---
title: "Get sensitive card details"
method: POST
path: "/twcard-data/v1/sensitive-card-data/details"
tags: ["card-sensitive-details"]
---

# Get sensitive card details

`POST /twcard-data/v1/sensitive-card-data/details`

Fetches the card's Primary Account Number (PAN), security code (CVV2), expiry date, and cardholder name.

Requires an encrypted JWE payload for security. See the [sensitive card details guide](/guides/product/issue-cards/sensitive-card-details) for implementation details.

To retrieve sensitive card details, the card must be in either `ACTIVE` or `FROZEN` status. A 403 response will be returned for cards in any other status.

{% admonition type="warning" %}
This endpoint is SCA protected when applicable. If your profile is registered within the UK and/or EEA, SCA most likely applies. For more information, see [implementing SCA](/guides/developer/auth-and-security/sca-and-2fa).
{% /admonition %}

## Headers

- `x-tw-twcard-card-token` string, uuid, required
- `X-External-Correlation-Id` string, uuid

## Request body

- object
  - `keyVersion` integer, required — The version of the encryption key to use. Always set to 1.
  - `encryptedPayload` string, required — Your JWE encrypted payload.

## Response `200`

Sensitive card details retrieved successfully.

- object
  - `nonce` string, uuid — An arbitrary UUID issued from the cryptographic communication.
  - `cvv2` string — The card CVV2 security code.
  - `pan` string — The card Primary Account Number.
  - `expiryDate` string — The card expiry date in MM/YY format.
  - `cardholderName` string — Name on the card.

## Other responses

- `429` — Rate limit exceeded. Retry after the number of seconds specified in the `Retry-After` header.

---

[API](https://skmtc.net/wise/apis/platform-api.md) · [All operations](https://skmtc.net/wise/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/wise/platform-api/versions/4907a1d269ab/schema)