CyberSource Tokenize API
An orchestration resource used to combine multiple API calls into a single request.
OpenAPI Specification
swagger: '2.0'
info:
description: All CyberSource API specs merged together. These are available at https://developer.cybersource.com/api/reference/api-reference.html
version: 0.0.1
title: CyberSource Merged Spec bankAccountValidation Tokenize API
host: apitest.cybersource.com
basePath: /
schemes:
- https
consumes:
- application/json;charset=utf-8
produces:
- application/hal+json;charset=utf-8
tags:
- name: Tokenize
description: 'An orchestration resource used to combine multiple API calls into a single request.
'
paths:
/tms/v2/tokenize:
post:
summary: Tokenize
description: "| | | | \n| --- | --- | --- |\n|The **Tokenize API** endpoint facilitates the creation of various TMS tokens such as Customers, Payment Instruments, Shipping Addresses, and Instrument Identifiers in a single operation. The request includes a processingInformation object, which specifies **\"TOKEN_CREATE\"** and the types of tokens to be created. The **tokenInformation** section of the request includes detailed information relevant to each token type. This includes attributes for Customers, Payment Instruments, Shipping Addresses, Instrument Identifiers and Transient Token data. The payload is flexible, allowing for different combinations of tokens to be created in a single request.| |The **API response** includes a responses array, which details the outcome of the tokenization process for each requested resource type, such as Customer, Payment Instrument, Shipping Address, and Instrument Identifier. Each entry in this array provides an HTTP status code such as **201/200 for successful creations**, and a unique identifier for the newly created token.<br>In cases where token creation encounters issues, the response includes a **non-2XX** status code and an errors array for the affected resource. Each error object in the array details the **error type and a descriptive message** providing insight into why a particular token creation was not attempted or failed.\n"
parameters:
- name: profile-id
in: header
description: The Id of a profile containing user specific TMS configuration.
required: false
type: string
minLength: 36
maxLength: 36
x-hide-field: true
- name: postTokenizeRequest
in: body
required: true
schema:
type: object
properties:
processingInformation:
type: object
properties:
actionList:
type: array
description: "Array of actions (one or more) to be included in the tokenize request.\n\nPossible Values:\n - `TOKEN_CREATE`: Use this when you want to create a token from the card/bank data in your tokenize request.\n"
items:
type: string
example:
- TOKEN_CREATE
actionTokenTypes:
type: array
description: 'TMS tokens types you want to perform the action on.
Possible Values:
- customer
- paymentInstrument
- instrumentIdentifier
- shippingAddress
- tokenizedCard
'
items:
type: string
example:
- customer
- paymentInstrument
- shippingAddress
- instrumentIdentifier
tokenInformation:
type: object
properties:
jti:
type: string
maxLength: 64
description: 'TMS Transient Token, 64 hexadecimal id value representing captured payment credentials (including Sensitive Authentication Data, e.g. CVV).
'
transientTokenJwt:
type: string
description: 'Flex API Transient Token encoded as JWT (JSON Web Token), e.g. Flex microform or Unified Payment checkout result.
'
customer:
type: object
properties:
_links:
type: object
readOnly: true
properties:
self:
type: object
readOnly: true
properties:
href:
type: string
readOnly: true
description: 'Link to the Customer.
'
example: /tms/v2/customers/D9F340DD3DB9C276E053A2598D0A41A3
paymentInstruments:
type: object
readOnly: true
properties:
href:
type: string
readOnly: true
description: 'Link to the Customers Payment Instruments.
'
example: /tms/v2/customers/D9F340DD3DB9C276E053A2598D0A41A3/payment-instruments
shippingAddress:
type: object
readOnly: true
properties:
href:
type: string
readOnly: true
description: 'Link to the Customers Shipping Addresses.
'
example: /tms/v2/customers/D9F340DD3DB9C276E053A2598D0A41A3/shipping-addresses
id:
type: string
minLength: 1
maxLength: 32
description: The Id of the Customer Token.
objectInformation:
type: object
properties:
title:
type: string
description: 'Name or title of the customer.
'
maxLength: 60
comment:
type: string
description: 'Comments that you can make about the customer.
'
maxLength: 150
buyerInformation:
type: object
properties:
merchantCustomerID:
type: string
description: 'Your identifier for the customer.
