Retrieve digital wallet token PAN - Marqeta Docs

GET///

Use this endpoint if Marqeta is your card issuer. If you use Marqeta only for tokenization as a service, use the Tokenization-as-a-Service endpoint instead.

Use this endpoint to retrieve a digital wallet token with the entire primary account number (PAN) displayed. The PAN returned is of the digital wallet token and not of the card. For security reasons, the PAN is not fully visible on the digital wallet token returned by GET /digitalwallettokens/{token}.

Sending a request to this endpoint requires Payment Card Industry (PCI) Data Security Standard (DSS) compliance. You must comply with PCI DSS data security requirements if you want to store, transmit, or process sensitive card data such as the cardholder’s PAN, personal identification number (PIN), and card expiration date.

URL path parameters

Fields	Description
token string Required	Unique identifier of the digital wallet token (DWT). Allowable Values: Existing DWT token

Response body

Fields	Description
address_verification object Conditionally returned	Contains address verification information. Allowable Values: `name`, `postal_code`, `street_address`, `zip`
address_verification.name string Conditionally returned	Name of the cardholder. Allowable Values: 40 char max
address_verification.postal_code string Conditionally returned	Postal code. Allowable Values: 10 char max
address_verification.street_address string Conditionally returned	Street address provided by the cardholder. Allowable Values: 40 char max
address_verification.zip string Conditionally returned	United States ZIP code. Allowable Values: 10 char max
card_token string Conditionally returned	Unique identifier of the card. Allowable Values: Existing card token
created_time datetime Conditionally returned	Date and time when the digital wallet token object was created, in UTC. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
device object Conditionally returned	Contains information related to the device being provisioned. Allowable Values: `device_id`, `ip_address`, `language_code`, `location`, `name`, `phone_number`, `token`, `type`
device.device_id string Conditionally returned	Identity number of the device. Allowable Values: 24 char max
device.ip_address string Conditionally returned	Device’s IP address. Allowable Values: IP address format, 50 char max
device.language_code string Conditionally returned	Language the device is configured to use. Allowable Values: 50 char max
device.location string Conditionally returned	Geographic coordinates of the device. Allowable Values: Latitude and longitude in `DDD.DD/DDD.DD` format. NOTE: Both the longitude and latitude are prefixed with either a `+` or `-` symbol, for example: `+42.29/-71.07`.
device.name string Conditionally returned	Name of the device. Allowable Values: 50 char max
device.phone_number string Conditionally returned	Device’s telephone number. Allowable Values: 50 char max
device.token string Conditionally returned	Unique identifier of the device object. Allowable Values: 36 char max
device.type string Conditionally returned	Type of device being provisioned. Allowable Values: `MOBILE_PHONE`, `WATCH`, `TABLET`, `MOBILE_PHONE_OR_TABLET`, `VEHICLE`, `APPLIANCE`, `LAPTOP`, `GAMING_DEVICE`, `WEARABLE_DEVICE`, `UNKNOWN`
fulfillment_status string Conditionally returned	Digital wallet token’s provisioning status. For fulfillment status descriptions, see Create digital wallet token transition. Allowable Values: `DECISION_RED`, `DECISION_YELLOW`, `DECISION_GREEN`, `REJECTED`, `PROVISIONED`
issuer_eligibility_decision string Conditionally returned	Indicates whether the Marqeta platform provisions the digital wallet token: - `0000` – The Marqeta platform provisions the token. - `token.activation.verification.required` – Provisioning is pending; further action is required for completion. - `token.activation.verification.required.tspdecision` – Provisioning is pending; the card network’s risk engine flagged the request for additional review. - `decision due to TSP risk manager` – Provisioning is pending; the card network’s risk engine flagged the request for additional review. For all other values, check the value of the `fulfillment_status` field to determine the provisioning outcome. NOTE: The value `invalid.cid` indicates an invalid CVV2 number. Allowable Values: `0000`, `cardaccount.verified`, `card.suspicious`, `token.activation.verification.required`, `token.activation.verification.required.tspdecision`, `decision due to TSP risk manager`, `token.activation-request.decline`, `card.not.active`, `invalid.cid`, `card.expired`, `card.suspended`, `cardholder.not.active`
last_modified_time datetime Conditionally returned	Date and time when the digital wallet token object was last modified, in UTC. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
metadata object Conditionally returned	Contains additional information about the digital wallet token. Allowable Values: `cardproduct_preferred_notification_language`, `issuer_product_config_id`
metadata.cardproduct_preferred_notification_language string Conditionally returned	Language specified in the `config.transaction_controls.notification_language` field of the card product: - ces – Czech - deu – German - eng – English - fra – French - ell – Greek - ita – Italian - nld – Dutch - pol – Polish - por – Portuguese - ron – Romanian - spa – Spanish - swe – Swedish By default, notifications are sent in English. The ISO maintains the full list of ISO 3166 two- and three-digit numeric country codes. Allowable Values: `ces`, `deu`, `eng`, `fra`, `ell`, `ita`, `nld`, `pol`, `por`, `ron`, `spa`, `swe`
