> ## Documentation Index
> Fetch the complete documentation index at: https://nextgen-docs.enfuce.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Lists tokens for a card
> Returns a list of tokens associated with the specified card ID.
## OpenAPI
````yaml json-files/wallet.openapi.json get /v1/wallet/{cardId}/tokens
openapi: 3.0.3
info:
description: >
Wallet API enables getting needed data for tokenization and enablement in
programs like
Apple Pay and Google Pay.
#### Terms used
| Term |
Definition |
| Customer |
End customer using financial institution's mobile application |
| In-app activation |
Wallet provisioning using financial institution app as authentication method |
| In-app provisioning |
Mastercard's term for push provisioning |
| Push provisioning |
VISA's term for pushing card details from within mobile application. This term will be used in this document |
| Wallet provider |
Such as Apple Pay, Google Pay or Samsung Pay |
It's called in two cases:
- *Push provisioning* - this is usually done within issuers own application
and card holder does
not need to enter any information. Then the different endpoints for push
provisioning must be used.
- *In-app activation* - activating a card by manually adding information,
then endpoint for generate activation
data must be used after authentication of end customer is completed.
In above case the difference between push provisioning and in-app activation
is which endpoint that is
called in step 3.
Note that diagram above is a simplification of full flow in order to explain
it from a developer point of view.
version: '1'
title: Wallet operations
contact:
name: Enfuce Financial Services
url: https://enfuce.com
email: info@enfuce.com
x-logo:
url: https://developer.enfuce.com/images/enfuce.svg
altText: Enfuce logo
servers:
- url: https://api.{{tenant}}.ext-uat1-sandbox.mycore.enfuce.com/issuer
description: UAT Sandbox
- url: https://api.{{tenant}}.eu.live.prod.mycore.enfuce.com/issuer
description: Production
security:
- bearerAuth: []
tags:
- name: Push Provision
- name: Activate token
- name: Get tokens
paths:
/v1/wallet/{cardId}/tokens:
get:
tags:
- Get tokens
summary: Lists tokens for a card
description: |
Returns a list of tokens associated with the specified card ID.
operationId: getTokens
parameters:
- name: cardId
in: path
description: CardId of the card for which tokens are requested.
required: true
schema:
type: string
format: uuid
- name: fetchFromCardScheme
in: query
description: >
If true, tokens will be fetched directly from the
card scheme (e.g., Mastercard, Visa).
If false, tokens will be fetched from the internal
system.
required: false
schema:
type: boolean
default: true
- name: includeCardSchemePayload
in: query
description: >
If true, the response will include the raw payload
from the card scheme for each token (if available).
If false, the card scheme payload will be omitted
from the response.
required: false
schema:
type: boolean
default: false
- $ref: '#/components/parameters/x-audit-user'
responses:
'200':
description: Successful lookup of tokens for given card id.
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/TokenResponse'
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'500':
$ref: '#/components/responses/InternalServerError'
components:
parameters:
x-audit-user:
in: header
name: x-audit-user
required: false
description: Optional audit user header
schema:
type: string
schemas:
TokenResponse:
type: object
description: Represents a digital wallet token.
properties:
tokenUniqueReferenceId:
$ref: '#/components/schemas/TokenUniqueReferenceId'
tokenRequestorId:
$ref: '#/components/schemas/TokenRequestorId'
tokenRequestor:
$ref: '#/components/schemas/TokenRequestor'
status:
$ref: '#/components/schemas/TokenStatus'
tokenSuffix:
$ref: '#/components/schemas/TokenSuffix'
deletedFromConsumerApp:
$ref: '#/components/schemas/DeletedFromConsumerApp'
authorizationDecision:
$ref: '#/components/schemas/AuthorizationDecisionColor'
cardId:
allOf:
- $ref: '#/components/schemas/Id'
description: The id of the card associated with the token.
createdAt:
allOf:
- $ref: '#/components/schemas/Created'
description: The timestamp when the token was created by the TSP.
updatedAt:
allOf:
- $ref: '#/components/schemas/Updated'
description: The timestamp of the most recent update to the token’s status.
updateCount:
$ref: '#/components/schemas/UpdateCount'
cardSchemePayload:
type: string
description: The raw payload from the card scheme, if available.
