How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Tokenization API

Merchant Services Tokenization APIs enable merchants to secure their cards on file by replacing the sensitive Primary Account Number (PAN) with a token. Currently supports network tokenization via Mastercard, Visa & Amex.

Tokenization API is one of 26 APIs that JPMorgan Chase publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Bulk Key Management, Bulk Operation, Cryptograms Request, Health Check, and Token Lifecycle Management. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

This API exposes 14 operations across 12 paths, organized into 6 resource areas, and defines 91 schemas. It is described by OpenAPI 3.0.1, at version 1.5.0.

Requests are made against 3 base URLs: https://api.merchant.jpmorgan.com/payments/v1/, https://api-test.merchant.jpmorgan.com/payments/v1/, https://api-mock.payments.jpmorgan.com/payments/v1.

14 operations 12 paths 91 schemas 8 GET1 PATCH5 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.0.1
API Version
1.5.0
Base URL
https://api.merchant.jpmorgan.com/payments/v1/
Authentication
HTTP Bearer
Resource Areas
6

Authentication & Security 1

Tokenization API declares 1 security scheme for authenticating requests. It accepts HTTP bearer tokens (JWT) (BearerAuth). By default, every request must be authenticated.

Paths & Operations 14

Across 12 paths, the API surfaces 14 operations — 8 GET, 1 PATCH, 5 POST. They span 6 resource areas: Health Check, Token Processing, Cryptograms Request, Token Lifecycle Management, Bulk Operation, Bulk Key Management. Each is listed below with its method, path, parameters, and response codes.

Health Check 1

Validate the health of the service.

GET
/healthcheck
Health check for the Tokenization service
v1GetHealth → 200500503504
Token Processing 5

Manage or request tokens and cryptograms.

POST
/tokens
Token provisioning request
v1ProvisionToken 2 params body → 201400401403409412500503
GET
/tokens/{token-reference-id}
Request token information
v1GetTokenByTokenReferenceId 4 params → 200400401403404500503504
GET
/tokens/{token-reference-id}/details
Request token details
v1GetTokenDetailsByTokenReferenceId 4 params → 200400401403404500503504
GET
/tokens/{token-reference-id}/assets/{asset-reference-id}
Request token assets
v1GetTokenAssetsByTokenAndAssetReferenceIds 5 params → 200400401403404500503504
POST
/acquirertokens
Provision a acquirer token for a payment instrument
v1AcquirerTokenPost 2 params body → 201400401403409412500503
Cryptograms Request 1

Request cryptograms for a token.

POST
/cryptograms
Token cryptogram request
v1CreateCryptogram 2 params body → 201400401403412500503504
Token Lifecycle Management 2

Manage or request token state information.

PATCH
/tokens/{token-reference-id}/lifecycle-states
Token lifecycle management request
v1UpdateTokenStateByTokenReferenceId 3 params body → 200400401403412500503504
GET
/tokens/{token-reference-id}/lifecycle-states
Request token states
v1GetTokenStateByTokenReferenceId 4 params → 200400401403404500503504
Bulk Operation 3

Bulk Token Operation.

POST
/bulk-tokens
Process Bulk Tokens
v1BulkTokenPost 3 params body → 201400401403409412500503
GET
/bulk-tokens/{merchant-file-identifier}
Retrieve the status of a bulk file
v1BulkTokenByIdGet 3 params → 200400401403404500503504
GET
/bulk-tokens/{merchant-file-identifier}/download
Retrieve details of a bulk file
v1BulkTokenDownloadGet 3 params → 200400401403404500503504
Bulk Key Management 2

Bulk Key Management

POST
/bulk-tokens/encryption-key
Create encryption key from a merchant
v1BulkTokenKeyManagementPost 2 params body → 201400401403409412500503
GET
/bulk-tokens/encryption-key
Provide public key to a merchant
v1BulkTokenKeyManagementGet 2 params → 200400401403404500503504

Schemas 91

The contract defines 91 schemas that model the data the API accepts and returns. The most detailed are paymentInstrument (21 properties), tokenInformation (15 properties), accountInformation (14 properties), acquirerTokenInformation (14 properties). Each schema is shown below with its type and property counts.