metadata.issuer_product_config_id string Conditionally returned	Unique identifier of the product configuration on the Marqeta platform. Allowable Values: 255 char max
state string Conditionally returned	State of the digital wallet token. For state descriptions, see Transitioning Token States. Allowable Values: `REQUESTED`, `REQUEST_DECLINED`, `ACTIVE`, `SUSPENDED`, `TERMINATED`
state_reason string Conditionally returned	Reason why the digital wallet token transitioned to its current state. Allowable Values: 255 char max
token string Conditionally returned	Unique identifier of the digital wallet token. Allowable Values: Existing digital wallet token.
token_service_provider object Conditionally returned	Contains information held and provided by the token service provider (card network). Allowable Values: `correlation_id`, `pan_reference_id`, `token_assurance_level`, `token_assurance_method`, `token_eligibility_decision`, `token_expiration`, `token_pan`, `token_provisioning_insight_data`, `token_reference_id`, `token_requestor_id`, `token_requestor_name`, `token_score`, `token_type`
token_service_provider.correlation_id string Conditionally returned	For Mastercard only. Unique value representing a tokenization request. Allowable Values: Existing correlation identifier
token_service_provider.pan_reference_id string Conditionally returned	Unique identifier of the digital wallet token primary account number (PAN) within the card network. Allowable Values: Existing PAN Reference ID
token_service_provider.token_assurance_level string Conditionally returned	For Mastercard only. Represents the confidence level in the digital wallet token. Allowable Values: 0-99
token_service_provider.token_assurance_method string Conditionally returned	For Mastercard only. Method used to verify the cardholder before the digital wallet token was provisioned. Always `null` for other card networks. Allowable Values: `10`, `11`, `12`, `25`
token_service_provider.token_eligibility_decision string Conditionally returned	Digital wallet’s decision as to whether the digital wallet token should be provisioned. Allowable Values: `DECISION_RED`, `DECISION_YELLOW`, `DECISION_GREEN`
token_service_provider.token_expiration string Conditionally returned	Expiration date of the digital wallet token. Allowable Values: Format: MMyy
token_service_provider.token_pan string Conditionally returned	Primary account number (PAN) of the digital wallet token. Allowable Values: 16 char max
token_service_provider.token_provisioning_insight_data string Conditionally returned	For Mastercard only. Contains the Token Provisioning Insight risk score and reason code for the digital wallet token. Always `null` for other card networks. Allowable Values: 3 char max
token_service_provider.token_reference_id string Conditionally returned	Unique identifier of the digital wallet token within the card network. Allowable Values: Existing Token Reference ID
token_service_provider.token_requestor_id string Conditionally returned	Unique numerical identifier of the token requestor within the card network. These ID numbers map to `token_requestor_name` field values as follows: Mastercard - 50110030273 – `APPLE_PAY` - 50120834693 – `ANDROID_PAY` - 50139059239 – `SAMSUNG_PAY` Visa - 40010030273 – `APPLE_PAY` - 40010075001 – `ANDROID_PAY` - 40010043095 – `SAMSUNG_PAY` - 40010075196 – `MICROSOFT_PAY` - 40010075338 – `VISA_CHECKOUT` - 40010075449 – `FACEBOOK` - 40010075839 – `NETFLIX` - 40010077056 – `FITBIT_PAY` - 40010069887 – `GARMIN_PAY` Allowable Values: 11 char max Example Values: - Mastercard – 50110030273, 50120834693, 50139059239 - Visa – 40010030273, 40010075001, 40010075338, 40010075449, 40010075839, 40010043095
token_service_provider.token_requestor_name string Conditionally returned	Name of the token requestor within the card network. NOTE: The list of example values for this field is maintained by the card networks and is subject to change. Allowable Values: 255 char max Example Values: - Mastercard – `APPLE_PAY`, `ANDROID_PAY`, `SAMSUNG_PAY` - Visa – `APPLE_PAY`, `ANDROID_PAY`, `SAMSUNG_PAY`, `MICROSOFT_PAY`, `VISA_CHECKOUT`, `FACEBOOK`, `NETFLIX`, `FITBIT_PAY`, `GARMIN_PAY`
token_service_provider.token_score string Conditionally returned	Token score assigned by the digital wallet. Allowable Values: 25 char max
token_service_provider.token_type string Conditionally returned	Type of the digital wallet token. Allowable Values: `MERCHANT_CARD_ON_FILE`, `DEVICE_SECURE_ELEMENT`, `DEVICE_CLOUD_BASED`, `ECOMMERCE_DIGITAL_WALLET`
transaction_device object Conditionally returned	Contains information about the device used in the transaction to enhance the risk decisioning process. Use this data to improve fraud prevention and dispute resolution. Allowable Values: `binding_id`, `ip_address`, `location`, `phone_number`
transaction_device.binding_id string Conditionally returned	Unique identifier of the data component bound to the credential. Allowable Values: 48 char max
transaction_device.ip_address string Conditionally returned	IP address of the device. The presence of the IP address helps determine if the transaction was initiated from an unusual network, helping establish a pattern of safe device usage that further confirms the authenticity of the consumer who initiated the transaction. Allowable Values: IP address format, 39 char max
transaction_device.location string Conditionally returned	Geographic coordinates of the device. Contains the latitude and longitude of the device used when the cardholder was authenticated during checkout. This field helps to determine if the transaction was initiated from an unexpected location. Allowable Values: Latitude and longitude in `DDD.DD/DDD.DD` format.
