--- title: "Search for card by PAN" method: POST path: "/v1/cards/search_by_pan" tags: ["Card"] --- # Search for card by PAN `POST /v1/cards/search_by_pan` Get card configuration such as spend limit and state. Customers must be PCI compliant to use this endpoint. Please contact [support.lithic.com](https://support.lithic.com/) for questions. *Note: this is a `POST` endpoint because it is more secure to send sensitive data in a request body than in a URL.* ## Request body - object - `pan` string, required — The PAN for the card being retrieved. ## Response `200` OK - PciCardResponse — Card details without PCI information - `account_token` string, required — Globally unique identifier for the account to which the card belongs. - `auth_rule_tokens` string[] — List of identifiers for the Auth Rule(s) that are applied on the card. This field is deprecated and will no longer be populated in the `Card` object. The key will be removed from the schema in a future release. Use the `/auth_rules` endpoints to fetch Auth Rule information instead. - `card_program_token` string, required — Globally unique identifier for the card program on which the card exists. - `bulk_order_token` string, uuid, nullable — Globally unique identifier for the bulk order associated with this card. Only applicable to physical cards that are part of a bulk shipment - `replacement_for` string, nullable — If the card is a replacement for another card, the globally unique identifier for the card that was replaced. - `cardholder_currency` string — 3-character alphabetic ISO 4217 code for the currency of the cardholder. - `created` string, date-time, required — An RFC 3339 timestamp for when the card was created. UTC time zone. - `digital_card_art_token` string, nullable — Specifies the digital card art to be displayed in the user's digital wallet after tokenization. This artwork must be approved by Mastercard and configured by Lithic to use. - `exp_month` string — Two digit (MM) expiry month. - `exp_year` string — Four digit (yyyy) expiry year. - `funding` FundingAccount, required — Funding account for a card - `account_name` string — Account name identifying the funding source. This may be `null`. - `created` string, date-time, required — An RFC 3339 string representing when this funding source was added to the Lithic account. This may be `null`. UTC time zone. - `last_four` string, required — The last 4 digits of the account (e.g. bank account, debit card) associated with this FundingAccount. This may be null. - `nickname` string, nullable — The nickname given to the `FundingAccount` or `null` if it has no nickname. - `state` 'DELETED' | 'ENABLED' | 'PENDING', required — State of funding source. Funding source states: * `ENABLED` - The funding account is available to use for card creation and transactions. * `PENDING` - The funding account is still being verified e.g. bank micro-deposits verification. * `DELETED` - The founding account has been deleted. - `token` string, uuid, required — A globally unique identifier for this FundingAccount. - `type` 'DEPOSITORY_CHECKING' | 'DEPOSITORY_SAVINGS', required — Types of funding source: * `DEPOSITORY_CHECKING` - Bank checking account. * `DEPOSITORY_SAVINGS` - Bank savings account. - `hostname` string — Hostname of card's locked merchant (will be empty if not applicable). - `last_four` string, required — Last four digits of the card number. - `memo` string — Friendly name to identify the card. - `network_program_token` string, nullable — Globally unique identifier for the card's network program. Null if the card is not associated with a network program. Currently applicable to Visa cards participating in Account Level Management only - `pending_commands` string[] — Indicates if there are offline PIN changes pending card interaction with an offline PIN terminal. Possible commands are: CHANGE_PIN, UNBLOCK_PIN. Applicable only to cards issued in markets supporting offline PINs. - `pin_status` 'OK' | 'BLOCKED' | 'NOT_SET', required — Indicates if a card is blocked due a PIN status issue (e.g. excessive incorrect attempts). - `product_id` string, nullable — Only applicable to cards of type `PHYSICAL`. This must be configured with Lithic before use. Specifies the configuration (i.e., physical card art) that the card should be manufactured with. - `spend_limit` integer, required — Amount (in cents) to limit approved authorizations (e.g. 100000 would be a $1,000 limit). Transaction requests above the spend limit will be declined. - `spend_limit_duration` 'ANNUALLY' | 'FOREVER' | 'MONTHLY' | 'TRANSACTION', required — Spend limit duration values: * `ANNUALLY` - Card will authorize transactions up to spend limit for the trailing year. * `FOREVER` - Card will authorize only up to spend limit for the entire lifetime of the card. * `MONTHLY` - Card will authorize transactions up to spend limit for the trailing month. To support recurring monthly payments, which can occur on different day every month, the time window we consider for monthly velocity starts 6 days after the current calendar date one month prior. * `TRANSACTION` - Card will authorize multiple transactions if each individual transaction is under the spend limit. - `state` 'CLOSED' | 'OPEN' | 'PAUSED' | 'PENDING_ACTIVATION' | 'PENDING_FULFILLMENT', required — Card state values: * `CLOSED` - Card will no longer approve authorizations. Closing a card cannot be undone. * `OPEN` - Card will approve authorizations (if they