> ## Documentation Index
> Fetch the complete documentation index at: https://developers.ingopayments.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify — Card

> Tokenize a debit or credit card account for future push-to-card disbursements.



## OpenAPI

````yaml specs/ingopay-verify-card.yaml POST /gateway/verify--card
openapi: 3.0.3
info:
  title: IngoPay API — Verify Card (Debit or Credit)
  description: >
    Verify support for customer debit or credit card data and tokenize the
    account for use in a subsequent Process call.


    The Verify method validates and tokenizes the customer's card information.
    The returned `customer_account_token` is used in place of raw card data on
    all future Process requests for the same account.


    **Mutual exclusivity rules:**

    - Provide either `customer_account_token` **or** `third_party_token` **or**
      raw card fields (`account`, `expiration_date`, `recipient_first_name`,
      `recipient_last_name`, `recipient_address1`, `recipient_city`,
      `recipient_state`, `recipient_zip`) — never more than one grouping.

    - `cvv` is conditionally required based on client configuration
      (`cvv_enabled`). Contact your Ingo integration manager to confirm your
      configuration.

    - `expiration_date` is conditionally required based on client configuration
      (`expiration_date_enabled`). Contact your Ingo integration manager to
      confirm your configuration.
  version: '11'
  contact:
    name: Ingo Money Developer Support
    url: https://developers.ingomoney.com
servers:
  - url: https://payapi-sandbox.ingo.money
    description: Sandbox
  - url: https://payapi.ingo.money
    description: Production
security:
  - HmacAuth: []
paths:
  /gateway/verify--card:
    post:
      tags:
        - Account Tokenization
      summary: Verify and tokenize a debit or credit card
      description: >
        Validates a customer's card data and returns a `customer_account_token`
        for use in push (Process) and pull (Debit Process) requests.
        `account_type` must always be `CA` for this operation.
      operationId: verifyCard
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyCardRequest'
            example:
              participant_id: 12345
              account_type: CA
              amount: 1010.5
              recipient_first_name: Alex
              recipient_last_name: Rivera
              account: '4111111111111111'
              expiration_date: '2612'
              cvv: '123'
              recipient_address1: 100 Innovation Way
              recipient_address2: Apt 2
              recipient_city: Anytown
              recipient_state: GA
              recipient_zip: '00000'
              recipient_phone: '1231231234'
              participant_unique_id1: 1f2739ed-3531-4af2-ae36-e6faf7936462
              participant_unique_id2: 90759390-01c7-47e7-8a90-6faa89b18ff6
              timestamp: 1576097158
              version: 11
      responses:
        '200':
          description: Verification successful — token returned
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerifyCardResponse'
              example:
                status: 100
                client_message: Success
                data:
                  customer_account_token: ca875cce-58c0-46a0-8f14-676190cc7df6
                  last_4: '1111'
                  request_timestamp: 1576097360
                  issuers:
                    - payee_id: '526263'
                      payee_name: Bank of America - Platinum MasterCard and Visa
                      payee_address: PO Box 15019
                      payee_city: Wilmington
                      payee_state: DE
                      payee_zip: 19850-5019
                      credit_info:
                        min: '0.05'
                        max: '1500.00'
                        card_type: Debit
                        estimated_posting_time: Payment will post within 5 minutes.
                        estimated_posting_date: 04/21/2026
                      issuing_network: Visa
                      credit_enabled: 1
                      debit_enabled: 0
                  participant_unique_id1: 1f2739ed-3531-4af2-ae36-e6faf7936462
                  participant_unique_id2: 90759390-01c7-47e7-8a90-6faa89b18ff6
                  expiration_date: '2612'
                  count: 1
                time: '2.4505'
        '400':
          description: Validation error — check request body
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              example:
                status: 700
                client_message: Account not currently available for payment
                data:
                  request_timestamp: 1576097360
components:
  schemas:
    VerifyCardRequest:
      type: object
      required:
        - participant_id
        - account_type
        - participant_unique_id1
        - timestamp
        - version
      description: >
        Exactly one of the following groupings must be provided: (1)
        `customer_account_token`, (2) `third_party_token`, or (3) raw card
        fields — `account`, `recipient_first_name`, `recipient_last_name`,
        `recipient_address1`, `recipient_city`, `recipient_state`,
        `recipient_zip`.
