Quick Start for Travel API Consumers

Step 1: Get your organization and cardholder IDs

Every card belongs to an organization and a cardholder. If you're using a single technical cardholder (recommended for automated integrations), fetch these IDs once and store them.

GET /organizations
GET /cardholders

Step 2: Find your card configuration

Every card needs a cardConfig that defines its type and features. For travel, you'll typically use configurations containing TRAVEL; these come with pre-configured merchant restrictions (e.g.: only travel-related purchases allowed).

GET /cards/available-cards

Returns available configurations, like PLIANT_VIRTUAL_TRAVEL.

Step 3: Issue a card

Create a virtual card instantly. In one API call, you can set everything: spend limit, validity dates, traveler name, and custom fields for your booking reference.

POST /cards/{cardholderId}/instant

{
  "organizationId": "your-org-id",
  "cardConfig": "pliant_virtual_travel",
  "label": "Hotel Marriott - John Smith",
  "limit": 50000,
  "transactionLimit": 50000,
  "validFrom": "2026-03-01",
  "validTo": "2026-03-05",
  "validTimezone": "Europe/Berlin",
  "cardholderProperties": {
    "firstName": "John",
    "lastName": "Smith"
  },
  "customFields": {
    "bookingRef": "BK-12345"
  }
}

Key parameters explained

Step 4: Fine-tune with card controls

Travel cards come with sensible defaults, but you can add more restrictions if needed, for example:

"cardControls": {
  "categories": {
    "type": "MCC",
    "values": ["3501", "3502", "7011"],
    "restriction": "ALLOWED"
  },
  "merchants": {
    "type": "MATCH_TERM",
    "values": ["MARRIOTT", "HILTON"],
    "restriction": "ALLOWED"
  }
}

See Card Controls for all options including time-based restrictions.

Step 5: Get the card number (PAN & CVV)

After issuing a card, you need the actual card number to send to the merchant.

Option A: Two calls

Issue the card first, then fetch sensitive data:

GET /card-details/{cardId}

Option B: One call (PCI-compliant only)

Issue the card and get PAN/CVV in one request:

POST /cards/{cardholderId}/instant-pci

⚠️

PCI-DSS required

Accessing card sensitive data requires PCI-DSS compliance. If you're not certified, use our secure web widget instead.

Step 6: Track transactions with callbacks

Subscribe to callback events to get notified when transactions happen. This is how you'll know when a hotel charges the card.

POST /transactions/subscription

{
  "url": "https://your-server.com/pliant-webhook",
  "event": "TRANSACTION_CONFIRMED"
}

Key events for travel

Best practices

Hotel booking with exact dates

Set validFrom to check-in, validTo to checkout + 1 day (for incidentals). Card auto-terminates after.

Airline ticket purchase

Use maxTransactionCount: 1 for one-time use. Set limit to exact ticket price + small buffer for fees.

Trip cancelled? Terminate the card

Call POST /cards/{cardId}/terminate to immediately disable the card. No further charges possible.

Reconciliation options

Match transactions back to your bookings using one of these methods:

• Callbacks: Real-time webhooks (recommended)
• Transaction API: poll GET /transactions and POST /transactions/details for the most relevant transaction details
• Accounting Transaction API: poll POST /accounting/transactions for data containing additional fields relevant for accounting
• Monthly statements: PDF/CSV via GET /statements
• Custom CSV exports: contact Pliant to configure exports matching your format

Quick reference: essential endpoints

Next steps

• Card Entity: detailed card types and statuses
• Card Controls: all restriction options (MCCs, merchants, times)
• PCI Web Widget: show card details without PCI compliance
• Transactions API: query and filter transactions

Questions? Contact [email protected].