# Network token provisioning codes

View [Mastercard](#Mastercard) and [Visa](#Visa) responses to a [network token](https://www.checkout.com/docs/payments/store-and-manage-credentials/store-credentials/network-tokens.md) provisioning request.

---

## Mastercard

The following table documents errors related to network token provisioning requests using [Mastercard Digital Enablement Service (MDES)](https://developer.mastercard.com/product/mdes/).

| Error Code | Description |
| --- | --- |
| `NO_RESPONSE_FROM_ISSUER` | The issuer did not respond to the network message in the expected time. When this happens, Mastercard sends an asynchronous message to the issuer.<br><br>You should only retry the request after the time specified in the `retry-after` header. |
| `ISSUER_DECLINED` | The card issuer, not Mastercard or Checkout.com, declined the request to provision a network token for this card. Retrying the same card is unlikely to succeed until the issuer's position changes.<br><br>Ask your customer to contact their issuing bank, or to use a different card. |
| `INTERNAL_SERVICE_FAILURE` | MDES had an internal exception. |
| `INVALID_PAN` | The Primary Account Number (PAN) format is not valid, or other data associated with the PAN was incorrect or entered incorrectly. Ask your customer to verify their details and try again. |
| `MISSING_EXPIRY_DATE` | The required expiry date for the card is missing. Retry the request providing the card's expiry date. |
| `DUPLICATE_REQUEST` | The PAN was already provisioned to the device or the same request is being processed. |
| `PROVISION_FAILED` | The provisioning of PAN to the device failed. |
| `PAN_INELIGIBLE` | The PAN is not in an approved account range for MDES. |
| `DEVICE_INELIGIBLE` | The device is not supported by MDES. |
| `PAN_INELIGIBLE_FOR_DEVICE` | The issuer does not allow the PAN to be provisioned to the device. |
| `PAN_PROVISIONING_COUNT_EXCEEDED` | The PAN was already provisioned to the maximum number of allowed devices. |
| `INVALID_ELIGIBILITY_RECEIPT` | The eligibility receipt is expired or the value cannot be found. |
| `INVALID_TASK_ID` | The task ID could not be found.<br><br>For inbound calls, the task ID was not unique. |
| `INVALID_TERMS_AND_CONDITIONS` | The terms and conditions ID accepted by the account holder does not match what was sent in the `CheckEligibility` response. |
| `INVALID_AUTHENTICATION_METHOD` | The authentication method could not be found. |
| `INVALID_TOKEN_UNIQUE_REFERENCE` | The Token Unique Reference (TUR) could not be found, or does not match the provided `paymentAppInstanceId`. |
| `INVALID_PAN_UNIQUE_REFERENCE` | The PAN unique reference could not be found. |
| `INVALID_TOKEN_STATUS` | The token is in an invalid status for the requested operation. For example, you may be attempting to reactivate a deleted token. |
| `INVALID_WORKFLOW` | The operation requested is invalid for the token. For example, you may be attempting to activate an approved mapping, or you've provided `rnsInfo` when it's not the first card being digitized. |
| `INVALID_AID_CARD_TYPE` | The PIX value in the Application Identifier (AID) was not correct for the account range brand product. |
| `INVALID_AID_RID` | The Registered Identification Number (RID) value in the AID is incorrect for Mastercard. |
| `INVALID_CARDLET_ID` | The cardlet ID could not be mapped to a cardlet. |
| `INVALID_METHOD` | The URI for the call cannot be mapped to an API endpoint. |
| `INCORRECT_TAV` | The provided Tokenization Authentication Value (TAV) is incorrect and was rejected. |
| `EXPIRED_CODE` | The authentication code is expired or invalid. |
| `INVALID_DATA` | The data supplied for the request is invalid. No further details are provided. |
| `NO_ACTIVE_TOKENS` | There are no active tokens for the given account PAN and consumer account. |
| `ALT_CREDENTIALS_COUNT_EXCEEDED` | You reached the maximum amount of alternate payment credentials for the token.<br><br>You can either:<br><br>- Wait for unused credentials to expire.<br>- Use any unused credentials for the first time in a transaction. |
| `INVALID_CRYPTOGRAPHIC_DATA` | The credentials were already used in a transaction, or the validity period of the alternate payment account credentials expired.<br><br>This error is also returned if the cryptogram has been exchanged but the value for `merchantSupportsDtvc` or `walletMerchantIdentifier` does not match the original request. |
| `TOKEN_PAN_NOT_FOUND` | The token PAN that was supplied in the request was not found. This could be due to:<br><br>- An invalid token or token number<br>- A mismatch in the token expiration date<br>- An expired token |
| `tokenization_declined` | A recent provisioning attempt for this card was declined, so we paused further attempts for the same card and did not forward this request to the card scheme. The response to the earlier attempt contains the reason for the original decline.<br><br>Wait at least 24 hours before retrying, or ask your customer to use a different card or contact their issuer. |
| `ACCOUNT_INELIGIBLE` | The financial account does not have an associated account range in MDES. |
| `INVALID_PUSH_ACCOUNT_RECEIPT` | The push account receipt is not found or is not valid for the token requestor. |
| `REDIGITIZATION_VELOCITY_COUNT_EXCEEDED` | The number of allowed re-digitizations for the token in the given time period exceeded the maximum value. |

