Reveal card details

Changed on Sep 23, 2026

When the card's cardCapabilities.supportsPanReveal is true, mint a signed, short-lived URL for the card processor's iframe that displays the card's full PAN, CVV, and expiry to the cardholder. The Card resource never carries a reveal URL.

When cardCapabilities.supportsPanReveal is false, this endpoint cannot reveal the card. Use the card issuer's challenge-based hosted reveal flow instead.

Request the reveal right before rendering the iframe and render the returned panEmbedUrl immediately; it expires at expiresAt (within minutes). Never store, cache, or log the URL — it is a bearer secret for the full card details. The card data renders inside the processor's iframe and never crosses Grid's or your servers.

Set cardConfigs.panRevealCssUrl on your platform config to style the iframe with your own stylesheet, or send cssUrl in the body to override it for one reveal.

Every reveal is audit-logged with the requesting actor.

post/cards/{id}/reveal

Request

Base URL: https://api.lightspark.com/grid/2025-10-13
URL: https://api.lightspark.com/grid/2025-10-13/cards/{id}/reveal
Auth: HTTP basic

Request body

cssUrlstring uri nullable

HTTPS URL of a stylesheet for this reveal only, overriding cardConfigs.panRevealCssUrl for this call without changing your platform config. Use it to style one reveal differently from the rest — to match the cardholder's light or dark theme, for example. Subject to the same rules as the platform-level setting: it must be reachable over HTTPS without credentials, it styles the same selectors, and it loads into the page rendering the live card details, so host it somewhere you would trust with them. Omit the field, or send null, to fall back to your platform config.

Example request

{
  "cssUrl": "https://acme.com/card-reveal-dark.css"
}

Response

Reveal URL minted.

panEmbedUrlstring uri required

Signed URL of the card processor's iframe that securely displays the PAN, CVV, and expiry to the cardholder. The full PAN and CVV never cross Grid's servers — render this URL in an iframe in your client to reveal card details. The URL is a short-lived bearer secret: render it immediately and never store, cache, or log it.

expiresAtstring date-time required

When the signed URL stops loading. Request a new reveal rather than re-rendering an expired URL.

Example response

{
  "panEmbedUrl": "https://embed.lithic.com/iframe/...?t=...",
  "expiresAt": "2026-05-08T14:16:00Z"
}

Changes

Sep 23, 2026556180e5b2ae Revision changes
- info
  added optional request body
Sep 15, 20263966e5d38aad Revision changes
- breaking
  removed the required property from the response with the status
- breaking
  removed the required property from the response with the status
- breaking
  removed the required property from the response with the status
- breaking
  removed the required property from the response with the status
- breaking
  removed the required property from the response with the status
- breaking
  removed the required property from the response with the status
- breaking
  removed the required property from the response with the status
- breaking
  removed the required property from the response with the status
- breaking
  removed the required property from the response with the status
- breaking
  removed the required property from the response with the status
- breaking
  removed the required property from the response with the status
- breaking
  removed the required property from the response with the status
- warning
  added the new ACCOUNT_NOT_FOUND enum value to the response property for the response status
- warning
  added the new AUTH_METHOD_NOT_FOUND enum value to the response property for the response status
- warning
  added the new CUSTOMER_NOT_FOUND enum value to the response property for the response status
- warning
  added the new CUSTOMER_NOT_VERIFIED enum value to the response property for the response status
- warning
  added the new DOCUMENT_ALREADY_EXISTS enum value to the response property for the response status
- warning
  added the new DOCUMENT_HOLDER_NOT_FOUND enum value to the response property for the response status
- warning
  added the new DUPLICATE_EXTERNAL_ACCOUNT enum value to the response property for the response status
- warning
  added the new DUPLICATE_PAY_REQUEST enum value to the response property for the response status
- warning
  added the new NOT_FOUND enum value to the response property for the response status
- warning
  added the new PAYMENT_URL_NOT_FOUND enum value to the response property for the response status
- warning
  added the new PLATFORM_NOT_FOUND enum value to the response property for the response status
- warning
  added the new REQUEST_NOT_FOUND enum value to the response property for the response status
- warning
  added the new SANCTION_BLOCKED enum value to the response property for the response status
- warning
  added the new SESSION_NOT_FOUND enum value to the response property for the response status
- warning
  added the new SMS_OTP_CREDENTIAL_SET_CHANGED enum value to the response property for the response status
- warning
  added the new SMS_OTP_PHONE_NUMBER_ALREADY_EXISTS enum value to the response property for the response status
- warning
  added the new STABLECOIN_EXTERNAL_ACCOUNT_NOT_FOUND enum value to the response property for the response status
- warning
  added the new STABLECOIN_NOT_FOUND enum value to the response property for the response status
- warning
  added the new STABLECOIN_OPERATION_NOT_FOUND enum value to the response property for the response status
- warning
  added the new STABLECOIN_SYMBOL_ALREADY_EXISTS enum value to the response property for the response status
- warning
  added the new STABLECOIN_TOKEN_IDENTIFIER_ALREADY_EXISTS enum value to the response property for the response status
- warning
  added the new UNRECOGNIZED_MANDATORY_COUNTERPARTY_DATA_KEY enum value to the response property for the response status
- warning
  added the new VERIFICATION_NOT_FOUND enum value to the response property for the response status
- warning
  added the new WALLET_NOT_PROVISIONED enum value to the response property for the response status
- info
  added the required property to the response with the status
- info
  added the required property to the response with the status
- info
  added the required property to the response with the status
- info
  added the required property to the response with the status
- info
  added the required property to the response with the status
- info
  added the required property to the response with the status

Operation history (5 revisions)