Skip to main content
GET
Get Encrypted Card Details

Overview

This endpoint returns the card number, CVV and expiry encrypted, so the card data cannot be read by anything sitting between us and you — your API gateway, a reverse proxy, a logging service, an error tracker, or a response cache. The three fields are encrypted with AES-256-GCM under a key derived from the access token you used to make the request. You already have that token, so there is nothing to configure and no key for Fyatu to store on your behalf. Decrypting takes about five lines in any language.
If you only read the balance, you do not need this endpoint. GET /cards/{cardId} continues to return the balance, pending authorizations, masked number, expiry and status exactly as it does now. Only cardNumber and cvv are moving here.

Replacing the old fields

GET /cards/{cardId} will stop returning cardNumber and cvv. If your integration displays a card to an end user, switch that one call to this endpoint. Everything else stays where it is.

How to decrypt

Each encrypted field is base64 and unpacks as:
The key is SHA-256("fyatu/card-secrets/v1:" + accessToken) — the literal prefix, then the token you authenticated with, hashed to 32 bytes.

The response

Three encrypted fields and nothing else. The card is the one you named in the path, and the encryption is exactly what this page describes — fixed, published, and the same on every call, so there is nothing in the body to branch on.
Those three values decrypt to 5371001234567890, 123 and 10/2029. The response is sent with Cache-Control: no-store, so nothing on the path between us keeps a copy.

Things worth knowing

Decrypt as you read. The key is your access token, so once that token expires a stored response can no longer be decrypted. Do not persist the encrypted values expecting to open them later.
  • A field the issuer did not return arrives as an empty string, not as an encrypted empty value — so you can tell “no CVV available” from “here is the CVV” without decrypting anything.
  • Decryption fails rather than returning wrong data if a value was altered in transit. That is AES-GCM’s authentication tag, and it is why a tampered card number can never silently become a different valid-looking one.
  • Every field in every response uses a fresh random nonce, so the same card number never produces the same encrypted value twice.
  • A card that is still being provisioned has no details yet and returns 409. If the issuer is briefly unreachable the response is 503 — retry shortly.

Authorizations

Authorization
string
header
required

JWT access token obtained from /auth/token

Path Parameters

cardId
string
required

Card ID

Response

Encrypted card details retrieved

success
boolean
Example:

true

status
integer
Example:

200

message
string
Example:

"Card details retrieved securely"

data
object