const profileName = 'SiteMinder';
const params = new URLSearchParams({
  pathSegments: 'SiteMinderCustID=CUST001',
  saveCVV: 'true',
  ref: 'booking-12345'
});

const response = await fetch(
  `https://service.pcibooking.net/api/booker/${profileName}/reservation?${params}`,
  {
    method: 'POST',
    headers: {
      'Authorization': 'APIKEY your-api-key',
      'Content-Type': 'application/xml'
    },
    body: '<ReservationRequest><HotelCode>HOTEL01</HotelCode></ReservationRequest>'
  }
);

const tokenUri = response.headers.get('X-pciBooking-cardUri');
console.log('Token URI:', tokenUri);

const data = await response.text();
console.log('Sanitized response:', data);

import requests

profile_name = 'SiteMinder'

response = requests.post(
    f'https://service.pcibooking.net/api/booker/{profile_name}/reservation',
    params={
        'pathSegments': 'SiteMinderCustID=CUST001',
        'saveCVV': 'true',
        'ref': 'booking-12345'
    },
    headers={
        'Authorization': 'APIKEY your-api-key',
        'Content-Type': 'application/xml'
    },
    data='<ReservationRequest><HotelCode>HOTEL01</HotelCode></ReservationRequest>'
)

token_uri = response.headers.get('X-pciBooking-cardUri')
print('Token URI:', token_uri)
print('Sanitized response:', response.text)

The third-party response body is returned with card details replaced by token placeholders.
The X-pciBooking-cardUri header contains the new token URI.

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Couldn't fetch a valid pciShield profile:: <profileName>",
    "errorList": null
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Invalid target Uri::",
    "errorList": null
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected Temp Session or One-Time Accesss Token",
    "errorList": null
}