match card and account parameters). * `PAUSED` - Card will decline authorizations, but can be resumed at a later time. * `PENDING_FULFILLMENT` - The initial state for cards of type `PHYSICAL`. The card is provisioned pending manufacturing and fulfillment. Cards in this state can accept authorizations for e-commerce purchases, but not for "Card Present" purchases where the physical card itself is present. * `PENDING_ACTIVATION` - At regular intervals, cards of type `PHYSICAL` in state `PENDING_FULFILLMENT` are sent to the card production warehouse and updated to state `PENDING_ACTIVATION`. Similar to `PENDING_FULFILLMENT`, cards in this state can be used for e-commerce transactions or can be added to mobile wallets. API clients should update the card's state to `OPEN` only after the cardholder confirms receipt of the card. In sandbox, the same daily batch fulfillment occurs, but no cards are actually manufactured. - `substatus` 'LOST' | 'COMPROMISED' | 'DAMAGED' | 'END_USER_REQUEST' | 'ISSUER_REQUEST' | 'NOT_ACTIVE' | 'SUSPICIOUS_ACTIVITY' | 'INTERNAL_REVIEW' | 'EXPIRED' | 'UNDELIVERABLE' | 'OTHER', nullable — Card state substatus values: * `LOST` - The physical card is no longer in the cardholder's possession due to being lost or never received by the cardholder. * `COMPROMISED` - Card information has been exposed, potentially leading to unauthorized access. This may involve physical card theft, cloning, or online data breaches. * `DAMAGED` - The physical card is not functioning properly, such as having chip failures or a demagnetized magnetic stripe. * `END_USER_REQUEST` - The cardholder requested the closure of the card for reasons unrelated to fraud or damage, such as switching to a different product or closing the account. * `ISSUER_REQUEST` - The issuer closed the card for reasons unrelated to fraud or damage, such as account inactivity, product or policy changes, or technology upgrades. * `NOT_ACTIVE` - The card hasn’t had any transaction activity for a specified period, applicable to statuses like `PAUSED` or `CLOSED`. * `SUSPICIOUS_ACTIVITY` - The card has one or more suspicious transactions or activities that require review. This can involve prompting the cardholder to confirm legitimate use or report confirmed fraud. * `INTERNAL_REVIEW` - The card is temporarily paused pending further internal review. * `EXPIRED` - The card has expired and has been closed without being reissued. * `UNDELIVERABLE` - The card cannot be delivered to the cardholder and has been returned. * `OTHER` - The reason for the status does not fall into any of the above categories. A comment can be provided to specify the reason. - `comment` string — Additional context or information related to the card. - `token` string, required — Globally unique identifier. - `type` 'MERCHANT_LOCKED' | 'PHYSICAL' | 'SINGLE_USE' | 'VIRTUAL' | 'UNLOCKED' | 'DIGITAL_WALLET', required — Card types: * `VIRTUAL` - Card will authorize at any merchant and can be added to a digital wallet like Apple Pay or Google Pay (if the card program is digital wallet-enabled). * `PHYSICAL` - Manufactured and sent to the cardholder. We offer white label branding, credit, ATM, PIN debit, chip/EMV, NFC and magstripe functionality. * `SINGLE_USE` - Card is closed upon first successful authorization. * `MERCHANT_LOCKED` - Card is locked to the first merchant that successfully authorizes the card. * `UNLOCKED` - *[Deprecated]* Similar behavior to VIRTUAL cards, please use VIRTUAL instead. * `DIGITAL_WALLET` - *[Deprecated]* Similar behavior to VIRTUAL cards, please use VIRTUAL instead. - `pan` string — Primary Account Number (PAN) (i.e. the card number). Customers must be PCI compliant to have PAN returned as a field in production. Please contact https://support.lithic.com/ for questions. - `cvv` string — Three digit cvv printed on the back of the card. ## Other responses - `400` — A parameter in the query given in the request does not match the valid queries for the endpoint. - `401` — | | | |---|---| | User has not been authenticated | Invalid or missing API key | | API key is not active | The API key used is no longer active | | Could not find API key | The API key provided is not associated with any user | | Please provide API key in Authorization header | The Authorization header is not in the request | | Please provide API key in the form Authorization: [api-key] | The Authorization header is not formatted properly | | Insufficient privileges. Issuing API key required | Write access requires an Issuing API key. Reach out at [lithic.com/contact](https://lithic.com/contact) | | Insufficient privileges to create virtual cards. | Creating virtual cards requires an additional privilege | Reach out at [lithic.com/contact](https://lithic.com/contact) | - `404` — The specified resource was not found. - `422` — Unprocessable entity. - `429` — Client has exceeded the number of allowed requests in a given time period. | | | |---|---| | Rate limited, too many requests per second | User has exceeded their per second rate limit | | Rate limited, reached daily limit | User has exceeded their daily rate limit | | Rate limited, too many keys tried | One IP has queried too many different API keys | --- [API](https://skmtc.net/lithic-com/apis/lithic-developer-api.md) · [All operations](https://skmtc.net/lithic-com/apis/lithic-developer-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lithic-com/lithic-developer-api/revisions/53ab5d4e2adb/schema)