---
title: "Create a cryptogram for a Card-on-File"
method: POST
path: "/payment-instruments/{token}/network-token-cryptogram"
tags: ["Payment Instrument Tokenization"]
---

# Create a cryptogram for a Card-on-File

`POST /payment-instruments/{token}/network-token-cryptogram`

## Request

- Base URL: `https://sandbox.comcarde.com/v1`
- URL: `https://sandbox.comcarde.com/v1/payment-instruments/{token}/network-token-cryptogram`
- Auth: HTTP bearer

## Response `201`

Cryptogram created.

- CryptogramProvisioningResponse: A provisioned network token cryptogram. This cryptogram field will only be included if `networkTokenProvisioning` is set to `cryptogram` and the cryptogram provisioning succeeds.
  - `cryptogram` string, required: The cryptogram value, from the provider of the Network Token. This value is one time use, for subsequent payments a new cryptogram should be retrieved.
  - `eci` string, required: The electronic commerce indicator (ECI).
  - `networkToken` NetworkToken: Information about a Network Token.
    - `id` string, required: A unique identifier that represents the token associated with a card enrolled into the Card Network Service
    - `token` string: The unique token for the enrolled PAN which can be used in authorization as per ISO/IEC 7812 format. This will only be available once a cryptogram has been provisioned at least once.
    - `expiryDate` string, required: Expiration date of the token, noted in MM-YY format
    - `issuer` 'MASTERCARD' | 'VISA', required: The issuing card network of the Network Token
    - `status` 'ACTIVE' | 'DISABLED' | 'DELETED', required: The status of the Network Token. - `ACTIVE`: Can be used to provision Cryptograms for payments. - `DISABLED`: This can be due to card suspensions, fraud, or other temporary hold reasons and may be re-activated at a later date. - `DELETED`: The token is no longer valid and cannot be re-activated. This can be due to token expirations, lost card or other non-temporary reasons.
    - `tokenUniqueReference` string, required: Unique identifier for the Network Token provided by the Card Network
    - `paymentAccountReference` string, required: A non-financial reference assigned to each unique funding PAN (FPAN) that's used to link the payment account of that PAN to affiliated payment tokens. See our [dedicated PAR guide](https://docs.br-dge.io/docs/payment-account-reference) for more info.
    - `lastFour` string: Last four digits of the Network Token
    - `cardBin` string: BIN of the associated associated Card
    - `cardLastFour` string: Last four digits of the associated Card
    - `cardExpiryDate` string: Expiration date of the associated Card, noted in MM-YY Format
    - `cardIssuer` string: Name of the issuing bank

## Other responses

- `400`: Unable to provision Cryptogram - Bad Request
- `401`: Unauthorized request.
- `403`: Functionality not enabled for retail channel.
- `404`: The specified entity was not found.
- `500`: An internal server error occurred upstream while processing the request. If you have any questions about why you are receiving these responses, please raise a ticket with support on the BR-DGE Support Portal at <https://comcarde.atlassian.net/servicedesk/customer/portals> with the `id` from the response so we track down the individual requests on our end.

---

[API](https://skmtc.dev/br-dge/apis/br-dge-payment-instrument-rest-api.md) - [All operations](https://skmtc.dev/br-dge/apis/br-dge-payment-instrument-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/br-dge/apis/br-dge-payment-instrument-rest-api/revisions/700277cae488?raw)