Encrypted Card Details Retrieval

Retrieve the full card details (PAN, CVV, expiry date) as an encrypted payload that only you can decrypt. The details are encrypted with the public half of an RSA key pair registered with Reap; you decrypt them with the private half on your backend.

Approval required. This capability is enabled per program by Reap. Your system handles raw card data after decryption, so your environment must be PCI DSS compliant, and Reap enables it only after reviewing your compliance status. Projects without it receive 403 PAN_REVEAL_NOT_ENABLED.You are responsible for the decrypted values: never store, log, cache, or transmit them beyond the immediate use.

Most integrations do not need this. If you only need to display card details to the cardholder, use the iframe reveal flow instead - it keeps raw card data out of your systems entirely and needs no approval.

Prerequisites

The capability is enabled for your project by Reap. Talk to your account manager to request it; Reap reviews your PCI DSS compliance status before enabling. Calls from projects without it receive 403 PAN_REVEAL_NOT_ENABLED.
You hold the RSA private key:
- Production: Reap generates a dedicated RSA-2048 key pair for your program and hands you the key pair over a secure channel during onboarding.
- Sandbox: a single, publicly documented key pair is shared by all sandbox programs (see Sandbox keys). It provides no confidentiality, sandbox cards are test cards.

Request

See Reveal PAN for the full endpoint reference.

curl -X POST https://sandbox.api.reap.global/cards/{cardId}/reveal-pan \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Reap-Version: 2025-02-14"

No request body. The card must exist, must not be in a terminal or inactive status, and its account must be active.

Response

{
	"encryptedData": "hEJ2X8QeZ...base64...",
	"encryption": "RSA_OAEP_SHA1"
}

Field	Description
`encryptedData`	Base64-encoded ciphertext of the card details JSON.
`encryption`	Encryption scheme of `encryptedData`. Dispatch your decryption on this value; new schemes may be added later.

Decrypting encryptedData yields a JSON document:

{
	"pan": "5200000000001005",
	"cvv": "123",
	"expiryDate": "12/28"
}

Decryption

For encryption: "RSA_OAEP_SHA1": base64-decode encryptedData, then decrypt with your RSA private key using OAEP padding with SHA-1.

OpenSSL
Node.js

echo "$ENCRYPTED_DATA" | base64 -d > /tmp/blob.bin
openssl pkeyutl -decrypt -inkey private-key.pem -in /tmp/blob.bin \
  -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha1

import { privateDecrypt, constants } from 'node:crypto';

const cardDetails = JSON.parse(
	privateDecrypt(
		{
			key: privateKeyPem,
			padding: constants.RSA_PKCS1_OAEP_PADDING,
			oaepHash: 'sha1',
		},
		Buffer.from(encryptedData, 'base64')
	).toString('utf8')
);

Always decrypt on your backend. Never ship the private key to a browser or mobile client, and never proxy the decrypted details through systems outside your PCI scope.

Errors

Status	Code	Meaning
403	`PAN_REVEAL_NOT_ENABLED`	The capability is not enabled for your project.
404	`CARD_NOT_FOUND`	The card does not exist or has been deleted.
400	`CARD_OPERATION_NOT_ALLOWED`	The card status does not permit revealing its details.
400	`ACCOUNT_NOT_ACTIVE`	The account the card belongs to is not active.

Sandbox keys

All sandbox programs share one RSA key pair. Use this private key to decrypt sandbox responses:

Security obligations

Decrypt only on PCI DSS compliant backend systems.
Never log, persist, or cache the decrypted PAN, CVV, or expiry date.
Never expose the private key or decrypted details to client-side code.
Every retrieval is audited by Reap.

Getting Started

Program Configuration

Compliance

Accounts

Cards

Transactions

Spend Policies

Virtual Assets

Agentic Payments

Rewards

Encrypted Card Details Retrieval

Prerequisites

Request

Response

Decryption

Errors

Sandbox keys

Security obligations

​Prerequisites

​Request

​Response

​Decryption

​Errors

​Sandbox keys

​Security obligations

Prerequisites

Request

Response

Decryption

Errors

Sandbox keys

Security obligations