LIlightsparkdev
Cards

Reveal card details

Changed on

When the card's cardCapabilities.supportsPanReveal is true, mint a signed, short-lived URL for the card processor's iframe that displays the card's full PAN, CVV, and expiry to the cardholder. The Card resource never carries a reveal URL.

When cardCapabilities.supportsPanReveal is false, this endpoint cannot reveal the card. Use the card issuer's challenge-based hosted reveal flow instead.

Request the reveal right before rendering the iframe and render the returned panEmbedUrl immediately; it expires at expiresAt (within minutes). Never store, cache, or log the URL — it is a bearer secret for the full card details. The card data renders inside the processor's iframe and never crosses Grid's or your servers.

Set cardConfigs.panRevealCssUrl on your platform config to style the iframe with your own stylesheet, or send cssUrl in the body to override it for one reveal.

Every reveal is audit-logged with the requesting actor.

post/cards/{id}/reveal

Request

  • Base URL
    https://api.lightspark.com/grid/2025-10-13
  • URL
    https://api.lightspark.com/grid/2025-10-13/cards/{id}/reveal
  • Auth
    HTTP basic

Request body

cssUrlstring uri nullable

HTTPS URL of a stylesheet for this reveal only, overriding cardConfigs.panRevealCssUrl for this call without changing your platform config. Use it to style one reveal differently from the rest — to match the cardholder's light or dark theme, for example. Subject to the same rules as the platform-level setting: it must be reachable over HTTPS without credentials, it styles the same selectors, and it loads into the page rendering the live card details, so host it somewhere you would trust with them. Omit the field, or send null, to fall back to your platform config.

Example request

{
  "cssUrl": "https://acme.com/card-reveal-dark.css"
}

Response

Reveal URL minted.

panEmbedUrlstring uri required

Signed URL of the card processor's iframe that securely displays the PAN, CVV, and expiry to the cardholder. The full PAN and CVV never cross Grid's servers — render this URL in an iframe in your client to reveal card details. The URL is a short-lived bearer secret: render it immediately and never store, cache, or log it.

expiresAtstring date-time required

When the signed URL stops loading. Request a new reveal rather than re-rendering an expired URL.

Example response

{
  "panEmbedUrl": "https://embed.lithic.com/iframe/...?t=...",
  "expiresAt": "2026-05-08T14:16:00Z"
}

Changes

  • d996ddfb9d2bRevision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

  • 5abf2bb56bcbRevision changes
    • warning

      added the new CORRIDOR_UNDER_MAINTENANCE enum value to the response property for the response status