Skip to main content
GET
Get Encrypted Card Details

Overview

This endpoint returns the card number, CVV and expiry encrypted, so the card data cannot be read by anything sitting between us and you — your API gateway, a reverse proxy, a logging service, an error tracker, or a response cache. The three fields are encrypted with AES-256-GCM under a key derived from the API key you used to make the request. You already have that key, so there is nothing to configure and no key for Fyatu to store on your behalf. Decrypting takes about five lines in any language.
If you only read the balance, you do not need this endpoint. GET /cards/{id} continues to return the balance, pending authorizations, masked number, expiry and status exactly as it does now. Only cardNumber and cvv are moving here.

Replacing the old fields

GET /cards/{id} will stop returning cardNumber and cvv. If your integration displays a card to an end user, switch that one call to this endpoint. Everything else stays where it is.

How to decrypt

Each encrypted field is base64 and unpacks as:
The key is SHA-256("fyatu/card-secrets/v1:" + apiKey) — the literal prefix, then the key you authenticated with, hashed to 32 bytes.

The response

Three encrypted fields and nothing else. The card is the one you named in the path, and the encryption is exactly what this page describes — fixed, published, and the same on every call, so there is nothing in the body to branch on.
Those three values decrypt to 5371001234567890, 123 and 10/2029. The response is sent with Cache-Control: no-store, so nothing on the path between us keeps a copy. If you hold several API keys, or are mid-rotation, the key to use is simply the one the request was made with — a response is only ever encrypted to the credential that fetched it.

Things worth knowing

Decrypt as you read. The key is your API key, so rotating or revoking that key makes any response encrypted to it permanently unreadable. Do not persist the encrypted values expecting to open them later.
  • A field the issuer did not return arrives as an empty string, not as an encrypted empty value — so you can tell “no CVV available” from “here is the CVV” without decrypting anything.
  • Decryption fails rather than returning wrong data if a value was altered in transit. That is AES-GCM’s authentication tag, and it is why a tampered card number can never silently become a different valid-looking one.
  • Every field in every response uses a fresh random nonce, so the same card number never produces the same encrypted value twice.
  • A card that is still being provisioned has no details yet and returns 409. If the issuer is briefly unreachable the response is 503 — retry shortly.

Authorizations

Authorization
string
header
required

API key from the FYATU CaaS portal. Pass as Authorization: Bearer <key>.

Path Parameters

id
string
required

Card ID

Response

Encrypted card details retrieved

success
boolean
Example:

true

status
integer
Example:

200

message
string
Example:

"Card details retrieved securely"

data
object