> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developer.americanexpress.ferndocs.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer.americanexpress.ferndocs.com/_mcp/server.

# Create a new profile via acquisition.

POST https://api.qa2s.americanexpress.com/loyalty/v1/acquisition
Content-Type: application/json

Based on the acquisition event provided by an event producer system, this endpoint will create a Customer profile if one does not exist and associate a new profile with the provided instrument. Furthermore, the endpoint automatically enrolls the Customer into the default benefits of the associated Partner for the Cobrand Card Acquisition.

Reference: https://developer.americanexpress.ferndocs.com/utilities/network-loyalty/api-reference/acquisition

## Authentication

- `X-AMEX-API-KEY` header (required) — Application API key issued during app registration.
- `Authorization` header (required) — HMAC (one-way TLS). A `MAC` authorization header signed with your client secret. See https://developer.americanexpress.com/documentation/api-security/hmac
- `Authorization` header (required) — HMAC over mutual TLS. Requires a client certificate in addition to the signed `MAC` authorization header.
- `Authorization` header (bearer token, required) — OAuth 2.0 client credentials. Exchange your API key and secret for a bearer token, then send it as `Authorization: Bearer <token>`.

## Servers

- `https://api.qa2s.americanexpress.com/loyalty` (Sandbox, default)
- `https://api.qa2s.americanexpress.com/loyalty/v1/network` (Sandbox, default)

## Request

### Headers

- `Authorization` (string, required) — The Authorization header for the authentication at APIGEE. The following should be in the format of this header:MAC id: The Partner's Client ID. The Client ID is generated during the Partner Onboarding and the App Registration.ts: A client-generated timestamp (Unix Epoch format in milli-seconds).nonce: A unique identifier string. The value of nonce must be unique for the each request.mac: The request mac is generated using the HMAC SHA256 algorithm. Use the Client Secret to generate a hash/signature. The Client ID and Client Secret is generated during the Partner Onboarding and App registration.e.g., MAC id="adc3af10-7bf6-4d8a-87ea-35519ff6e1ad",ts="1466548572491",nonce="be3bd46c-b052-4ae8-9f61-993635e5bc98",bodyhash="cRPVGQWU+89HNR0ASAJFjhKqDF9X0pApGYuC/NVQNEU=",mac="NqbqNO3vSBwk6EE7pBi11DzvgLCh50IPAICCIWgjxYA="
- `correlation_id` (string, required) — A unique identifier used to track the request. This is with the current debugging standard in mind to track the request end-to-end. This will be mainly passed by the originating server (if it's a Webapp) or empty in case of the direct browser/app calls.e.g., GUID.
- `sender` (string, required) — The sender contains the sender information.e.g., Issuer or Service Provider.
- `keyname` (string, required) — The value assigned to the key used to encrypt the payload. For HIPED operations, this value must start with 'MK'.e.g., AA3434342323.

### Body (application/json)

This endpoint expects an Acquisition.

- `source` (enum, required) — To track from where this event was initiated.IssuerServicingWebMobileAlways use: Issuer.
  - Allowed values: `Issuer`, `Servicing`, `Web`, `Mobile`
- `type` (enum, required) — To define an event type.Always use: v1.instrument.instrumentCreated.
  - Allowed values: `v1.instrument.instrumentCreated`
- `time` (string, required) — The event initiation time in UTC.Always use: RFC3339 Nano format.e.g., 2020-04-13T22:59:42.582326946Z.
- `data` (Acquisition_Payload, required) — The acquisition payload contains data for the Issuer, Applicant/Customer, and instrument information.
- `specversion` (enum, optional) — The Cloud event Specification version.NOTE: Always use 0.3.
  - Allowed values: `0.3`
- `id` (string, optional) — If populated, this should be the same as the correlation\_id.

## Response

### 202

Acknowledged Request.

## Errors

### 400 Bad Request Error

Bad request.

- `error_code` (string, optional)
- `user_message` (string, optional) — An error occurred when processing your request.
- `developer_message` (string, optional) — A named\_exception was thrown by service\_method when performing processing\_task.

### 403 Forbidden Error

Forbidden.

- `error_code` (string, optional)
- `user_message` (string, optional) — An error occurred when processing your request.
- `developer_message` (string, optional) — A named\_exception was thrown by service\_method when performing processing\_task.

### 404 Not Found Error

Not Found.

- `error_code` (string, optional)
- `user_message` (string, optional) — An error occurred when processing your request.
- `developer_message` (string, optional) — A named\_exception was thrown by service\_method when performing processing\_task.

### 409 Conflict Error

Conflict: Business error.

