View as Markdown

llms.txt

The API reference isn't available right now

This instance couldn't load its API specification. The reference returns as soon as the specification is readable again.

Back to the API reference

No such operation

This instance documents no operation under that identifier. It may have been renamed, or it may belong to a feature this installation hasn't enabled.

Back to the API reference

This reference may be out of date

This instance couldn't reach its API specification on the last attempt, so this page shows the copy fetched before that. Anything added or changed since then is missing here, and the reference updates itself as soon as the specification is readable again. Last fetched 2026-10-22 22:09 UTC.

API reference Tokens

Deactivates a payment token.

POST /api/tokens/deactivate-async deprecated

No permission required.

The record is kept, for audit and for the transactions that reference it, but later attempts to charge against the token are refused. Reactivate reverses this.

Signed in, you can send this request to your own sandbox merchant from the console and read the answer. Sign in to try it.

Example request

Every block below sends the same request. Replace {{BASE_URL}} with the address of the API you are calling and {{API_KEY}} with your own key.

The request body is a . See the Request body section below for its fields.

Code sample language

cURL

curl -X POST "{{BASE_URL}}/api/tokens/deactivate-async" \
  -H "api-key: {{API_KEY}}"

PowerShell

$headers = @{
    'api-key' = '{{API_KEY}}'
}

$response = Invoke-RestMethod -Method POST -Uri '{{BASE_URL}}/api/tokens/deactivate-async' `
    -Headers $headers

npm install @winkpg/winkpg-api

TypeScript (SDK)

import { Configuration, TokensApi } from '@winkpg/winkpg-api';

const api = new TokensApi(new Configuration({
  basePath: '{{BASE_URL}}',
  apiKey: '{{API_KEY}}',
}));

const { data } = await api.tokensDeactivate();

TypeScript (raw HTTP)

const response = await fetch('{{BASE_URL}}/api/tokens/deactivate-async', {
  method: 'POST',
  headers: {
    "api-key": "{{API_KEY}}",
  },
});

const data = await response.json();

dotnet add package WinkPg.Api.Client

C# (SDK)

using WinkPg.Api.Client.Api;
using WinkPg.Api.Client.Client;

var config = new Configuration { BasePath = "{{BASE_URL}}" };
config.AddApiKey("api-key", "{{API_KEY}}");

var api = new TokensApi(config);
var result = await api.TokensDeactivateAsync();

C# (raw HTTP)

using var http = new HttpClient { BaseAddress = new Uri("{{BASE_URL}}") };

var request = new HttpRequestMessage(new HttpMethod("POST"), "/api/tokens/deactivate-async");
request.Headers.Add("api-key", "{{API_KEY}}");

var response = await http.SendAsync(request);
response.EnsureSuccessStatusCode();
var json = await response.Content.ReadAsStringAsync();

pip install winkpg-api

Python (SDK)

import winkpg_api

configuration = winkpg_api.Configuration(host="{{BASE_URL}}")
configuration.api_key["ApiKey"] = "{{API_KEY}}"

with winkpg_api.ApiClient(configuration) as client:
    api = winkpg_api.TokensApi(client)
    result = api.tokens_deactivate()

pip install requests

Python (raw HTTP)

import requests

headers = {
    "api-key": "{{API_KEY}}",
}

response = requests.request(
    "POST",
    "{{BASE_URL}}/api/tokens/deactivate-async",
    headers=headers,
)
response.raise_for_status()
data = response.json()

Parameters

Name In Type Description
id required query string (uuid) The token to deactivate.
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
suppressNulls required query boolean If true, omit properties with null values.
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

Request body

application/json , required

Field Type Description

This request body has no documented fields.

Responses

200 OK

Body: PaymentTokenDto PaymentTokenDto Each item has these fields.

Field Type Description
extraProperties required object nullableread only
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
id required string (uuid)
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
creationTime required string (date-time) The date and time when this entity was created.
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
creatorId required string (uuid) The ID of the user who created this entity. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
lastModificationTime required string (date-time) The date and time when this entity was last modified. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
lastModifierId required string (uuid) The ID of the user who last modified this entity. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
isDeleted required boolean Indicates whether this entity has been deleted.
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
deleterId required string (uuid) The ID of the user who deleted this entity, if it is deleted. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
deletionTime required string (date-time) The date and time when this entity was deleted, if it is deleted. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
tenantId required string (uuid) Id of the related tenant. nullableread only
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
concurrencyStamp required string nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
numericToken required integer (int64) The numeric representation of the token. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
cardFormatToken required string The card format representation of the token. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
transactionId required string (uuid) The unique identifier of the associated transaction when the token was created. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
paymentDetails required PaymentDetailSnapshot PaymentDetailSnapshot The payment details snapshot associated with this token.
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

Fields of PaymentDetailSnapshot:

Field Type Description
cardData required CardData CardData Conditional: When CardData is not null.
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
checkData required CheckData CheckData Conditional: When CheckData is not null.
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
tokenData required TokenData TokenData Conditional: When TokenData is not null.
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
processorTokens required array of StoredProcessorToken array of StoredProcessorToken Processor-issued reusable tokens (e.g. TSYS `RequestToken`) captured at auth time and stored alongside the card. Keyed by processor + processor profile; a repeat sale prefers a matching token at the rail and falls back to the PAN. An empty list when no processor token is held. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
networkToken required StoredNetworkToken StoredNetworkToken A stored network token (DPAN) for this payment method. Not populated: network-token acquisition is not yet supported, so this is always absent.
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
paymentMethodType required TokenPaymentMethodType TokenPaymentMethodType read only
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Unknown Not classified.
Card A card, keyed or read.
Check A bank account debited over ACH, or a check.
DigitalWallet A digital wallet (Apple Pay, Google Pay, Paze), which rides the card networks.
AlternativePayment An alternative payment method approved inside a provider and presented as an approval reference.