'
maxLength: 100
email:
type: string
maxLength: 255
description: 'Customer''s primary email address, including the full domain name.
'
clientReferenceInformation:
type: object
properties:
code:
type: string
description: 'Client-generated order reference or tracking number.
'
maxLength: 50
merchantDefinedInformation:
type: array
description: 'Object containing the custom data that the merchant defines.
'
items:
type: object
properties:
name:
type: string
description: 'The number you assign as the name for your merchant-defined data or secure field. Possible Values are data1 to data4 and sensitive1 to sensitive4
For example, to set the name for merchant-defined data 2 field, you would reference merchantDefinedInformation[x].name as data2
Possible Values:
- data1
- data2
- data3
- data4
- sensitive1
- sensitive2
- sensitive3
- sensitive4
'
value:
type: string
description: 'The value you assign for your merchant-defined data field.
**Warning** Merchant-defined data fields are not intended to and must not be used to capture personally identifying information. Accordingly, merchants are prohibited from capturing, obtaining, and/or transmitting any personally identifying information in or via the merchant-defined data fields. Personally identifying information includes, but is not
limited to, address, credit card number, social security number, driver''s license number, state-issued identification number, passport number, and card verification numbers (CVV,
CVC2, CVV2, CID, CVN). In the event it is discovered a merchant is capturing and/or transmitting personally identifying information via the merchant-defined data fields, whether or not intentionally, the merchant''s account will immediately be suspended, which will result in a rejection of any and all transaction requests submitted by the merchant after the point of suspension.
'
maxLength: 100
defaultPaymentInstrument:
type: object
properties:
id:
type: string
description: 'The Id of the Customers default Payment Instrument
'
defaultShippingAddress:
type: object
properties:
id:
type: string
description: 'The Id of the Customers default Shipping Address
'
metadata:
type: object
readOnly: true
properties:
creator:
type: string
readOnly: true
description: 'The creator of the Customer.
'
_embedded:
type: object
readOnly: true
description: 'Additional resources for the Customer.
'
properties:
defaultPaymentInstrument:
readOnly: true
type: object
properties:
_links:
type: object
readOnly: true
properties:
self:
type: object
readOnly: true
properties:
href:
type: string
readOnly: true
description: 'Link to the Payment Instrument.
'
example: /tms/v2/customers/D9F340DD3DB9C276E053A2598D0A41A3/payment-instruments
customer:
type: object
readOnly: true
properties:
href:
type: string
readOnly: true
description: 'Link to the Customer.
'
example: /tms/v2/customers/D9F340DD3DB9C276E053A2598D0A41A3
id:
type: string
minLength: 1
maxLength: 32
description: The Id of the Payment Instrument Token.
object:
type: string
readOnly: true
example: paymentInstrument
description: 'The type.
Possible Values:
- paymentInstrument
'
default:
type: boolean
description: "Flag that indicates whether customer payment instrument is the dafault.\nPossible Values:\n - `true`: Payment instrument is customer's default.\n - `false`: Payment instrument is not customer's default.\n"
state:
type: string
readOnly: true
example: ACTIVE
description: 'Issuers state for the card number.
Possible Values:
- ACTIVE
- CLOSED : The account has been closed.
'
type:
type: string
readOnly: true
description: 'The type of Payment Instrument.
Possible Values:
- cardHash
'
bankAccount:
type: object
properties:
type:
type: string
maxLength: 18
description: "Account type.\n\nPossible Values:\n - checking : C\n - general ledger : G This value is supported only on Wells Fargo ACH\n - savings : S (U.S. dollars only)\n - corporate checking : X (U.S. dollars only)\n"
card:
type: object
properties:
expirationMonth:
type: string
maxLength: 2
description: 'Two-digit month in which the payment card expires.
Format: `MM`.
Possible Values: `01` through `12`.
'
expirationYear:
type: string
maxLength: 4
description: 'Four-digit year in which the credit card expires.
Format: `YYYY`.
