Reveal card secrets
POST/v1/cards/:card_id/secrets
Returns the card's number and security code, each encrypted to a public key you supply. It is a server-to-server call: there is no page to open, and only the holder of the matching private key can read the values.
Send an RSA public key in PEM form, of at least 2048 bits. The response
carries encrypted_pan and encrypted_cvv, each encrypted with RSA-OAEP
using SHA-256 and encoded as base64. last_four and expires_at come back
in the clear.
Only an active card has details to show. Any other card is refused with
card_invalid_state, and a closed card with card_closed.
The response is never cached. Idempotency-Key is accepted like on every
other POST, but it is not used here: a replay would have to keep a copy of
the first response, so every call is answered afresh with a new ciphertext.
Never write the decrypted values to a log, an analytics event, web storage or a support ticket.
Requires the cards:secrets scope. A program whose processor cannot
return card details does not have this endpoint at all.
Request
Responses
- 200
- 400
- 403
- 404
- 422
The card's number and security code, encrypted to your key.
The request is malformed or contains an unrecognized parameter.
Credentials are valid but not permitted. Do not retry.
The resource does not exist, or belongs to another organization. The two are deliberately indistinguishable.
Well-formed but fails a business rule.