curl --request POST \
--url https://sg.sandbox.api.reap.global/cards/{id}/reveal-pan \
--header 'Authorization: Bearer <token>' \
--header 'Reap-Version: <reap-version>'const options = {
method: 'POST',
headers: {'Reap-Version': '<reap-version>', Authorization: 'Bearer <token>'}
};
fetch('https://sg.sandbox.api.reap.global/cards/{id}/reveal-pan', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://sg.sandbox.api.reap.global/cards/{id}/reveal-pan"
headers = {
"Reap-Version": "<reap-version>",
"Authorization": "Bearer <token>"
}
response = requests.post(url, headers=headers)
print(response.text){
"encryptedData": "<string>",
"encryption": "RSA_OAEP_SHA1"
}{
"error": {
"code": "CARD_OPERATION_NOT_ALLOWED",
"message": "<string>",
"detail": {}
}
}{
"error": {
"code": "PAN_REVEAL_NOT_ENABLED",
"message": "<string>",
"detail": {}
}
}{
"error": {
"code": "CARD_NOT_FOUND",
"message": "<string>",
"detail": {}
}
}Reveal PAN
Returns the card details (PAN, CVV, expiry) as an encrypted payload. Available only to PCI-scoped partners approved by Reap; all other projects receive 403 PAN_REVEAL_NOT_ENABLED. Decrypt with the private half of the RSA key pair registered with Reap, using the OAEP hash named by encryption. Never store or log the decrypted card details.
curl --request POST \
--url https://sg.sandbox.api.reap.global/cards/{id}/reveal-pan \
--header 'Authorization: Bearer <token>' \
--header 'Reap-Version: <reap-version>'const options = {
method: 'POST',
headers: {'Reap-Version': '<reap-version>', Authorization: 'Bearer <token>'}
};
fetch('https://sg.sandbox.api.reap.global/cards/{id}/reveal-pan', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://sg.sandbox.api.reap.global/cards/{id}/reveal-pan"
headers = {
"Reap-Version": "<reap-version>",
"Authorization": "Bearer <token>"
}
response = requests.post(url, headers=headers)
print(response.text){
"encryptedData": "<string>",
"encryption": "RSA_OAEP_SHA1"
}{
"error": {
"code": "CARD_OPERATION_NOT_ALLOWED",
"message": "<string>",
"detail": {}
}
}{
"error": {
"code": "PAN_REVEAL_NOT_ENABLED",
"message": "<string>",
"detail": {}
}
}{
"error": {
"code": "CARD_NOT_FOUND",
"message": "<string>",
"detail": {}
}
}Authorizations
API key as Bearer token
Headers
API version (YYYY-MM-DD)
2025-02-14 "2025-02-14"
Path Parameters
Response
Encrypted card details response
Base64-encoded ciphertext of the card details JSON ({ pan, cvv, expiryDate }), encrypted per the encryption scheme. Decrypt with the private half of the RSA key pair registered with Reap.
Encryption scheme of encryptedData. Dispatch decryption on this value: it follows the OAEP hash of the public key registered with Reap for your program and can change when that key is replaced.
RSA_OAEP_SHA1, RSA_OAEP_SHA256 "RSA_OAEP_SHA1"