'
type:
type: string
description: "Value that indicates the card type. Possible Values v2 : v1:\n * 001 : visa\n * 002 : mastercard - Eurocard—European regional brand of Mastercard\n * 003 : american express\n * 004 : discover\n * 005 : diners club\n * 006 : carte blanche\n * 007 : jcb\n * 008 : optima\n * 011 : twinpay credit\n * 012 : twinpay debit\n * 013 : walmart\n * 014 : enRoute\n * 015 : lowes consumer\n * 016 : home depot consumer\n * 017 : mbna\n * 018 : dicks sportswear\n * 019 : casual corner\n * 020 : sears\n * 021 : jal\n * 023 : disney\n * 024 : maestro uk domestic\n * 025 : sams club consumer\n * 026 : sams club business\n * 028 : bill me later\n * 029 : bebe\n * 030 : restoration hardware\n * 031 : delta online — use this value only for Ingenico ePayments. For other processors, use 001 for all Visa card types.\n * 032 : solo\n * 033 : visa electron\n * 034 : dankort\n * 035 : laser\n * 036 : carte bleue — formerly Cartes Bancaires\n * 037 : carta si\n * 038 : pinless debit\n * 039 : encoded account\n * 040 : uatp\n * 041 : household\n * 042 : maestro international\n * 043 : ge money uk\n * 044 : korean cards\n * 045 : style\n * 046 : jcrew\n * 047 : payease china processing ewallet\n * 048 : payease china processing bank transfer\n * 049 : meijer private label\n * 050 : hipercard — supported only by the Comercio Latino processor.\n * 051 : aura — supported only by the Comercio Latino processor.\n * 052 : redecard\n * 054 : elo — supported only by the Comercio Latino processor.\n * 055 : capital one private label\n * 056 : synchrony private label\n * 057 : costco private label\n * 060 : mada\n * 062 : china union pay\n * 063 : falabella private label\n"
issueNumber:
type: string
maxLength: 2
description: 'Number of times a Maestro (UK Domestic) card has been issued to the account holder. The card might or might not have an issue number. The number can consist of one or two digits, and the first digit might be a zero. When you include this value in your request, include exactly what is printed on the card. A value of 2 is different than a value of 02. Do not include the field, even with a blank value, if the card is not a Maestro (UK Domestic) card.
**Note** The issue number is not required for Maestro (UK Domestic) transactions.
'
startMonth:
type: string
maxLength: 2
description: 'Month of the start of the Maestro (UK Domestic) card validity period. Do not include the field, even with a blank value, if the card is not a Maestro (UK Domestic) card. `Format: MM`.
Possible Values: 01 through 12.
**Note** The start date is not required for Maestro (UK Domestic) transactions.
'
startYear:
type: string
maxLength: 4
description: 'Year of the start of the Maestro (UK Domestic) card validity period. Do not include the field, even with a blank value, if the card is not a Maestro (UK Domestic) card. `Format: YYYY`.
**Note** The start date is not required for Maestro (UK Domestic) transactions.
'
useAs:
type: string
example: pinless debit
description: '''Payment Instrument was created / updated as part of a pinless debit transaction.''
'
hash:
type: string
minLength: 32
maxLength: 34
readOnly: true
description: 'Hash value representing the card.
'
tokenizedInformation:
type: object
properties:
requestorID:
type: string
maxLength: 11
description: 'Value that identifies your business and indicates that the cardholder''s account number is tokenized. This value
is assigned by the token service provider and is unique within the token service provider''s database.
**Note** This field is supported only through **VisaNet** and **FDC Nashville Global**.
'
transactionType:
type: string
maxLength: 1
description: 'Type of transaction that provided the token data. This value does not specify the token service provider; it
specifies the entity that provided you with information about the token.
Set the value for this field to 1. An application on the customer''s mobile device provided the token data.
'
buyerInformation:
type: object
properties:
companyTaxID:
type: string
maxLength: 9
description: 'Company''s tax identifier. This is only used for eCheck service.
'
currency:
type: string
maxLength: 3
description: 'Currency used for the order. Use the three-character I[ISO Standard Currency Codes.](http://apps.cybersource.com/library/documentation/sbc/quickref/currencies.pdf)
For an authorization reversal (`reversalInformation`) or a capture (`processingOptions.capture` is set to `true`), you must use the same currency that you used in your payment authorization request.
#### DCC for First Data
Your local currency. For details, see the `currency` field description in [Dynamic Currency Conversion For First Data Using the SCMP API](http://apps.cybersource.com/library/documentation/dev_guides/DCC_FirstData_SCMP/DCC_FirstData_SCMP_API.pdf).