This body has no documented fields.

type required TokenType TokenType The underlying payment type of the token.
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Card A card, keyed or read.
Check A bank account debited over ACH, or a check.
Cash Cash, which carries no instrument block of its own.
DigitalWallet A digital wallet (Apple Pay, Google Pay, Paze), which rides the card networks.
AlternativePayment An alternative payment method approved inside a provider (PayPal, Venmo, Pay Later, Affirm, Klarna, Afterpay) and presented to the gateway as an approval reference.
category required TokenCategory TokenCategory The category of the token (e.g., internal, network).
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Internal
Network
Wallet
merchantId required string (uuid) Id of the related Merchant. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
customerId required string (uuid) The customer this stored credential is bound to, or `null` when it is not bound to one. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
tokenSharing required boolean The sharing status of the token.
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
label required string Optional human-readable label for the token. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
status required TokenStatus TokenStatus The status of the token (Active, Inactive, Invalidated).
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Active Token is active and can be used for transactions.
Inactive Token is inactive but can be reactivated.
Invalidated Token has been invalidated and replaced by a new token. Cannot be used for new transactions and cannot be reactivated.
Redacted The vaulted account data has been wiped at the owner's request, leaving an audit shell: the last four, brand, BIN metadata, expiry, customer, merchant and lifecycle history survive, and the card number, cardholder name, bank account / routing / MICR values and any stored processor or network token do not.
invalidatedByTokenId required string (uuid) The ID of the token that replaced this one (if invalidated and regenerated). nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
replacesTokenId required string (uuid) The ID of the token that this token replaced (if this is a regenerated token). nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
regenerationReason required TokenRegenerationReason TokenRegenerationReason The reason for token regeneration (if applicable). nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
Manual Manually initiated by user.
NearExpiration Automated regeneration due to near expiration.
SuspectedCompromise Suspected compromise or security concern.
Other Other reason.
lastRegeneratedAt required string (date-time) The timestamp when this token was last regenerated. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
redactedAt required string (date-time) When the token's stored card or bank account details were erased, or `null` for a token that has not been redacted. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
redactionReason required string The reason recorded when the token's stored details were erased, or `null` for a token that has not been redacted. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.
publicReference required string The stable, opaque `pt_`-prefixed handle for this token: the only token identifier permitted to leave the gateway, and the value to charge against on a merchant-initiated transaction. Distinct from the internal id, which correlates to a card number and is never treated as a merchant-facing handle. nullable
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

403 Forbidden

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description
error required RemoteServiceErrorInfo RemoteServiceErrorInfo
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

401 Unauthorized

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description
error required RemoteServiceErrorInfo RemoteServiceErrorInfo
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

400 Bad Request

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description
error required RemoteServiceErrorInfo RemoteServiceErrorInfo
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

404 Not Found

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description
error required RemoteServiceErrorInfo RemoteServiceErrorInfo
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

501 Not Implemented

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description
error required RemoteServiceErrorInfo RemoteServiceErrorInfo
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

500 Internal Server Error

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description
error required RemoteServiceErrorInfo RemoteServiceErrorInfo
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

default The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. The error reference lists the values `error.code` can take. The request failed. The body carries the standard error envelope: a machine-readable `error.code`, a human-readable `error.message`, and `error.validationErrors` when the failure was a validation rejection. The error reference lists the values `error.code` can take.

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description
error required RemoteServiceErrorInfo RemoteServiceErrorInfo
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

429 The request was refused because a rate limit was exceeded, or because something a later retry can clear stopped it. A rate limit refusal carries an `application/problem+json` body: wait at least the interval `Retry-After` names before retrying, then back off. Limits are tuned per deployment, so read the allowance from the response headers rather than assuming a fixed ceiling. Any other refusal carries the standard error envelope as `application/json`, and its `error.code` names the cause.

Body: RemoteServiceErrorResponse RemoteServiceErrorResponse Each item has these fields.

Field Type Description
error required RemoteServiceErrorInfo RemoteServiceErrorInfo
Values: Values combine: send one or more member names separated by a comma and a space, or the integer sum of their values. Responses carry the names.

This response has no documented body fields.

Errors

A failed request returns the platform error envelope. The error reference lists every value error.code can carry and shows the four response shapes.

Codes declared by

Authentication

    Reconnecting to the server

    Could not reconnect

    This session has ended

    Attempt 1

    Your work on this page is still here. Retrying keeps it; reloading starts the page again.

    The server no longer holds this page's state, so it has to be loaded again.