---
title: "Perform token operation"
method: POST
path: "/v1/cards/{cardId}/network-tokens/{tokenId}"
tags: ["Token lifecycle"]
---

# Perform token operation

`POST /v1/cards/{cardId}/network-tokens/{tokenId}`

## Request

- Base URL: `https://sandbox.pismolabs.io/passport`
- URL: `https://sandbox.pismolabs.io/passport/v1/cards/{cardId}/network-tokens/{tokenId}`
- Auth: none declared

Perform token operation.

**Notes**: 
 * This is a PCI endpoint, use the https://gw-pci.pismolabs.io/cards-tokenization environment.
 * This endpoint takes an account token - an access token encoded with a Pismo account ID

## Request body

- TokenOperationRequest
  - `operation_reason` string, required: Operation reason. Be descriptive, it should be clear what the customer needs to do. For a suspended token, for example, the reason could say "Suspended due to lost device."
  - `operation_type` 'DELETE' | 'SUSPEND' | 'RESUME' | 'CALL_CENTER_ACTIVATION' | 'CARDHOLDER_STEPUP_APP_TO_APP' | 'TOKEN_DEVICE_BIDING_APPROVE' | 'TOKEN_DEVICE_BINDING_APPROVE_BANK_APP', required: Operation type: * `DELETE` - Delete token * `SUSPEND` - Suspend token * `RESUME` - Resume suspended token * `CALL_CENTER_ACTIVATION` - Call center verification * `CARDHOLDER_STEPUP_APP_TO_APP` - App2App verification * `TOKEN_DEVICE_BIDING_APPROVE` - Device verification, approve and activate the most recently inactive device (only Visa) * `TOKEN_DEVICE_BINDING_APPROVE_CALL_CENTER` - Device verification with call center activation, approve and activate the most recently inactive device (only Visa) * `TOKEN_DEVICE_BINDING_APPROVE_BANK_APP` - Device verification with bank app approval, approve and activate the most recently inactive device (only Visa) **Note**: For App2App token activation, set this field to `CARDHOLDER_STEPUP_APP_TO_APP` (Mastercard) and `CALL_CENTER_ACTIVATION` (Visa).
  - `activation_code` string: REQUIRED if `operation_type` is `CALL_CENTER_ACTIVATION`. These codes are known only to the issuer/caller.
  - `operator_id` string: Client-generated ID for person or system performing the operation. This is for client monitoring and internal record-keeping.

## Response `200`

Success

## Other responses

- `400`: Bad request
- `401`: Access token is missing or invalid
- `500`: Internal server error

---

[API](https://skmtc.dev/pismo/apis/platform-authentication.md) - [All operations](https://skmtc.dev/pismo/apis/platform-authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/pismo/apis/platform-authentication/revisions/935b62e16de4?raw)