# For details about currency as used in partial authorizations, see "Features for Debit Cards and Prepaid Cards" in the [Credit Card Services Using the SCMP API Guide](https://apps.cybersource.com/library/documentation/dev_guides/CC_Svcs_SCMP_API/html/)
'
dateOfBirth:
type: string
format: date
example: '1960-12-30'
description: 'Date of birth of the customer. Format: YYYY-MM-DD
'
personalIdentification:
type: array
items:
type: object
properties:
id:
type: string
maxLength: 26
description: 'The value of the identification type.
'
type:
type: string
description: "The type of the identification.\n\nPossible Values:\n - driver license\n"
issuedBy:
type: object
properties:
administrativeArea:
type: string
description: 'The State or province where the customer''s driver''s license was issued.
Use the two-character State, Province, and Territory Codes for the United States and Canada.
'
maxLength: 20
billTo:
type: object
properties:
firstName:
type: string
maxLength: 60
description: 'Customer''s first name. This name must be the same as the name on the card.
'
lastName:
type: string
maxLength: 60
description: 'Customer''s last name. This name must be the same as the name on the card.
'
company:
type: string
maxLength: 60
description: 'Name of the customer''s company.
'
address1:
type: string
maxLength: 60
description: 'Payment card billing street address as it appears on the credit card issuer''s records.
'
address2:
type: string
maxLength: 60
description: 'Additional address information.
'
locality:
type: string
maxLength: 50
description: 'Payment card billing city.
'
administrativeArea:
type: string
maxLength: 20
description: 'State or province of the billing address. Use the State, Province, and Territory Codes for the United States
and Canada.
'
postalCode:
type: string
maxLength: 10
description: 'Postal code for the billing address. The postal code must consist of 5 to 9 digits.
When the billing country is the U.S., the 9-digit postal code must follow this format:
[5 digits][dash][4 digits]
**Example** `12345-6789`
When the billing country is Canada, the 6-digit postal code must follow this format:
[alpha][numeric][alpha][space][numeric][alpha][numeric]
**Example** `A1B 2C3`
'
country:
type: string
maxLength: 2
description: 'Payment card billing country. Use the two-character ISO Standard Country Codes.
'
email:
type: string
maxLength: 255
description: 'Customer''s email address, including the full domain name.
'
phoneNumber:
type: string
maxLength: 15
description: 'Customer''s phone number.
'
processingInformation:
type: object
title: tmsPaymentInstrumentProcessingInfo
properties:
billPaymentProgramEnabled:
type: boolean
description: 'Flag that indicates that this is a payment for a bill or for an existing contractual loan.
Possible Values:
- `true`: Bill payment or loan payment.
- `false` (default): Not a bill payment or loan payment.
# For processor-specific details, see the `bill_payment` field description in [Credit Card Services Using the SCMP API.](https://apps.cybersource.com/library/documentation/dev_guides/CC_Svcs_SCMP_API/html/)
'
bankTransferOptions:
type: object
properties:
SECCode:
type: string
maxLength: 3
description: 'Specifies the authorization method for the transaction.
#### TeleCheck
Possible Values:
- `ARC`: account receivable conversion
- `CCD`: corporate cash disbursement
- `POP`: point of purchase conversion
- `PPD`: prearranged payment and deposit entry
- `TEL`: telephone-initiated entry
- `WEB`: internet-initiated entry
# For details, see `ecp_sec_code` field description in the [Electronic Check Services Using the SCMP API Guide.](https://apps.cybersource.com/library/documentation/dev_guides/EChecks_SCMP_API/html/)
'
merchantInformation:
type: object
title: TmsMerchantInformation
properties:
merchantDescriptor:
type: object
properties:
alternateName:
type: string
description: 'Alternate contact information for your business,such as an email address or URL.
This value might be displayed on the cardholder''s statement.
When you do not include this value in your capture or credit request, the merchant URL from your CyberSource account is used.
Important This value must consist of English characters
'
maxLength: 13
instrumentIdentifier:
type: object
properties:
id:
type: string
minLength: 12
maxLength: 32
description: 'The Id of the Instrument Identifier linked to the Payment Instrument.
'
metadata:
type: object
readOnly: true
properties:
# --- truncated at 32 KB (320 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cybersource/refs/heads/main/openapi/cybersource-tokenize-api-openapi.yml