accountholderName
string
Consumer name that includes the first, middle, and last name.
accountInformation
object
Account Object
14 properties 3 required
accountholderTelephone
object
Conditional - Provide either email or telephone number for the accountholder.
2 properties 1 required
tokenNumber
string
The token number is a SECURE surrogate value for the account number utilized in payment. A token is created at enrollment into programs or when consumer creden…
cardAssetData
array
Card assets which help to build virtual replication of actual physical card art.
cardAssetDataElement
object
Card assets which help to build virtual replication of actual physical card art.
6 properties
cardReferenceNumber
string
Identifier assigned to a credit/debit card number that was tokenized.
address
object
Address Object
6 properties
transactionAmount
integer
Specifies the monetary value of the transaction performed.
cardNumber
string
The Card Number is a number recognized by an issuer and used to identify the underlying account to which each transaction should be applied.
cardExpiry
object
A number in the form of Month/Year. Provided in format MM/YY.
2 properties 2 required
expiry
object
A number in the form of Month/Year that is displayed on a card (Debit/Credit). Provided in format MM/YY.
2 properties 2 required
month
integer
The month of the expiration date
year
integer
The year of the expiration date
cardTokenStatus
string
Current state of the token.
cardMetaData
object
Information about the card related to a token.
10 properties
issuerInformation
object
Information about the card issuer
12 properties
transactionCurrencyCode
string
Monetary unit that was associated with transaction using ISO 4217 format.
device
object
Contains additional information related to the consumer device.
11 properties
electronicCommerceIndicator
string
Codifies the authentication results of the cardholder's credit card and tokenization interaction. Also known as ECI.
identifier
string
It is the resource identifier for a given merchant request, provided/generated by JPMC.
ipAddress
string
IP address of the consumer's device used in token transactions. Supports both IPv4 and IPv6. When processing American Express - IP Address is required in IPv4…
cardLast4Digits
string
Identifies the final 4 digits card number.
stateChangeReason
string
Lifecycle action requested by merchant for a token.
merchant
object
Contains information about the Merchant.
5 properties 1 required
merchantDoingBusinessAs
string
Alternate name for the merchant if it exists (trading name).
merchantName
string
Merchant legal name.
paymentAccountReference
string
Payment Account Reference (PAR) acts as a linkage mechanism for processing transactions when full PAN is unavailable. PAR is not intended to be a PAN replaceme…
paymentAmounts
object
Information about the amount and currency related to a transaction.
2 properties
paymentOrder
object
Information about the order related to the transaction.
4 properties
requestIdentifier
string
Merchant identifier for the request. The value must be unique.
riskInformation
object
Risk information related to token request.
4 properties
walletRisk
object
Risk information related to the wallet.
4 properties
cardRisk
object
A list of errors and warnings.
2 properties
deviceRisk
object
Information about risk related to device.
4 properties
userRisk
object
Information about risk related to account holder.
7 properties
stateChangeReasonCode
string
Codifies the reason code for Token account level change.
timestamp
string
Designates the date, hour, minute and second when response was provided for a request. Using ISO 8601 date-time format.
tokenAssetResponse
object
Contains card asset information including card art, and Issuer information
7 properties
tokenAuthenticationValue
string
Contains authentication value received from the payment networks for network token transactions.
tokenizationApprovalStatus
string
Processing status of a tokenization request from the merchant.
tokenCryptogramResponse
object
Response to token cryptogram request.
9 properties
tokenLifecycleMercant
object
Manage the lifecycle of a token on file
2 properties 1 required
paymentInstrument
object
Payment Instrument
21 properties
tokenCryptogramRequest
object
Request Cryptogram for a token, which can be used in token payment processing.
5 properties
tokenCryptogramPaymentInstrument
object
Manage the lifecycle of a token on file
7 properties
tokenCryptogramType
string
Type of cryptogram to be requested from Token service.
tokenInformationResponse
object
Current information and status of a token.
8 properties
tokenInfoMerchant
object
Current information and status of a token
1 property
tokenInfoPaymentInstrument
object
