Reveal Card Details

POST /api/v1/business/card/{reference}/reveal

curl -X POST "https://api.usenumero.com/numeroaccount/api/v1/business/card/NCRD24AD18BEBD474A/reveal" \
  -H "X-Numero-Api-Key: your_api_key" \
  -H "X-Numero-Signature: $SIGNATURE" \
  -H "X-Numero-Signature-Version: v2"

{
  "data": {
    "cardReference": "NCRD24AD18BEBD474A",
    "pan": "4242424242424242",
    "cvv": "123",
    "expiryMonth": "06",
    "expiryYear": "2029",
    "cardholderName": "Ada Obi"
  },
  "error": null,
  "meta": {
    "request_id": "req_365123ebc73323f1482508560ce6400e",
    "pagination": null
  }
}

import { createHmac } from "node:crypto";

const apiKey = process.env.NUMERO_API_KEY;
const publicKey = process.env.NUMERO_PUBLIC_KEY;
const reference = process.env.NUMERO_CARD_REFERENCE;
if (!apiKey || !publicKey || !reference) throw new Error("Card API configuration is missing");

const signature = createHmac("sha256", Buffer.from(publicKey, "utf8"))
  .update("")
  .digest("base64");
const response = await fetch(
  `https://api.usenumero.com/numeroaccount/api/v1/business/card/${encodeURIComponent(reference)}/reveal`,
  {
    method: "POST",
    cache: "no-store",
    headers: {
      "X-Numero-Api-Key": apiKey,
      "X-Numero-Signature": signature,
      "X-Numero-Signature-Version": "v2"
    }
  }
);
if (!response.ok) throw new Error("Card reveal request failed");
const result = await response.json();
if (result.error || !result.data?.pan || !result.data?.cvv)
  throw new Error("Complete card details are unavailable");
// Display result.data only in the authorised cardholder's temporary reveal view.
// Never console.log(result), persist it, or send it to analytics.