Cards

Reveal PAN

POSThttps://api.firstleeward.com/v0/cards/:id/reveal-pan

Returns the card details (PAN, CVV, expiry) as an encrypted payload. Available only to PCI-scoped partners approved by First Leeward; all other projects receive 403 FEATURE_NOT_ENABLED with detail.feature: PCI_PAN_ACCESS. Decrypt with the private half of the RSA key pair registered with First Leeward, using the OAEP hash named by encryption. Never store or log the decrypted card details.

Authorizations

Authorizationstring · headerrequired

API key as Bearer token, e.g. Bearer YOUR_API_KEY

Headers

Leeward-Versionenum<string>required

API version (YYYY-MM-DD). Available option: 2026-09-18

Path Parameters

idstring<uuid>required

Response

200Encrypted card details response

encryptedDatastringrequired

Base64-encoded ciphertext of the card details JSON ({ pan, cvv, expiryDate }), encrypted per the encryption scheme. Decrypt with the private half of the RSA key pair registered with First Leeward.

encryptionstringrequired

Encryption scheme of encryptedData. Dispatch decryption on this value: it follows the OAEP hash of the public key registered with First Leeward for your program and can change when that key is replaced.

Available options:RSA_OAEP_SHA1RSA_OAEP_SHA256

400Card operation not allowed in current status

errorobjectrequired

Show child attributes

codestringrequired

messagestringrequired

detailobject | nullrequired