Skip to main content
POST

Authorizations

​
Authorization
string
header
required

JWT bearer token obtained via the OAuth2 client-credentials grant from the platform Authentication API. The token's scopes gate the endpoints it may call, and its audience names the Guardian instance. This is the standard way to authenticate to Guardian.

Body

application/json
​
source
From Session · object
required

Where the PCI token is created from. type selects the variant.

​
expires_in
integer

How many seconds after creation the token expires automatically.

Required range: 1 <= x <= 2592000
Example:

3600

​
metadata
object

Metadata consisting of key-value entries.

  • Maximum 20 key-value pairs.
  • Maximum 20 characters per key.
  • Maximum 80 characters per value.
Example:

Response

Success response

Which variant you get follows the request's source.type, and the two carry no shared tag field — tell them apart by shape.

  • A session source returns the Session object (session_id only); collect the card client-side with it, then read the token back.
  • A pan source returns the Token itself.
​
session_id
string<uuid>
required
Example:

"0f2c8f7e-4d2a-4d1b-9a6e-1c9b2d3e4f50"