- `error_code` (string, optional)
- `user_message` (string, optional) — An error occurred when processing your request.
- `developer_message` (string, optional) — A named\_exception was thrown by service\_method when performing processing\_task.

### 500 Internal Server Error

Internal server error.

- `error_code` (string, optional)
- `user_message` (string, optional) — An error occurred when processing your request.
- `developer_message` (string, optional) — A named\_exception was thrown by service\_method when performing processing\_task.

## Types

### Acquisition_Payload

The acquisition payload contains data for the Issuer, Applicant/Customer, and instrument information.

- `network_info` (Network_Info, required) — An object containing the GNS-related information.
- `applicant` (Application_Info, required) — The applicant refers to the Customer or the Person applying for the instrument on the Issuer side.
- `product_info` (Product_Info, required) — The reference to a marketable product.e.g., Platinum Card.
- `instrument` (Instrument, required) — The information of the instrument acquired by the Customer from the Issuer.e.g., Card.
- `program_account_id` (string, optional) — The Partner Account ID refers to the FFN.e.g., The Hilton Honors or the BA Executive Club number of the Customer.This is required to be sent by Network Loyalty GNS for the Partner: Hilton Cobrand.
- `demographics` (Acquisition_demographics, optional) — This is required by Network Loyalty GNS. This contains all possible Customer data which can be sent by Network/Issuer to make a successful transfer.NOTE: All the fields that follow are optional, as any Partner may have different mandatory fields. Typically, the API checks mandatory parameters from a specific program_name and validates the mandatory fields.

### Network_Info

An object containing the GNS-related information.

- `institution_id` (string, required) — A unique ID which recognizes the Issuer.e.g., Bank_1, Bank_2.
- `network_id` (string, optional) — A unique ID which identifies the Issuer Network and will be provided, if required.e.g., Express_Company.

### Application_Info

The applicant refers to the Customer or the Person applying for the instrument on the Issuer side.

- `app_approval_date` (string, required) — This is the date the Card Member's credit card application has been approved. Used to determine when the Customer's eligibility for the point transfers and the elite tier benefit enrollments begin.Always use: RFC3339 Nano format.e.g., 2021-07-14T15:18:15.443Z.
- `applicant_entity_kind` (enum, required) — Refers to the Individual or the Commercial in case of the Corporate or the Small Business instruments.IndividualCommercialAlways use: Individual.
  - Allowed values: `Individual`, `Commercial`
- `applicant_id_kind` (enum, required) — Refers to the Customer ID that uniquely identifies the Person or the Business.Always Use: Issuer_Customer_Id.
  - Allowed values: `Issuer_Customer_Id`, `Amex_Customer_Id`
- `applicant_id` (string, required) — This is a unique ID generated in the Issuer's system to represent the Customer.e.g., If the Customer has two different cards, the applicant_id will stay the same and the instrument_id will be different.

### Product_Info

The reference to a marketable product.e.g., Platinum Card.

- `market` (double, required) — The code of the country.e.g., 101.
- `family` (string, required) — The family code from the GNS Issuer identifying a product.e.g., mock-family.

### Instrument

The information of the instrument acquired by the Customer from the Issuer.e.g., Card.

- `instrument_id` (string, required) — A unique ID for an instrument that is internal to the Issuer. In case of a supplementary instrument, i.e., a Supplementary Card, the primary_instrument_id may also be populated to link it with the Primary Owner.e.g., GUID.
- `primary_instrument_id` (string, optional) — A unique ID for an instrument that is internal to the Issuer and populated only for a supplementary acquisition scenario.e.g., GUID.

### Acquisition_demographics

This is required by Network Loyalty GNS. This contains all possible Customer data which can be sent by Network/Issuer to make a successful transfer.NOTE: All the fields that follow are optional, as any Partner may have different mandatory fields. Typically, the API checks mandatory parameters from a specific program_name and validates the mandatory fields.

- `FIRST_NAME` (string, optional)
- `MIDDLE_NAME` (string, optional)
- `LAST_NAME` (string, optional) — This is required to be sent by Network Loyalty GNS for the Partner: Hilton Cobrand.
- `DOB` (string, optional)
- `GENDER` (string, optional)
- `EMAIL` (string, optional)
- `LANGUAGE` (string, optional)
- `TITLE` (string, optional)
- `ADDR_LINE_1` (string, optional)
- `ADDR_LINE_2` (string, optional)
- `ADDR_LINE_3` (string, optional)
- `CITY` (string, optional)
- `STATE` (string, optional)
- `POSTAL_CODE` (string, optional)
- `COUNTRY` (string, optional)
- `TELEPHONE` (string, optional)

