# Initiate unified Google Pay push provisioning flow

Initiates the Google Pay Unified Push Provisioning flow. Unlike standard provisioning, the Unified flow allows a user to simultaneously add a card to their device's Google Wallet (for tap-to-pay) and save the actual card number to their broader Google Account (for online and Chrome autofill).  Because this flow handles the actual card number, it requires Strong Customer Authentication (SCA).   Integration Flow:  1. Trigger SCA: Calling this endpoint initially returns a 200 OK and triggers a Change Request. The customer must complete a 2FA challenge.  2. Fetch Payloads: Once authorized, the endpoint returns the two required Opaque Payment Cards (OPCs): 
  TSP OPC: The standard tokenization payload for the device wallet.
  Google OPC: A PGP-signed, encrypted payload containing the user's Primary Account Number (FPAN).
  Important: Do not attempt to parse, decode, or modify the Google OPC string. Your backend must pass both OPCs exactly as received directly to your mobile client, which will feed them into the Google Wallet SDK.

Endpoint: POST /v1/cards/{card_id}/sca_push_provision/google_unified
Version: 1.0

## Path parameters:

  - `card_id` (string, required)
    The unique identifier of the customer's card.

## Request fields (application/json):

  - `server_session_id` (string, required)
    A push provisioning session ID in the form of a UUID, generated by Google's server and provided via the TapAndPay SDK. Used to generate the Google OPC, which enables saving the card's FPAN to the user's Google Account. The destination user is implied by the session.
    Example: "f47ac10b-58cc-4372-a567-0e02b2c3d479"

  - `wallet_id` (string)
    The wallet ID of the active wallet on the selected device. A unique 24-byte identifier for each instance of an [Android user, Google account] pair. Provided by Google's TapAndPay SDK via the GeneratePaymentCredentialsRequest.
    Example: "Rwt3tJek_k1JxivcwbPHjKDk"

  - `stable_hardware_id` (string)
    The stable hardware ID of the selected device. A stable identifier for a physical Android device, provided by Google's TapAndPay SDK. Optionally used by certain TSPs during OPC generation. Use the getStableHardwareId method to retrieve this value.
    Example: "a1b2c3d4e5f6g7h8"

  - `token_requestor_id` (string)
    Unique identifier for the token requestor, provided by Google's TapAndPay SDK. Recommended for Visa cards — Visa may require issuers to embed this value in the TSP OPC. For non-Visa cards this field is accepted but not used in OPC generation.
    Example: "12345678901"

## Response 200 fields (application/json):

  - `id` (string)
    ID of the change request.
    Example: "d6c778822b2d7bd3b778935bcfd0d1d3csc"

  - `status` (string)
    The current status of the change request.
    Enum: "ACCEPTED", "AUTHORIZATION_REQUIRED", "CONFIRMATION_REQUIRED", "COMPLETED", "FAILED"

  - `updated_at` (string)
    UTC timestamp from the last time the change request was updated.
    Example: "2022-04-21T13:59:52+00:00"

  - `url` (string)
    URL to use to authorize the change request.
    Example: "https://example.com/authorize"

## Response 201 fields (application/json):

  - `opaque_payment_card` (string)
    The TSP Opaque Payment Card (OPC) — an encrypted payload passed to Google Pay, which forwards it to the Token Service Provider (TSP) to create a device token for contactless payments.
    Example: "eyJhbGciOiJBMjU2R0NNS1ciLCJjaGFubmVsU2VjdXJpdHlDb250ZXh0IjoiU0hBUkVEX1NFQ1JFVCIsImVuYyI6IkEyNTZHQ00iLCJpYXQiOjE1NjYzMDUyNDIsIml2IjoiLVpMMGF4M0J2b1dRQjJhZyIsImtpZCI6IjhTTU5BWkRZTVFIQUFNNFU3S1ZZMTNDN0NlajVqdEVZbFI1MFhGRTdJd0R4RG9idE0iLCJ0YWciOiJDUW1DaWRFRkdFYkFyV3ViOU5IdkdRIiwidHlwIjoiSk9TRSJ9"

  - `google_opaque_payment_card` (string)
    The Google Opaque Payment Card — a PGP-signed, encrypted, and Base64-encoded payload containing the user's FPAN. Delivered to Google's backend to save the card number to the user's Google Account. Always populated on this endpoint.
    Example: "LS0tLS1CRUdJTiBQR1AgTUVTU0FHRS0tLS0tCmhRSU1BN...truncated..."

