---
title: "Get Token List"
method: POST
path: "/tokenization/v2/get-token"
tags: ["Token Management"]
---

# Get Token List

`POST /tokenization/v2/get-token`

Returns all active tokens for a customer.

## Headers

- `Client-Id` string, required
- `Accept` string, required

## Request body

- GetTokenRequest
  - `customer` object, required — Customer identification
    - `id` string, required — Merchant customer identifier. Must not be blank.
  - `channel` object — Optional channel filter. Omit to return tokens across all channels.
    - `id` 'CREDIT_CARD' | 'DIRECT_DEBIT' | 'EMONEY' | 'KARTU_KREDIT_INDONESIA' — Payment channel identifier
  - `issuer` object — Optional issuer filter.
    - `id` string — Issuer identifier (e.g., bank code or e-wallet name)

## Response `200`

Token list retrieved successfully

- GetTokenResponse — List of active tokens for the customer
  - `customer` object — Echoes back the resolved customer identifier
    - `id` string — Merchant customer identifier
  - `tokens` union[] — List of active tokens. Each item is one of: - `TokenCC` — for `CREDIT_CARD` channel - `Token` — for `DIRECT_DEBIT`, `EMONEY`, and `KARTU_KREDIT_INDONESIA` channels
    - union
      - TokenCC — Credit card network token. Always returned for CREDIT_CARD channel. `metadata` is null when VTS metadata is not available for this token. Fields with null values are omitted from the response (`@JsonInclude(NON_NULL)`).
        - `id` string — Token identifier (Visa network token value stored as gateway token ID)
        - `masked_account` string — Masked PAN. First 6 and last 4 digits visible, middle masked (e.g., `411111xxxxxx1111`).
        - `metadata` VtsCardMetadata — Subset of VTS GetCardMetadata response stored against the token
          - `vPanEnrollmentID` string — VTS PAN enrollment identifier
          - `status` string — Overall VTS enrollment status for this PAN
          - `paymentInstrument` object — Payment instrument details from VTS
            - `last4` string — Last 4 digits of the PAN
            - `expirationDate` object
              - …
            - `paymentAccountReference` string — Payment Account Reference (PAR)
          - `tokens` object[] — VTS provisioned token entries for this PAN
            - `vProvisionedTokenID` string — VTS Provisioned Token ID
            - `tokenStatus` string — VTS token status (e.g., ACTIVE, INACTIVE, SUSPENDED)
          - `cardMetaData` object — Card display metadata (branding colors, issuer contact information)
            - `backgroundColor` string
            - `foregroundColor` string
            - `labelColor` string
            - `contactWebsite` string
            - `contactEmail` string
            - `contactNumber` string
            - `contactName` string
            - `shortDescription` string
        - `card` TokenCCCard — Card details attached to a credit card token
          - `name` string — Cardholder name
          - `expiry` string — Masked expiry date. Month is visible, year is masked (e.g., `12/**`).
          - `bin` string — Bank Identification Number — first 6–8 digits of the PAN
          - `brand` string — Card network brand
          - `issuer` string — Card-issuing bank name
          - `country` string — Card country code (ISO 3166-1 alpha-2)
          - `encrypted_expiry` string — AU-Sec encrypted expiry date (original encrypted value from provisioning)
          - `hashed_card_number` string — HMAC-SHA512 of the plaintext card number, keyed with merchant-specific secret. Empty string if hashing fails.
          - `payer_account_id` string — Same value as `hashed_card_number`. Used as the VTS Payer Account ID.
      - Token — Token for non-credit-card channels (DIRECT_DEBIT, EMONEY, KARTU_KREDIT_INDONESIA). - `auth_code` is present only for DIRECT_DEBIT. - `encrypted_card_number` is present only for KARTU_KREDIT_INDONESIA. Fields with null values are omitted from the response (`@JsonInclude(NON_NULL)`).
        - `id` string — Token identifier (SHA-512 hash stored as the gateway token)
        - `masked_account` string — Masked account number. Format depends on channel: - DIRECT_DEBIT / EMONEY: first 6 digits visible, last 4 visible, middle masked (e.g., `123456xxxxxx7890`) - KARTU_KREDIT_INDONESIA: same masking pattern
        - `auth_code` string, nullable — Authorization code — 40-character string. Present for DIRECT_DEBIT only.
        - `encrypted_card_number` string, nullable — AU-Sec encrypted card number. Present for KARTU_KREDIT_INDONESIA only.

## Other responses

- `400` — Bad request.
- `500` — Internal server error — e.g., decryption failure or downstream service error

---

[API](https://skmtc.net/doku/apis/direct-debit-core-system-notify-binding-to-merchant-emoney-o.md) · [All operations](https://skmtc.net/doku/apis/direct-debit-core-system-notify-binding-to-merchant-emoney-o/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/doku/direct-debit-core-system-notify-binding-to-merchant-emoney-o/revisions/7887174f57bc/schema)