Get card information

GET

/card

• Production
• Sandbox

Retrieve the card profile and encrypted card data for an authenticated user.

Retrieving encrypted card details

1. Generate a session ID: Encrypt a 32‑character hexadecimal secret (no spaces/dashes) with the provided public RSA key using RSA‑OAEP.
2. Send the request: Include the encrypted secret in the header sessionid when calling this endpoint.
3. Decrypt the response: Use the original secret to decrypt encryptedPan, encryptedCvc, and pin (each returned as { data, iv }).

Step 1: Generate a sessionid and secret

import crypto from "node:crypto";

function session(): { sessionid: string; secret: string } {
  const secret = crypto.randomUUID().replaceAll("-", "");
  const secretKeyBase64 = Buffer.from(secret, "hex").toString("base64");
  const secretKeyBase64Buffer = Buffer.from(secretKeyBase64, "utf8");
  const secretKeyBase64BufferEncrypted = crypto.publicEncrypt(
    { key: pem, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING },
    secretKeyBase64Buffer,
  );
  return {
    sessionid: secretKeyBase64BufferEncrypted.toString("base64"),
    secret,
  };
}

The sessionid is required to make an API request. The secret will be needed for decryption later.

Step 2: Send the request

Use the sessionid in the header when calling this endpoint.

Step 3: Decrypt the response

Use the secret from Step 1 to decrypt the data.

import crypto from "node:crypto";

function decrypt(base64Secret: string, base64Iv: string, secretKey: string): string {
  const secret = Buffer.from(base64Secret, "base64");
  const iv = Buffer.from(base64Iv, "base64");
  const decipher = crypto.createDecipheriv("aes-128-gcm", Buffer.from(secretKey, "hex"), iv);
  decipher.setAutoPadding(false);
  decipher.setAuthTag(secret.subarray(-16));
  return Buffer.concat([decipher.update(secret.subarray(0, -16)), decipher.final()]).toString("utf8");
}

Authorizations

• credentialAuth

Parameters

Header Parameters

sessionid

required

string

Responses

200

Card information

object

cardId

required

string format: uuid

123e4567-e89b-12d3-a456-426655440000

displayName

required

string

John Doe

encryptedPan

required

object

data

required

string

iv

required

string

encryptedCvc

required

object

data

required

string

iv

required

string

expirationMonth

required

string

12

expirationYear

required

string

2025

lastFour

required

string

1234

mode

required

number

0

pin

required

Any of:

object

object

data

required

string

iv

required

string

provider

required

Allowed values: panda

panda

status

required

Allowed values: ACTIVE FROZEN

ACTIVE

limit

required

object

amount

required

number

frequency

required

Allowed values: per24HourPeriod per7DayPeriod per30DayPeriod perYearPeriod allTime perAuthorization

400

Bad request

object

code

required

string

bad request

legacy

required

string

bad request

403

Forbidden

object

code

required

string

no panda

legacy

required

string

no panda

404

Not found

object

code

required

Allowed values: no card

no card

legacy

required

Allowed values: card not found

card not found