const params = new URLSearchParams({
cardUri: 'https://service.pcibooking.net/api/payments/paycard/865ed8bec1f84366b97112a69cdbf915',
cvv: '123',
ref: 'booking-12345',
merchant: 'hotel-sunrise'
});
const response = await fetch(
`https://service.pcibooking.net/api/payments/paycard/duplicate?${params}`,
{
method: 'POST',
headers: {
'Authorization': 'APIKEY your-api-key'
}
}
);
const newTokenUri = response.headers.get('Location');
console.log('New token URI:', newTokenUri);
import requests
response = requests.post(
'https://service.pcibooking.net/api/payments/paycard/duplicate',
headers={'Authorization': 'APIKEY your-api-key'},
params={
'cardUri': 'https://service.pcibooking.net/api/payments/paycard/865ed8bec1f84366b97112a69cdbf915',
'cvv': '123',
'ref': 'booking-12345',
'merchant': 'hotel-sunrise'
}
)
new_token_uri = response.headers.get('Location')
print('New token URI:', new_token_uri)
<?xml version='1.0' encoding='utf-8'?>
<BankCard>
<Type>Visa</Type>
<Number>491891******5005</Number>
<NameOnCard>Juan Dela Cruz</NameOnCard>
<ExpirationDate>
<Month>07</Month>
<Year>2020</Year>
</ExpirationDate>
<IssueNumber>2</IssueNumber>
</BankCard>
{
"code": -1003,
"message": "Not authorized to access this resource",
"moreInfo": "Bad or missing authorization data, expected APIKEY or Temp Session or One-Time Accesss Token",
"errorList": null
}
Query & Update
Duplicate Token
Create a copy of an existing token, optionally adding a CVV and specifying property association and creator reference.
POST
/
api
/
payments
/
paycard
/
duplicate
const params = new URLSearchParams({
cardUri: 'https://service.pcibooking.net/api/payments/paycard/865ed8bec1f84366b97112a69cdbf915',
cvv: '123',
ref: 'booking-12345',
merchant: 'hotel-sunrise'
});
const response = await fetch(
`https://service.pcibooking.net/api/payments/paycard/duplicate?${params}`,
{
method: 'POST',
headers: {
'Authorization': 'APIKEY your-api-key'
}
}
);
const newTokenUri = response.headers.get('Location');
console.log('New token URI:', newTokenUri);
import requests
response = requests.post(
'https://service.pcibooking.net/api/payments/paycard/duplicate',
headers={'Authorization': 'APIKEY your-api-key'},
params={
'cardUri': 'https://service.pcibooking.net/api/payments/paycard/865ed8bec1f84366b97112a69cdbf915',
'cvv': '123',
'ref': 'booking-12345',
'merchant': 'hotel-sunrise'
}
)
new_token_uri = response.headers.get('Location')
print('New token URI:', new_token_uri)
<?xml version='1.0' encoding='utf-8'?>
<BankCard>
<Type>Visa</Type>
<Number>491891******5005</Number>
<NameOnCard>Juan Dela Cruz</NameOnCard>
<ExpirationDate>
<Month>07</Month>
<Year>2020</Year>
</ExpirationDate>
<IssueNumber>2</IssueNumber>
</BankCard>
{
"code": -1003,
"message": "Not authorized to access this resource",
"moreInfo": "Bad or missing authorization data, expected APIKEY or Temp Session or One-Time Accesss Token",
"errorList": null
}
Update Card Data Guide
Modify expiration dates and creator references on tokens
Duplicate Token method has been completed successfully, a new card token will be created and the token URI will be returned in the response header Location.
The result of this process would be that there are two card tokens in PCI Booking for the same card.
It is your responsibility to delete one of them to avoid getting charged for storage on both tokens.
Error Responses
| Code | HTTP Status | Condition |
|---|---|---|
| -179 | 400 | CVV provided but does not match ^\d{3,4}$ |
| -160 | 404 | Card URI is invalid or card not found |
| -1003 | 401 | User is not the owner and is not associated with this card |
Parameter Constraints
| Parameter | Type | Required | Constraints |
|---|---|---|---|
| cardUri | string | Yes | Must contain a valid 32-character hexadecimal token |
| cvv | string | No | If provided, must match ^\d{3,4}$ (3 or 4 digits) |
This endpoint is rate limited.
Parameters
Headers
string
required
Your API key prefixed with
APIKEY. Example: APIKEY your-api-key. For server-to-server calls.Alternative: Browser-Side Authentication
Alternative: Browser-Side Authentication
This endpoint also accepts token-based authentication via query parameters:
If multiple methods are provided, precedence: Session Token > Access Token > API Key.
| Method | Details |
|---|---|
| Access Token (recommended) | accessToken query param. How to generate. |
| Session Token | sessionToken query param. How to generate. Valid for 5 minutes. |
Query String
string
required
The card URI (resource identifier for the card location within PCI Booking). For example,
https://service.pcibooking.net/api/payments/paycard/865ed8bec1f84366b97112a69cdbf915. The card URI should be URL encoded.string
Security code, as returned from the iFrame or other sources. If not provided, the new token will not contain any CVV.
string
A reference value that can be used to query for this card token.
string
The Property’s Username (user ID) found within PCI Booking (under “Property settings”) which has been given permission to view the card. The owner (Booker) always has permission to view the card.
const params = new URLSearchParams({
cardUri: 'https://service.pcibooking.net/api/payments/paycard/865ed8bec1f84366b97112a69cdbf915',
cvv: '123',
ref: 'booking-12345',
merchant: 'hotel-sunrise'
});
const response = await fetch(
`https://service.pcibooking.net/api/payments/paycard/duplicate?${params}`,
{
method: 'POST',
headers: {
'Authorization': 'APIKEY your-api-key'
}
}
);
const newTokenUri = response.headers.get('Location');
console.log('New token URI:', newTokenUri);
import requests
response = requests.post(
'https://service.pcibooking.net/api/payments/paycard/duplicate',
headers={'Authorization': 'APIKEY your-api-key'},
params={
'cardUri': 'https://service.pcibooking.net/api/payments/paycard/865ed8bec1f84366b97112a69cdbf915',
'cvv': '123',
'ref': 'booking-12345',
'merchant': 'hotel-sunrise'
}
)
new_token_uri = response.headers.get('Location')
print('New token URI:', new_token_uri)
Response
200 - Card duplicated. ALocation header is returned with the new token URI.
Remember to set the CVV Retention Policy on the new token if it includes a CVV.
<?xml version='1.0' encoding='utf-8'?>
<BankCard>
<Type>Visa</Type>
<Number>491891******5005</Number>
<NameOnCard>Juan Dela Cruz</NameOnCard>
<ExpirationDate>
<Month>07</Month>
<Year>2020</Year>
</ExpirationDate>
<IssueNumber>2</IssueNumber>
</BankCard>
{
"code": -1003,
"message": "Not authorized to access this resource",
"moreInfo": "Bad or missing authorization data, expected APIKEY or Temp Session or One-Time Accesss Token",
"errorList": null
}