Skip to main content

Tokens

List or delete a customer's saved card tokens.

Use this API to display a customer's saved cards in your checkout UI, or to honor a customer's request to remove a stored payment method.

info

If a request returns error_codes: ["forbidden"], the request is being blocked at the account or network level rather than rejected for being malformed. Verify your IP/network is allowlisted for your merchant account and retry.

The LIST sample below uses the same c_token created via Tokenization — Pay + Save on the Payment page, so you can see it appear in LIST. The DELETE sample further below uses a separate token.

Endpoint​

MethodPOST
Path/cards/tokens
Sandboxhttps://sandbox.simpaisa.com/cards/tokens

Headers​

HeaderValue
client-idYour Client ID (e.g. YOUR_CLIENT_ID)
Content-Typeapplication/json
merchantIdYour unique merchant ID (e.g. YOUR_MERCHANT_ID)
modecards
regionPK
versionV5

Request Body​

ParameterRequiredDescription
request.apiOperationYesLIST to retrieve all active saved cards, or DELETE to remove a specific card
request.customer_idYesThe cref_ value identifying the customer — nested under request, not top-level
request.c_tokenOnly for DELETEThe c_token value to delete
signatureYesRSA signature of the request object

Response Body​

LIST​

ParameterDescription
response.customer_idThe cref_ queried
response.countNumber of active tokens returned
response.tokens[].c_tokenSaved card token
response.tokens[].card_schemee.g. Visa
response.tokens[].last_fourLast 4 digits of the card
response.tokens[].expiry_monthCard expiry month
response.tokens[].expiry_yearCard expiry year
response.tokens[].statusACTIVE
response.tokens[].created_onISO timestamp the token was created
signatureRSA signature of the response body

DELETE​

ParameterDescription
response.customer_idThe cref_ the token belonged to
response.c_tokenThe deleted token
response.statusDELETED
response.response_summarye.g. "Card removed successfully."
signatureRSA signature of the response body

Samples​

Request​

curl --location 'https://sandbox.simpaisa.com/cards/tokens' \
--header 'client-id: YOUR_CLIENT_ID' \
--header 'merchantId: YOUR_MERCHANT_ID' \
--header 'mode: cards' \
--header 'region: PK' \
--header 'version: V5' \
--header 'Content-Type: application/json' \
--data-raw '{
  "request": {
    "apiOperation": "LIST",
    "customer_id": "cref_1f330571755c11f18b1702eb53"
  },
  "signature": "AUTOGENERATED"
}'

Response​

{
    "response": {
        "customer_id": "cref_1f330571755c11f18b1702eb53",
        "count": 1,
        "tokens": [
            {
                "c_token": "ct_v1_c0091c45-a7ff-4728-88ee-834b284848fc",
                "card_scheme": "Visa",
                "last_four": "1111",
                "expiry_month": "03",
                "expiry_year": "2030",
                "status": "ACTIVE",
                "created_on": "2026-07-01T14:50:53Z"
            }
        ]
    },
    "signature": "YOUR_SIGNATURE"
}

Note this c_token (ct_v1_c0091c45-a7ff-4728-88ee-834b284848fc) and customer_id (cref_1f330571755c11f18b1702eb53) are the exact same values from the Tokenization — Pay + Save and Direct Charge samples, and the Capture Successful / Successful Tokenization Inquiry Inquiry samples — confirming the full lifecycle (create → charge/capture → direct-charge → list) on one real token.