Invoke Forward Proxy

POST

pci-proxy

forward

curl --request POST \
  --url https://api-sandbox.y.uno/v1/pci-proxy/forward \
  --header 'Content-Type: application/json' \
  --header 'private-secret-key: <api-key>' \
  --header 'public-api-key: <api-key>' \
  --header 'yuno-proxy-destination-url: <yuno-proxy-destination-url>' \
  --data '
{
  "amount": 2500,
  "currency": "USD",
  "card": {
    "number": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.number}}",
    "expiration_month": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_month}}",
    "expiration_year": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_year}}",
    "holder_name": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.holder_name}}"
  }
}
'

import requests

url = "https://api-sandbox.y.uno/v1/pci-proxy/forward"

payload = {
    "amount": 2500,
    "currency": "USD",
    "card": {
        "number": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.number}}",
        "expiration_month": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_month}}",
        "expiration_year": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_year}}",
        "holder_name": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.holder_name}}"
    }
}
headers = {
    "yuno-proxy-destination-url": "<yuno-proxy-destination-url>",
    "public-api-key": "<api-key>",
    "private-secret-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'yuno-proxy-destination-url': '<yuno-proxy-destination-url>',
    'public-api-key': '<api-key>',
    'private-secret-key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    amount: 2500,
    currency: 'USD',
    card: {
      number: '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.number}}',
      expiration_month: '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_month}}',
      expiration_year: '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_year}}',
      holder_name: '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.holder_name}}'
    }
  })
};

fetch('https://api-sandbox.y.uno/v1/pci-proxy/forward', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-sandbox.y.uno/v1/pci-proxy/forward",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'amount' => 2500,
    'currency' => 'USD',
    'card' => [
        'number' => '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.number}}',
        'expiration_month' => '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_month}}',
        'expiration_year' => '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_year}}',
        'holder_name' => '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.holder_name}}'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "private-secret-key: <api-key>",
    "public-api-key: <api-key>",
    "yuno-proxy-destination-url: <yuno-proxy-destination-url>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api-sandbox.y.uno/v1/pci-proxy/forward"

	payload := strings.NewReader("{\n  \"amount\": 2500,\n  \"currency\": \"USD\",\n  \"card\": {\n    \"number\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.number}}\",\n    \"expiration_month\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_month}}\",\n    \"expiration_year\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_year}}\",\n    \"holder_name\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.holder_name}}\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("yuno-proxy-destination-url", "<yuno-proxy-destination-url>")
	req.Header.Add("public-api-key", "<api-key>")
	req.Header.Add("private-secret-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api-sandbox.y.uno/v1/pci-proxy/forward")
  .header("yuno-proxy-destination-url", "<yuno-proxy-destination-url>")
  .header("public-api-key", "<api-key>")
  .header("private-secret-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"amount\": 2500,\n  \"currency\": \"USD\",\n  \"card\": {\n    \"number\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.number}}\",\n    \"expiration_month\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_month}}\",\n    \"expiration_year\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_year}}\",\n    \"holder_name\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.holder_name}}\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api-sandbox.y.uno/v1/pci-proxy/forward")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["yuno-proxy-destination-url"] = '<yuno-proxy-destination-url>'
request["public-api-key"] = '<api-key>'
request["private-secret-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"amount\": 2500,\n  \"currency\": \"USD\",\n  \"card\": {\n    \"number\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.number}}\",\n    \"expiration_month\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_month}}\",\n    \"expiration_year\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_year}}\",\n    \"holder_name\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.holder_name}}\"\n  }\n}"

response = http.request(request)
puts response.read_body

{}

Forwards your request to the destination in the yuno-proxy-destination-url header, replacing {{vaulted_token.<TOKEN>.<field>}} expressions inside Yuno’s secure environment with the data stored under the vaulted token: the card (PAN, expiration, holder name), its network token (DPAN and its expiration), and its network transaction ID (NTID). For destinations that require HMAC-signed requests, send yuno-proxy-auth + yuno-proxy-auth-secret-key and the proxy signs the resolved body for you — see Signed destinations. See the Forward Proxy guide for a step-by-step integration.