      properties:
        participant_id:
          type: integer
          description: Unique participant identifier assigned by Ingo.
          example: 12345
        account_type:
          type: string
          enum:
            - CA
          minLength: 1
          description: Always `CA` for card-based (debit or credit) transactions.
          example: CA
        customer_account_token:
          type: string
          minLength: 1
          maxLength: 255
          nullable: false
          description: >
            Alternative to raw card data when the account was previously
            tokenized. If provided, `third_party_token` and all raw card fields
            (`account`, `expiration_date`, `recipient_first_name`,
            `recipient_last_name`, `recipient_address1`, `recipient_address2`,
            `recipient_city`, `recipient_state`, `recipient_zip`) must be
            omitted.
          example: ca875cce-58c0-46a0-8f14-676190cc7df6
        third_party_token:
          type: object
          nullable: false
          description: >
            Contains data about an optional third-party account token. If
            provided, `customer_account_token` and raw card fields (`account`,
            `expiration_date`, `cvv`) must be omitted. Only permitted if the
            client is configured for third-party token use.
          required:
            - provider
            - token
          properties:
            provider:
              type: string
              maxLength: 3
              description: >
                Ingo-provided identifier for the third-party tokenization
                service provider.
              example: '1'
            token:
              type: string
              minLength: 1
              maxLength: 100
              description: >
                Third-party account token. To be de-tokenized; its associated
                account data is then used to create an Ingo account token.
              example: tok_3rdparty_abc123xyz
        amount:
          type: number
          format: float
          minimum: 0.01
          nullable: true
          description: >-
            Dollar amount of disbursement. Max value determined by participant
            velocity limits.
          example: 1010.5
        recipient_first_name:
          type: string
          minLength: 1
          maxLength: 255
          nullable: false
          description: >
            Recipient first name. Required unless `customer_account_token` is
            provided. Must be omitted if `customer_account_token` is provided.
          example: Johnny
        recipient_last_name:
          type: string
          minLength: 1
          maxLength: 255
          nullable: false
          description: >
            Recipient last name. Required unless `customer_account_token` is
            provided. Must be omitted if `customer_account_token` is provided.
          example: Rockets
        recipient_business_name:
          type: string
          maxLength: 150
          nullable: true
          description: Optional recipient business name.
          example: Rockets LLC
        account:
          type: string
          minLength: 1
          maxLength: 255
          nullable: false
          description: >
            Card account number. Required unless `customer_account_token` or
            `third_party_token` is provided. Must be omitted if either token is
            provided.
          example: '4111111111111111'
        expiration_date:
          type: string
          maxLength: 4
          pattern: ^[0-9]{2}(0[1-9]|1[0-2])$
          nullable: true
          description: >
            Card expiration date in YYMM format. Conditionally required based on
            client configuration (`expiration_date_enabled`). Not required if
            `customer_account_token` or `third_party_token` is provided.
          example: '2612'
        cvv:
          type: string
          pattern: ^[0-9]{3,4}$
          nullable: true
          description: >
            CVV value (3–4 digits depending on card type). Conditionally
            required based on client configuration (`cvv_enabled`). Never
            required if `customer_account_token` or `third_party_token` is
            provided.
          example: '123'
        recipient_address1:
          type: string
          minLength: 1
          maxLength: 255
          nullable: false
          description: >
            Recipient billing address line 1. Required unless
            `customer_account_token` is provided.
          example: 123 Main St
        recipient_address2:
          type: string
          maxLength: 255
          nullable: true
          description: Recipient billing address line 2.
          example: Apt 2
        recipient_city:
          type: string
          minLength: 1
          maxLength: 255
          nullable: false
          description: >
            Recipient billing city. Required unless `customer_account_token` is
            provided.
