Skip to main content
POST
Reveal card credentials
This is the most sensitive response in the API. It is a POST precisely so it cannot be triggered by a link, prefetch, or browser history entry, and it answers with Cache-Control: no-store, private.

Handling the response

  • Never log it, never put it in an error report, and never write it to disk.
  • Do not store it. Fetch it when the holder asks to see the card, and drop it after.
  • Do not proxy it through your own persistent cache or CDN.
  • Show it in a component that does not survive a page reload.
A card must have been issued at the provider before credentials exist — a card still creating answers 409 card_not_ready.

Error codes

Authorizations

Authorization
string
header
required

A secret API key, sent as Authorization: Bearer sk_test_… in sandbox or Bearer sk_live_… in live.

Path Parameters

cardId
string
required

Card ULID. A 26-character ULID.

Required string length: 26
Pattern: ^[0-7][0-9A-HJKMNP-TV-Z]{25}$
Example:

"01K2Z3AB4C5D6E7F8G9HJKMNPQ"

Response

Successful response.

sensitive
pan
string
required

The full card number. Never log or store it.

sensitive
cvv
string
required

The security code.

expiryMonth
integer
required
Required range: 1 <= x <= 12
expiryYear
integer
required