Tokenize from sFTP

const serverAddress = 'sftp.thirdparty.com:22';
const folderPath = 'reports/daily';
const fileName = 'reservations.xml';

const params = new URLSearchParams({
  filter: 'GBT',
  ref: 'import-2024-01',
  timeout: '30'
});

const response = await fetch(
  `https://service.pcibooking.net/api/sftp/${serverAddress}/${folderPath}/${fileName}?${params}`,
  {
    headers: {
      'Authorization': 'APIKEY your-api-key'
    }
  }
);

const tokenUri = response.headers.get('X-pciBooking-cardUri');
console.log('Token URI:', tokenUri);

const data = await response.text();
console.log('Sanitized file content:', data);

import requests

server_address = 'sftp.thirdparty.com:22'
folder_path = 'reports/daily'
file_name = 'reservations.xml'

response = requests.get(
    f'https://service.pcibooking.net/api/sftp/{server_address}/{folder_path}/{file_name}',
    params={
        'filter': 'GBT',
        'ref': 'import-2024-01',
        'timeout': '30'
    },
    headers={
        'Authorization': 'APIKEY your-api-key'
    }
)

token_uri = response.headers.get('X-pciBooking-cardUri')
print('Token URI:', token_uri)
print('Sanitized file content:', response.text)

The file content is returned with card details replaced by token placeholders.
The X-pciBooking-cardUri header contains the token URI(s).

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "...",
    "errorList": null
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected Temp Session or One-Time Access Token",
    "errorList": null
}

GET

api

sftp

{serverAddress}

{folderPath}

{fileName}

const serverAddress = 'sftp.thirdparty.com:22';
const folderPath = 'reports/daily';
const fileName = 'reservations.xml';

const params = new URLSearchParams({
  filter: 'GBT',
  ref: 'import-2024-01',
  timeout: '30'
});

const response = await fetch(
  `https://service.pcibooking.net/api/sftp/${serverAddress}/${folderPath}/${fileName}?${params}`,
  {
    headers: {
      'Authorization': 'APIKEY your-api-key'
    }
  }
);

const tokenUri = response.headers.get('X-pciBooking-cardUri');
console.log('Token URI:', tokenUri);

const data = await response.text();
console.log('Sanitized file content:', data);

import requests

server_address = 'sftp.thirdparty.com:22'
folder_path = 'reports/daily'
file_name = 'reservations.xml'

response = requests.get(
    f'https://service.pcibooking.net/api/sftp/{server_address}/{folder_path}/{file_name}',
    params={
        'filter': 'GBT',
        'ref': 'import-2024-01',
        'timeout': '30'
    },
    headers={
        'Authorization': 'APIKEY your-api-key'
    }
)

token_uri = response.headers.get('X-pciBooking-cardUri')
print('Token URI:', token_uri)
print('Sanitized file content:', response.text)

The file content is returned with card details replaced by token placeholders.
The X-pciBooking-cardUri header contains the token URI(s).

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "...",
    "errorList": null
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected Temp Session or One-Time Access Token",
    "errorList": null
}

File Transfer Tokenization Guide

Tokenize card data from SFTP file transfers

Also available over FTPS:

GET https://service.pcibooking.net/api/ftps/{serverAddress}/{folderPath}/{fileName}

PCI Booking connects to the sFTP server, downloads the file, tokenizes any card data found in it (based on the specified filter), and returns the sanitized file content with the following custom headers:

Header	Description
`X-pciBooking-cardUri`	Semicolon-separated list of token URIs for each card tokenized.
`X-pciBooking-Tokenization-Errors`	Errors encountered during tokenization (e.g. invalid card number, missing fields). Present only if errors occurred.
`X-pciBooking-Tokenization-Warnings`	Warnings encountered during tokenization (e.g. expired card accepted). Present only if warnings occurred.

If the path ends with /, PCI Booking returns a directory listing instead of downloading a file.

Error Responses

Code	HTTP Status	Condition
`-1003`	`401`	Authorization token is missing or invalid.
`-125`	`400`	Invalid host format (e.g. multiple colons in the server address).
`-125`	`400`	Invalid or missing Basic Auth credentials in the Authorization header.
`-125`	`400`	The requested filter name is not recognized.
`-1003`	`401`	SFTP/FTPS login failed (invalid server credentials).
`-160`	`404`	File download or directory listing failed on the remote server.