          example: Atlanta
        recipient_state:
          type: string
          minLength: 2
          maxLength: 2
          pattern: >-
            ^(?:A[LKSZRAEP]|C[AOT]|D[EC]|F[LM]|G[AU]|HI|I[ADLN]|K[SY]|LA|M[ADEHINOPST]|N[CDEHJMVY]|O[HKR]|P[ARW]|RI|S[CD]|T[NX]|UT|V[AIT]|W[AIVY])$
          nullable: false
          description: >
            Recipient billing state (standard US postal abbreviation). Required
            unless `customer_account_token` is provided.
          example: GA
        recipient_zip:
          type: string
          maxLength: 10
          pattern: ^[0-9]{5}(?:-[0-9]{4})?$
          nullable: false
          description: >
            Recipient billing zip code. 5-digit zip or zip+4 in xxxxx-xxxx
            format. Required unless `customer_account_token` is provided.
          example: '30313'
        recipient_phone:
          type: string
          maxLength: 10
          nullable: true
          description: 10-digit recipient phone number.
          example: '1231231234'
        participant_unique_id1:
          type: string
          minLength: 1
          maxLength: 255
          description: >
            Participant assigned ID to be associated with
            `customer_account_token` creation. Should correlate to participant
            assigned values affiliated with future process requests for tracking
            purposes (e.g. CustomerID or AccountID). Must not contain NPI data.
          example: 1f2739ed-3531-4af2-ae36-e6faf7936462
        participant_unique_id2:
          type: string
          maxLength: 255
          nullable: true
          description: >
            Optional second participant assigned ID to be associated with
            `customer_account_token` creation. Should be carried forward to
            future process requests for tracking purposes. Must not contain NPI
            data.
          example: 90759390-01c7-47e7-8a90-6faa89b18ff6
        store_id:
          type: string
          maxLength: 255
          nullable: true
          description: |
            Client assigned store ID. Required for Retail client participants.
          example: STORE-001
        terminal_id:
          type: string
          maxLength: 255
          nullable: true
          description: >
            Client assigned terminal ID. Required for Retail client
            participants.
          example: TERM-042
        clerk_id:
          type: string
          maxLength: 255
          nullable: true
          description: |
            Client assigned clerk ID. Required for Retail client participants.
          example: CLK-007
        timestamp:
          type: integer
          format: int64
          description: Unix timestamp of the request.
          example: 1576097158
        version:
          type: integer
          description: API version of the request. Current version is 11.
          example: 11
    VerifyCardResponse:
      type: object
      properties:
        status:
          type: integer
          description: >
            Numeric code describing the status of the API request. 100 =
            Success.
          example: 100
        client_message:
          type: string
          description: Text description associated with the status code.
          example: Success
        data:
          type: object
          properties:
            customer_account_token:
              type: string
              description: >
                GUID — unique value generated based upon account and recipient
                data. Use this token in all subsequent Process requests for this
                account.
              example: ca875cce-58c0-46a0-8f14-676190cc7df6
            last_4:
              type: string
              description: The last 4 digits of the card.
              example: '1111'
            request_timestamp:
              type: integer
              format: int64
              description: Unix timestamp of the request.
              example: 1576097360
            issuers:
              type: array
              description: Information about the issuer of the card.
              items:
                type: object
                properties:
                  payee_id:
                    type: string
                    description: The Ingo assigned ID for the payee.
                    example: '526263'
                  payee_name:
                    type: string
                    description: Name of the payee (issuer).
                    example: Bank of America - Platinum MasterCard and Visa
                  payee_address:
                    type: string
                    nullable: true
                    description: Payee address.
                    example: PO Box 15019
                  payee_city:
                    type: string
                    nullable: true
                    description: Payee city.
                    example: Wilmington
                  payee_state:
                    type: string
                    nullable: true
                    description: Payee state.
                    example: DE
                  payee_zip:
                    type: string
                    nullable: true
                    description: Payee zip code.
                    example: 19850-5019
                  credit_info:
                    type: object
                    nullable: true
                    description: >
                      Information regarding limits for push (credit to card)
                      transactions. Returned if participant is enabled for push
                      and card is enabled for push processing.
                    properties:
                      min:
                        type: string
                        description: >-
                          Minimum amount issuer will accept for a push
                          transaction.
                        example: '0.05'
                      max:
                        type: string
                        description: >-
                          Maximum amount issuer will accept for a push
                          transaction.
