> ## Documentation Index > Fetch the complete documentation index at: https://developer.cartevo.co/llms.txt > Use this file to discover all available pages before exploring further. # Get Card Details > Retrieve full details of a single card. Optionally reveal the unmasked card number and CVV (audit-logged). ## Overview `GET /cards/{id}` returns full details of a single card. By default, the card number and CVV are returned as masked or as opaque encrypted tokens (PCI DSS requirement). Append `?reveal=true` to receive the cleartext PAN and CVV — every reveal call is audit-logged and visible in your dashboard. ## When to use it * Display a card's status and balance to the cardholder. * One-time reveal of the PAN/CVV for the cardholder to use the card (e.g. in a "show card" UI immediately after creation). * Reconcile your local cache against Cartevo's source of truth (use `?sync=true`). ## Prerequisites * The card must belong to your company. * For `?reveal=true`: nothing extra — but be aware every reveal is audit-logged. ## Request ### Headers | Name | Required | Description | | --------------- | -------- | ----------------------- | | `Authorization` | Yes | `Bearer ` | ### Path parameters | Name | Type | Description | | ---- | ------ | --------------- | | `id` | string | Card ID (UUID). | ### Query parameters | Name | Type | Default | Description | | ------------ | ------- | ------- | -------------------------------------------------------------------------------------------------------------------------- | | `reveal` | boolean | `false` | If `true`, the response includes the cleartext `number` and `cvv` instead of opaque tokens. Audit-logged. | | `includeRaw` | boolean | `false` | If `true`, includes the raw upstream-issuer payload under `raw`. Useful for debugging; not for production UI. | | `sync` | boolean | `true` | If `true` (default), force-refresh from the upstream issuer. Set `false` to read from Cartevo's local cache only (faster). | ## Response ### 200 — Success (default, masked) ```json theme={null} { "success": true, "statusCode": 200, "message": "Data retrieved successfully", "data": { "id": "550e8400-e29b-41d4-a716-446655440000", "status": "ACTIVE", "balance": 100.0, "currency": "USD", "masked_pan": "**** **** **** 1111", "number": "tkMplr_eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", "cvv": "tkMplr_eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", "expiry_month": 12, "expiry_year": 2028, "is_virtual": true, "is_physical": false, "brand": "VISA", "created_at": "2026-05-09T10:15:00.000Z" } } ``` ### 200 — With `?reveal=true` ```json theme={null} { "success": true, "statusCode": 200, "message": "Data retrieved successfully", "data": { "id": "550e8400-e29b-41d4-a716-446655440000", "status": "ACTIVE", "balance": 100.0, "currency": "USD", "masked_pan": "**** **** **** 1111", "number": "4111111111111111", "cvv": "123", "expiry_month": 12, "expiry_year": 2028, "is_virtual": true, "is_physical": false, "brand": "VISA", "created_at": "2026-05-09T10:15:00.000Z" } } ``` ### Field reference | Field | Type | Description | | -------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------- | | `id` | string | Card ID (UUID). | | `status` | string | One of `PENDING`, `ACTIVE`, `FROZEN`, `SUSPENDED`, `TERMINATED`, `FAILED`. See [Glossary → Card](/getting-started/glossary#card). | | `balance` | number | Available balance in `currency`. | | `currency` | string | Always `USD`. | | `masked_pan` | string | Always returned. Last 4 digits visible. | | `number` | string | Without `reveal`: opaque encrypted token (begins `tkMplr_`). With `reveal`: cleartext 16-digit PAN. | | `cvv` | string | Without `reveal`: opaque encrypted token. With `reveal`: cleartext 3-digit CVV. | | `expiry_month` | integer | 1–12. | | `expiry_year` | integer | 4-digit year. | | `is_virtual` | boolean | Always `true` today. | | `is_physical` | boolean | Always `false` today. | | `brand` | string | `VISA` or `MASTERCARD`. | > **About the opaque tokens:** When `reveal` is not set, the `number` and `cvv` fields contain encrypted tokens (e.g. `tkMplr_...