Authorize a BT session for card

Request

🔒 Private label — contact sales. Requires a private-label entitlement on your API client.

Authorizes a Basis Theory session so the caller can reveal sensitive card details (PAN/CVV). Accessible by CARD_USER and admin roles. The nonce must be obtained from a BT session created client-side, and the VCN must belong to the authenticated employee.

Security

oauth2ClientCredentials(Required scopes: cards:write)

org_wallet_refstring

Organization wallet reference, defaults to "1" if not provided

business_idstringrequired

Business identifier for the request

Bodyapplication/jsonrequired

BT session authorization details

noncestringrequired

Nonce value for BT session authorization

Example:"abc123def456"

vcnstringrequired

Virtual Card Number (VCN) for authorization

Example:"4532123456789012"

curl -i -X POST \
  https://developer.boyahq.com/_mock/v2/openapi/cards/authorize \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -H 'business_id: string' \
  -H 'org_wallet_ref: string' \
  -d '{
    "nonce": "abc123def456",
    "vcn": "4532123456789012"
  }'

Responses

BT session authorized successfully