## Response 400 fields (application/json):

  - `title` (string)
    A short, human-readable summary of the problem type.
    Example: "Validation Error"

  - `status` (string)
    The HTTP status code applicable to this problem.
    Example: "400"

  - `id` (string)
    A unique identifier for this specific occurrence of the problem.
    Example: "a95f2aaf-4e0c-4d49-8021-8a16a884ed86"

  - `detail` (string)
    A human-readable explanation specific to this occurrence of the problem.
    Example: "The request payload contains invalid data."

  - `code` (string)
    An application-specific error code.
    Example: "validation_error"

  - `details` (array)
    An optional array containing specific field validation errors. Used primarily for POST/PUT requests.

  - `details.field` (string)
    The specific field in the payload that failed validation.
    Example: "certificates"

  - `details.message` (string)
    The reason the field failed validation.
    Example: "Failed to validate chain of trust for apple certificates with error - Certification path could not be validated."

## Response 401 fields (application/json):

  - `title` (string)
    A short, human-readable summary of the problem type.
    Example: "Unauthorized"

  - `status` (string)
    The HTTP status code applicable to this problem.
    Example: "401"

  - `id` (string)
    A unique identifier for this specific occurrence of the problem.
    Example: "b82b1cde-7d3a-4f5b-9a12-8b17b884ec99"

  - `detail` (string)
    A human-readable explanation specific to this occurrence of the problem.
    Example: "Missing or invalid authentication token."

  - `code` (string)
    An application-specific error code.
    Example: "unauthorized_access"

## Response 403 fields (application/json):

  - `title` (string)
    A short, human-readable summary of the problem type.
    Example: "Forbidden Action"

  - `status` (string)
    The HTTP status code applicable to this problem.
    Example: "403"

  - `id` (string)
    A unique identifier for this specific occurrence of the problem.
    Example: "c93f2aaf-4e0c-4d49-8021-8a16a884ed11"

  - `detail` (string)
    A human-readable explanation specific to this occurrence of the problem.
    Example: "You do not have sufficient permissions to perform this action."

  - `code` (string)
    An application-specific error code.
    Example: "insufficient_permissions"

## Response 404 fields (application/json):

  - `title` (string)
    A short, human-readable summary of the problem type.
    Example: "Resource Not Found"

  - `status` (string)
    The HTTP status code applicable to this problem.
    Example: "404"

  - `id` (string)
    A unique identifier for this specific occurrence of the problem.
    Example: "d12f2aaf-4e0c-4d49-8021-8a16a884ed22"

  - `detail` (string)
    A human-readable explanation specific to this occurrence of the problem.
    Example: "The requested card could not be found."

  - `code` (string)
    An application-specific error code.
    Example: "resource_not_found"

## Response 500 fields (application/json):

  - `title` (string)
    A short, human-readable summary of the problem type.
    Example: "Internal Server Error"

  - `status` (string)
    The HTTP status code applicable to this problem.
    Example: "500"

  - `id` (string)
    A unique identifier for this specific occurrence of the problem.
    Example: "f66f2aaf-4e0c-4d49-8021-8a16a884ed44"

  - `detail` (string)
    A human-readable explanation specific to this occurrence of the problem.
    Example: "An unexpected internal error occurred."

  - `code` (string)
    An application-specific error code.
    Example: "internal_server_error"