`). These are **not** decryptable client-side and **not** usable as a real card number. They exist so that field shapes are stable across both response variants. Always store them only if you are sure why. ## Error responses | Status | Trigger | | ------ | ---------------------------------------------------- | | `401` | Missing or expired Bearer token. | | `404` | Card does not exist or belongs to another company. | | `5xx` | Upstream issuer unreachable (only when `sync=true`). | ## Security and PCI DSS * Every call with `?reveal=true` is audit-logged. * Never store revealed PAN/CVV in your own logs, databases, or analytics. * Pass revealed data only over HTTPS, only to the cardholder, and never to third parties. * For more details, see the [Cards Overview → PCI DSS](/api-reference/endpoint/Virtual-Card-Overview#security-and-pci-dss-compliance) section. ## Code examples ```bash cURL theme={null} # Masked curl https://api.cartevo.co/api/v1/cards/550e8400-e29b-41d4-a716-446655440000 \ -H "Authorization: Bearer $TOKEN" # Revealed (audit-logged) curl 'https://api.cartevo.co/api/v1/cards/550e8400-e29b-41d4-a716-446655440000?reveal=true' \ -H "Authorization: Bearer $TOKEN" ``` ```js Node.js (axios) theme={null} const { data } = await axios.get( `https://api.cartevo.co/api/v1/cards/${cardId}`, { headers: { Authorization: `Bearer ${token}` }, params: { reveal: true }, } ); const { number, cvv, expiry_month, expiry_year } = data.data; ``` ## Related * [Cards Overview](/api-reference/endpoint/Virtual-Card-Overview) — security model and statuses. * [`GET /cards/{id}/transactions`](/api-reference/endpoint/get-card-transactions) — transaction history for this card. ## OpenAPI ````yaml GET /cards/{id} openapi: 3.1.0 info: title: Cartevo API description: Essential endpoints for wallets, transactions, customers and conversion. version: 1.0.0 servers: - url: https://api.cartevo.co/api/v1 security: - bearerAuth: [] paths: /cards/{id}: get: summary: Card details description: Retrieves the full, unmasked details for a single card. parameters: - name: id in: path required: true schema: type: string format: uuid - name: reveal in: query description: >- Set to true to reveal unmasked card details (number, CVV). Default is false. required: false schema: type: boolean default: false responses: '200': description: Detailed information for a single card. content: application/json: schema: $ref: '#/components/schemas/GetCardResponse' '404': description: Card not found. components: schemas: GetCardResponse: allOf: - $ref: '#/components/schemas/StandardResponse' - type: object properties: data: $ref: '#/components/schemas/CardDetails' StandardResponse: type: object properties: success: type: boolean example: true statusCode: type: integer example: 200 message: type: string example: Data retrieved successfully CardDetails: type: object properties: id: type: string format: uuid example: 91b3c6d6-111b-44da-9f81-16f019bebe8c status: type: string example: ACTIVE balance: type: number example: 0.45 currency: type: string example: USD number: type: string description: Encrypted card number example: >- tkAlsp_eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ2YWx1ZSI6IjUzNjAyNTI0ODM0NjU0MDciLCJpYXQiOjE3NjExNDg5NzR9.7sNid1b1pxmkpseiCR45E8Xj9hdmenZDovBcjVatBF0 masked_pan: type: string example: '**** **** **** 5407' cvv: type: string description: Encrypted CVV example: >- tkAlsp_eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ2YWx1ZSI6Ijg1NyIsImlhdCI6MTc2MTE0ODk3NH0.K7YHl0nzZTsScjUma_G5fyxYZFNnK-2SczstVtdMK1A expiry_month: type: integer example: 10 expiry_year: type: integer example: 28 is_virtual: type: boolean example: true is_physical: type: boolean example: false created_at: type: string format: date-time securitySchemes: bearerAuth: type: http scheme: bearer ````