Get Card Details | Bitnob API Reference

Get Card Details (Sensitive)

Retrieve the card's sensitive credentials — full card number, CVV and expiry. They are always returned encrypted to the public key registered for your account; decrypting them yields PCI-sensitive data, so handle the result with extreme care.

Security Warning

Only call this endpoint when absolutely necessary. Never log or store the full card number or CVV. Display card details securely in the UI and consider implementing additional verification (e.g., 2FA) before showing details to end users.

Card secured details

The card number and CVV are always returned encrypted, to a key only you can open. You must register a public key before calling this endpoint, and decrypt the response to read them. See Decrypt card secured details.

Get card details (secure)GET/api/cards/:cardId/secure

Request

Call GET /api/cards/:cardId/secure to fetch the sensitive card credentials. Treat the response as PCI-regulated.

Get Card Details

Path Parameters

successBoolean

Top-level flag indicating whether the request was processed successfully.

messageString

Human-readable status message describing the outcome.

data.encrypted_detailsObject

Envelope carrying the sealed card credentials. Decrypt it to obtain card_id, card_number, cvv, expiry_month, expiry_year, name and balance_amount.

data.encrypted_details.encrypted_dataString

Base64. The credentials JSON under AES-256-GCM, laid out as nonce (12 bytes) followed by ciphertext then tag (16 bytes). No AAD.

data.encrypted_details.encrypted_keyString

Base64. The one-time AES-256 key for this response, wrapped with your registered RSA public key using OAEP with SHA-256. Unwrap it with your private key.

data.encrypted_details.algorithmString

Identifies the scheme. Always 'RSA-OAEP-256+AES-256-GCM'. Reject anything else rather than guessing.

data.balance_amountString

Card balance in minor units, outside the encrypted blob so it can be shown without decrypting. Serialized as a JSON string — convert before arithmetic.

data.balance_currencyString

ISO 4217 currency of balance_amount.

timestampDate

Top-level RFC 3339 / ISO 8601 server timestamp of when the response was generated (UTC).

PCI-Sensitive Payload

The response itself carries no readable PAN — but what you decrypt out of it does. The moment you unseal encrypted_details you are holding an unmasked PAN and CVV, and PCI scope follows it: never log it, never persist it, never forward it to non-compliant services. Render directly in an iframe or PCI-scoped surface and discard immediately.

Response Body