LIlightsparkdev
Agent Operations

Reveal a purchase card

Changed on

Mint a short-lived signed URL of the card processor's page that displays one of the agent's open PURCHASE cards: its full number, expiry and CVV. The card details never pass through Grid; open the URL where the purchase is being made, right away, and never store or log it. Standard cards are revealed only by the platform with POST /cards/{id}/reveal.

Every reveal is audit-logged with the agent as the actor. Reveals are rate limited per agent and per card; beyond the limit the request is rejected with 429 RATE_LIMITED. Requires the MANAGE_CARDS permission.

post/agents/me/cards/{cardId}/reveal

Request

  • Base URL
    https://api.lightspark.com/grid/2025-10-13
  • URL
    https://api.lightspark.com/grid/2025-10-13/agents/me/cards/{cardId}/reveal
  • Auth
    HTTP bearer

Response

Reveal URL minted

panEmbedUrlstring uri required

Signed URL of the card processor's iframe that securely displays the PAN, CVV, and expiry to the cardholder. The full PAN and CVV never cross Grid's servers — render this URL in an iframe in your client to reveal card details. The URL is a short-lived bearer secret: render it immediately and never store, cache, or log it.

expiresAtstring date-time required

When the signed URL stops loading. Request a new reveal rather than re-rendering an expired URL.

Example response

{
  "panEmbedUrl": "https://embed.lithic.com/iframe/...?t=...",
  "expiresAt": "2026-05-08T14:16:00Z"
}

Changes

  • d996ddfb9d2bRevision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

  • 5abf2bb56bcbRevision changes
    • warning

      added the new CORRIDOR_UNDER_MAINTENANCE enum value to the response property for the response status