect to the failure URL.

The default, Accept, means that if 3DS can’t complete for any reason, the card is still tokenized - silently, without 3DS data. Nothing in the response flags this as unusual. If you later charge that token through a PSP that requires 3DS, the charge will be rejected, and the missing-3DS token is often the last thing anyone thinks to check. If your flow depends on every token having 3DS data, set this to Reject and handle the failure explicitly instead of relying on the default.

string

Merchant name for 3DS authentication. Must be URL-encoded and match a configured 3DS merchant. Leave blank to use PCI Booking’s merchant (Visa and Mastercard only).

integer

default:"0"

Transaction amount shown in the 3DS challenge screen, in the currency’s minor units (cents) - for example, 25 GBP is sent as 2500. Must be paired with currencyCode. If omitted, authentication uses 0 EUR.

string

default:"EUR"

ISO 4217 currency code for the 3DS challenge amount. Must be paired with amount.

string

Cardholder email for 3DS authentication. Since August 2024, Visa requires either email or phone for all 3DS authentications.

string

Cardholder phone number for 3DS authentication (digits only, e.g. 00353112223344). Required by Visa if email is not provided.

Do not use the merchantName parameter unless you have configured a 3DS merchant account. Providing an unconfigured merchant name will cause 3DS processing to fail.

Advanced

boolean

default:"false"

When true, removes PCI Booking’s submit button so you can trigger form submission from your own page via postMessage. See postMessage setup.

boolean

default:"false"

When true, PCI Booking checks if this card was previously stored and returns the existing token instead of creating a new one. A duplicate is a card with the same card number and expiration date as an existing token in your account; differences in cardholder name or CVV do not matter.

boolean

default:"false"

When true, PCI Booking sends the non-sensitive form data to your page via postMessage for custom validation before tokenizing. Your page has 3 seconds to respond.

Request Example

Since this is a URL you build (not a server-side API call), the “request” is the fully constructed URL placed in an iframe or used as a redirect target. Here is an example using curl to test the URL directly:

curl
Node.js
Python

curl -G "https://service.pcibooking.net/api/payments/capturecard" \
  --data-urlencode "accessToken=at_test_abc123" \
  --data-urlencode "brand=myhotel" \
  --data-urlencode "language=en" \
  --data-urlencode "autoDetectCardType=true" \
  --data-urlencode "success=https://yoursite.com/booking/success" \
  --data-urlencode "failure=https://yoursite.com/booking/failure" \
  --data-urlencode "postMessageHost=yoursite.com" \
  --data-urlencode "creatorReference=booking-12345" \
  --data-urlencode "cvv=true"

const params = new URLSearchParams({
  accessToken: "at_test_abc123",
  brand: "myhotel",
  language: "en",
  autoDetectCardType: "true",
  success: "https://yoursite.com/booking/success",
  failure: "https://yoursite.com/booking/failure",
  postMessageHost: "yoursite.com",
  creatorReference: "booking-12345",
  cvv: "true"
});

const url = `https://service.pcibooking.net/api/payments/capturecard?${params}`;

// Use this URL as an iframe src or redirect target
console.log(url);

// To test the URL directly:
const response = await fetch(url);
console.log(response.status);

import requests

params = {
    "accessToken": "at_test_abc123",
    "brand": "myhotel",
    "language": "en",
    "autoDetectCardType": "true",
    "success": "https://yoursite.com/booking/success",
    "failure": "https://yoursite.com/booking/failure",
    "postMessageHost": "yoursite.com",
    "creatorReference": "booking-12345",
    "cvv": "true"
}

# Build the URL for iframe src or redirect target
prepared = requests.Request("GET",
    "https://service.pcibooking.net/api/payments/capturecard",
    params=params
).prepare()
print(prepared.url)

# To test the URL directly:
response = requests.get(
    "https://service.pcibooking.net/api/payments/capturecard",
    params=params
)
print(response.status_code)

In production, you would set this URL as the src of an iframe element on your page:

<iframe src="https://service.pcibooking.net/api/payments/capturecard?accessToken=at_test_abc123&brand=myhotel&language=en&autoDetectCardType=true&success=https%3A%2F%2Fyoursite.com%2Fbooking%2Fsuccess&failure=https%3A%2F%2Fyoursite.com%2Fbooking%2Ffailure&postMessageHost=yoursite.com"></iframe>

Success Response

On successful card capture, PCI Booking redirects the cardholder’s browser to your success URL with the token details appended as query parameters:

https://yoursite.com/success?token=TOKEN_URI&last4Digits=1234&expirationDate=12/2028&cardType=Visa&nameOnCard=John+Doe

If you are using postMessage instead of redirect, the token details are sent via a postMessage event.

Error Responses

If the form cannot be rendered (invalid or missing parameters, authentication failure), PCI Booking redirects to your failure URL with error details. If no failure URL is configured, PCI Booking displays an error page.

Error	Cause
Invalid or expired session/access token	The authentication token is missing, malformed, or has expired. Generate a new token and rebuild the URL.
Missing required parameters	`brand`, `language`, or `postMessageHost` was not provided.
Invalid language code	The `language` value is not a valid ISO 639-1 code. The form falls back to English.
3DS challenge timeout	The cardholder did not complete the 3D Secure challenge within 5 minutes.
3DS authentication rejected	The cardholder failed 3D Secure authentication and `UnavailThreeDSAuth` is set to `Reject`.
3DS service unavailable	The 3DS provider is unreachable. If `UnavailThreeDSAuth` is `Accept`, the card is tokenized without 3DS. If `Reject`, the cardholder is redirected to the failure URL.
Invalid merchant name	The `merchantName` value does not match any configured 3DS merchant account.

Errors delivered to the failure URL are appended as query parameters. See success/failure URLs for the format and available error fields.

Start Here

Authentication & General

Capture Cards

Manage Tokens

Use Tokens

Additional Functions

Payments Library

Request a Card Entry Form

Hosted Card Entry Form Guide

Parameters

Authentication

Core Parameters

Card Form Display

Styling

CVV

3D Secure

Advanced

Request Example

Success Response

Error Responses

Hosted Card Entry Form Guide

​Parameters

​Authentication

​Core Parameters

​Card Form Display

​Styling

​CVV

​3D Secure

​Advanced

​Request Example

​Success Response

​Error Responses

Parameters

Authentication

Core Parameters

Card Form Display

Styling

CVV

3D Secure

Advanced

Request Example

Success Response

Error Responses