---
title: "Show Card PAN"
method: POST
path: "/cards/{cardId}/reveal"
tags: ["Card", "Swipe"]
---

# Show Card PAN

`POST /cards/{cardId}/reveal`

## Request

- Base URL: `https://sandbox.api.caas.reap.global`
- URL: `https://sandbox.api.caas.reap.global/cards/{cardId}/reveal`
- Auth: API key in header `x-reap-api-key`
- TypeScript: <https://skmtc.dev/reap-global/apis/reap-api/docs/cards/:cardId/reveal/post.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `cardId` string, uuid, required

## Headers

- `Accept-Version` string, required: Specifies the API version to use for this request.

## Response `200`

Return card PAN

- object
  - `data` object: Base64-encoded RSA-OAEP ciphertext of the card PAN, CVV, and expiry date.
    - `pan` string, required
    - `cvv` string, required
    - `expiryDate` string, required
  - `oaepHash` 'sha1' | 'sha256', required: The OAEP digest used to encrypt data.

## Other responses

- `400`: Unsafe Access
- `403`: Forbidden
- `404`: Card not found

## Changes

- **2026-11-03** `beb4b8d4eb01`: 2 info
  - added the non-success response with the status `403`
  - added the required property `oaepHash` to the response with the `200` status

[Operation history](https://skmtc.dev/reap-global/apis/reap-api/changes/cards/:cardId/reveal/post.md)

---

[API](https://skmtc.dev/reap-global/apis/reap-api.md) - [All operations](https://skmtc.dev/reap-global/apis/reap-api/llms.txt) - [OpenAPI document](https://skmtc.dev/reap-global/apis/reap-api/revisions/beb4b8d4eb01?raw)