# Push Provisioning for Apple Pay

Returns encrypted cardholder information and other metadata needed for Apple Pay push provisioning.
This API is not available for sandbox testing.

Endpoint: POST /twcard-data/v1/push-provisioning/encrypted-payload/apple-pay
Security: UserToken

## Security:

  - `UserToken` (unknown)
    http bearer JWT

## Header parameters:

  - `x-tw-twcard-card-token` (string, required)
    The card token identifying which card to retrieve push provisioning data for.

  - `X-External-Correlation-Id` (string)
    Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. [Learn more](/guides/developer/headers/correlation-id).

## Request fields (application/json):

  - `certificates` (array, required)
    DER encoded X.509 ECC leaf and sub CA certificates, each encoded in Base64.
    Example: ["MIICpTCCAkqgAwIBAgIIB...","MIICpTCCAYmgAwIBAgIIX..."]

  - `nonce` (string, required)
    One time use nonce generated by Apple Servers and HEX encoded on iOS app.
    Example: a1b2c3d4e5f6

  - `nonceSignature` (string, required)
    The device and account specific signature of the nonce generated by Apple and HEX encoded on iOS app.
    Example: f6e5d4c3b2a1

## Response 200:

  - `200` (unknown)
    Encrypted cardholder information for Apple Pay.

## Response 200 fields (application/json):

  - `encryptedPassData` (string)
    Encrypted authentication data following card scheme and wallet provider specifications. The response is encoded in Base64.
    Example: 443232323637393045DDE321469537FE461E824AA55BA67BF645454330A32433610DE1D1461475BEB6D815F31764DDC20298BD779FBE37EE5AB3CBDA9F9825E1

  - `activationData` (string)
    Encrypted activation data following card scheme and wallet provider specifications. The response is encoded in Base64.
    Example: KDlTthhZTGufMY…….xPSUrfmqCHXaI9wOGY=

  - `ephemeralKey` (string)
    Ephemeral key used to encrypt authentication data. The response is encoded in Base64.
    Example: A1B2C3D4E5F6112233445566

## Response 200 headers (application/json):

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f

## Response 429:

  - `429` (unknown)
    Rate limit exceeded. Retry after the number of seconds specified in the `Retry-After` header.

## Response 429 headers (application/json):

  - `Retry-After` (integer)
    Number of seconds to wait before retrying the request.
    Example: 5

  - `X-Rate-Limited-By` (string)
    Identifies the rate limiter that triggered the 429 response.
    Example: wise-public-api

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f