Reveal card credentials
curl --request POST \
--url https://sandbox-api.sakawave.example/v1/cards/{cardId}/details \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://sandbox-api.sakawave.example/v1/cards/{cardId}/details', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://sandbox-api.sakawave.example/v1/cards/{cardId}/details"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text){
"pan": "5399830000004242",
"cvv": "123",
"expiryMonth": 8,
"expiryYear": 2028
}{
"statusCode": 400,
"message": "Must be a valid identifier.",
"code": "validation_failed",
"errors": [
{
"message": "Must be a valid identifier.",
"field": "accountId",
"code": "custom",
"path": [
"accountId"
]
}
]
}{
"statusCode": 401,
"code": "INVALID_API_KEY",
"message": "Invalid or inactive API credentials."
}{
"statusCode": 404,
"code": "resource_not_found",
"message": "Resource not found."
}{
"statusCode": 409,
"code": "resource_conflict",
"message": "The request conflicts with the current resource state."
}{
"statusCode": 429,
"message": "Too many API requests. Try again later.",
"code": "api_key_rate_limit_exceeded",
"retryAfterSeconds": 17
}{
"statusCode": 500,
"code": "internal_server_error",
"message": "An unexpected error occurred."
}{
"statusCode": 503,
"code": "provider_unavailable",
"message": "We could not issue an account number just now. Try again shortly."
}Cards
Reveal card credentials
Returns the full card number and security code, fetched live from the provider. Sakawave does not store them.
POST
/
v1
/
cards
/
{cardId}
/
details
Reveal card credentials
curl --request POST \
--url https://sandbox-api.sakawave.example/v1/cards/{cardId}/details \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://sandbox-api.sakawave.example/v1/cards/{cardId}/details', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://sandbox-api.sakawave.example/v1/cards/{cardId}/details"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text){
"pan": "5399830000004242",
"cvv": "123",
"expiryMonth": 8,
"expiryYear": 2028
}{
"statusCode": 400,
"message": "Must be a valid identifier.",
"code": "validation_failed",
"errors": [
{
"message": "Must be a valid identifier.",
"field": "accountId",
"code": "custom",
"path": [
"accountId"
]
}
]
}{
"statusCode": 401,
"code": "INVALID_API_KEY",
"message": "Invalid or inactive API credentials."
}{
"statusCode": 404,
"code": "resource_not_found",
"message": "Resource not found."
}{
"statusCode": 409,
"code": "resource_conflict",
"message": "The request conflicts with the current resource state."
}{
"statusCode": 429,
"message": "Too many API requests. Try again later.",
"code": "api_key_rate_limit_exceeded",
"retryAfterSeconds": 17
}{
"statusCode": 500,
"code": "internal_server_error",
"message": "An unexpected error occurred."
}{
"statusCode": 503,
"code": "provider_unavailable",
"message": "We could not issue an account number just now. Try again shortly."
}This is the most sensitive response in the API. It is a
POST precisely so it cannot be triggered by a link, prefetch, or browser history entry, and it answers with Cache-Control: no-store, private.Handling the response
- Never log it, never put it in an error report, and never write it to disk.
- Do not store it. Fetch it when the holder asks to see the card, and drop it after.
- Do not proxy it through your own persistent cache or CDN.
- Show it in a component that does not survive a page reload.
creating answers 409 card_not_ready.
Error codes
| Status | code | Cause |
|---|---|---|
400 | validation_failed | The identifier is not a ULID. |
409 | card_not_ready | The card has not finished being issued. |
503 | card_credentials_unavailable | The provider did not return the number or security code. |
401 | INVALID_API_KEY | The key is missing, invalid, inactive, expired, from the other environment, or blocked by its IP allowlist. |
404 | card_not_found | No such card for this business. |
429 | api_key_rate_limit_exceeded | The per-minute limit for this key was exceeded. |
Authorizations
A secret API key, sent as Authorization: Bearer sk_test_… in sandbox or Bearer sk_live_… in live.
Path Parameters
Card ULID. A 26-character ULID.
Required string length:
26Pattern:
^[0-7][0-9A-HJKMNP-TV-Z]{25}$Example:
"01K2Z3AB4C5D6E7F8G9HJKMNPQ"