Store Paycard (Card Migration)

curl --request POST \
  --url https://service.pcibooking.net/api/payments/paycard \
  --header 'Authorization: <authorization>' \
  --header 'Content-Type: <content-type>' \
  --data '
{
  "BankCardDetails": {}
}
'

import requests

url = "https://service.pcibooking.net/api/payments/paycard"

payload = { "BankCardDetails": {} }
headers = {
    "Authorization": "<authorization>",
    "Content-Type": "<content-type>"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: '<authorization>', 'Content-Type': '<content-type>'},
  body: JSON.stringify({BankCardDetails: {}})
};

fetch('https://service.pcibooking.net/api/payments/paycard', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://service.pcibooking.net/api/payments/paycard",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'BankCardDetails' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: <authorization>",
    "Content-Type: <content-type>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://service.pcibooking.net/api/payments/paycard"

	payload := strings.NewReader("{\n  \"BankCardDetails\": {}\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "<authorization>")
	req.Header.Add("Content-Type", "<content-type>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://service.pcibooking.net/api/payments/paycard")
  .header("Authorization", "<authorization>")
  .header("Content-Type", "<content-type>")
  .body("{\n  \"BankCardDetails\": {}\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://service.pcibooking.net/api/payments/paycard")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = '<authorization>'
request["Content-Type"] = '<content-type>'
request.body = "{\n  \"BankCardDetails\": {}\n}"

response = http.request(request)
puts response.read_body

{
    "Type": "Visa",
    "Number": "491891******5005",
    "NameOnCard": "Juan Dela Cruz",
    "ExpirationDate": {
        "Month": "07",
        "Year": "2020"
    },
    "IssueNumber": "2"
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected APIKEY or Temp Session or One-Time Accesss Token",
    "errorList": null
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Merchant or Owner are not associated with bank card [{{Token}] userID: SoBookIt",
    "errorList": null
}

POST

api

payments

paycard

Store Paycard (Card Migration)

curl --request POST \
  --url https://service.pcibooking.net/api/payments/paycard \
  --header 'Authorization: <authorization>' \
  --header 'Content-Type: <content-type>' \
  --data '
{
  "BankCardDetails": {}
}
'

import requests

url = "https://service.pcibooking.net/api/payments/paycard"

payload = { "BankCardDetails": {} }
headers = {
    "Authorization": "<authorization>",
    "Content-Type": "<content-type>"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: '<authorization>', 'Content-Type': '<content-type>'},
  body: JSON.stringify({BankCardDetails: {}})
};

fetch('https://service.pcibooking.net/api/payments/paycard', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://service.pcibooking.net/api/payments/paycard",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'BankCardDetails' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: <authorization>",
    "Content-Type: <content-type>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://service.pcibooking.net/api/payments/paycard"

	payload := strings.NewReader("{\n  \"BankCardDetails\": {}\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "<authorization>")
	req.Header.Add("Content-Type", "<content-type>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://service.pcibooking.net/api/payments/paycard")
  .header("Authorization", "<authorization>")
  .header("Content-Type", "<content-type>")
  .body("{\n  \"BankCardDetails\": {}\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://service.pcibooking.net/api/payments/paycard")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = '<authorization>'
request["Content-Type"] = '<content-type>'
request.body = "{\n  \"BankCardDetails\": {}\n}"

response = http.request(request)
puts response.read_body

{
    "Type": "Visa",
    "Number": "491891******5005",
    "NameOnCard": "Juan Dela Cruz",
    "ExpirationDate": {
        "Month": "07",
        "Year": "2020"
    },
    "IssueNumber": "2"
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected APIKEY or Temp Session or One-Time Accesss Token",
    "errorList": null
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Merchant or Owner are not associated with bank card [{{Token}] userID: SoBookIt",
    "errorList": null
}

Card Migration Guide

Migrate existing card data into PCI Booking tokens

Use this endpoint to migrate card data you currently store on your own systems into PCI Booking tokens. Send the full card details in XML format, and PCI Booking returns a token URI you can use for all future operations. This is typically a one-time bulk migration step when onboarding with PCI Booking.

This endpoint accepts card details in XML format only. Set Content-Type: text/xml.

Error Responses

Code	HTTP Status	Condition
-123	400	Request body is not valid XML or is null
-123	400	XML fails schema validation
-160	404	Submitted data is PaymentInfo instead of BankCard
-179	400	Card validation failed (Luhn check, expiration, or CVV). Returns `errorList` with details
-125	400	Card storage failed due to invalid data
-150	500	Card storage failed due to a system error
-1003	401	Missing `CanTokenize` permission

Parameter Constraints

Parameter	Type	Required	Constraints
validateLuhn	boolean	No	Defaults to `true`. Validates card number with Luhn algorithm
validateExpiration	boolean	No	Defaults to `false`. When `true`, rejects expired cards
saveCVV	boolean	No	Defaults to `false`. Requires CVV retention policy to be set after storage
eliminateCardDuplication	boolean	No	Defaults to `false`. When `true`, returns existing token if card already stored
Content-Type	string	Yes	Must be `text/xml`
Auth	string	Yes	ApiKey, AccessToken, or SessionToken

The request body must contain a BankCardDetails XML document. See Card Data XML Structure for the full field reference.

<BankCardDetails xmlns="http://www.pcibooking.net/reservation" schemaVersion="1.0">
  <BankCard>
    <Type>Visa</Type>
    <Number>4918914107195005</Number>
    <NameOnCard>Juan Dela Cruz</NameOnCard>
    <ExpirationDate>
      <Month>07</Month>
      <Year>2020</Year>
    </ExpirationDate>
    <IssueNumber>2</IssueNumber>
    <OwnerID>123456789</OwnerID>
    <CVV>123</CVV>
  </BankCard>
</BankCardDetails>

On success, a card token is created and the token URI is returned in the Location response header. The response body contains the submitted card details with sensitive data masked.

