Raw Card Processing
The `/raw-data` endpoint for PCI DSS Level 1 merchants.
Process a payment by sending untokenized card data. It lives on its own domain and on a
different route from /process/, and is only enabled for certified businesses.
Requires PCI DSS Level 1. You must hold a current certification and share your Attestation of Compliance (AOC) with Tonder before production access is enabled. If you don't have it, use the tokenized flow — it covers the same use case with a reduced PCI scope (SAQ A / SAQ A-EP).
Endpoint
| Environment | URL |
|---|---|
| Sandbox | POST https://process-sandbox.tonder.io/raw-data |
| Production | POST https://process.tonder.io/raw-data |
It is not under Tonder's /api/v1/ and does not accept browser calls. Test it from your
terminal, Postman or your backend.
Headers
| Header | Description |
|---|---|
Authorization | Your API key, prefixed with Token. |
X-Skyflow-Authorization | The access_token (JWT) from GET /api/v1/tokenization/auth/. It's short-lived — request it right before processing. |
Content-Type | application/json. |
Request body
| Field | Type | Description |
|---|---|---|
operation_type | string | "payment" to process a payment. |
amount | number | Amount in decimal format (e.g. 150.00). |
currency | string | MXN, CLP or USD. Mexico and Chile use the same flow; only this value changes. |
customer | object | The customer's name and email. |
payment_method | object | type: "CARD" plus raw card_number, cardholder_name, cvv, expiration_month, expiration_year. |
client_reference | string | Your unique reference for this transaction. |
return_url | string | Where the customer returns after finishing (for example, after a 3DS challenge). |
Example
curl -X POST "https://process-sandbox.tonder.io/raw-data" \
-H "Authorization: Token YOUR_TONDER_API_KEY" \
-H "X-Skyflow-Authorization: YOUR_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"operation_type": "payment",
"amount": 150.00,
"currency": "MXN",
"customer": {
"name": "Ozzy Osbourne",
"email": "ozzy@testuser.com"
},
"payment_method": {
"type": "CARD",
"card_number": "4000000000000077",
"cardholder_name": "Ozzy Osbourne",
"cvv": "123",
"expiration_month": "07",
"expiration_year": "26"
},
"client_reference": "ORD-001",
"return_url": "https://tonder.io"
}'Response
Same shape as a normal /process/ payment: id, status, amount, currency,
client_reference and the timestamps.
Always verify the final status at GET /api/v1/transactions/{id}/ — it's the source of truth.
Don't rely on the HTTP code or the initial response alone.