---
title: "Get Card Credentials"
method: GET
path: "/cms/api/v1/issuers/{issuerId}/cards/{cardId}/credentials"
---

# Get Card Credentials

`GET /cms/api/v1/issuers/{issuerId}/cards/{cardId}/credentials`

## Request

- Base URL: `https://api.d1.thalescloud.io/authz/v1`
- URL: `https://api.d1.thalescloud.io/authz/v1/cms/api/v1/issuers/{issuerId}/cards/{cardId}/credentials`
- Auth: none declared
- TypeScript: <https://skmtc.dev/thalescloud/apis/d1-oauth-api/docs/cms/api/v1/issuers/:issuerId/cards/:cardId/credentials/get.ts> (a function with typed inputs; its response is checked against the schema)

API used by D1 to call the CMS for retrieving the card credentials (PAN, expiry date, cardholder name and CVV) using a card identifier.<br/>It can be used, for example, for displaying the card details to an end user who wants to perform an e-commerce transaction or for registering a 'legacy card' in the D1 system.

## Headers

- `Authorization` string

## Response `200`

OK

- object
  - `encryptedData` string, required: The encryptedData is the encrypted json (cf http://www.json.org/ ) representation of the card credentials.<br/>This value is encrypted using the JWE encryption (please refer to the **[Sensitive Information Encryption](https://thales-dis-dbp.stoplight.io/docs/d1-developer-portal/24df87894894d-data-encryption)** for more details)<br/><br/><b>Content</b><br/><br/>Once deciphered, the plaintext contains: |JSON field parameter name|description|MOC|Format| |-------|-------|-------|-------| |pan|The funding pan value.|M|string - from 10 to 19 digits| |exp|The expiry date of the card.|M|string - 4 digits, following the format MMYY| |name|The card holder name.|O|string - up to 128 characters| |cvv|The CVV2 value of the funding card|M|string - 3 or 4 digits| |auxiliaryPan|The auxiliary funding pan value.It shall be provided when cobadge is supported and if the card has an auxiliary pan.|C|string - up to 19 digits| |auxiliaryExp|The auxiliary expiry date of the card.It shall be provided when cobadge is supported and if the card has an auxiliary pan.|C|string - 4 digits, following the format MMYY| |customSuffix|last 4 digits of the display pan which is different than the actual funding pan|O|string - 4 digits|

## Other responses

- `400`: Bad Request
- `401`: Authorization missing or invalid
- `403`: Action forbidden (if card is not active, for example)
- `404`: Resource not found (issuerId, cardId)
- `500`: Internal Server Error

---

[API](https://skmtc.dev/thalescloud/apis/d1-oauth-api.md) - [All operations](https://skmtc.dev/thalescloud/apis/d1-oauth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/thalescloud/apis/d1-oauth-api/revisions/96089514858c?raw)