Tokenize on Response Using Preset Profiles

const profileName = 'SiteMinder';
const params = new URLSearchParams({
  pathSegments: 'SiteMinderCustID=CUST001',
  saveCVV: 'true',
  ref: 'booking-12345'
});

const response = await fetch(
  `https://service.pcibooking.net/api/booker/${profileName}/reservation?${params}`,
  {
    method: 'POST',
    headers: {
      'Authorization': 'APIKEY your-api-key',
      'Content-Type': 'application/xml'
    },
    body: '<ReservationRequest><HotelCode>HOTEL01</HotelCode></ReservationRequest>'
  }
);

const tokenUri = response.headers.get('X-pciBooking-cardUri');
console.log('Token URI:', tokenUri);

const data = await response.text();
console.log('Sanitized response:', data);

import requests

profile_name = 'SiteMinder'

response = requests.post(
    f'https://service.pcibooking.net/api/booker/{profile_name}/reservation',
    params={
        'pathSegments': 'SiteMinderCustID=CUST001',
        'saveCVV': 'true',
        'ref': 'booking-12345'
    },
    headers={
        'Authorization': 'APIKEY your-api-key',
        'Content-Type': 'application/xml'
    },
    data='<ReservationRequest><HotelCode>HOTEL01</HotelCode></ReservationRequest>'
)

token_uri = response.headers.get('X-pciBooking-cardUri')
print('Token URI:', token_uri)
print('Sanitized response:', response.text)

The third-party response body is returned with card details replaced by token placeholders.
The X-pciBooking-cardUri header contains the new token URI.

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Couldn't fetch a valid pciShield profile:: wsc",
    "errorList": null
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Invalid target Uri::",
    "errorList": null
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected Temp Session or One-Time Accesss Token",
    "errorList": null
}

POST

api

booker

{ProfileName}

reservation

const profileName = 'SiteMinder';
const params = new URLSearchParams({
  pathSegments: 'SiteMinderCustID=CUST001',
  saveCVV: 'true',
  ref: 'booking-12345'
});

const response = await fetch(
  `https://service.pcibooking.net/api/booker/${profileName}/reservation?${params}`,
  {
    method: 'POST',
    headers: {
      'Authorization': 'APIKEY your-api-key',
      'Content-Type': 'application/xml'
    },
    body: '<ReservationRequest><HotelCode>HOTEL01</HotelCode></ReservationRequest>'
  }
);

const tokenUri = response.headers.get('X-pciBooking-cardUri');
console.log('Token URI:', tokenUri);

const data = await response.text();
console.log('Sanitized response:', data);

import requests

profile_name = 'SiteMinder'

response = requests.post(
    f'https://service.pcibooking.net/api/booker/{profile_name}/reservation',
    params={
        'pathSegments': 'SiteMinderCustID=CUST001',
        'saveCVV': 'true',
        'ref': 'booking-12345'
    },
    headers={
        'Authorization': 'APIKEY your-api-key',
        'Content-Type': 'application/xml'
    },
    data='<ReservationRequest><HotelCode>HOTEL01</HotelCode></ReservationRequest>'
)

token_uri = response.headers.get('X-pciBooking-cardUri')
print('Token URI:', token_uri)
print('Sanitized response:', response.text)

The third-party response body is returned with card details replaced by token placeholders.
The X-pciBooking-cardUri header contains the new token URI.

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Couldn't fetch a valid pciShield profile:: wsc",
    "errorList": null
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Invalid target Uri::",
    "errorList": null
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected Temp Session or One-Time Accesss Token",
    "errorList": null
}

Universal Tokenization Guide

Tokenize cards from any source using preset profiles

PCI Booking forwards your request to the third party defined in the profile, tokenizes any card data found in the response, and returns the sanitized response with the following custom headers:

Header	Description
`X-pciBooking-cardUri`	Semicolon-separated list of token URIs for each card tokenized. The header name can be customized per profile.
`X-pciBooking-Tokenization-Errors`	Errors encountered during tokenization (e.g. invalid card number, missing fields). Present only if errors occurred.
`X-pciBooking-Tokenization-Warnings`	Warnings encountered during tokenization (e.g. expired card accepted). Present only if warnings occurred.

Error Responses

Code	HTTP Status	Condition
`-1003`	`401`	Authorization token is missing or invalid (requires Access Token or Session Token).
`-1003`	`401`	User does not have `CanTokenize` permission.
`-125`	`400`	The specified profile name was not found.
`-150`	`500`	Failed to retrieve the profile configuration (internal error).

