Block Raw Card Data on API Endpoints

Advanced Billing can enforce, at the API layer, that the endpoints which accept payment details never receive a raw card or bank account number. With this control turned on for your site, any request to a guarded endpoint that carries a raw payment field is rejected before it is processed. Requests that use a Maxio.js token, a vault token, or no payment data at all are unaffected. This is aimed at sites that need a hard guarantee that cardholder data never reaches Advanced Billing's API in the clear, such as sites that use the Maxio API Gateway. The check applies to every API request to a guarded endpoint, whichever client sends it.

Which endpoints are guarded

The control applies to these endpoints:

• Create or update a subscription with payment details (subscriptions#create, subscriptions#update)
• Create or update a payment profile, including through the V3 API (payment_profiles#create, payment_profiles#update)
• Sign up or create a subscription group with payment details (subscription_groups#signup, subscription_groups#create)
• Chargify Direct signups and card updates (POST /api/v2/signups, POST /api/v2/subscriptions/:id/card_update)

Which fields are blocked

A request to a guarded endpoint is rejected if it contains any of the following fields, wherever the endpoint expects payment attributes (for example, nested under credit_card_attributes, bank_account_attributes, or payment_profile_attributes):

• full_number
• card_number
• cvv
• bank_account_number
• bank_routing_number
• bank_iban

A request that instead supplies chargify_token or vault_token, or that carries no payment fields at all, is processed normally.

What a blocked request looks like

A blocked request is rejected with a 422 Unprocessable Entity response and nothing is saved. Nothing about the rest of your request is validated first — the check runs before your other payment or subscription attributes are processed.

For the V1 and V3 JSON APIs, the response body is:

{
  "errors": [
    "Raw payment data (card number, CVV, bank account number) is not accepted by this endpoint for this site. Submit payment details through the Maxio API Gateway or use a chargify.js token."
  ]
}

For Chargify Direct (transparent redirect) requests, you're redirected back to your redirect_uri with status_code=422 and the same message, following the usual Chargify Direct error-handling convention.

Only API requests are affected. Submitting a form through the merchant-facing web UI (for example, adding a payment profile from the Admin) is not subject to this check.

Turn it on

This control is enabled per site by the Maxio team, not from a setting in your Admin console. Contact your account team to have it turned on for a site.

Maxio API Gateway tab visibility

For sites that are both eligible for the Maxio API Gateway (connected to a Maxio instance with SSO enabled for the seller) and have this control turned on together with the API Gateway integration itself, the Maxio API Gateway tab appears under Config > Integrations. If either piece isn't in place, the tab stays hidden.

Related information

For the payment tokenization alternative to raw card fields, see Understand Maxio.js.

For how this control fits into your broader PCI scope, see Understand PCI Compliance.