This instance couldn't reach its API specification on the last attempt, so this page shows the copy fetched before that. Anything added or changed since then is missing here, and the reference updates itself as soon as the specification is readable again. Last fetched 2026-10-22 22:09 UTC.
The details are validated and stored encrypted, and the response carries the token
identifiers, numeric and card-format, alongside a masked echo of what was stored. Use this
to store a payment method before charging it; to store one while charging it, ask for
tokenization on the transaction instead.
Signed in, you can send this request to your own sandbox merchant from the console
and read the answer.
Sign in to try it.
Example request
Each example below is one request, shown in every language. Choose an example and a language, then replace {{BASE_URL}} with the address of the API you are calling and {{API_KEY}} with your own key.
The request body is a CreateStandaloneTokenRequestDto. See the Request body section below for its fields.
Parameters
Name
In
Type
Description
suppressNullsrequired
query
boolean
If true, omit properties with null values.
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Request body
application/json, required
Field
Type
Description
merchantIdrequired
string (uuid)
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
customerIdrequired
string (uuid)
nullable
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Processor-issued reusable tokens (e.g. TSYS `RequestToken`) captured at auth time
and stored alongside the card. Keyed by processor + processor profile; a repeat sale
prefers a matching token at the rail and falls back to the PAN. An empty list when no
processor token is held.nullable
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Defines the supported token types used in transaction-related models. Also aliased as the
platform's payment-method category (`InitializeContext` imports it as
`PaymentMethodCategory`), which is what the processor-profile pre-filter narrows on.
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Card
A card, keyed or read.
Check
A bank account debited over ACH, or a check.
Cash
Cash, which carries no instrument block of its own.
DigitalWallet
A digital wallet (Apple Pay, Google Pay, Paze), which rides the card networks.
AlternativePayment
An alternative payment method approved inside a provider (PayPal, Venmo, Pay Later, Affirm, Klarna, Afterpay) and presented to the gateway as an approval reference.
Defines the category of a token used in transaction processing.
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Internal
Network
Wallet
idempotencyKeyrequired
string
Optional caller-supplied key that makes this create safe to retry. Send the same key with the
same payment details and the gateway returns the token it already minted instead of minting a
second one, so a timeout or a network retry during a bulk import cannot leave you with two
vault records for one card.
Conditional: When IdempotencyKey is not empty.nullable
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
The internal vault record id of the minted token. Deprecated for external use: charge with
`publicReference` instead.
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
numericTokenrequired
integer (int64)
Legacy numeric form of the token, retained for existing internal callers and back-compat.
Not the preferred external handle: use `publicReference`.nullable
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
cardFormatTokenrequired
string
Legacy card-format (PAN-shaped) form of the token, retained for existing internal callers and
back-compat. Not the preferred external handle: use `publicReference`.nullable
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
publicReferencerequired
string
The chargeable public reference of the minted token (the opaque `pt_`-prefixed handle).nullable
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Processor-issued reusable tokens (e.g. TSYS `RequestToken`) captured at auth time
and stored alongside the card. Keyed by processor + processor profile; a repeat sale
prefers a matching token at the rail and falls back to the PAN. An empty list when no
processor token is held.nullable
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Defines the supported token types used in transaction-related models. Also aliased as the
platform's payment-method category (`InitializeContext` imports it as
`PaymentMethodCategory`), which is what the processor-profile pre-filter narrows on.
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Card
A card, keyed or read.
Check
A bank account debited over ACH, or a check.
Cash
Cash, which carries no instrument block of its own.
DigitalWallet
A digital wallet (Apple Pay, Google Pay, Paze), which rides the card networks.
AlternativePayment
An alternative payment method approved inside a provider (PayPal, Venmo, Pay Later, Affirm, Klarna, Afterpay) and presented to the gateway as an approval reference.
What create idempotency did to the request that produced this response.
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
NotRequested
The request carried no idempotencyKey, so there was nothing to deduplicate. A repeat send mints a second token for the same card.
KeyAccepted
The request carried an idempotencyKey and this request claimed it. This is the original create; a repeat send of the same request inside the deduplication window returns this token instead of minting another.
Replayed
The idempotencyKey matched a create that had already produced a token for this merchant and credential, so nothing was minted. The response body is that original token exactly as it stands, with its original identifiers and public reference.
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
This response has no documented body fields.
defaultThe request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. The error reference lists the values `error.code` can take.The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. The error reference lists the values `error.code` can take.
Values:Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
This response has no documented body fields.
429The request was refused because a rate limit was exceeded, or because something a later retry can clear stopped it. A rate limit refusal carries an `application/problem+json` body: wait at least the interval `Retry-After` names before retrying, then back off. Limits are tuned per deployment, so read the allowance from the response headers rather than assuming a fixed ceiling. Any other refusal carries the standard error envelope as `application/json`, and its `error.code` names the cause.