                        example: '1500.00'
                      card_type:
                        type: string
                        description: The type of card (e.g. Debit, Prepaid).
                        example: Debit
                      estimated_posting_time:
                        type: string
                        description: Estimated posting time narrative.
                        example: Payment will post within 5 minutes.
                      estimated_posting_date:
                        type: string
                        description: Estimated posting date in date format.
                        example: 04/21/2026
                  debit_info:
                    type: object
                    nullable: true
                    description: >
                      Information regarding limits for pull (debit from card)
                      transactions. Returned if participant is enabled for pull
                      and card is enabled for pull processing.
                    properties:
                      min:
                        type: string
                        description: >-
                          Minimum amount issuer will accept for a pull
                          transaction.
                        example: '0.05'
                      max:
                        type: string
                        description: >-
                          Maximum amount issuer will accept for a pull
                          transaction.
                        example: '1500.00'
                      card_type:
                        type: string
                        description: The type of card (e.g. Debit, Prepaid).
                        example: Debit
                  issuing_network:
                    type: string
                    description: Information regarding the issuing network of the card.
                    example: Visa
                  credit_enabled:
                    type: integer
                    enum:
                      - 0
                      - 1
                    description: >
                      Whether the card is enabled for push (credit)
                      transactions. 1 = Enabled, 0 = Not enabled.
                    example: 1
                  debit_enabled:
                    type: integer
                    enum:
                      - 0
                      - 1
                    description: >
                      Whether the card is enabled for pull (debit) transactions.
                      1 = Enabled, 0 = Not enabled.
                    example: 0
                  network_validation:
                    type: object
                    nullable: true
                    description: >-
                      Reference data from network card validation. Present when
                      network validation was performed for this account.
                    properties:
                      validation_provider_id:
                        type: string
                        maxLength: 3
                        description: >-
                          Card validation service provider. 1 = Visa, 3 =
                          MasterCard.
                        example: '1'
                      name_validation:
                        type: object
                        nullable: true
                        description: Name match validation results.
                        properties:
                          name_match_status:
                            type: string
                            maxLength: 3
                            description: >-
                              Whether name match was performed. 1 = Performed, 2
                              = Not performed, 3 = Not supported by provider, 4
                              = Client not configured.
                          name_match_decision:
                            type: string
                            maxLength: 3
                            nullable: true
                            description: >-
                              Overall name match result. 1 = Match, 2 = Partial
                              Match, 3 = No Match.
                          first_name_match_decision:
                            type: string
                            maxLength: 3
                            nullable: true
                            description: >-
                              First name match result. 1 = Match, 2 = Partial
                              Match, 3 = No Match.
                          last_name_match_decision:
                            type: string
                            maxLength: 3
                            nullable: true
                            description: >-
                              Last name match result. 1 = Match, 2 = Partial
                              Match, 3 = No Match.
                          middle_name_match_decision:
                            type: string
                            maxLength: 3
                            nullable: true
                            description: >-
                              Middle name match result. 1 = Match, 2 = Partial
                              Match, 3 = No Match.
            participant_unique_id1:
              type: string
              description: Echo of participant assigned ID for the verify request.
              example: 1f2739ed-3531-4af2-ae36-e6faf7936462
            participant_unique_id2:
              type: string
              nullable: true
              description: >
                Echo of optional second participant assigned ID for the verify
                request.
              example: 90759390-01c7-47e7-8a90-6faa89b18ff6
            expiration_date:
              type: string
              description: >
                Expiration date of the card associated with the
                customer_account_token in YYMM format. Retain this to provide
                expiration alerts to the cardholder.
              example: '2612'
            count:
              type: integer
              description: Always returns 1.
              example: 1
        time:
          type: string
          description: Time in seconds to complete the request.
          example: '2.4505'
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          example: 700
        client_message:
          type: string
          example: Account not currently available for payment
        data:
          type: object
          properties:
            request_timestamp:
              type: integer
              format: int64
              example: 1576097360
  securitySchemes:
    HmacAuth:
      type: apiKey
      in: header
      name: Authorization
      description: >-
        HMAC-SHA512 signed Authorization header. See the Authentication page for
        the complete signing guide.

````