const params = new URLSearchParams({
  profileName: 'MyOTAProfile',
  targetURI: 'https://api.thirdparty.com/reservations/12345',
  httpMethod: 'POST',
  saveCVV: 'true',
  ref: 'booking-12345'
});

const response = await fetch(
  `https://service.pcibooking.net/api/payments/paycard/capture?${params}`,
  {
    method: 'POST',
    headers: {
      'Authorization': 'APIKEY your-api-key',
      'Content-Type': 'application/xml'
    },
    body: '<ReservationRequest><ID>12345</ID></ReservationRequest>'
  }
);

const tokenUri = response.headers.get('X-pciBooking-cardUri');
console.log('Token URI:', tokenUri);

const data = await response.text();
console.log('Sanitized response:', data);

import requests

response = requests.post(
    'https://service.pcibooking.net/api/payments/paycard/capture',
    params={
        'profileName': 'MyOTAProfile',
        'targetURI': 'https://api.thirdparty.com/reservations/12345',
        'httpMethod': 'POST',
        'saveCVV': 'true',
        'ref': 'booking-12345'
    },
    headers={
        'Authorization': 'APIKEY your-api-key',
        'Content-Type': 'application/xml'
    },
    data='<ReservationRequest><ID>12345</ID></ReservationRequest>'
)

token_uri = response.headers.get('X-pciBooking-cardUri')
print('Token URI:', token_uri)
print('Sanitized response:', response.text)

The third-party response body is returned with card details replaced by token placeholders.
The X-pciBooking-cardUri header contains the new token URI.

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Couldn't fetch a valid pciShield profile:: <profileName>",
    "errorList": null
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Invalid target Uri::",
    "errorList": null
}

Empty response body.
Authentication failed: the API key, session token or access token is missing or was not accepted.
See "Authentication and Permission Failures" on the Error Handling page.