Current information and status of a token
6 properties 1 required
tokenLifecycleResponse
object
Response to a lifecycle request.
11 properties 2 required
tokenLifecycleRequest
object
Manage the lifecycle of a token on file.
2 properties
tokenLifecyclePaymentInstrument
object
Manage the lifecycle of a token on file
1 property
lifecycleManagementAction
object
Manage the lifecycle of a token on file
2 properties
tokenProvisionResponse
object
Token provisioning response
9 properties 1 required
tokenProvisonMerchant
object
Contains information about the merchant.
2 properties
tokenInformation
object
Information about provisioned token
15 properties 2 required
accountholderValidation
object
Contains information related to validation of the consumer or accountholder.
3 properties
tokenProvisionRequest
object
Token provisioning request
6 properties 1 required
tokenReferenceIdentifier
string
Identifier given to a token at the time of provisioning. Can be used as a reference to the token number.
tokenRequestorIdentifier
string
Identifier for the merchant given by payment networks or token provider.
trackTwo
string
Contains track 2 equivalent data for the token.
url
string
Reference to a web resource.
healthCheckResource
object
Contains health check information about a resource.
1 property 1 required
messages
object
A list of errors and warnings.
4 properties 2 required
responseStatus
string
Request result status.
responseCode
string
Short explanation of the response code.
responseMessage
string
Long explanation of the response message.
code
string
Codifies a raised exception encountered by an internal or external system, sub-system, interface, job, module, system component with which the web service appl…
message
string
Provides textual description of a problem that has occurred and is preventing the system from completing a task. Messages can be a confirmation, warning or not…
validationMessage
object
Object containing information about transaction validation.
3 properties 2 required
adfsError
object
Object containing information about the active directory file system error.
3 properties 3 required
payload
object
Payload Object
4 properties
tokenProvisionDuplicateResponse
object
Token Provision Duplicate Response
3 properties
fileInformation
object
Batch file informtion containg tokens from merchant
5 properties
tokenBulkPostResponse
object
Batch file information containing tokens from merchant
3 properties
downloadResponse
object
Response for download
6 properties
accountHolderReference
string
Unique reference identifier for a consumer within the token requestor. Required by Visa Token Service, optional for Amex and Mastercard. Visa token service max…
tokenBulkRequest
object
This is used for specifying an attribute used on a model for object that will contain one or more attributes
5 properties
keyManagementRequest
object
Request object for Key management operation
3 properties
keyManagementResponse
object
Response object for Key management operation
1 property
acquirerTokenProvisionRequest
object
Acquirer Token Provision Request
6 properties 1 required
acquirerAccountInformation
object
Acquirer Account Information
13 properties 2 required
acquirerTokenInformation
object
Acquirer Token Information
14 properties
acquirerTokenProvisionResponse
object
Acquirer Token Provision Response
8 properties
bankAccountDetokenizationResponse
object
Attribute related to bank account detokenization response.
9 properties
bankAccountDetokenizationRequest
object
Attribute related to bank account detokenization request.
1 property 1 required
transactionProcessingEntityIdentifier
string
Identifies a unique entity for transaction processing at the lowest level of the account hierarchy of the backend proprietary merchant acquiring processing pla…
updateTimestamp
string
Designates the hour, minute, and second in a specifc day when the record was last modified.
ach
object
Object for ACH (Automated Clearing House) payment method which occurs whenever someone instructs the ACH network to “push” money from their account to someone…
2 properties 2 required
paymentMethodType
object
Various payment methods need de-tokenization service
1 property

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

jp-morgan-chase-tokenization-api-openapi.yml Raw ↑

Other APIs JPMorgan Chase publishes across the network.

Digital Onboarding API
Consumer Profile Management API
Reporting API
Notifications API
Request to Pay via QR Code API
Checkout API
Dispute Management API
Accounts API
Alerts and Decisioning API
Product Configuration API
Recipients API
Webhooks API
Where this information came from

This is an independent, third-party profile of Tokenization API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.