# Create a delegated payment token

Tokenizes a credential for controlled usage by the merchant's PSP per the **Allowance** constraints.
Exactly one credential type is currently supported: **card**.

Endpoint: POST /sessions/agentic_commerce/delegate_payment
Version: 2025-09-29
Security: bearerAuth

## Security:

  - `bearerAuth` (unknown)
    http bearer API Key

## Header parameters:

  - `Authorization` (string, required)

  - `Content-Type` (string, required)

  - `Accept-Language` (string)

  - `User-Agent` (string)

  - `Idempotency-Key` (string)

  - `Request-Id` (string)

  - `Signature` (string)

  - `Timestamp` (string)

  - `API-Version` (string, required)

## Request fields (application/json):

  - `payment_method` (object, required)

  - `payment_method.type` (string, required)
    Enum: "card"

  - `payment_method.card_number_type` (string, required)
    Enum: "fpan", "network_token"

  - `payment_method.number` (string, required)
    network token or fallback fpan value

  - `payment_method.exp_month` (string)

  - `payment_method.exp_year` (string)

  - `payment_method.name` (string)

  - `payment_method.cvc` (string)

  - `payment_method.cryptogram` (string)

  - `payment_method.eci_value` (string)

  - `payment_method.checks_performed` (array)

  - `payment_method.iin` (string)

  - `payment_method.display_card_funding_type` (string, required)
    Enum: "credit", "debit", "prepaid"

  - `payment_method.display_wallet_type` (string)

  - `payment_method.display_brand` (string)

  - `payment_method.display_last4` (string)

  - `payment_method.metadata` (object, required)

  - `allowance` (object, required)

  - `allowance.reason` (string, required)
    Enum: "one_time"

  - `allowance.max_amount` (integer, required)
    Minor units (e.g., $20 → 2000)

  - `allowance.currency` (string, required)
    ISO-4217 lowercase (e.g., usd)

  - `allowance.checkout_session_id` (string, required)

  - `allowance.merchant_id` (string, required)

  - `allowance.expires_at` (string, required)

  - `billing_address` (object)

  - `billing_address.name` (string, required)

  - `billing_address.line_one` (string, required)

  - `billing_address.line_two` (string)

  - `billing_address.city` (string, required)

  - `billing_address.state` (string, required)

  - `billing_address.country` (string, required)
    ISO-3166-1 alpha-2

  - `billing_address.postal_code` (string, required)

  - `risk_signals` (array, required)

  - `risk_signals.type` (string, required)
    Enum: "card_testing"

  - `risk_signals.score` (integer, required)

  - `risk_signals.action` (string, required)
    Enum: "blocked", "manual_review", "authorized"

  - `metadata` (object, required)

## Request examples:

  - `Card (FPAN) — success` (unknown)

## Response 201:

  - `201` (unknown)
    Created

## Response 201 fields (application/json):

  - `id` (string, required)
    Unique vault token identifier (vt_...)

  - `created` (string, required)

  - `metadata` (object, required)

## Response 201 headers (application/json):

  - `Request-Id` (string)
    Echo of the request correlation ID

## Response 400:

  - `400` (unknown)
    Bad Request

## Response 400 fields (application/json):

  - `type` (string, required)
    Enum: "invalid_request", "rate_limit_exceeded", "processing_error", "service_unavailable"

  - `code` (string, required)
    Enum: "invalid_card", "duplicate_request", "idempotency_conflict"

  - `message` (string, required)

  - `param` (string)
    JSONPath of offending field

## Response 401:

  - `401` (unknown)
    Unauthorized

## Response 401 fields (application/json):

  - `type` (string, required)
    Enum: "invalid_request", "rate_limit_exceeded", "processing_error", "service_unavailable"

  - `code` (string, required)
    Enum: "invalid_card", "duplicate_request", "idempotency_conflict"

  - `message` (string, required)

  - `param` (string)
    JSONPath of offending field

## Response 409:

  - `409` (unknown)
    Idempotency conflict

## Response 409 fields (application/json):

  - `type` (string, required)
    Enum: "invalid_request", "rate_limit_exceeded", "processing_error", "service_unavailable"

  - `code` (string, required)
    Enum: "invalid_card", "duplicate_request", "idempotency_conflict"

  - `message` (string, required)

  - `param` (string)
    JSONPath of offending field

## Response 422:

  - `422` (unknown)
    Semantic validation error

## Response 422 fields (application/json):

  - `type` (string, required)
    Enum: "invalid_request", "rate_limit_exceeded", "processing_error", "service_unavailable"

  - `code` (string, required)
    Enum: "invalid_card", "duplicate_request", "idempotency_conflict"

  - `message` (string, required)

  - `param` (string)
    JSONPath of offending field

## Response 429:

  - `429` (unknown)
    Rate limit exceeded

## Response 429 fields (application/json):

  - `type` (string, required)
    Enum: "invalid_request", "rate_limit_exceeded", "processing_error", "service_unavailable"

  - `code` (string, required)
    Enum: "invalid_card", "duplicate_request", "idempotency_conflict"

  - `message` (string, required)

  - `param` (string)
    JSONPath of offending field

## Response 500:

  - `500` (unknown)
    Processing error

## Response 500 fields (application/json):

  - `type` (string, required)
    Enum: "invalid_request", "rate_limit_exceeded", "processing_error", "service_unavailable"

  - `code` (string, required)
    Enum: "invalid_card", "duplicate_request", "idempotency_conflict"

  - `message` (string, required)

  - `param` (string)
    JSONPath of offending field

## Response 503:

  - `503` (unknown)
    Service unavailable

## Response 503 fields (application/json):

  - `type` (string, required)
    Enum: "invalid_request", "rate_limit_exceeded", "processing_error", "service_unavailable"

  - `code` (string, required)
    Enum: "invalid_card", "duplicate_request", "idempotency_conflict"

  - `message` (string, required)

  - `param` (string)
    JSONPath of offending field

## Response 201 examples:

  - `created` (unknown)

## Response 400 examples:

  - `invalid_request_missing_field` (unknown)

## Response 401 examples:

  - `unauthorized` (unknown)

## Response 409 examples:

  - `idem_conflict` (unknown)

## Response 422 examples:

  - `invalid_request` (unknown)

## Response 429 examples:

  - `rate_limit_exceeded` (unknown)

## Response 500 examples:

  - `internal_server_error` (unknown)

## Response 503 examples:

  - `service_unavailable` (unknown)