---
title: "Retrieve sensitive data"
method: GET
path: "/v1/vendor_cards/{vendor_card_id}/retrieve"
tags: ["Vendor card"]
---

# Retrieve sensitive data

`GET /v1/vendor_cards/{vendor_card_id}/retrieve`

## Request

- Base URL: `https://api.cardda.com`
- URL: `https://api.cardda.com/v1/vendor_cards/{vendor_card_id}/retrieve`
- Auth: HTTP bearer

Returns the sensitive information of the card (PAN, CVC, expiry). Authorized
for admins or the cardholder the card belongs to. This is the only endpoint
that exposes the full card number — the list and show endpoints redact it.

## Path parameters

- `vendor_card_id` string, required

## Parameters

- `#/paths/~1v1~1merchants/get/parameters/0` (unresolved $ref)

## Response `200`

Sensitive data of the card (PAN, CVC, expiry).

- VendorCardRetrieve
  - `id` string: Card id. Cardda card ids are vendor-prefixed base64-encoded strings (e.g. `Q2FyZDoxMDIwNjQ5Mw==`), not UUIDs. Matches the same identifier returned by the vendor cards list endpoint.
  - `cvc` string
  - `exp_month` string
  - `exp_year` string
  - `number` string
  - `last4` string
  - `name` string

## Other responses

- `400`: Bad Request — the vendor returned no sensitive data for this card.
- `401`: Unauthorized
- `404`: Vendor card not found (or not visible to the caller).

---

[API](https://skmtc.dev/cardda/apis/banking-api.md) - [All operations](https://skmtc.dev/cardda/apis/banking-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cardda/apis/banking-api/revisions/ff1aeb3fda8b?raw)