Skip to main content
Universal Tokenization profiles are pre-built parsing profiles that PCI Booking maintains for commonly used third parties. Instead of creating your own profile, you reference one that is already configured and tested.

​
What Is a Universal Profile?

A universal profile is a pre-configured parsing template that tells PCI Booking exactly where card data appears in a third party’s API response. It defines the response format (JSON, XML, or other), the field paths that contain card numbers, expiration dates, CVV, and cardholder names, and how to replace them with tokens. Universal profiles are maintained and tested by PCI Booking, so you do not need to create or manage the parsing logic yourself.

​
How It Works

The flow is the same as Tokenization on Response. The only difference is that you reference a universal profile name instead of a custom one when calling the proxy endpoint.
  1. Send your request through PCI Booking’s proxy endpoint, specifying the universal profile name and the third party’s connection details.
  2. PCI Booking forwards the request to the third party.
  3. PCI Booking parses the response using the universal profile, tokenizes all card data, and returns the sanitized response to you.
Your system receives the full response from the third party, but with all card data replaced by PCI Booking tokens. The response structure remains identical, so your existing parsing logic continues to work without changes.

​
When to Use Universal Profiles vs. Custom Profiles

  • Your third party is already supported by a pre-built profile
  • You want zero configuration on your side
  • You prefer PCI Booking to maintain and update the parsing rules when the third party changes their API

​
Common Use Cases

Universal profiles are widely used in the travel and hospitality industry:
  • OTA integrations where booking platforms receive virtual card details from online travel agencies
  • Channel managers that aggregate reservation data (including payment cards) from multiple booking channels
  • GDS systems that relay card data as part of reservation records
  • Property management systems receiving cards from central reservation systems

​
Available Profiles

You can retrieve the current list of universal profiles programmatically using the Get Tokenization Profiles API. Each profile includes the third party name, the response format it parses (JSON, XML, SOAP, etc.), and the specific fields it tokenizes. Profiles are versioned. When a third party updates their API response format, PCI Booking updates the universal profile accordingly. Your integration does not need to change since the profile name stays the same and the updated parsing logic is applied automatically.

​
Next Steps

Tokenization on Response

Full guide including custom profile creation.

Capture Cards Overview

All available tokenization methods.