transaction_device.phone_number string Conditionally returned	Telephone number of the device. Contains the phone number that was used to authenticate the consumer during checkout, or the consumer’s preferred phone number. The presence of the phone number helps establish the consumer’s authenticity when matching the phone number provided during checkout to a list of known phone numbers for the consumer. Allowable Values: 15 char max
user object Conditionally returned	Contains information about a cardholder. Allowable Values: `account_holder_group_token`, `active`, `address1`, `address2`, `authentication`, `birth_date`, `birth_place`, `business_token`, `city`, `company`, `corporate_card_holder`, `country`, `created_time`, `email`, `first_name`, `gender`, `honorific`, `id_card_expiration_date`, `id_card_number`, `identifications`, `ip_address`, `last_modified_time`, `last_name`, `metadata`, `middle_name`, `nationality`, `notes`, `parent_token`, `passport_expiration_date`, `passport_number`, `password`, `phone`, `postal_code`, `ssn`, `state`, `status`, `title`, `token`, `uses_parent_account`, `zip`
user.account_holder_group_token string Conditionally returned	Associates the specified account holder group with the cardholder. Allowable Values: 36 char max
user.active boolean Conditionally returned	Specifies if the cardholder is in the `ACTIVE` state on the Marqeta platform. Allowable Values: `true`, `false`
user.address1 string Conditionally returned	Cardholder’s address. Allowable Values: 255 char max
user.address2 string Conditionally returned	Additional address information for the cardholder. Allowable Values: 255 char max
user.authentication object Conditionally returned	Contains the cardholder’s email address and password information. Allowable Values: `email_verified`, `email_verified_time`, `last_password_update_channel`, `last_password_update_time`
user.authentication.email_verified boolean Conditionally returned	Specifies whether the email address has been verified. Allowable Values: `true`, `false`
user.authentication.email_verified_time datetime Conditionally returned	Date and time when the email address was verified. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
user.authentication.last_password_update_channel string Conditionally returned	Specifies the channel through which the password was last changed. Allowable Values: `USER_CHANGE`, `USER_RESET`
user.authentication.last_password_update_time datetime Conditionally returned	Date and time when the password was last changed. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
user.birth_date string Conditionally returned	Cardholder’s date of birth. Allowable Values: Format: yyyy-MM-dd
user.birth_place string Conditionally returned	Country where the cardholder was born. Allowable Values: 255 char max ISO 3166 two-character country codes. For example, the country code for the United States is `US`. The ISO maintains the full list of ISO-3166 country codes.
user.business_token string Conditionally returned	Unique identifier of the business resource. Allowable Values: Existing business resource token
user.city string Conditionally returned	City where the cardholder resides. Allowable Values: 40 char max
user.company string Conditionally returned	Company name. Allowable Values: 255 char max
user.corporate_card_holder boolean Conditionally returned	Specifies if the cardholder holds a corporate card. Allowable Values: `true`, `false`
user.country string Conditionally returned	Country where the cardholder resides. Allowable Values: 40 char max
user.created_time datetime Returned	Date and time when the resource was created, in UTC. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
user.email string Conditionally returned	Valid email address of the cardholder. Allowable Values: 1–255 chars
user.first_name string Conditionally returned	Cardholder’s first name. Allowable Values: 40 char max
user.gender string Conditionally returned	Gender of the cardholder. Allowable Values: `F`, `M`
user.honorific string Conditionally returned	Cardholder’s title or prefix: Dr., Miss, Mr., Ms., and so on. Allowable Values: 10 char max
user.id_card_expiration_date string Conditionally returned	Expiration date of the cardholder’s identification. Allowable Values: Format: yyyy-MM-dd
user.id_card_number string Conditionally returned	Cardholder’s identification card number. Allowable Values: 255 char max
user.identifications array of objects Conditionally returned	One or more objects containing identifications associated with the cardholder. Allowable Values: Valid array of one or more `identifications` objects
user.identifications[].expiration_date string Conditionally returned	Expiration date of the identification, if applicable. Allowable Values: Format: yyyy-MM-dd
user.identifications[].type string Conditionally returned	Type of identification. Allowable Values: `SSN`, `TIN`, `SIN`, `NIN`, `PASSPORT_NUMBER`, `DRIVERS_LICENSE`, `BUSINESS_NUMBER`, `BUSINESS_TAX_ID`, `TAXPAYER_REFERENCE`
user.identifications[].value string Conditionally returned	Number associated with the identification. Allowable Values: 255 char max
user.ip_address string Conditionally returned	Cardholder’s IP address. Allowable Values: 39 char max
user.last_modified_time datetime Returned	Date and time when the resource was last updated, in UTC. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
user.last_name string Conditionally returned	Cardholder’s last name. Allowable Values: 40 char max
