---
title: "Retrieve Card Data"
method: POST
path: "/api/v2_1/cards/lookup"
tags: ["Card"]
---

# Retrieve Card Data

`POST /api/v2_1/cards/lookup`

## Request

- Base URL: `https://secure.payu.com`
- URL: `https://secure.payu.com/api/v2_1/cards/lookup`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/payu-com/apis/payu-gpo-europe-rest-api/docs/api/v2_1/cards/lookup/post.ts> (a function with typed inputs; its response is checked against the schema)

Card Data API allows you to retrieve the characteristics of a payment card (for example issuer, card country,
card type and other attributes derived from payment organizations' BIN tables) before an actual order is
created, without charging the card.

**Note**: the request must contain either `token` or the `card` object — never both in the same 
request.

## Headers

- `Content-Type` string, required
- `Authorization` string, required

## Request body

- union
  - object
    - `token` string, required: Card token value. Supported variants: - SINGLE: always prefixed with `TOKD_` - MULTI: prefixed with `TOKC_` (when retrieved using [Retrieve All Available Payment Methods](https://developers.payu.com/europe/api/#tag/Payment-Methods/operation/retrieve-payment-methods)) or `TOK_` (before card token activation and first order) - SINGLE_LONGTERM: always prefixed with `TOK_` For more details about creating tokens and supported variants, see [Creating Tokens](https://developers.payu.com/europe/docs/payment-solutions/cards/tokenization/create-token/). **Note**: Cannot be combined with the `card` object. Token or card object is required.
  - object
    - `card` object, required: Full card data object for PCI DSS compliant merchants approved to process card data. **Note**: Cannot be combined with `token` object.
      - `number` string, required: Card number as PAN or VAN (for example from Visa Tokenization Services, Mastercard MDES/SCOF, Google Pay, or Apple Pay).
      - `expirationMonth` string, required: Card expiration month.
      - `expirationYear` string, required: Card expiration year.

## Response `200`

Card identified. Card characteristics returned in the response body.

- object
  - `maskedNumber` string: Masked card number (for example `536447******6443`). **Note**: For network-tokenized cards (Visa/Mastercard), only the last 4 digits may be visible.
  - `expirationMonth` integer: Card expiration month.
  - `expirationYear` integer: Card expiration year.
  - `scheme` 'MC' | 'VS': Payment organization (card scheme): - `MC` (Mastercard/Maestro) - `VS` (Visa)
  - `description` string: Card product description from the BIN table (for example `World Debit Mastercard Card`, `Visa Infinite`).
  - `type` string: Card product type code from the payment organization's BIN table (for example `MDH`, `I`, `I1`). For details, refer to official Visa or Mastercard documentation.
  - `countryCode` string: Card country code, ISO 3166-1 alpha-2 (for example `PL`, `RO`).
  - `classification` 'DEBIT' | 'PREPAID' | 'CREDIT' | 'CHARGE': Card classification.
  - `profile` 'BUSINESS' | 'CONSUMER' | 'BOTH': Card profile.
  - `uniqueReference` string: Unique immutable identifier of the physical card number (PAN). The same PAN always yields the same value, regardless of the token used. Useful for detecting the same card saved on multiple accounts. Maximum length is 256 characters. **Note**: For network-tokenized cards (Visa/Mastercard), PayU may not always know the real PAN due to instrument nature (for example Apple Pay or network token has been updated by Issuer and pushed to PayU with new data for lost card scenario) or token lifecycle updates. In such cases, PayU cannot guarantee full immutability of unique reference.
  - `issuer` object: Card issuer data.
    - `name` string: Issuer name.
    - `region` 'UNITED_STATES' | 'CANADA' | 'ASIA_PACIFIC' | 'LATING_AMERICA_AND_CARIBBEAN' | 'EUROPE' | 'V6_CE_EUROPE_MID_EAST_AND_AFRICA' | 'ME_SOUTH_ASIA_MID_EAST_AFRICA': Issuer region within the card scheme. **Note**: Mastercard and Visa use different regional definitions. For selected European countries, Visa-specific `V6_CE_EUROPE_MID_EAST_AND_AFRICA` may be returned.
    - `countryCode` string: Issuer country code, ISO 3166-1 alpha-2 (for example `PL`, `RO`). **Note**: Can differ from card `countryCode`, especially for fintechs operating across regions under one country's license (for example EEA).
  - `installmentOptions` object: Retrieve available card installments options for a specific card. Available for merchants operating on the Romanian market (requires contact with a PayU representative first).
    - `numbers` integer[]: Section containing available installments options (for example `[1, 6, 12]`).
    - `provider` string: Card installments program provider.
    - `settings` object: Object representing provider-specific settings.
      - `minAmount` number: If returned for a given card BIN, the order amount must be higher than this value to use the installment plan; if lower or equal, the order is rejected.

## Other responses

- `400`: Request validation error (for example missing both `token` and `card`, providing both `token` and `card`, malformed card number or expiration date, invalid token format).
- `401`: Missing or invalid OAuth bearer token.
- `403`: The POS is not allowed to use the Card Data API.
- `404`: Card could not be identified or no data is available for the given card number.
- `408`: Cannot complete request, please try again.
- `429`: Request rate limit exceeded.
- `500`: Unexpected error on PayU side. Retry the request later.

---

[API](https://skmtc.dev/payu-com/apis/payu-gpo-europe-rest-api.md) - [All operations](https://skmtc.dev/payu-com/apis/payu-gpo-europe-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/payu-com/apis/payu-gpo-europe-rest-api/revisions/185e74d5e007?raw)