---
title: "Generate Network Token Cryptogram"
method: POST
path: "/network-tokens/cryptograms"
---

# Generate Network Token Cryptogram

`POST /network-tokens/cryptograms`

Generates a fresh, single-use network token cryptogram for a vaulted card, so it can be authorized on an external PSP. Available only to PCI-certified merchants with the product enabled.

## Request body

- object
  - `vaulted_token` string, uuid, required — The vaulted token of the card, the same identifier used as `payment_method.vaulted_token` in [Create Payment](https://docs.y.uno/reference/create-payment). The card must be an enrolled card of your organization with an active network token.
  - `country` string, required — ISO 3166-1 alpha-2 country code where the token will be used. Resolves the network token onboarding (organization + brand + country), with the same semantics as `country` in Create Payment.
  - `amount` object — Optional. Forwarded to the scheme; recommended, as some scheme flows bind the amount.
    - `currency` string — ISO 4217 currency code.
    - `value` number — Amount value in the given currency.

## Response `201`

Cryptogram generated.

- object
  - `vaulted_token` string — Echo of the request's vaulted token.
  - `network_token` object — The card's current network token. Same shape returned by the PCI network-token retrieval.
    - `network` string — Card network.
    - `number` string — The current DPAN (device/network PAN). **Always submit this value with the returned `cryptogram`** — never a previously stored DPAN.
    - `status` unknown
    - `par` unknown
    - `network_token_id` unknown
    - `token_data` object
      - `iin` string
      - `lfd` string — Last four digits of the DPAN.
      - `expiration_month` integer
      - `expiration_year` integer
  - `cryptogram` string — A fresh, single-use cryptogram from the scheme, generated on every call. Submit it together with `network_token.number` (DPAN) and `eci` to your PSP.
  - `eci` unknown
  - `created_at` string, date-time — Issuance timestamp (UTC).

## Other responses

- `400` — Bad request — `INVALID_REQUEST`, `INSTRUMENT_NOT_TOKENIZABLE`, `PAYMENT_METHOD_NOT_ENROLLED`, `NETWORK_TOKEN_NOT_FOUND`, `TOKEN_NOT_ACTIVE`, `NETWORK_NOT_SUPPORTED`, or `COUNTRY_NOT_SUPPORTED`.
- `403` — Forbidden — `PCI_MERCHANT_REQUIRED` (organization is not a PCI-certified merchant) or `PRODUCT_NOT_ENABLED` (product flag is off for the organization).
- `404` — Not found — `PAYMENT_METHOD_NOT_FOUND`. The `vaulted_token` does not exist or does not belong to your organization (identical response, no existence leak).
- `502` — Provider error — `PROVIDER_ERROR`. The card scheme (Visa VTS / Mastercard MDES) could not be reached or returned an error.

---

[API](https://skmtc.net/y/apis/ai-caller.md) · [All operations](https://skmtc.net/y/apis/ai-caller/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/y/ai-caller/revisions/05b629819b49/schema)