---
title: "Get card info with encrypted PAN V3 [beta]"
method: POST
path: "/v3/pcicards/cards/search"
tags: ["PCI"]
---

# Get card info with encrypted PAN V3 \[beta\]

`POST /v3/pcicards/cards/search`

## Request

- Base URL: `https://sandbox.pismolabs.io`
- URL: `https://sandbox.pismolabs.io/v3/pcicards/cards/search`
- Auth: HTTP bearer

Get card information - card ID, account ID, customer ID - using a card's encrypted PAN (Primary Account Number). To set up encryption for this endpoint, contact your Pismo representative. Alternatively, to send the PAN as clear text, call the [Get card info with PAN](ref:post-v1-card-search-by-pan) endpoint.

This endpoint uses AES256 with the GCM mode. AES-256 GCM is an authenticated encryption mode that uses the Advanced Encryption Standard (AES) with a 256-bit key in Galois/Counter Mode (GCM) to provide both confidentiality and integrity for data. In AES, an initialization vector (IV) is a fixed-size, non-secret randomized number used alongside the secret key to jumpstart the encryption process. The caller is responsible for generating the IV.  The Additional Authenticated Data (AAD) parameter must be the organization/tenant ID. AAD, in AES-GCM, is unencrypted data that is authenticated alongside the ciphertext to ensure the message's integrity and authenticity.

**Note:** This is a PCI endpoint, use the https://gw-pci.pismolabs.io environment.

## Request body

- SearchCardV2RequestBody2: Search for card with encrypted PAN object
  - `pan` string: Primary Account Number (PAN) encrypted with AES/GCM/NoPadding algorithm. The ciphertext (PAN encryption result) is **REQUIRED** to be base64 encoded.
  - `iv` string: Array initialization vector, used as a initial state for the AES algorithm. This field is used on the requester side to encrypt the PAN. It must be an random array of 16 bytes of length encoded as base64
  - `key_id` string: Key ID used for encryption. To obtain the `key_id`, the sender will generate a symmetric key (AES), encrypt this key with an asymmetric key (public_key) and send it via secure email to the security team. To obtain the asymmetric key, you must open a Configuration item for the Cards squad. After the Pismo security team registers the symmetric key, the `key_id` is shared with the issuer.

## Response `200`

Response for find card success

- SearchCardResponse: Get card information with PAN response object
  - `card_id` integer: Card ID
  - `account_id` number: Account ID
  - `customer_id` integer: Pismo customer ID

## Other responses

- `401`: Access token is missing or invalid
- `404`: The specified resource was not found
- `500`: Internal server error

---

[API](https://skmtc.dev/pismo/apis/card-issuing-cards.md) - [All operations](https://skmtc.dev/pismo/apis/card-issuing-cards/llms.txt) - [OpenAPI document](https://skmtc.dev/pismo/apis/card-issuing-cards/revisions/05611ac051b0?raw)