---
title: "Get Apple Pay token metadata"
method: POST
path: "/payment-instruments/apple-pay/query"
tags: ["Payment Instrument Tokenization"]
---

# Get Apple Pay token metadata

`POST /payment-instruments/apple-pay/query`

Apple Pay tokens contain encrypted data that only BR-DGE can decrypt. This endpoint lets you access that previously encrypted data, along with Bank Identifier Number (BIN) lookup data derived from the decrypted Apple Pay DPAN. This is particularly useful for performing your own pre-payment checks.

## Request body

- ApplePayTokenRequest
  - `token` string — If you are directly integrating with Apple Pay APIs on your client app then please refer to our [Apple Pay REST API guide] for details on how to generate an Apple Pay token for BR-DGE Payments. Alternatively you can use the [BR-DGE Web SDK Apple Pay module] to directly generate Apple Pay tokens for BR-DGE Payments. [Apple Pay REST API guide]: https://docs.br-dge.io/docs/rest-api-apple-pay [BR-DGE Web SDK Apple Pay module]: https://docs.br-dge.io/docs/apple-pay-module

## Response `200`

Successful retrieval of Apple Pay details

- ApplePayDetails — Decrypted Apple Pay information and card metadata
  - `metadata` CardMetadata — If a card payment instrument is used then BR-DGE may be able to provide metadata about the card **Please note: All text will be UPPERCASE and all fields can be null**
    - `metadataType` string — Discriminator field. Discriminator field. Please see the discriminator mapping for the PaymentInstrumentMetadata schema.
    - `cardBrand` string — MASTERCARD, VISA, etc
    - `issuer` string — Name of issuing bank
    - `type` 'DEBIT' | 'CREDIT' | 'CHARGE_CARD' | 'CHARGE' | 'DEFERRED_DEBIT' | 'PREPAID' | 'PREPAID_RELOADABLE' | 'UNKNOWN'
    - `category` string — CLASSIC, BUSINESS, MIXED_PRODUCT, etc
    - `countryIsoA2` string — ISO 3166 Alpha-2 Country code
    - `commercial` boolean — Indicates if the card is corporate or retail
    - `bin` string — The Bank Identification Number that identifies the bank or financial institution that issued the card
  - `expiryDate` string — Card expiry date in MM-YY format.
  - `fingerprint` string — A unique token that can be used to detect if two BR-DGE tokens represent the same underlying Payment Instrument.
  - `fingerprintExtended` string — A fingerprint with card expiry date appended in MMYY format.
  - `decryptedPayload` ApplePayDecryptedPayload — [Apple Pay decrypted payload] excluding sensitive fields, such as cryptogram [Apple Pay decrypted payload]: https://developer.apple.com/documentation/passkit_apple_pay_and_wallet/apple_pay/payment_token_format_reference#3949536
    - `applicationPrimaryAccountNumber` string, required — Device-specific account number of the card that funds this transaction
    - `applicationExpirationDate` string, required — Card expiration date in the format YYMMDD
    - `currencyCode` string, required — ISO 4217 numeric currency code, as a string to preserve leading zeros
    - `transactionAmount` integer, required — Transaction amount in the lowest denomination of the given currency
    - `cardholderName` string — Optional field containing cardholder's name if present
    - `deviceManufacturerIdentifier` string, required — Hex-encoded device manufacturer identifier
    - `paymentDataType` '3DSecure' | 'EMV', required — Transaction type. EMV relates to POS terminal transactions. 3D-Secure relates to ecommerce transactions.
    - `paymentData` ApplePayDecryptedPaymentData, required — Detailed payment data, excluding cryptogram
      - `eciIndicator` integer — Optional. ECI indicator, as defined by 3D-Secure. The card network may add an ECI indicator to the payment data that the payment token includes.
    - `transactionId` string, required — Transaction identifier, generated on the device. Retrieved from [header] of decoded Apple Pay token. [header]: https://developer.apple.com/documentation/passkit_apple_pay_and_wallet/apple_pay/payment_token_format_reference#3949539

## Other responses

- `400` — Bad request - the request was in an invalid format or contained invalid information. If have any questions about why you are receiving these responses, please raise a ticket with support on the BR-DGE Support Portal at <https://docs.br-dge.io/docs/support#contact-support> with the `id` from the response so we can track down the individual requests on our end.
- `401` — Unauthorized request.
- `500` — An internal server error occurred upstream while processing the request. If you have any questions about why you are receiving these responses, please raise a ticket with support on the BR-DGE Support Portal at <https://comcarde.atlassian.net/servicedesk/customer/portals> with the `id` from the response so we track down the individual requests on our end.

---

[API](https://skmtc.net/br-dge/apis/br-dge-transaction-rest-api.md) · [All operations](https://skmtc.net/br-dge/apis/br-dge-transaction-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/br-dge/br-dge-transaction-rest-api/versions/a9c0feac5523/schema)