---
title: "Track Card"
method: POST
path: "/issuers/{issuerId}/physicalCards/{cardId}/track"
---

# Track Card

`POST /issuers/{issuerId}/physicalCards/{cardId}/track`

This API is used by the issuer backend to request the shipment tracking of any card not personalized by Thales

## Request body

- union
  - object
    - `trackingType` 'PRODUCTION', required — The current status of card. - PRODUCTION: Track Card Production.
    - `productionSite` string, required — The factory where the card was produced.
  - object
    - `trackingType` 'SHIPMENT', required — The current status of card. - SHIPMENT: Track Card Production and Shipment.
    - `trackingNumber` string, required — The tracking number.
    - `postalCode` string — The destination postal Code.
    - `countryCode` string — The country code, based on ISO 3166-1 alpha-2 format
    - `shipmentDate` string, required — The date and time the card was shipped. Format: YYYY-MM-DDThh:mm:ssZ (UTC timezone only)
    - `productionSite` string, required — The factory where the card was produced.
  - object
    - `trackingType` 'RETURN', required — The current status of card. - RETURN: Track Card return.
    - `productionSite` string, required — The factory where the card was produced.

## Response `202`

Successful track card request

- CardOperationResponse — Operation information.
  - `operationId` string — Unique identifier of the operation

## Other responses

- `400` — Bad request due to invalid URI, headers, parameters, or payload.<br/> The below table defines the possible errors: | errorCode | error | Retry Possible | Comments | | -------------- | ------------| ----------| -----------------------------------| | - | - | no | General error with no further information provided. | | FIELD_INVALID_FORMAT | Field in error (first found) | no | A field does not match the expected format specified in the documentation. | | CRYPTO_ERROR | - | no | Decryption of the provided encrypted data failed. | | FIELD_INVALID_VALUE | Field in error (first found) | no | A field value is not permitted for the specified field. | | PARSING_ERROR | Field in error (first found) | no | Encrypted data is not a valid JSON string. |
- `401` — The provided Authorization header is missing or invalid
- `403` — Forbidden action, check the state of the linked end user (consumer) or account or digital card
- `404` — Resource not found
- `500` — Internal Server Error
- `503` — The service is temporarily unavailable. You may retry your request later.

---

[API](https://skmtc.net/thalescloud/apis/d1-oauth-api.md) · [All operations](https://skmtc.net/thalescloud/apis/d1-oauth-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/thalescloud/d1-oauth-api/revisions/96089514858c/schema)