Parameter Constraints

serverAddress: Format is hostname or hostname:port. Only one colon is allowed. Default port is 22.
filter: Must be one of: GBT, SIMPLECSV, SIMPLEJSON, AIR, IUR, TADC, CSV. Case-insensitive.
Authorization header: Must contain valid Basic Auth credentials (username:password) for the SFTP/FTPS server.

Parameters

Authentication

This is a browser-facing endpoint. Use one of the authentication methods below instead of the API key shown above.

accessToken

string

Recommended. A long-lived token for browser-side calls. How to generate.

sessionToken

string

Alternative. Valid for 5 minutes. How to generate.

If both are provided, the session token takes precedence.

Path Parameters

serverAddress

string

required

The sFTP server address. This can be an IP address or domain name. If required, add the port number with a colon. For example: fsgatewaytest.aexp.com:22 or 10.200.1.10.

folderPath

string

required

The folder path where the file should be downloaded from. This can be an individual folder or a full path.

fileName

string

required

The file name to download, including extension. For example: PCIBTST.xml.

Query String

filter

string

required

The file format filter that tells PCI Booking how to parse the file content and locate card data.

timeout

string

The number of seconds PCI Booking should wait for the sFTP server to respond.

ref

string

A reference value which can be used to query for this card token.

merchantId

string

The user ID of the property to associate the token with. Found under “Property settings” in the user’s site.

eliminateCardDuplication

boolean

default:"false"

Controls whether PCI Booking checks if the card already exists as a token in your account.

true: PCI Booking looks up the card in your stored tokens. If a match is found, the existing token URI is returned instead of creating a new one.
false (default): A new token is always created, even if the same card was previously stored.

Headers

Content-Encoding

string

PCI Booking supports request compression in gzip and deflate formats. Set this header as needed. Omit if no compression is required.

const serverAddress = 'sftp.thirdparty.com:22';
const folderPath = 'reports/daily';
const fileName = 'reservations.xml';

const params = new URLSearchParams({
  filter: 'GBT',
  ref: 'import-2024-01',
  timeout: '30'
});

const response = await fetch(
  `https://service.pcibooking.net/api/sftp/${serverAddress}/${folderPath}/${fileName}?${params}`,
  {
    headers: {
      'Authorization': 'APIKEY your-api-key'
    }
  }
);

const tokenUri = response.headers.get('X-pciBooking-cardUri');
console.log('Token URI:', tokenUri);

const data = await response.text();
console.log('Sanitized file content:', data);

import requests

server_address = 'sftp.thirdparty.com:22'
folder_path = 'reports/daily'
file_name = 'reservations.xml'

response = requests.get(
    f'https://service.pcibooking.net/api/sftp/{server_address}/{folder_path}/{file_name}',
    params={
        'filter': 'GBT',
        'ref': 'import-2024-01',
        'timeout': '30'
    },
    headers={
        'Authorization': 'APIKEY your-api-key'
    }
)

token_uri = response.headers.get('X-pciBooking-cardUri')
print('Token URI:', token_uri)
print('Sanitized file content:', response.text)

Response

200 - The file content with card details masked. Token URIs are returned in the X-pciBooking-cardUri header.

Remember to set the CVV Retention Policy on the token.

The file content is returned with card details replaced by token placeholders.
The X-pciBooking-cardUri header contains the token URI(s).

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "...",
    "errorList": null
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected Temp Session or One-Time Access Token",
    "errorList": null
}

Get Tokenization Profiles Store Paycard (Card Migration)

Start Here

Authentication & General

Capture Cards

Manage Tokens

Use Tokens

Additional Functions

Payments Library

File Transfer Tokenization Guide

Error Responses

Parameter Constraints

Parameters

Authentication

Path Parameters

Query String

Headers

Response

File Transfer Tokenization Guide

​Error Responses

​Parameter Constraints

​Parameters

​Authentication

​Path Parameters

​Query String

​Headers

​Response

Error Responses

Parameter Constraints

Parameters

Authentication

Path Parameters

Query String

Headers

Response