---
title: "Create a cryptogram for a Card-on-File"
method: POST
path: "/payment-instruments/{token}/network-token-cryptogram"
tags: ["Payment Instrument Tokenization"]
---

# Create a cryptogram for a Card-on-File

`POST /payment-instruments/{token}/network-token-cryptogram`

## Response `201`

Cryptogram created.

- CryptogramProvisioningResponse — A provisioned network token cryptogram. This cryptogram field will only be included if `networkTokenProvisioning` is set to `cryptogram` and the cryptogram provisioning succeeds.
  - `cryptogram` string, required — The cryptogram value, from the provider of the Network Token. This value is one time use, for subsequent payments a new cryptogram should be retrieved.
  - `eci` string, required — The electronic commerce indicator (ECI).
  - `networkToken` NetworkToken — Information about a Network Token.
    - `id` string, required — A unique identifier that represents the token associated with a card enrolled into the Card Network Service
    - `token` string — The unique token for the enrolled PAN which can be used in authorization as per ISO/IEC 7812 format. This will only be available once a cryptogram has been provisioned at least once.
    - `expiryDate` string, required — Expiration date of the token, noted in MM-YY format
    - `issuer` 'MASTERCARD' | 'VISA', required — The issuing card network of the Network Token
    - `status` 'ACTIVE' | 'DISABLED' | 'DELETED', required — The status of the Network Token. - `ACTIVE`: Can be used to provision Cryptograms for payments. - `DISABLED`: This can be due to card suspensions, fraud, or other temporary hold reasons and may be re-activated at a later date. - `DELETED`: The token is no longer valid and cannot be re-activated. This can be due to token expirations, lost card or other non-temporary reasons.
    - `tokenUniqueReference` string, required — Unique identifier for the Network Token provided by the Card Network
    - `paymentAccountReference` string, required — A non-financial reference assigned to each unique funding PAN (FPAN) that's used to link the payment account of that PAN to affiliated payment tokens. See our [dedicated PAR guide](https://docs.br-dge.io/docs/payment-account-reference) for more info.
    - `lastFour` string — Last four digits of the Network Token
    - `cardBin` string — BIN of the associated associated Card
    - `cardLastFour` string — Last four digits of the associated Card
    - `cardExpiryDate` string — Expiration date of the associated Card, noted in MM-YY Format
    - `cardIssuer` string — Name of the issuing bank

## Other responses

- `400` — Unable to provision Cryptogram - Bad Request
- `401` — Unauthorized request.
- `403` — Functionality not enabled for retail channel.
- `404` — The specified entity was not found.
- `500` — An internal server error occurred upstream while processing the request. If you have any questions about why you are receiving these responses, please raise a ticket with support on the BR-DGE Support Portal at <https://comcarde.atlassian.net/servicedesk/customer/portals> with the `id` from the response so we track down the individual requests on our end.

---

[API](https://skmtc.net/br-dge/apis/br-dge-transaction-rest-api.md) · [All operations](https://skmtc.net/br-dge/apis/br-dge-transaction-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/br-dge/br-dge-transaction-rest-api/versions/a9c0feac5523/schema)