## Examples

**Request**

```json
{
  "source": "Issuer",
  "type": "v1.instrument.instrumentCreated",
  "time": "2020-04-13T22:59:42.582326946Z",
  "data": {
    "network_info": {
      "institution_id": "string"
    },
    "applicant": {
      "app_approval_date": "string",
      "applicant_entity_kind": "Individual",
      "applicant_id_kind": "Issuer_Customer_Id",
      "applicant_id": "If the Customer has two different cards, the applicant_id will stay the same and the instrument_id will be different."
    },
    "product_info": {
      "market": 826,
      "family": "ELCE"
    },
    "instrument": {
      "instrument_id": "GUID"
    }
  }
}
```

**Response**

```json
{}
```

**SDK Code**

```python
import requests

url = "https://api.qa2s.americanexpress.com/loyalty/v1/acquisition"

payload = {
    "source": "Issuer",
    "type": "v1.instrument.instrumentCreated",
    "time": "2020-04-13T22:59:42.582326946Z",
    "data": {
        "network_info": { "institution_id": "string" },
        "applicant": {
            "app_approval_date": "string",
            "applicant_entity_kind": "Individual",
            "applicant_id_kind": "Issuer_Customer_Id",
            "applicant_id": "If the Customer has two different cards, the applicant_id will stay the same and the instrument_id will be different."
        },
        "product_info": {
            "market": 826,
            "family": "ELCE"
        },
        "instrument": { "instrument_id": "GUID" }
    }
}
headers = {
    "Authorization": "Authorization",
    "correlation_id": "correlation_id",
    "keyname": "keyname",
    "sender": "sender",
    "X-AMEX-API-KEY": "<apiKey>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript
const url = 'https://api.qa2s.americanexpress.com/loyalty/v1/acquisition';
const options = {
  method: 'POST',
  headers: {
    Authorization: 'Authorization',
    correlation_id: 'correlation_id',
    keyname: 'keyname',
    sender: 'sender',
    'X-AMEX-API-KEY': '<apiKey>',
    'Content-Type': 'application/json'
  },
  body: '{"source":"Issuer","type":"v1.instrument.instrumentCreated","time":"2020-04-13T22:59:42.582326946Z","data":{"network_info":{"institution_id":"string"},"applicant":{"app_approval_date":"string","applicant_entity_kind":"Individual","applicant_id_kind":"Issuer_Customer_Id","applicant_id":"If the Customer has two different cards, the applicant_id will stay the same and the instrument_id will be different."},"product_info":{"market":826,"family":"ELCE"},"instrument":{"instrument_id":"GUID"}}}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.qa2s.americanexpress.com/loyalty/v1/acquisition"

	payload := strings.NewReader("{\n  \"source\": \"Issuer\",\n  \"type\": \"v1.instrument.instrumentCreated\",\n  \"time\": \"2020-04-13T22:59:42.582326946Z\",\n  \"data\": {\n    \"network_info\": {\n      \"institution_id\": \"string\"\n    },\n    \"applicant\": {\n      \"app_approval_date\": \"string\",\n      \"applicant_entity_kind\": \"Individual\",\n      \"applicant_id_kind\": \"Issuer_Customer_Id\",\n      \"applicant_id\": \"If the Customer has two different cards, the applicant_id will stay the same and the instrument_id will be different.\"\n    },\n    \"product_info\": {\n      \"market\": 826,\n      \"family\": \"ELCE\"\n    },\n    \"instrument\": {\n      \"instrument_id\": \"GUID\"\n    }\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Authorization")
	req.Header.Add("correlation_id", "correlation_id")
	req.Header.Add("keyname", "keyname")
	req.Header.Add("sender", "sender")
	req.Header.Add("X-AMEX-API-KEY", "<apiKey>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.qa2s.americanexpress.com/loyalty/v1/acquisition")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Authorization'
request["correlation_id"] = 'correlation_id'
request["keyname"] = 'keyname'
request["sender"] = 'sender'
request["X-AMEX-API-KEY"] = '<apiKey>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"source\": \"Issuer\",\n  \"type\": \"v1.instrument.instrumentCreated\",\n  \"time\": \"2020-04-13T22:59:42.582326946Z\",\n  \"data\": {\n    \"network_info\": {\n      \"institution_id\": \"string\"\n    },\n    \"applicant\": {\n      \"app_approval_date\": \"string\",\n      \"applicant_entity_kind\": \"Individual\",\n      \"applicant_id_kind\": \"Issuer_Customer_Id\",\n      \"applicant_id\": \"If the Customer has two different cards, the applicant_id will stay the same and the instrument_id will be different.\"\n    },\n    \"product_info\": {\n      \"market\": 826,\n      \"family\": \"ELCE\"\n    },\n    \"instrument\": {\n      \"instrument_id\": \"GUID\"\n    }\n  }\n}"

