---
title: "Get OTP for PCI Widget"
method: GET
path: "/card-details/widget/{cardId}/otp"
tags: ["Card Sensitive Data"]
---

# Get OTP for PCI Widget

`GET /card-details/widget/{cardId}/otp`

## Request

- Base URL: `https://partner-api.getpliant.com/api`
- URL: `https://partner-api.getpliant.com/api/card-details/widget/{cardId}/otp`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/getpliant/apis/pliant-customer-api/docs/card-details/widget/:cardId/otp/get.ts> (a function with typed inputs; its response is checked against the schema)

This endpoint is used to get an OTP for the PCI Widget (Web and Mobile). The OTP is used to authenticate the cardholder request and to retrieve the sensitive card data. 
The request has to be made from the backend of your application. Directly calling this endpoint from your frontend is not allowed due to security reasons.

**A dedicated host URL `pci-api.getpliant.com` is used for this endpoint!** Please refer to the [documentation](/docs/pci-widget-web) for more information.

## Path parameters

- `cardId` string, uuid, required

## Headers

- `Pliant-Trace-Id` string, uuid, required

## Response `200`

Ok

- string: The OTP for the PCI Widget

## Other responses

- `400` (unresolved $ref)
- `401` (unresolved $ref)
- `403` (unresolved $ref)
- `404` (unresolved $ref)
- `429` (unresolved $ref)
- `500` (unresolved $ref)

## Changes

- **2026-11-03** `a4fbf7d068b4`: 4 breaking, 13 info
  - the response's body type changed from no type to `object` for status `400`
  - the response's body type changed from no type to `object` for status `401`
  - the response's body type changed from no type to `object` for status `403`
  - the response's body type changed from no type to `object` for status `500`
  - …13 more

[Operation history](https://skmtc.dev/getpliant/apis/pliant-customer-api/changes/card-details/widget/:cardId/otp/get.md)

---

[API](https://skmtc.dev/getpliant/apis/pliant-customer-api.md) - [All operations](https://skmtc.dev/getpliant/apis/pliant-customer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getpliant/apis/pliant-customer-api/revisions/a4fbf7d068b4?raw)