---
title: "Reveal a purchase card"
method: POST
path: "/agents/me/cards/{cardId}/reveal"
tags: ["Agent Operations"]
---

# Reveal a purchase card

`POST /agents/me/cards/{cardId}/reveal`

## Request

- Base URL: `https://api.lightspark.com/grid/2025-10-13`
- URL: `https://api.lightspark.com/grid/2025-10-13/agents/me/cards/{cardId}/reveal`
- Auth: HTTP bearer

Mint a short-lived signed URL of the card processor's page that displays one of the agent's open `PURCHASE` cards: its full number, expiry and CVV. The card details never pass through Grid; open the URL where the purchase is being made, right away, and never store or log it. Standard cards are revealed only by the platform with `POST /cards/{id}/reveal`.

Every reveal is audit-logged with the agent as the actor. Reveals are rate limited per agent and per card; beyond the limit the request is rejected with `429 RATE_LIMITED`. Requires the MANAGE_CARDS permission.

## Response `200`

Reveal URL minted

- CardRevealResponse
  - `panEmbedUrl` string, uri, required: Signed URL of the card processor's iframe that securely displays the PAN, CVV, and expiry to the cardholder. The full PAN and CVV never cross Grid's servers — render this URL in an iframe in your client to reveal card details. The URL is a short-lived bearer secret: render it immediately and never store, cache, or log it.
  - `expiresAt` string, date-time, required: When the signed URL stops loading. Request a new reveal rather than re-rendering an expired URL.

## Other responses

- `401`: Unauthorized
- `403`: Forbidden - Agents API, agent cards or agent purchase cards are not enabled for the platform, the agent is paused, the agent does not have the MANAGE_CARDS permission, or the customer is not verified
- `404`: Card not found
- `409`: Conflict. Returned with `CONFLICT` when the card is not a `PURCHASE` card, and with `CARD_NOT_MUTABLE` when it is closed or expired.
- `429`: Too many reveals for this agent or card; retry later
- `500`: Internal service error

## Changes

> 115 revisions in range; 2 not diffed.

- **2026-10-28** `d996ddfb9d2b`: 3 info
  - added the optional property `details/permission` to the response with the `403` status
  - added the optional property `details/policyDenialReason` to the response with the `403` status
  - added the optional property `details/refusalReason` to the response with the `403` status
- **2026-10-28** `5abf2bb56bcb`: 1 warning
  - added the new `CORRIDOR_UNDER_MAINTENANCE` enum value to the `code` response property for the response status `403`
- **2026-10-26** `f11f1e76bdd7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/lightsparkdev/apis/grid-api/changes/agents/me/cards/:cardId/reveal/post.md)

---

[API](https://skmtc.dev/lightsparkdev/apis/grid-api.md) - [All operations](https://skmtc.dev/lightsparkdev/apis/grid-api/llms.txt) - [OpenAPI document](https://skmtc.dev/lightsparkdev/apis/grid-api/revisions/7a1db46ec552?raw)