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.qa2s.americanexpress.com/loyalty/v1/acquisition")
  .header("Authorization", "Authorization")
  .header("correlation_id", "correlation_id")
  .header("keyname", "keyname")
  .header("sender", "sender")
  .header("X-AMEX-API-KEY", "<apiKey>")
  .header("Content-Type", "application/json")
  .body("{\n  \"source\": \"Issuer\",\n  \"type\": \"v1.instrument.instrumentCreated\",\n  \"time\": \"2020-04-13T22:59:42.582326946Z\",\n  \"data\": {\n    \"network_info\": {\n      \"institution_id\": \"string\"\n    },\n    \"applicant\": {\n      \"app_approval_date\": \"string\",\n      \"applicant_entity_kind\": \"Individual\",\n      \"applicant_id_kind\": \"Issuer_Customer_Id\",\n      \"applicant_id\": \"If the Customer has two different cards, the applicant_id will stay the same and the instrument_id will be different.\"\n    },\n    \"product_info\": {\n      \"market\": 826,\n      \"family\": \"ELCE\"\n    },\n    \"instrument\": {\n      \"instrument_id\": \"GUID\"\n    }\n  }\n}")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.qa2s.americanexpress.com/loyalty/v1/acquisition', [
  'body' => '{
  "source": "Issuer",
  "type": "v1.instrument.instrumentCreated",
  "time": "2020-04-13T22:59:42.582326946Z",
  "data": {
    "network_info": {
      "institution_id": "string"
    },
    "applicant": {
      "app_approval_date": "string",
      "applicant_entity_kind": "Individual",
      "applicant_id_kind": "Issuer_Customer_Id",
      "applicant_id": "If the Customer has two different cards, the applicant_id will stay the same and the instrument_id will be different."
    },
    "product_info": {
      "market": 826,
      "family": "ELCE"
    },
    "instrument": {
      "instrument_id": "GUID"
    }
  }
}',
  'headers' => [
    'Authorization' => 'Authorization',
    'Content-Type' => 'application/json',
    'X-AMEX-API-KEY' => '<apiKey>',
    'correlation_id' => 'correlation_id',
    'keyname' => 'keyname',
    'sender' => 'sender',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api.qa2s.americanexpress.com/loyalty/v1/acquisition");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "Authorization");
request.AddHeader("correlation_id", "correlation_id");
request.AddHeader("keyname", "keyname");
request.AddHeader("sender", "sender");
request.AddHeader("X-AMEX-API-KEY", "<apiKey>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"source\": \"Issuer\",\n  \"type\": \"v1.instrument.instrumentCreated\",\n  \"time\": \"2020-04-13T22:59:42.582326946Z\",\n  \"data\": {\n    \"network_info\": {\n      \"institution_id\": \"string\"\n    },\n    \"applicant\": {\n      \"app_approval_date\": \"string\",\n      \"applicant_entity_kind\": \"Individual\",\n      \"applicant_id_kind\": \"Issuer_Customer_Id\",\n      \"applicant_id\": \"If the Customer has two different cards, the applicant_id will stay the same and the instrument_id will be different.\"\n    },\n    \"product_info\": {\n      \"market\": 826,\n      \"family\": \"ELCE\"\n    },\n    \"instrument\": {\n      \"instrument_id\": \"GUID\"\n    }\n  }\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = [
  "Authorization": "Authorization",
  "correlation_id": "correlation_id",
  "keyname": "keyname",
  "sender": "sender",
  "X-AMEX-API-KEY": "<apiKey>",
  "Content-Type": "application/json"
]
let parameters = [
  "source": "Issuer",
  "type": "v1.instrument.instrumentCreated",
  "time": "2020-04-13T22:59:42.582326946Z",
  "data": [
    "network_info": ["institution_id": "string"],
    "applicant": [
      "app_approval_date": "string",
      "applicant_entity_kind": "Individual",
      "applicant_id_kind": "Issuer_Customer_Id",
      "applicant_id": "If the Customer has two different cards, the applicant_id will stay the same and the instrument_id will be different."
    ],
    "product_info": [
      "market": 826,
      "family": "ELCE"
    ],
    "instrument": ["instrument_id": "GUID"]
  ]
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api.qa2s.americanexpress.com/loyalty/v1/acquisition")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```