---
title: "Create a secure view for card details"
method: POST
path: "/v1/cards/{id}/virtual_card_requests"
tags: ["Cards servicing"]
---

# Create a secure view for card details

`POST /v1/cards/{id}/virtual_card_requests`

Retrieves the card number, expiry date, and CVV for the card specified in the request URL. The response is encrypted; your customer must decrypt it using a bound device.

Please note the following prerequisites:
  * Your customer's device must have a supported operating system (Android: 4.3 or higher; iOS: iPhone 5 or newer, not jailbroken or rooted).
  * The customer must have already verified their device using the device binding process. You will need to supply the `device_id` in this request.

> **Warning**
>
> **Never store or log decrypted card details on a customer's device. This information may never leave the device.** You may only make clean PAN details available in the device's **temporary memory.**

## Path parameters

- `id` string, required

## Request body

- object
  - `device_id` string, required — ID of the customer's bound device.
  - `device_data` string — Encoded device fingerprint generated using the [Seon SDK](https://seon.io). See the [device monitoring guide](https://docs.solarisgroup.com/guides/kyc/device-monitoring) for more information about generating this value.
  - `signature` string, required — The device signature obtained during the device binding process. The signature must be generated using the device's **unrestricted key.** Follow these steps to generate the key: 1. Generate the RSA key pair. This results in an `rsa_key`. 2. Create a JWK JSON representation of the **public** part of the `rsa_key`. This results in a `jwk_key`. 3. Generate a single string from the `jwk_key` representation of the **public** part of the `rsa_key` using the following steps: 1. Sort every key/value pair alphabetically by the **key.** 2. Combine the key and value of every key/value pair using `:` as the delimiter, e.g., `alg:RS256`. 3. Join every key/value pair to a single string using `;` as the delimiter, e.g., `alg:RS256;...;e:AQAB`. 4. This results in a `key_string`, whose format resembles this: `alg:RS256;e:AQAB;kid:0016E6D1...35E6;kty:RSA;n:qp7...Q;use:enc`. 4. Sign the `key_string` using the device's **unrestricted** key. This results in the `signed_key`. Read more about how to create an unrestricted key for use in device binding [here](https://docs.solarisgroup.com/guides/authentication/device-binding/#device-binding). 5. **Hex-encode** the `signed_key` to get the `signature`.
  - `jwk` object, required — [JSON Web Key (JWK)](https://datatracker.ietf.org/doc/html/rfc7517) data that will be used to encrypt the card details. [Click here to learn more about this algorithm.](https://datatracker.ietf.org/doc/html/rfc7518)
    - `kty` 'RSA', required — The key type. The only possible value is `RSA`.
    - `use` 'enc' — (Optional) The public key use. The only possible value is `enc`.
    - `alg` 'RS256' — (Optional) The algorithm to use for encryption. The only possible value is `RS256`.
    - `kid` string — (Optional) The key ID. Use any unique identifier, such as a UUID.
    - `n` string, required — Modulus (for RSA keys)
    - `e` string, required — Exponent (for RSA keys)
  - `jwe` object, required — [JSON Web Encryption](https://tools.ietf.org/html/rfc7516) attributes.
    - `alg` 'RSA1_5' | 'RSA_OAEP_256' | 'RSA_OAEP_256_ANDROID', required — Algorithm used for CEK encryption. Possible values: <ul> <li>`RSA_OAEP_256` (recommended): Uses SHA-256 for both the `main digest` and the `mask generation function` (mgf1).</li> <li>`RSA_OAEP_256_ANDROID`: Android-specific version of the above, which uses SHA-256 for the `main digest` and SHA-1 for the `mask generation function` (mgf1).</li> </ul>
    - `enc` 'A256GCM' | 'A256CBC_HS512', required — Encryption algorithm.

## Response `200`

Successful result of the operation

- SolarisDecoratorsEncryptedVirtualCard
  - `data` string — The JWE-encrypted card details. Use one of the following libraries for decryption: <ul> <li>[Android](https://connect2id.com/products/nimbus-jose-jwt/examples/jwe-with-preset-cek)</li> <li>[iOS](https://github.com/airsidemobile/JOSESwift#jwe-encryption-and-decryption)</li> </ul>

## Other responses

- `400` — Validation error.
- `403` — You are not authorized to perform this action.
- `404` — The resource could not be found.
- `500` — Internal server error.
- `default` — Unexpected error

---

[API](https://skmtc.net/solarisgroup/apis/card-creation-servicing.md) · [All operations](https://skmtc.net/solarisgroup/apis/card-creation-servicing/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/solarisgroup/card-creation-servicing/revisions/a772504dcc9e/schema)