---
title: "Request PIN Control access token by plasticId."
method: POST
path: "/v2/plastic/{plasticId}"
tags: ["PIN Control handling"]
---

# Request PIN Control access token by plasticId.

`POST /v2/plastic/{plasticId}`

This operation is used to create the PIN control access token.

The successful response from this call returns an _id_, a _pinURL_ for mobile device webview and _pinFrameURL_
for an iframe in desktop browser flow. _Id_ is valid for 30 seconds.

For mobile webview, device should be instructed to do a POST call to the _pinURL_ with the content of the _id_
in a form field named _controlId_.

For desktop browser flow, iframe should be opened to _pinFrameURL_ with query parameter _key_, which needs
to be agreed with Enfuce beforehand. After iframe has been loaded, browser should make 
a _window.postMessage()_ call to the iframe. The message object should contain fields _operation_ 
(with value _view-pin_ or _set-pin_) and _controlId_.

## Path parameters

- `plasticId` string, biginteger, required

## Query parameters

- `auditUser` string, required

## Request body

- PinControlResourceBody
  - `scope` 'VIEW_PIN' | 'SET_PIN', required — Describes the scope of the operation that is authorized by the user.

## Response `201`

Successful creation of the access token

- PinControlResponseBody
  - `id` string, required — The ID of this PIN Control access token.
  - `pinURL` string — The URL that the cardholder's mobile device webview should browse to for accessing the PIN.
  - `pinFrameURL` string — The URL of the iframe for desktop browser based flows for accessing PIN.

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Card not Found
- `500` — Internal server error

---

[API](https://skmtc.net/enfuce/apis/transfer-api.md) · [All operations](https://skmtc.net/enfuce/apis/transfer-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/enfuce/transfer-api/versions/dc4a41118f80/schema)