Save a new card the client tokenized via Hosted Fields

Authorization

X-Api-Key<token>

Business API key, e.g. vuz_ab12cdef... Created via Settings → Integrations → API Keys. Unlike partner keys, a public API key's STRING does not encode its environment — isolation instead comes from a completely separate sandbox database: a key minted on the Sandbox server (above) only ever reads/writes sandbox data and can never see or affect production, regardless of what the key looks like.

In: header

Path Parameters

clientId*string

Client ID

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

token*string

Tranzila token from Hosted Fields (TranzilaTK)

lastFour*string

Last four digits

brand*string

Card brand

expMonth*number

Expiry month (1–12)

expYear*number

Expiry year (4-digit)

Response Body

`application/json`

curl -X POST "https://example.com/clients/string/cards" \  -H "Content-Type: application/json" \  -d '{    "token": "me4b50240d8c6222312",    "lastFour": "4504",    "brand": "visa",    "expMonth": 6,    "expYear": 2030  }'

{  "id": "string",  "brand": "visa",  "lastFour": "4504",  "expMonth": 6,  "expYear": 2030,  "inUseByMandate": true,  "isDefault": true}