Retrieve Card Details

const response = await fetch(
  'https://service.pcibooking.net/api/payments/paycard/2821a46d80e14d1b96a7f18f1b81926d?retrieveCVV=yes',
  {
    headers: {
      'Authorization': 'APIKEY your-api-key'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://service.pcibooking.net/api/payments/paycard/2821a46d80e14d1b96a7f18f1b81926d',
    headers={'Authorization': 'APIKEY your-api-key'},
    params={'retrieveCVV': 'yes'}
)

print(response.json())

{
    "@xmlns": "http://www.pcibooking.net/reservation",
    "@schemaVersion": "1.0",
    "BankCard": {
        "Type": "Visa",
        "Number": "4918914107195005",
        "NameOnCard": "Juan Dela Cruz",
        "ExpirationDate": {
            "Month": "07",
            "Year": "2020"
        },
        "IssueNumber": "2"
    }
}

{
    "@xmlns": "http://www.pcibooking.net/reservation",
    "@schemaVersion": "1.0",
    "BankCard": {
        "Type": "Visa",
        "Number": "4918914107195005",
        "NameOnCard": "Juan Dela Cruz",
        "ExpirationDate": {
            "Month": "07",
            "Year": "2020"
        },
        "IssueNumber": "2",
        "CVV": "123"
    }
}

Empty response body.
Authentication failed: the API key, session token or access token is missing or was not accepted.
See "Authentication and Permission Failures" on the Error Handling page.

GET

api

payments

paycard

{cardToken}

const response = await fetch(
  'https://service.pcibooking.net/api/payments/paycard/2821a46d80e14d1b96a7f18f1b81926d?retrieveCVV=yes',
  {
    headers: {
      'Authorization': 'APIKEY your-api-key'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://service.pcibooking.net/api/payments/paycard/2821a46d80e14d1b96a7f18f1b81926d',
    headers={'Authorization': 'APIKEY your-api-key'},
    params={'retrieveCVV': 'yes'}
)

print(response.json())

{
    "@xmlns": "http://www.pcibooking.net/reservation",
    "@schemaVersion": "1.0",
    "BankCard": {
        "Type": "Visa",
        "Number": "4918914107195005",
        "NameOnCard": "Juan Dela Cruz",
        "ExpirationDate": {
            "Month": "07",
            "Year": "2020"
        },
        "IssueNumber": "2"
    }
}

{
    "@xmlns": "http://www.pcibooking.net/reservation",
    "@schemaVersion": "1.0",
    "BankCard": {
        "Type": "Visa",
        "Number": "4918914107195005",
        "NameOnCard": "Juan Dela Cruz",
        "ExpirationDate": {
            "Month": "07",
            "Year": "2020"
        },
        "IssueNumber": "2",
        "CVV": "123"
    }
}

Empty response body.
Authentication failed: the API key, session token or access token is missing or was not accepted.
See "Authentication and Permission Failures" on the Error Handling page.

Query & Retrieve Guide

Search for tokens and retrieve their metadata

Please note that the response to this method will be the full and unmasked card details. Processing this response will put the system, network and all connected components into PCI scope. Before using this method, we recommend that you review the need for using it and setting up the proper environment to run it in.

Retrieves the full, unmasked card number and all associated card details for a token. This endpoint is intended for PCI DSS-compliant environments that need raw card data, such as for manual payment processing or migration to another vault.

Error Responses

Code	HTTP Status	Condition
-1003	401	The token does not exist, was deleted, or you are not the owner and not associated with it. See Token Not Found or Not Accessible.

Error detail

Each condition below gives the exact moreInfo text, why it happens and how to resolve it. The full set is on the Error Handling page.

-1003 You are not authorized to access this resource - token does not exist, was deleted, or is not yours

HTTP status: 401message: You are not authorized to access this resource. Please contact customer support.moreInfo: one of the following, depending on which check failed:

User is not the owner of this bank card
Merchant or Owner are not associated with bank card [<token>] userID: <userId>
User <userId> is not associated with bank card [<token>]
User <userId> cannot delegate token <token> - not owner and lacks delegation rights
User is not authorized to handle bank cards

Reason. The credential authenticated fine, but it cannot act on the token in the request. Either the token does not exist or it is not yours to use. The generic wording makes this the single most misread error in the API. On a token call it is far more often one of the causes below than an actual permissions problem.How to resolve.

Check the token still exists. This is the most common cause. On every token endpoint except Delete Token, a token that does not exist or was deleted returns this error, the same as a token that belongs to another account. See Token Not Found or Not Accessible.
Check the tokenization actually succeeded. If the call that should have created the token failed, the token never existed, and calls that use it report -1003.
Check the environment. A sandbox token cannot be used from production, or the reverse.
Check ownership and association. See the rules below.

