---
title: "Reveal card details"
method: POST
path: "/cards/{id}/reveal"
tags: ["Cards"]
---

# Reveal card details

`POST /cards/{id}/reveal`

Mint a signed, short-lived URL for the card processor's iframe that displays the card's full PAN, CVV, and expiry to the cardholder. This is the only way to obtain a reveal URL — the `Card` resource never carries one.

Request the reveal right before rendering the iframe and render the returned `panEmbedUrl` immediately; it expires at `expiresAt` (within minutes). Never store, cache, or log the URL — it is a bearer secret for the full card details. The card data renders inside the processor's iframe and never crosses Grid's or your servers.

Every reveal is audit-logged with the requesting actor.

## Response `200`

Reveal URL minted.

- CardRevealResponse
  - `panEmbedUrl` string, uri, required — Signed URL of the card processor's iframe that securely displays the PAN, CVV, and expiry to the cardholder. The full PAN and CVV never cross Grid's servers — render this URL in an iframe in your client to reveal card details. The URL is a short-lived bearer secret: render it immediately and never store, cache, or log it.
  - `expiresAt` string, date-time, required — When the signed URL stops loading. Request a new reveal rather than re-rendering an expired URL.

## Other responses

- `401` — Unauthorized
- `403` — Forbidden. The session has no attributable actor to audit the reveal against (for example, an impersonated dashboard session).
- `404` — Card not found
- `500` — Internal service error
- `501` — Not implemented in this environment. Cards are not enabled for every Grid deployment; environments without a configured card issuer return `501 NOT_IMPLEMENTED`.

---

[API](https://skmtc.net/stainless-api/apis/grid-api.md) · [All operations](https://skmtc.net/stainless-api/apis/grid-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/stainless-api/grid-api/revisions/151f2d9bad9c/schema)