- Guides
- Proxy Recipes
- API
- Form JS
- External Links
PCI Vault allows you to securely provide third parties or client-side applications with direct access to data stored in your vault, without exposing your API credentials or sensitive authentication details.
To enable this, you can generate a unique, shareable retrieval endpoint. These endpoints are read-only and are purpose-built for securely retrieving vault data. For enhanced security, they can be restricted to specific tokens or references, ensuring that only explicitly authorized data can be accessed. Your API credentials, passphrase, and administrative capabilities remain fully protected at all times.
Create a temporary endpoint that you can share with others without compromising your passphrase. This new endpoint can be used to retrieve data that was encrypted with the provided key. You can also lock down the new endpoint to only retrieve specific tokens or references.
Important: We store an encrypted version of the provided key in our database. This endpoint generates a secret necessary to decrypt the key and then decrypt the captured data. Anybody with the secret can use the generated endpoint to decrypt the data accessible by the new endpoint. We do not store the secret. We recommend that you delete the endpoint after use.
The identifier for the key that will be used to fetch and decrypt data.
The passphrase for the key that will be used to fetch and decrypt data.
A unique name for the endpoint. The uniqueness is enforced across the entire vault, you can't use a unique id that is currently being used by someone else.
The duration for which the endpoint will be active. This can be specified using a ISO8601 duration string.
A token to which new endpoint must be locked down. The new endpoint will only have access to this token. If neither token or reference is specified, the new endpoint will have access to all tokens.
A reference to which new endpoint must be locked down. The new endpoint will only have access to tokens with this reference. If the reference is not specified, the new endpoint will have access to tokens with any reference.
A comma separated list of rule ids to apply to the data in order. This does not change stored data.
A comma separated list of fields to mask in the response. In a masked field, all non-space characters will be replaced by an asterisk (*), except for the last 4 characters
Whether the returned data should include card metadata. When set to true, the BIN is queried and the issuer data is returned together with the decrypted data.
Set the Accept header text/html to receive the endpoint data in ready-made HTML code.
Accept |
application/json |
# No Body
List available retrieval endpoints, this list may include expired endpoints. Expired endpoints can't be used and will be deleted.
Optional key identifier for filtering endpoints.
# No Body
Decrypt or list encrypted data by token from the vault without having access to a key. Use the secret provided when creating this unique endpoint. If the token is provided, decrypted data will be returned, otherwise tokens will be listed.
The unique id of the endpoint to use.
The token to retrieve. If left unspecified, this endpoint will generate a tree of available tokens using the supplied reference if applicable.
The reference by which data must be filtered. If a token has been stored with a reference, both the reference and the token must be supplied in order to decrypt the associated data.
Filter for tokens where the reference begins with the specified value.
If set to true, decrypt all tokens in the tree. Note: every token in the tree will be decrypted and counted as an API operation, so use this with caution when using a large limit parameter.
Limit the number of cards in the tree. This limit is 1024 by default. To remove the limit, specify a negative limit. Warning: Your browser might not be able to render too many cards, we recommend you set the limit fairly low when trying this endpoint out. Depending on how many cards are in the vault, removing the limit might also result in an error due to a timeout.
The token received in the X-PCIVault-Next-Token header in a previous request.
The secret associated to the endpoint.
# No Body
Delete a retrieval endpoint. Please note that this endpoint can also be used to delete capturing endpoints by specifying a unique id belonging to a capturing endpoint.
The unique id of the endpoint to delete.
# No Body
Use this endpoint to create a hosted form which can be embedded in an iFrame.
The created form will be publicly visible, and can be used with any retrieve endpoint.
This endpoint is zero-rated.
Note: hosted forms created through the capture iframe and retrieve iframe endpoints are interchangeable and can be used for both retrieval and capture.
The type of form, this can be either pcd for credit card, ach for bank details or custom for a custom form.
A unique id for the form. This id must be a system-wide unique id. If you don't specify an id, PCI Vault will generate one for you.
A list of of CSS links to include. This is useful for externally hosting CSS to modify the form.
A list of of Javascript links to include. This is useful for externally hosting Javascript to modify the form.
Base64 encoded CSS. This CSS will be included in a <style> tag in the form HTML.
Base64 encoded Javascript. This Javascript will be included in a <script> tag in the form HTML.
Loads the form with Cross-Origin-Embedder-Policy: require-corp header when set to true. Used when embedding the iframe into a page loaded with the same header. Note: if this is set to true, any css_links and js_links need to respond with the Cross-Origin-Resource-Policy: cross-origin header.
Base64 encoded Javascript function which will be invoked when the form was submitted successfully.
Base64 encoded Javascript function which will be invoked if an error occurs when the form is submitted.
The display mode of the form, standalone or embedded. If omitted, the form is rendered in standalone mode.
Set to true to force the used of a randomized keypad input.
Set to true to hide the sample credit card on the PCD form.
Set to true to highlight the fields of the sample credit card when the inputs are focused on the PCD form.
Set to true to disable all validation on the PCD form.
Set to true to strip space from the credit card on the PCD form.
A javascript object, specifying which fields to validate or display. Each key is optional, but must have an object value with validate and/or visible as keys containing true or false as values. Unspecified, undefined, or null keys will be overridden by true values. Invisible fields will not be validated.
Example data presets:
Example data presets:
A javascript object, specifying custom colours for the card image, buttons and messages.
The base style for the form. This can be either pcivault or modern. If omitted, the default is pcivault.
The primary color for the call to action. e.g. #009844
The primary color for the card image. e.g. #009844
The color for the card shadow. e.g. #009844
The color for success messages. e.g. #009844
The color for error messages. e.g. #009844
The base64 encoded logo image to display on the card image.
A string that specifies the color mode of the form. The accepted values are light, dark, and auto. If set to auto, the form will automatically switch between light and dark modes based on the user's system preferences.
Use this endpoint to list your hosted forms.
The id of a specific form to retrieve. If omitted will list all hosted forms for the current user.
# No Body
Request the HTML for rendering the hosted HTML form.
This link can be included in an iFrame like this:
<iframe
src="api-stage.pcivault.io/v1/retrieve/iframe/MmRMVP4UjYD8g5kVUcmx4Z?unique_id=MThcun2CoC9Eeou3khz4cN&secret=QyXgJqG3d2Tj7ttsbRHI5TffocOg3dZGYmuOuDCLE-wPi_CxoJh7uKSROpm8hIHJ&token=5d7c9c6d3b15f03632742d66e933ad431e1dbc1e8ce6450437d216b14a3d657b&reference=test_reference"
></iframe>
This endpoint is publicly available, no Basic Auth or secret headers necessary. However, the unique id and secret for a valid Retrieval Endpoint is necessary for the form to retrieve the data.
The id for the form you want to access
The unique id for the retrieval endpoint from which the form should fetch data.
The secret for the retrieval endpoint from which the form should fetch data.
The token to retrieve.
A reference for the token. Must be specified if the token was stored with a reference
Set this to true to fetch data from the staging environment rather than production.
The HTML title for the hosted form.
# No Body
Delete a hosted form. You will only be able to delete the form created by the same Basic Auth user.
The id of the hosted form to delete.
# No Body