BetaThe PCI Proxy is in beta and is enabled per organization. In production, requests return 403 PRODUCT_NOT_ENABLED until your organization is activated — contact your Key Account Manager (KAM). The sandbox is open for testing.

Server-side onlyProxy requests detokenize card data and must only be made from your backend. Never expose your private-secret-key in client-side code.

All of GET, POST, PUT, PATCH, and DELETE are supported: the destination receives the same method you used. Put the complete destination URL, including its path and any query string, in the yuno-proxy-destination-url header; a query string on the /pci-proxy/forward request itself is rejected. The destination host must be on your destination allowlist. If you are a PCI-certified merchant and need the raw card data itself rather than a pass-through call, use Retrieve Enrolled Payment Method by ID PCI Data instead.

Authorizations

public-api-key

string

header

default:<Your public-api-key>

required

private-secret-key

string

header

default:<Your private-secret-key>

required

Headers

yuno-proxy-destination-url

string

required

The complete destination URL, including its path and any query string (for example https://api.example-processor.com/charges/ch_123/capture?expand=true). Must be a public HTTPS hostname on port 443, and the host must be registered on your destination allowlist; IP addresses and internal networks are rejected. It must not contain {{vaulted_token...}} expressions (card data must never appear in a URL).

Example:

"https://api.example-processor.com/charges"

yuno-proxy-timeout

integer

Destination timeout in seconds. Default 30, maximum 120.

Required range: 1 <= x <= 120

Example:

30

yuno-account-id

string

Optional account scope. Narrows which allowlisted destinations are permitted for this request; it does not affect token resolution (vaulted tokens are always scoped to your organization). Like all yuno-* headers it is removed before forwarding and never reaches the destination.

Example:

"acc_123"

yuno-proxy-auth

enum<string>

Signing scheme for destinations that require HMAC request signing over the body. The proxy computes the signature over the resolved body (after expression substitution) and injects the destination's auth headers; your signing secret is used in memory and discarded — nothing is stored. Supported: DLOCAL_HMAC (the proxy generates X-Date and computes Authorization: V2-HMAC-SHA256, Signature: <hex> over X-Login + X-Date + resolved body; you send X-Login, X-Trans-Key, and X-Version as normal destination headers). An unknown value — or a DLOCAL_HMAC request missing the X-Login or X-Trans-Key headers — is rejected with 400 INVALID_REQUEST before the destination is contacted.

Available options:

DLOCAL_HMAC

Example:

"DLOCAL_HMAC"

yuno-proxy-auth-secret-key

string

Your signing secret for this request (required when yuno-proxy-auth is present). Like every yuno-* header it is stripped before forwarding and excluded from logs.

Body

The body the destination API expects, with vaulted token expressions where card data belongs. The proxy is content-transparent: it forwards your body and Content-Type unchanged and resolves {{vaulted_token.<TOKEN>.<field>}} expressions anywhere in the raw body, so any content type is supported (JSON, form-encoded, XML). The JSON object below is illustrative. Supported fields: number, expiration_month, expiration_year, holder_name; when the card has a network token, network_token_number (DPAN), network_token_expiration_month, network_token_expiration_year; and network_transaction_id (NTID: the scheme's reference for the card's original transaction, for merchant-initiated transactions). The security code is not stored and cannot be injected; cryptograms are per-transaction and are not resolved — include the value directly in the body if your destination requires one. At most 20 distinct tokens per request; maximum body size 1 MB. Expressions are also resolved in header values. All non-expression content is forwarded untouched.

The body is of type object.

Response

Response from the destination, passed through unchanged (the actual status code is whatever the destination returned; check yuno-proxy-destination-status).

The destination's response body, unchanged.

