> ## Documentation Index > Fetch the complete documentation index at: https://docs.useaxra.com/llms.txt > Use this file to discover all available pages before exploring further. # Tokenize card data for a session (iframe / allowed origins only) > Exchanges card details for a single-use token inside an open session, so the card number never reaches your own server. Callable only from an allow-listed origin — the browser `Origin` header is checked and a missing or unrecognised one is refused — and the session must still be live. Returns the token id with the card brand and last four digits. ## OpenAPI ````yaml /openapi.json post /api/v1/elements/tokenize openapi: 3.0.0 info: title: Axra Public API description: Merchant and third-party developer API surface version: '2026-04-15' contact: {} servers: - url: http://localhost:3001 description: Local development - url: https://staging-api.useaxra.com description: Staging - url: https://api.useaxra.com description: Production security: [] tags: - name: Authentication description: >- Exchange your API credentials for a short-lived bearer token, rotate a leaked key, and confirm which account a credential belongs to. Start here — every other operation on this page requires one of these credentials. - name: Payments description: >- Accept card payments server-to-server, or hand the customer a hosted checkout session, then complete 3-D Secure, retrieve, list and refund what you charged. Also exposes the fee schedule that applies to your own account. - name: Payment Links description: >- Shareable hosted payment pages. Create a link, send it to a customer and let us host the checkout, instead of building a payment page of your own. - name: Local Rails description: >- Collect from customers over local bank transfer and mobile money in supported markets. List the channels available for a country, currency and amount, then create a collection and poll it for the funds. - name: Corridor Status description: >- Whether a corridor is usable right now, per country, currency, method and direction. Poll this before you route a payment rather than discovering an outage by having one fail. The answer reflects end-to-end usability through Axra, not just whether an upstream network is reachable, and it is served from a cached measurement — so polling it is cheap and never blocks on an upstream check. - name: Elements description: >- Browser-side card tokenisation for the drop-in payment SDK. Your page exchanges card details for a single-use token, so raw card numbers never reach your server. - name: Customers description: >- Customers you have charged and the payment methods saved against them, so a returning buyer can pay without re-entering their card. - name: Payouts description: >- Send money out to a bank account or mobile money wallet. Quote a cross-currency payout before you commit to it, look up the destination networks for a corridor, then track or cancel what you sent. - name: Payout Recipients description: >- Saved payout destinations. Store a beneficiary once and reference it by id on later payouts, instead of resending full account details every time. - name: Payout Batches description: >- Pay many recipients in one submission — payroll and mass disbursement. A batch is created as a priced draft you can inspect, and only moves money once you submit it. - name: Payout Schedules description: >- Payouts that run later, once or on a repeating cadence. Authorize the schedule up front, then pause, resume, edit or cancel it. - name: Disputes description: >- Chargebacks raised against your payments. Review them, upload evidence to contest one, accept the loss, and set the defence policy applied on your behalf. - name: Fraud description: >- Your own fraud rules, evaluated on payments before they are charged, plus the block list those rules produce. Test a rule against a sample payload before enabling it. - name: Treasury — End-Users description: >- Banking-as-a-Service. The end-users your platform holds balances for — create one before provisioning a wallet or starting identity verification. - name: Treasury — KYC description: >- Identity verification for a treasury end-user: start a check and read its status. Sandbox-only helpers drive a pending check to approved or rejected so you can build against both outcomes. - name: Treasury — Wallets description: >- Currency-scoped balances held for an end-user. Provision a wallet, read its ledger balance and entries, and fetch the instructions a customer uses to fund it. - name: Treasury — Payouts description: >- Move money out of an end-user wallet, then track or cancel it while it is still pending. - name: Webhooks description: >- Register endpoints to receive signed event callbacks, inspect delivery attempts, replay a delivery and rotate a signing secret. The two products keep separate registries: `/webhook-endpoints` for the merchant API, `/treasury/webhook-endpoints` for treasury partners. paths: /api/v1/elements/tokenize: post: tags: - Elements summary: Tokenize card data for a session (iframe / allowed origins only) description: >- Exchanges card details for a single-use token inside an open session, so the card number never reaches your own server. Callable only from an allow-listed origin — the browser `Origin` header is checked and a missing or unrecognised one is refused — and the session must still be live. Returns the token id with the card brand and last four digits. operationId: ElementsController_tokenize parameters: [] requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/TokenizeElementsDto' responses: '200': description: OK content: application/json: schema: type: object properties: success: type: boolean example: true data: $ref: '#/components/schemas/ElementsTokenResponseDto' required: - success - data '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/HttpErrorEnvelopeDto' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/HttpErrorEnvelopeDto' '409': description: Conflict content: application/json: schema: $ref: '#/components/schemas/HttpErrorEnvelopeDto' '422': description: Unprocessable content: application/json: schema: $ref: '#/components/schemas/HttpErrorEnvelopeDto' '429': description: Too many requests content: application/json: schema: $ref: '#/components/schemas/HttpErrorEnvelopeDto' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/HttpErrorEnvelopeDto' components: schemas: TokenizeElementsDto: type: object properties: sessionId: type: string pattern: /^es_[a-f0-9]{32}$/i description: Session id returned from POST /elements/session example: es_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa number: type: string minLength: 12 maxLength: 19 pattern: /^\d+$/ example: '4242424242424242' expMonth: type: number minimum: 1 maximum: 12 example: 12 expYear: type: number minimum: 2024 maximum: 2100 example: 2030 cvc: type: string minLength: 3 maxLength: 4 pattern: /^\d+$/ example: '123' required: - sessionId - number - expMonth - expYear - cvc ElementsTokenResponseDto: type: object properties: id: type: string last4: type: string brand: type: string expiresInSeconds: type: number required: - id - last4 - brand - expiresInSeconds HttpErrorEnvelopeDto: type: object properties: success: type: boolean example: false error: $ref: '#/components/schemas/HttpErrorBodyDto' required: - success - error HttpErrorBodyDto: type: object properties: code: type: string example: VALIDATION_ERROR message: type: string example: email must be an email statusCode: type: number example: 400 errors: type: object description: >- Optional per-field validation messages (when present on the source exception) additionalProperties: type: array items: type: string required: - code - message - statusCode ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.