Reveal card details

Mint a signed, short-lived URL for the card processor’s iframe that displays the card’s full PAN, CVV, and expiry to the cardholder. This is the only way to obtain a reveal URL — the Card resource never carries one.

Request the reveal right before rendering the iframe and render the returned panEmbedUrl immediately; it expires at expiresAt (within minutes). Never store, cache, or log the URL — it is a bearer secret for the full card details. The card data renders inside the processor’s iframe and never crosses Grid’s or your servers.

Every reveal is audit-logged with the requesting actor.

POST /cards/{id}/reveal

Reveal card details

cURL

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/cards/{id}/reveal \
  --header 'Authorization: Basic <encoded-value>'

const options = {method: 'POST', headers: {Authorization: 'Basic <encoded-value>'}};

fetch('https://api.lightspark.com/grid/2025-10-13/cards/{id}/reveal', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

val client = OkHttpClient()

val request = Request.Builder()
  .url("https://api.lightspark.com/grid/2025-10-13/cards/{id}/reveal")
  .post(null)
  .addHeader("Authorization", "Basic <encoded-value>")
  .build()

val response = client.newCall(request).execute()

200

{
  "panEmbedUrl": "https://embed.lithic.com/iframe/...?t=...",
  "expiresAt": "2026-05-08T14:16:00Z"
}

{
  "status": 401,
  "message": "<string>",
  "details": {}
}

{
  "status": 403,
  "message": "<string>",
  "details": {}
}

{
  "status": 404,
  "message": "<string>",
  "details": {}
}

{
  "status": 500,
  "message": "<string>",
  "details": {}
}

{
  "status": 501,
  "message": "<string>",
  "details": {}
}

Authorizations

Authorization · string · header · required

API token authentication using format <api token id>:<api client secret>

Path Parameters

id · string · required

System-generated unique card identifier

Response

200

application/json

Reveal URL minted.

panEmbedUrl · string<uri> · required

Signed URL of the card processor's iframe that securely displays the PAN, CVV, and expiry to the cardholder. The full PAN and CVV never cross Grid's servers — render this URL in an iframe in your client to reveal card details. The URL is a short-lived bearer secret: render it immediately and never store, cache, or log it.

Example:

"https://embed.lithic.com/iframe/...?t=..."

expiresAt · string<date-time> · required

When the signed URL stops loading. Request a new reveal rather than re-rendering an expired URL.

Example:

"2026-05-08T14:16:00Z"