Parameter Constraints

ProfileName: Must match an existing profile name (see Get Tokenization Profiles).
pathSegments: Required if the profile’s target URL has dynamic path segments. Provide key-value pairs in query string format.
eliminateCardDuplication: When true, a 200 status indicates the card already existed; 201 means a new token was created.

Parameters

Authentication

This is a browser-facing endpoint. Use one of the authentication methods below instead of the API key shown above.

accessToken

string

Recommended. A long-lived token for browser-side calls. How to generate.

sessionToken

string

Alternative. Valid for 5 minutes. How to generate.

If both are provided, the session token takes precedence.

Path Parameters

ProfileName

string

required

The name of the profile as returned from the Get Tokenization Profiles method.

Query String

pathSegments

string

Dynamic path segments to append to the profile’s target URL. Some third-party endpoints include dynamic values in the URL path (e.g. https://ws.mydomain.com/{customerName}). The Get Tokenization Profiles response lists the required path segments for each profile.

fwd

string

Query string parameters to append to the profile’s target URL. Some third-party endpoints require additional parameters (e.g. ?param1=value1&param2=value2). Provide the full query string as needed.

saveCVV

boolean

default:"false"

Whether to save the CVV in the database. true: save the CVV. false: discard the CVV.

ref

string

A reference value which can be used to query for this card token.

MerchantId

string

The user ID of the property to associate the token with. Found under “Property settings” in the user’s site.

eliminateCardDuplication

boolean

default:"false"

Controls whether PCI Booking checks if the card already exists as a token in your account.

true: PCI Booking looks up the card in your stored tokens. If a match is found, the existing token URI is returned instead of creating a new one. The response status will be 200 instead of 201.
false (default): A new token is always created, even if the same card was previously stored.

Request Body

The request body and headers are passed through to the third party as-is. Include any body content and headers that the third party requires.

const profileName = 'SiteMinder';
const params = new URLSearchParams({
  pathSegments: 'SiteMinderCustID=CUST001',
  saveCVV: 'true',
  ref: 'booking-12345'
});

const response = await fetch(
  `https://service.pcibooking.net/api/booker/${profileName}/reservation?${params}`,
  {
    method: 'POST',
    headers: {
      'Authorization': 'APIKEY your-api-key',
      'Content-Type': 'application/xml'
    },
    body: '<ReservationRequest><HotelCode>HOTEL01</HotelCode></ReservationRequest>'
  }
);

const tokenUri = response.headers.get('X-pciBooking-cardUri');
console.log('Token URI:', tokenUri);

const data = await response.text();
console.log('Sanitized response:', data);

import requests

profile_name = 'SiteMinder'

response = requests.post(
    f'https://service.pcibooking.net/api/booker/{profile_name}/reservation',
    params={
        'pathSegments': 'SiteMinderCustID=CUST001',
        'saveCVV': 'true',
        'ref': 'booking-12345'
    },
    headers={
        'Authorization': 'APIKEY your-api-key',
        'Content-Type': 'application/xml'
    },
    data='<ReservationRequest><HotelCode>HOTEL01</HotelCode></ReservationRequest>'
)

token_uri = response.headers.get('X-pciBooking-cardUri')
print('Token URI:', token_uri)
print('Sanitized response:', response.text)

Response

200 - The card already exists in your account (when eliminateCardDuplication is true). The response body contains the third-party response with card details masked. The existing token URI is returned in the X-pciBooking-cardUri header. 201 - A new card was tokenized. The response body contains the third-party response with card details masked. The new token URI is returned in the X-pciBooking-cardUri header.

Remember to set the CVV Retention Policy on the token.

The third-party response body is returned with card details replaced by token placeholders.
The X-pciBooking-cardUri header contains the new token URI.

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Couldn't fetch a valid pciShield profile:: wsc",
    "errorList": null
}

{
    "code": -125,
    "message": "Bad input data",
    "moreInfo": "Invalid target Uri::",
    "errorList": null
}

{
    "code": -1003,
    "message": "Not authorized to access this resource",
    "moreInfo": "Bad or missing authorization data, expected Temp Session or One-Time Accesss Token",
    "errorList": null
}

Tokenization in Response Get Tokenization Profiles

Start Here

Authentication & General

Capture Cards

Manage Tokens

Use Tokens

Additional Functions

Payments Library

Tokenize on Response Using Preset Profiles

Universal Tokenization Guide

Error Responses

Parameter Constraints

Parameters

Authentication

Path Parameters

Query String

Request Body

Response

Universal Tokenization Guide

​Error Responses

​Parameter Constraints

​Parameters

​Authentication

​Path Parameters

​Query String

​Request Body

​Response

Error Responses

Parameter Constraints

Parameters

Authentication

Path Parameters

Query String

Request Body

Response