> ## Documentation Index
> Fetch the complete documentation index at: https://nextgen-docs.enfuce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Activate token by its card scheme's unique reference

> Activates an inactive token (for example, completing the “orange flow” where cardholder needs
to activate a token after provisioning).




## OpenAPI

````yaml json-files/wallet.openapi.json post /v1/wallet/tokens/{id}/activate
openapi: 3.0.3
info:
  description: >
    Wallet API enables getting needed data for tokenization and enablement in
    programs like

    Apple Pay and Google Pay.


    #### Terms used

    <table>
      <tr>
        <th>Term</th>
        <th>Definition</th>
      <tr>
        <td>Customer</td>
        <td>End customer using financial institution's mobile application</td>
      </tr>
      <tr>
        <td>In-app activation</td>
        <td>Wallet provisioning using financial institution app as authentication method</td>
      </tr>
      <tr>
        <td>In-app provisioning</td>
        <td>Mastercard's term for push provisioning</td>
      </tr>
      <tr>
        <td>Push provisioning</td>
        <td>VISA's term for pushing card details from within mobile application. This term will be used in this document</td>
      </tr>
      <tr>
        <td>Wallet provider</td>
        <td>Such as Apple Pay, Google Pay or Samsung Pay </td>
      </tr>
    </table>


    It's called in two cases:

    - *Push provisioning* - this is usually done within issuers own application
    and card holder does

    not need to enter any information. Then the different endpoints for push
    provisioning must be used.

    - *In-app activation* - activating a card by manually adding information,
    then endpoint for generate activation

    data must be used after authentication of end customer is completed.


    ![ Provisioning example
    ](https://enfuce-public-resources.s3.eu-central-1.amazonaws.com/public/wallet_push_prov.svg)


    In above case the difference between push provisioning and in-app activation
    is which endpoint that is

    called in step 3.

    Note that diagram above is a simplification of full flow in order to explain
    it from a developer point of view.
  version: '1'
  title: Wallet operations
  contact:
    name: Enfuce Financial Services
    url: https://enfuce.com
    email: info@enfuce.com
  x-logo:
    url: https://developer.enfuce.com/images/enfuce.svg
    altText: Enfuce logo
servers:
  - url: https://api.{{tenant}}.ext-uat1-sandbox.mycore.enfuce.com/issuer
    description: UAT Sandbox
  - url: https://api.{{tenant}}.eu.live.prod.mycore.enfuce.com/issuer
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Push Provision
  - name: Activate token
  - name: Get tokens
paths:
  /v1/wallet/tokens/{id}/activate:
    post:
      tags:
        - Activate token
      summary: Activate token by its card scheme's unique reference
      description: >
        Activates an inactive token (for example, completing the “orange flow”
        where cardholder needs

        to activate a token after provisioning).
      operationId: activateToken
      parameters:
        - name: id
          in: path
          description: Token unique reference ID identifying the token to activate.
          required: true
          schema:
            $ref: '#/components/schemas/TokenUniqueReferenceId'
        - in: header
          name: x-idempotency-key
          required: false
          schema:
            type: string
            description: Idempotency key for the request
        - $ref: '#/components/parameters/x-audit-user'
      responses:
        '200':
          description: Token activated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResourceResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          description: >
            Token activation failed due to status conflict. The token's current
            state does not permit this operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          $ref: '#/components/responses/InternalServerError'
components:
  schemas:
    TokenUniqueReferenceId:
      type: string
      description: >
        A unique identifier for the token assigned by the Token Service Provider
        (TSP) (eg. Visa or MC)

        to manage the lifecycle of the token.
      minLength: 1
      maxLength: 64
      pattern: ^[A-Za-z0-9_-]+$
      example: DWSPMC00000000010906a349d9ca4eb1a4d53e3c90a11d9c
    ResourceResponse:
      type: object
      properties:
        description:
          type: string
          description: A description of the result of the action
        id:
          allOf:
            - $ref: '#/components/schemas/TokenUniqueReferenceId'
          description: Token Unique Reference ID
    ErrorResponse:
      type: object
      properties:
        type:
          description: The problem type.
          type: string
        title:
          description: The reason phrase of HttpStatus.
          type: string
        status:
          description: HTTP problem status.
          type: number
        detail:
          description: The problem detail.
          type: string
        instance:
          description: The request path.
          type: string
        id:
          description: Unique error identifier.
          type: string
          format: uuid
        timestamp:
          description: Date-time when error occurred.
          type: string
          format: date-time
  parameters:
    x-audit-user:
      in: header
      name: x-audit-user
      required: false
      description: Optional audit user header
      schema:
        type: string
  responses:
    BadRequest:
      description: Bad request
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            type: about:blank
            title: Bad Request
            status: 400
            detail: 'JSON parse error: Unexpected character...'
            instance: /v1/cards
            id: 5cc541cb-f456-4331-b537-d2380fca0400
            timestamp: '2026-02-24T12:34:56Z'
    Unauthorized:
      description: Unauthorized
    Forbidden:
      description: Forbidden
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            type: about:blank
            title: Forbidden
            status: 403
            detail: Access Denied
            instance: /v1/cards
            id: 5cc541cb-f456-4331-b537-d2380fca0403
            timestamp: '2026-02-24T12:34:56Z'
    NotFound:
      description: Not found
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            type: about:blank
            title: Not Found
            status: 404
            detail: >-
              Entity not found - Program with id:
              2ec117b7-454e-4cc5-8b89-dea5485aab2b
            instance: /v1/cards
            id: 5cc541cb-f456-4331-b537-d2380fca0404
            timestamp: '2026-02-24T12:34:56Z'
    InternalServerError:
      description: Internal server error
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            type: about:blank
            title: Internal Server Error
            status: 500
            detail: Unexpected error occurred.
            instance: /v1/cards
            id: 5cc541cb-f456-4331-b537-d2380fca0500
            timestamp: '2026-02-24T12:34:56Z'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT

````