Encrypted Retrieval

Retrieve the full card details (PAN, CVV, expiry date) as an encrypted payload that only you can decrypt. You generate the RSA key pair and register the public half with Reap; the details are encrypted with it and you decrypt them with the private half on your backend.

Approval required. This capability is enabled per program by Reap. Your system handles raw card data after decryption, so your environment must be PCI DSS compliant, and Reap enables it only after reviewing your compliance status. Projects without it receive 403 PAN_REVEAL_NOT_ENABLED.You are responsible for the decrypted values: never store, log, cache, or transmit them beyond the immediate use.

Most integrations do not need this. To show card details to the cardholder, use Secure Display instead - see Choosing an approach.

Prerequisites

The capability is enabled for your project by Reap. Talk to your account manager to request it; Reap reviews your PCI DSS compliance status before enabling. Calls from projects without it receive 403 PAN_REVEAL_NOT_ENABLED.
You hold the RSA private key:
- Production: you generate the key pair (RSA, 2048 bits or larger) and send only the public key to your implementation manager, who registers it against your program. The private key never leaves your systems and Reap never holds a copy.
- Sandbox: a single, publicly documented key pair is shared by all sandbox programs (see Sandbox keys). It provides no confidentiality, sandbox cards are test cards.

Request

See Reveal PAN for the full endpoint reference.

curl -X POST https://sandbox.api.reap.global/cards/{cardId}/reveal-pan \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Reap-Version: 2025-02-14"

No request body. The card must exist, must not be in a terminal or inactive status, and its account must be active.

Response

{
	"encryptedData": "hEJ2X8QeZ...base64...",
	"encryption": "RSA_OAEP_SHA256"
}

Field	Description
`encryptedData`	Base64-encoded ciphertext of the card details JSON.
`encryption`	Encryption scheme of `encryptedData`. Dispatch your decryption on this value; new schemes may be added later.

encryption is one of:

Value	Meaning
`RSA_OAEP_SHA256`	RSA-OAEP with SHA-256. Used for new keys.
`RSA_OAEP_SHA1`	RSA-OAEP with SHA-1.

The scheme is a property of the public key registered for your program, so it stays fixed until that key is replaced. Read it from every response rather than hardcoding it, so a key rotation cannot break your decryption. Decrypting encryptedData yields a JSON document:

{
	"pan": "5200000000001005",
	"cvv": "123",
	"expiryDate": "12/28"
}

Decryption

Base64-decode encryptedData, then decrypt with your RSA private key using OAEP padding and the hash named by encryption: SHA-256 for RSA_OAEP_SHA256, SHA-1 for RSA_OAEP_SHA1.

OpenSSL
Node.js

# Use rsa_oaep_md:sha1 when encryption is RSA_OAEP_SHA1
echo "$ENCRYPTED_DATA" | base64 -d > /tmp/blob.bin
openssl pkeyutl -decrypt -inkey private-key.pem -in /tmp/blob.bin \
  -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256

import { privateDecrypt, constants } from 'node:crypto';

// `response` is the parsed JSON body of POST /cards/{cardId}/reveal-pan,
// `privateKeyPem` the private half of the key registered with Reap.
const { encryptedData, encryption } = response;

const OAEP_HASH_BY_SCHEME = {
	RSA_OAEP_SHA256: 'sha256',
	RSA_OAEP_SHA1: 'sha1',
};

const cardDetails = JSON.parse(
	privateDecrypt(
		{
			key: privateKeyPem,
			padding: constants.RSA_PKCS1_OAEP_PADDING,
			oaepHash: OAEP_HASH_BY_SCHEME[encryption],
		},
		Buffer.from(encryptedData, 'base64')
	).toString('utf8')
);

Always decrypt on your backend. Never ship the private key to a browser or mobile client, and never proxy the decrypted details through systems outside your PCI scope.

Errors

Status	Code	Meaning
403	`PAN_REVEAL_NOT_ENABLED`	The capability is not enabled for your project.
404	`CARD_NOT_FOUND`	The card does not exist or has been deleted.
400	`CARD_OPERATION_NOT_ALLOWED`	The card status does not permit revealing its details.
400	`ACCOUNT_NOT_ACTIVE`	The account the card belongs to is not active.

Sandbox keys

All sandbox programs share one RSA key pair. Use this private key to decrypt sandbox responses:

Security obligations

Decrypt only on PCI DSS compliant backend systems.
Never log, persist, or cache the decrypted PAN, CVV, or expiry date.
Never expose the private key or decrypted details to client-side code.
Every retrieval is audited by Reap.

Getting Started

Program Configuration

Compliance

Accounts

Cards

Transactions

Spend Policies

Virtual Assets

Statements

Agentic Payments

Rewards

Encrypted Retrieval

Prerequisites

Request

Response

Decryption

Errors

Sandbox keys

Security obligations

​Prerequisites

​Request

​Response

​Decryption

​Errors

​Sandbox keys

​Security obligations

Prerequisites

Request

Response

Decryption

Errors

Sandbox keys

Security obligations