---
title: "Reveal Card PAN"
method: GET
path: "/cards/{card_id}/pan/reveal"
tags: ["Cards"]
---

# Reveal Card PAN

`GET /cards/{card_id}/pan/reveal`

## Request

- Base URL: `https://api.meow.com/v1`
- URL: `https://api.meow.com/v1/cards/{card_id}/pan/reveal`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/meow/apis/meow-api/docs/cards/:card_id/pan/reveal/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns the card number, CVC, and expiration for a claimed card. Call this via the `reveal_url` returned by Get Card PAN with `Authorization: Bearer <reveal_token>`, not against the API origin directly, which returns tokenized placeholders. Requires the `cards:write` scope and a valid reveal token.

## Path parameters

- `card_id` string, uuid, required: Card to act on. Use list_cards to find one.

## Headers

- `authorization` string: The `reveal_token` from Create Payment Token, as `Bearer <reveal_token>`. It is scoped to that one card and expires after `token_expires_in_seconds`.
- `x-entity-id` string, uuid

## Response `200`

Successful Response

- CardPanResponse
  - `card_number` string, required: Full card number (PAN).
  - `cvc` string, nullable: Card verification code.
  - `exp_month` integer, nullable: Expiration month (1-12).
  - `exp_year` integer, nullable: Expiration year (4-digit).

## Other responses

- `400`: The request could not be processed.
- `401`: Authentication failed.
- `403`: The API key is not authorized for this operation, or the user of a global API key is an admin or controller without approved KYC. The KYC case returns the message `KYC is required for controllers and admins.` until that user completes KYC in the Meow dashboard.
- `429`: Too many requests.

---

[API](https://skmtc.dev/meow/apis/meow-api.md) - [All operations](https://skmtc.dev/meow/apis/meow-api/llms.txt) - [OpenAPI document](https://skmtc.dev/meow/apis/meow-api/revisions/ea2d7e25b63b?raw)