Ownership and association.A token is owned by the account that created it. Another account can use the token only if the token was explicitly associated with it:

At tokenization, by passing merchantId on the tokenizing call.
After tokenization, by associating the token with the merchant.

Two rules catch people out:

An association can only target a primary account. If you pass the ID of a sub-user or a secondary property, the request is rejected and you must associate the token with the parent account instead.
Tokens never cross environments. A token created in sandbox cannot be used from production, and the reverse is also true.

Account level blocks.An account that has exceeded its processing allowance is blocked, and every billable API call from it then fails with HTTP 403 and code -1003, even though the credentials are still valid and can still sign in to the portal. In this response message is empty (null) and moreInfo holds only the generic -1003 text, so nothing in the body explains the block. The 403 status is what tells it apart from a token that is not accessible, which returns 401.This is a common cause on sandbox accounts, which have a lower allowance than production.Check for it when a 403 with -1003 appears suddenly across calls that used to work, on more than one token. A block affects every billable call on the account at once, whereas a genuine ownership problem affects only the specific token. Contact support with your account name to have the allowance reviewed and the block lifted.

-160 Uri not found - wrong operation for this kind of record

HTTP status: 404message: Uri not foundmoreInfo:

Resource not matching request
Resource not matching request. Cannot update a paycard
Resource not matching request. Cannot retrieve a paycard

Reason. The token exists, but it does not hold the kind of record this endpoint works on. The usual case is calling a card operation against a token that holds payment information rather than a card, or calling a card entry operation against a token created by a different capture type.How to resolve.

Check which endpoint created the token, and use the matching endpoint to read or update it.
For a card captured through a hosted form, use the retrieval endpoint for that capture type.

Parameter Constraints

Parameter	Type	Required	Constraints
cardToken	string	Yes	Must be a 32-character hexadecimal string
retrieveCVV	string	No	Accepts `yes`, `no`, or `mask`. Defaults to `no` (CVV not returned)
Auth	string	Yes	ApiKey with `CanReplaceToken` or `CanRetrieveCard` permission

Parameters

Headers

string

required

Your API key prefixed with APIKEY. Example: APIKEY your-api-key. See the Authentication guide.

Path Parameters

string

required

The token ID as returned by one of the tokenization methods. For example, 2821a46d80e14d1b96a7f18f1b81926d.

Query String

string

default:"no"

Specifies how the CVV should be handled in the response: Yes: the CVV will be retrieved. No: the CVV will not be retrieved. Mask: the CVV will return masked.

const response = await fetch(
  'https://service.pcibooking.net/api/payments/paycard/2821a46d80e14d1b96a7f18f1b81926d?retrieveCVV=yes',
  {
    headers: {
      'Authorization': 'APIKEY your-api-key'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://service.pcibooking.net/api/payments/paycard/2821a46d80e14d1b96a7f18f1b81926d',
    headers={'Authorization': 'APIKEY your-api-key'},
    params={'retrieveCVV': 'yes'}
)

print(response.json())

Response

{
    "@xmlns": "http://www.pcibooking.net/reservation",
    "@schemaVersion": "1.0",
    "BankCard": {
        "Type": "Visa",
        "Number": "4918914107195005",
        "NameOnCard": "Juan Dela Cruz",
        "ExpirationDate": {
            "Month": "07",
            "Year": "2020"
        },
        "IssueNumber": "2"
    }
}

{
    "@xmlns": "http://www.pcibooking.net/reservation",
    "@schemaVersion": "1.0",
    "BankCard": {
        "Type": "Visa",
        "Number": "4918914107195005",
        "NameOnCard": "Juan Dela Cruz",
        "ExpirationDate": {
            "Month": "07",
            "Year": "2020"
        },
        "IssueNumber": "2",
        "CVV": "123"
    }
}

Empty response body.
Authentication failed: the API key, session token or access token is missing or was not accepted.
See "Authentication and Permission Failures" on the Error Handling page.

Start Here

Authentication & General

Capture Cards

Manage Tokens

Use Tokens

Additional Functions

Payments Library

Retrieve Card Details

Query & Retrieve Guide

Error Responses

Error detail

Parameter Constraints

Parameters

Headers

Path Parameters

Query String

Response

Query & Retrieve Guide

​Error Responses

​Error detail

​Parameter Constraints

​Parameters

​Headers

​Path Parameters

​Query String

​Response

Error Responses

Error detail

Parameter Constraints

Parameters

Headers

Path Parameters

Query String

Response