deviceInfo:
$ref: '#/components/schemas/DeviceInfo'
TokenUniqueReferenceId:
type: string
description: >
A unique identifier for the token assigned by the Token Service Provider
(TSP) (eg. Visa or MC)
to manage the lifecycle of the token.
minLength: 1
maxLength: 64
pattern: ^[A-Za-z0-9_-]+$
example: DWSPMC00000000010906a349d9ca4eb1a4d53e3c90a11d9c
TokenRequestorId:
type: string
description: >-
Identifier used by merchants or wallet providers to request tokens from
the TSP.
example: '212345678'
TokenRequestor:
type: string
enum:
- APPLE_PAY
- GOOGLE_PAY
- SAMSUNG_PAY
- OTHER
example: APPLE_PAY
description: >
Code of the wallet provider or merchant that requested the token
(APPLE_PAY /GOOGLE_PAY/SAMSUNG_PAY/OTHER).
OTHER is used for tokens not linked to a wallet provider, such as
merchant tokens (credential-on-file,
subscription payments) or cloud tokens (e.g., Mastercard APANs).
TokenStatus:
type: string
enum:
- ACTIVE
- DEACTIVATED
- INACTIVE
- SUSPENDED
example: ACTIVE
description: |
Current status of the token:
- ACTIVE - Available for payments
- DEACTIVATED - Permanently deactivated
- INACTIVE - Waiting for activation
- SUSPENDED - Temporarily not available for payments
TokenSuffix:
type: string
description: >-
The last 4 digits of the tokenised PAN (DPAN) used for display and
identification purposes.
example: '7890'
DeletedFromConsumerApp:
type: boolean
description: If the token was deleted from the consumer app
AuthorizationDecisionColor:
type: string
enum:
- GREEN
- YELLOW
- ORANGE
- RED
example: YELLOW
description: The wallets common name for authorization decision.
Id:
type: string
format: uuid
description: Unique identifier of a resource.
example: 20218aae-b15e-406c-9e9f-23735cd86a48
Created:
type: string
format: date-time
description: The date and time when the card was created.
Updated:
type: string
format: date-time
description: The date and time when the object/entity was updated last time.
UpdateCount:
type: integer
description: The version number of the entity.
example: 1
DeviceInfo:
type: object
description: Device information.
properties:
deviceName:
type: string
description: >-
User-defined name of the device provided by the wallet or operating
system.
example: My Phone
deviceType:
type: string
description: |
Indicates the type of device on which the token is provisioned.
Typical values include PHONE, WATCH, TABLET, or WEARABLE.
example: PHONE
operatingSystem:
type: string
description: >
Operating system running on the device. Typical values include IOS,
ANDROID, or WATCHOS.
example: ANDROID
ErrorResponse:
type: object
properties:
type:
description: The problem type.
type: string
title:
description: The reason phrase of HttpStatus.
type: string
status:
description: HTTP problem status.
type: number
detail:
description: The problem detail.
type: string
instance:
description: The request path.
type: string
id:
description: Unique error identifier.
type: string
format: uuid
timestamp:
description: Date-time when error occurred.
type: string
format: date-time
responses:
BadRequest:
description: Bad request
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
type: about:blank
title: Bad Request
status: 400
detail: 'JSON parse error: Unexpected character...'
instance: /v1/cards
id: 5cc541cb-f456-4331-b537-d2380fca0400
timestamp: '2026-02-24T12:34:56Z'
Unauthorized:
description: Unauthorized
Forbidden:
description: Forbidden
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
type: about:blank
title: Forbidden
status: 403
detail: Access Denied
instance: /v1/cards
id: 5cc541cb-f456-4331-b537-d2380fca0403
timestamp: '2026-02-24T12:34:56Z'
NotFound:
description: Not found
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
type: about:blank
title: Not Found
status: 404
detail: >-
Entity not found - Program with id:
2ec117b7-454e-4cc5-8b89-dea5485aab2b
instance: /v1/cards
id: 5cc541cb-f456-4331-b537-d2380fca0404
timestamp: '2026-02-24T12:34:56Z'
InternalServerError:
description: Internal server error
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
type: about:blank
title: Internal Server Error
status: 500
detail: Unexpected error occurred.
instance: /v1/cards
id: 5cc541cb-f456-4331-b537-d2380fca0500
timestamp: '2026-02-24T12:34:56Z'
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
````