Turn card details into a single-use tok_ token. Only the Zenoz card-field iframes call this.
Merchants never call this endpoint directly. Sending card data from your own page or server would bring it into your PCI scope. Use monarch-zenoz.js, which calls it from inside the iframes.
The request must come from the Zenoz fields origin (http://fields.localhost:6500, https://fields.sandbox.zenoz.ai, https://cloud.zenoz.ai), or it gets 403 ORIGIN_NOT_ALLOWED. parent_origin, the merchant page, must be on the key's allowed origins.
The response holds a tok_ token that is bound to the payment intent, usable once and valid for 15 minutes, plus card display details. The CVC is kept encrypted only until the payment is authorized.
Local and sandbox deployments accept only published test cards. Any other card number gets 400 TEST_MODE_LIVE_CARD and nothing is stored. On production this endpoint returns 404 until card capture is enabled. Validation errors name the field, never the value.
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
CARD_DECLINED — refused by a card-testing control (prior declines on this card, bot signals). The response never says which rule fired.
RATE_LIMITED — more than 5 tokenize attempts on this intent, a velocity window (key / IP / card / BIN / distinct cards per IP), or the merchant's decline-rate breaker. Limits are deployment config (COCOON_VELOCITY_LIMITS). The rule is never named.
Card tokenization is not configured on this deployment (live without CARD_FINGERPRINT_KEY).