---

## Visa

The following table documents errors related to network token provisioning requests using [Visa Token Service (VTS)](https://developer.visa.com/capabilities/visa-secure-remote-commerce/docs#section3).

### Standard errors

VTS exposes different APIs. Any VTS API returns these errors, so you should handle them consistently. They are not documented as part of each individual API description.

| Error code | Reason code | Description |
| --- | --- | --- |
| `403` | `cardVerification Failed` | Invalid payment instrument or data associated with the payment instrument. The `location` field from the specific Visa API may point to the field failing the validation.<br><br>Ask your customer to check that all information is entered correctly. |
| `403` | `cardVerification NotSupported` | Visa cannot validate this card. Provision using a different method. |
| `403` | `tokenUsageViolation` | The purpose of the token does not match the intended usage of the token. Refer to VTS API specification to check the expected usage of the token. |
| `403` | `cardNotEligible` | The card cannot be used for tokenization at this moment. Try again later or choose another Visa card. |

### Enroll PAN errors

| Error code | Reason code | Description |
| --- | --- | --- |
| `403` | `cardNotAllowed` | The requested action is not allowed for the given PAN.<br><br>The card is valid but cannot be used for tokenization. This is most likely due to a reason specific to Visa. Ask the customer to use a different card. |
| `403` | `Declined` | The card is not eligible for tokenization at this moment. Try to provision the token one more time. If the issue persists, ask the customer to either use a different card, or to contact their issuer. |

### Provision Token—Given PAN Enrollment ID errors

| Error code | Reason code | Description |
| --- | --- | --- |
| `400` | `msrNotSupported` | Magnetic Stripe Reader (MSR) presentation is not supported for this PAN. Remove this presentation type and try again. |
| `400` | `provisionDataExpired` | The PAN information provided is considered stale.<br><br>If your are managing a push provisioning flow which allows the user to choose a card from their banking application or a web page, ask your customer to select the card again.<br><br>If you are sending the PAN in the `encPaymentInstrument` field through your Wallet Provider Service (WPS), you must re-create request and call the Enroll PAN API before invoking the Provision Token API. |
| `422` | `tokenization_declined` | A recent provisioning attempt for this card was declined, so we paused further attempts for the same card and did not forward this request to the card scheme. The response to the earlier attempt contains the reason for the original decline.<br><br>Wait at least 24 hours before retrying, or ask your customer to use a different card or contact their issuer. |
| `409` | `staleCardMetadata` | Card metadata is stale. Request the latest card metadata and try again. |
| `409` | `notAllowed` | Further operations for this card are no longer allowed. Contact your bank to resolve this issue. |

### Provision Token—Given PAN Data errors

| Error code | Reason code | Description |
| --- | --- | --- |
| `403` | `cardNotAllowed` | The requested action is not allowed for the given primary account number (PAN).<br><br>The card is valid but cannot be used for tokenization. This is most likely due to reasons specific to Visa. Ask the customer to use a different card. |
| `403` | `declined` | The card is not eligible for tokenization at this moment. Try to provision the token one more time. If the issue persists, ask the customer to either use a different card, or to contact their issuer. |
| `409` | `notAllowed` | Further operations for this card are not allowed. Contact your bank to resolve the issue. |

### Confirm Provisioning errors

| Error code | Reason code | Description |
| --- | --- | --- |
| `409` | `notAllowed` | Further operations for this card are not allowed. Contact your bank to resolve the issue. |