Parameters

Headers

Authorization

string

required

Your API key prefixed with APIKEY. Example: APIKEY your-api-key. For server-to-server calls.

Alternative: Browser-Side Authentication

This endpoint also accepts token-based authentication via query parameters:

Method	Details
Access Token (recommended)	`accessToken` query param. How to generate.
Session Token	`sessionToken` query param. How to generate. Valid for 5 minutes.

If multiple methods are provided, precedence: Session Token > Access Token > API Key.

Content-Type

string

default:"text/xml"

required

Must be text/xml. This endpoint accepts card details in XML format only.

Query String

ref

string

A reference value that can be used to query for this card token.

merchant

string

User ID of the property to associate the token with. Found under “Property settings” in the user’s site.

allowedUserId

string

User ID of the PCI Booking customer (booker ID) to associate the token with. The customer must share their PCI Booking user ID with you.

saveCVV

boolean

default:"false"

Whether to save the CVV in the database. true - save the CVV. false - do not save the CVV.

ValidateExpiration

boolean

default:"false"

Whether to check if the expiration date is valid. True validates the expiration date and tokenization will fail if expired. False accepts the date as is, even if in the past.

validateLuhn

boolean

default:"true"

Whether to check if the card number passes the Luhn algorithm. True validates using Luhn and tokenization will fail if the number does not pass. False accepts the number as is.

Request Body

BankCardDetails

object

The BankCardDetails object. See the XML structure and example above.

Request Example

Store a Visa card and associate it with a reference and property:

curl
Node.js
Python

curl -X POST "https://service.pcibooking.net/api/payments/paycard?ref=booking-12345&merchant=hotel-sunrise&saveCVV=true" \
  -H "Authorization: APIKEY your-api-key" \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0" encoding="utf-8"?>
<BankCardDetails xmlns="http://www.pcibooking.net/reservation" schemaVersion="1.0">
  <BankCard>
    <Type>Visa</Type>
    <Number>4111111111111111</Number>
    <NameOnCard>Jane Smith</NameOnCard>
    <ExpirationDate>
      <Month>12</Month>
      <Year>2028</Year>
    </ExpirationDate>
    <CVV>123</CVV>
  </BankCard>
</BankCardDetails>'

const xmlBody = `<?xml version="1.0" encoding="utf-8"?>
<BankCardDetails xmlns="http://www.pcibooking.net/reservation" schemaVersion="1.0">
  <BankCard>
    <Type>Visa</Type>
    <Number>4111111111111111</Number>
    <NameOnCard>Jane Smith</NameOnCard>
    <ExpirationDate>
      <Month>12</Month>
      <Year>2028</Year>
    </ExpirationDate>
    <CVV>123</CVV>
  </BankCard>
</BankCardDetails>`;

const params = new URLSearchParams({
  ref: "booking-12345",
  merchant: "hotel-sunrise",
  saveCVV: "true"
});

const response = await fetch(
  `https://service.pcibooking.net/api/payments/paycard?${params}`,
  {
    method: "POST",
    headers: {
      "Authorization": "APIKEY your-api-key",
      "Content-Type": "text/xml"
    },
    body: xmlBody
  }
);

const tokenUri = response.headers.get("Location");
console.log("Token URI:", tokenUri);

const data = await response.json();
console.log(data);

import requests

xml_body = """<?xml version="1.0" encoding="utf-8"?>
<BankCardDetails xmlns="http://www.pcibooking.net/reservation" schemaVersion="1.0">
  <BankCard>
    <Type>Visa</Type>
    <Number>4111111111111111</Number>
    <NameOnCard>Jane Smith</NameOnCard>
    <ExpirationDate>
      <Month>12</Month>
      <Year>2028</Year>
    </ExpirationDate>
    <CVV>123</CVV>
  </BankCard>
</BankCardDetails>"""

response = requests.post(
    "https://service.pcibooking.net/api/payments/paycard",
    params={
        "ref": "booking-12345",
        "merchant": "hotel-sunrise",
        "saveCVV": "true"
    },
    headers={
        "Authorization": "APIKEY your-api-key",
        "Content-Type": "text/xml"
    },
    data=xml_body
)

token_uri = response.headers.get("Location")
print("Token URI:", token_uri)
print(response.json())

On success, the token URI is returned in the Location response header (e.g. Location: https://service.pcibooking.net/api/payments/paycard/tok_abc123).

Response

201 - Card stored. A Location header is returned with the token URI. The response body contains the card details with sensitive data masked.

Remember to set the CVV Retention Policy on the token if you stored the CVV.

{
    "Type": "Visa",
    "Number": "491891******5005",
    "NameOnCard": "Juan Dela Cruz",
    "ExpirationDate": {
        "Month": "07",
        "Year": "2020"
    },
    "IssueNumber": "2"
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected APIKEY or Temp Session or One-Time Accesss Token",
    "errorList": null
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Merchant or Owner are not associated with bank card [{{Token}] userID: SoBookIt",
    "errorList": null
}

Tokenize from sFTP CVV Entry Form

Start Here

Authentication & General

Capture Cards

Manage Tokens

Use Tokens

Additional Functions

Payments Library

Store Paycard (Card Migration)

Card Migration Guide

Error Responses

Parameter Constraints

Parameters

Headers

Query String

Request Body

Request Example

Response

Card Migration Guide

​Error Responses

​Parameter Constraints

​Parameters

​Headers

​Query String

​Request Body

​Request Example

​Response

Error Responses

Parameter Constraints

Parameters

Headers

Query String

Request Body

Request Example

Response