Invoke Forward Proxy

curl --request POST \
  --url https://api-sandbox.y.uno/v1/pci-proxy/forward \
  --header 'Content-Type: application/json' \
  --header 'private-secret-key: <api-key>' \
  --header 'public-api-key: <api-key>' \
  --header 'yuno-proxy-destination-url: <yuno-proxy-destination-url>' \
  --data '
{
  "amount": 2500,
  "currency": "USD",
  "card": {
    "number": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.number}}",
    "expiration_month": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_month}}",
    "expiration_year": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_year}}",
    "holder_name": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.holder_name}}"
  }
}
'

import requests

url = "https://api-sandbox.y.uno/v1/pci-proxy/forward"

payload = {
    "amount": 2500,
    "currency": "USD",
    "card": {
        "number": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.number}}",
        "expiration_month": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_month}}",
        "expiration_year": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_year}}",
        "holder_name": "{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.holder_name}}"
    }
}
headers = {
    "yuno-proxy-destination-url": "<yuno-proxy-destination-url>",
    "public-api-key": "<api-key>",
    "private-secret-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'yuno-proxy-destination-url': '<yuno-proxy-destination-url>',
    'public-api-key': '<api-key>',
    'private-secret-key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    amount: 2500,
    currency: 'USD',
    card: {
      number: '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.number}}',
      expiration_month: '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_month}}',
      expiration_year: '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_year}}',
      holder_name: '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.holder_name}}'
    }
  })
};

fetch('https://api-sandbox.y.uno/v1/pci-proxy/forward', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-sandbox.y.uno/v1/pci-proxy/forward",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'amount' => 2500,
    'currency' => 'USD',
    'card' => [
        'number' => '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.number}}',
        'expiration_month' => '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_month}}',
        'expiration_year' => '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_year}}',
        'holder_name' => '{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.holder_name}}'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "private-secret-key: <api-key>",
    "public-api-key: <api-key>",
    "yuno-proxy-destination-url: <yuno-proxy-destination-url>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api-sandbox.y.uno/v1/pci-proxy/forward"

	payload := strings.NewReader("{\n  \"amount\": 2500,\n  \"currency\": \"USD\",\n  \"card\": {\n    \"number\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.number}}\",\n    \"expiration_month\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_month}}\",\n    \"expiration_year\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_year}}\",\n    \"holder_name\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.holder_name}}\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("yuno-proxy-destination-url", "<yuno-proxy-destination-url>")
	req.Header.Add("public-api-key", "<api-key>")
	req.Header.Add("private-secret-key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api-sandbox.y.uno/v1/pci-proxy/forward")
  .header("yuno-proxy-destination-url", "<yuno-proxy-destination-url>")
  .header("public-api-key", "<api-key>")
  .header("private-secret-key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"amount\": 2500,\n  \"currency\": \"USD\",\n  \"card\": {\n    \"number\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.number}}\",\n    \"expiration_month\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_month}}\",\n    \"expiration_year\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_year}}\",\n    \"holder_name\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.holder_name}}\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api-sandbox.y.uno/v1/pci-proxy/forward")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["yuno-proxy-destination-url"] = '<yuno-proxy-destination-url>'
request["public-api-key"] = '<api-key>'
request["private-secret-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"amount\": 2500,\n  \"currency\": \"USD\",\n  \"card\": {\n    \"number\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.number}}\",\n    \"expiration_month\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_month}}\",\n    \"expiration_year\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.expiration_year}}\",\n    \"holder_name\": \"{{vaulted_token.1a2b3c4d-5678-90ab-cdef-111213141516.holder_name}}\"\n  }\n}"

response = http.request(request)
puts response.read_body

{}

Getting Started

Reference

Customers

Network Tokens

Customer Sessions (Enrollment)

Checkout Sessions

Payment Methods (Checkout)

Checkout Builder

Payment Methods (Direct Workflow)

PCI Proxy

Payments

Pre-Debit Notifications

3DS2 Setup

Unreferenced Refunds

Dry-run

Transaction Reporting

Routing Recommendations

Payment Links

Recipients for Marketplace

Sellers (Franchise)

Subscriptions Plans

Subscriptions

Payouts

Organizations

Reports

Installments

AI Caller

Communications Campaigns

Conversion Rate

Banking Connectivity

Webhooks

Authorizations

Headers

Body

Response