Card Results

The card step adds to the identity result rather than producing one of its own. The same session ends once, and one result carries both: the card rows in checks, and on a tokenize session the paymentCard block.

The `paymentCard` Block

{
  "sessionId": "9f1c8e42-7c3e-4f2b-9d7a-2b1e5c8f4a10",
  "userRef": "user-123",
  "status": "completed",
  "checks": [
    { "name": "payment_card_scene_clear", "status": "passed", "group": "payment_card", "severity": "high", "reason": null, "detail": "no screen-recapture signals" },
    { "name": "payment_card_token_match", "status": "passed", "group": "payment_card", "severity": "high", "reason": null, "detail": "the tokenized card matches the photographed card and the holder" }
  ],
  "paymentCard": {
    "token": "3b9f6c1e-8d2a-4f7b-9e5c-1a2b3c4d5e6f",
    "lastFour": "4242",
    "kind": "recurring",
    "recordedAt": "2026-07-31T14:04:41.112Z"
  },
  "provider": "inyo",
  "trustIndex": 100,
  "completedAt": "2026-07-31T14:04:57.874Z"
}

The rest of the payload — document, person, the identity rows, decision — is described on Session Results.

Field	Description
`token`	The gateway's card token. Use it with the gateway's APIs, the same way as a token from the gateway's own tokenizer
`lastFour`	The last four digits of the tokenized card, for display
`kind`	`one_time` or `recurring`, from `storeLaterUse` on the session. The gateway's one-time and recurring rules apply
`recordedAt`	When Inyo360 recorded the token, an ISO 8601 UTC timestamp

When It Is Present

The block is present only on a session created with paymentCard.tokenize whose holder reached the token step and handed over a token. Otherwise the key is absent, not null.

Session	`paymentCard`
Verification only (`capture` without `tokenize`)	Absent
Tokenize, token recorded	Present
Tokenize, the holder never reached the token step — ran out of card attempts, or the session expired	Absent
Tokenize, and tokenizing was switched off for your tenant after the link was sent	Absent — the step ran as verification only

A card check that does not pass does not remove the block. The session still completes, and the row's status says what failed — see Checks.

How It Reaches You

The block rides on the identity result: the signed webhook, the redirect's result notification, and the read at GET /v1/sessions/{sessionId}. Signature verification and ordering are on Receiving Results.

What Inyo360 Stores Beside the Token

Inyo360 keeps a token record per session: the token, its kind, the last four as the widget reported them, the card's expiry month, and the cardholder name the holder confirmed on the widget's confirm screen. The result exposes only the four fields above. The expiry month and the holder name are not delivered.

lastFour is the value the widget reported from the gateway's tokenizer. Inyo360 checks it against the digits left on the stored card photos, and the outcome is the payment_card_token_match row. Gate on that row, not on lastFour alone.

See Data Handling for everything Inyo360 stores.

Next Steps

Checks — the card rows in checks
Tokenizing Cards — the gateway's token and how it is used