user.metadata object Conditionally returned	Associates any additional metadata you provide with the cardholder. Allowable Values: You can define the names and values of up to 20 fields in the format `"my_name_1": "my_value_1"`
user.middle_name string Conditionally returned	Cardholder’s middle name. Allowable Values: 40 char max
user.nationality string Conditionally returned	Cardholder’s nationality. Allowable Values: 255 char max
user.notes string Conditionally returned	Any additional information pertaining to the cardholder. Allowable Values: 255 char max
user.parent_token string Conditionally returned	Unique identifier of the parent user or business resource. Allowable Values: 1–36 chars
user.passport_expiration_date string Conditionally returned	Expiration date of the cardholder’s passport. Allowable Values: Format: yyyy-MM-dd
user.passport_number string Conditionally returned	Cardholder’s passport number. Allowable Values: 40 char max
user.password string Conditionally returned	Password to the cardholder’s user account on the Marqeta platform. Allowable Values: 1–255 chars
user.phone string Conditionally returned	Cardholder’s telephone number. Allowable Values: 255 char max
user.postal_code string Conditionally returned	Postal code of the cardholder’s address. Allowable Values: 10 char max
user.ssn string Conditionally returned	Cardholder’s Social Security Number (SSN). Allowable Values: Nine digits only, no delimiters.
user.state string Conditionally returned	State or province where the cardholder resides. Allowable Values: 2 char max
user.status string Conditionally returned	Specifies the status of the cardholder on the Marqeta platform. Allowable Values: `UNVERIFIED`, `LIMITED`, `ACTIVE`, `SUSPENDED`, `CLOSED`
user.title string Conditionally returned	Professional title of the cardholder, such as Chief Comptroller. Allowable Values: 255 char max
user.token string Conditionally returned	Unique identifier of the cardholder. Allowable Values: 1–36 chars
user.uses_parent_account boolean Conditionally returned	Indicates whether the child shares balances with the parent (`true`), or the child’s balances are independent of the parent (`false`). Allowable Values: `true`, `false`
user.zip string Conditionally returned	United States ZIP code of the cardholder’s address. Allowable Values: 10 char max
wallet_provider_profile object Conditionally returned	Contains information held and provided by the digital wallet provider. Allowable Values: `account`, `device_score`, `pan_source`, `reason_code`, `recommendation_reasons`, `risk_assessment`
wallet_provider_profile.account object Conditionally returned	Contains information related to the cardholder and provided by the digital wallet provider. Allowable Values: `email_address`, `id`, `score`
wallet_provider_profile.account.email_address string Conditionally returned	Digital wallet provider’s email address for the cardholder. Allowable Values: 255 char max
wallet_provider_profile.account.id string Conditionally returned	Digital wallet provider’s identity number for the cardholder. Allowable Values: 20 char max
wallet_provider_profile.account.score string Conditionally returned	Score from the digital wallet provider. Allowable Values: 50 char max
wallet_provider_profile.device_score string Conditionally returned	Score from the device. Allowable Values: 50 char max
wallet_provider_profile.pan_source string Conditionally returned	Source from which the digital wallet provider obtained the card primary account number (PAN). Allowable Values: `KEY_ENTERED`, `ON_FILE`, `MOBILE_BANKING_APP`
wallet_provider_profile.reason_code string Conditionally returned	Reason for the wallet provider’s provisioning decision. - 01 – Cardholder’s wallet account is too new relative to launch. - 02 – Cardholder’s wallet account is too new relative to provisioning request. - 03 – Cardholder’s wallet account/card pair is newer than date threshold. - 04 – Changes made to account data within the account threshold. - 05 – Suspicious transactions linked to this account. - 06 – Account has not had activity in the last year. - 07 – Suspended cards in the secure element. - 08 – Device was put in lost mode in the last seven days for longer than the duration threshold. - 09 – The number of provisioning attempts on this device in 24 hours exceeds threshold. - 0A – There have been more than the threshold number of different cards attempted at provisioning to this phone in 24 hours. - 0B – The card provisioning attempt contains a distinct name in excess of the threshold. - 0C – The device score is less than 3. - 0D – The account score is less than 4. - 0E – Device provisioning location outside of the cardholder’s wallet account home country. - 0G – Suspect fraud. Allowable Values: 01, 02, 03, 04, 05, 06, 07, 08, 09, 0A, 0B, 0C, 0D, 0E, 0G
wallet_provider_profile.recommendation_reasons array of strings Conditionally returned	Array of recommendation reasons from the digital wallet provider. Allowable Values: Valid array of one or more recommendation reasons
wallet_provider_profile.risk_assessment object Conditionally returned	Contains the digital wallet provider’s risk assessment for provisioning the digital wallet token. Allowable Values: `score`, `version`
wallet_provider_profile.risk_assessment.score string Conditionally returned	Wallet provider’s decision as to whether the digital wallet token should be provisioned. Allowable Values: `DECISION_RED`, `DECISION_YELLOW`, `DECISION_GREEN`
wallet_provider_profile.risk_assessment.version string Conditionally returned	Wallet provider’s risk assessment version. Allowable Values: Version information, as provided by the wallet provider

Sample response body

JSON

{
  "token": "my_token_0000",
  "card_token": "my_card_token_1989",
  "state": "ACTIVE",
  "state_reason": "Card activated by cardholder",
  "fulfillment_status": "PROVISIONED",
  "issuer_eligibility_decision": "cardaccount.verified",
  "created_time": "2025-10-03T18:55:45Z",
  "last_modified_time": "2026-01-26T22:36:10Z",
  "token_service_provider": {
    "token_reference_id": "my_token_reference_id_1600",
    "pan_reference_id": "my_pan_reference_id_0073",
    "token_requestor_id": "my_token_requestor_id_0373",
    "token_requestor_name": "Token Requestor Name",
    "token_type": "DEVICE_SECURE_ELEMENT",
    "token_pan": "my_token_pan_6792",
    "token_score": "02",
    "token_eligibility_decision": "DECISION_GREEN"
  },
  "device": {
    "type": "MOBILE_PHONE",
    "language_code": "eng",
    "device_id": "my_device_id_9575",
    "phone_number": "12345678900",
    "name": "Phone Name",
    "location": "+37.81/-122.26",
    "ip_address": "x.x.x.x"
  },
  "wallet_provider_profile": {
    "account": {
      "score": "05"
    },
    "risk_assessment": {
      "score": "DECISION_YELLOW",
      "version": "0001.00"
    },
    "device_score": "03",
    "pan_source": "KEY_ENTERED"
  },
  "address_verification": {
    "name": "Address Verification Name",
    "street_address": "223 Elm Street",
    "postal_code": "94703"
  }
}