Reveal full card details (sensitive)

curl --request POST \
  --url https://api.usenumero.com/numeroaccount/api/v1/business/card/{reference}/reveal \
  --header 'X-Numero-Api-Key: <api-key>' \
  --header 'X-Numero-Signature: <api-key>'

import requests

url = "https://api.usenumero.com/numeroaccount/api/v1/business/card/{reference}/reveal"

headers = {
    "X-Numero-Api-Key": "<api-key>",
    "X-Numero-Signature": "<api-key>"
}

response = requests.post(url, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'X-Numero-Api-Key': '<api-key>', 'X-Numero-Signature': '<api-key>'}
};

fetch('https://api.usenumero.com/numeroaccount/api/v1/business/card/{reference}/reveal', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.usenumero.com/numeroaccount/api/v1/business/card/{reference}/reveal",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "X-Numero-Api-Key: <api-key>",
    "X-Numero-Signature: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.usenumero.com/numeroaccount/api/v1/business/card/{reference}/reveal"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("X-Numero-Api-Key", "<api-key>")
	req.Header.Add("X-Numero-Signature", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.usenumero.com/numeroaccount/api/v1/business/card/{reference}/reveal")
  .header("X-Numero-Api-Key", "<api-key>")
  .header("X-Numero-Signature", "<api-key>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.usenumero.com/numeroaccount/api/v1/business/card/{reference}/reveal")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Numero-Api-Key"] = '<api-key>'
request["X-Numero-Signature"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "data": {
    "cardReference": "<string>",
    "pan": "<string>",
    "cvv": "<string>",
    "expiryMonth": "<string>",
    "expiryYear": "<string>",
    "cardholderName": "<string>"
  },
  "error": {
    "message": "<string>",
    "param": "<string>"
  },
  "meta": {
    "request_id": "<string>",
    "pagination": {
      "page": 123,
      "page_size": 123,
      "total": 123,
      "has_more": true
    }
  }
}

POST

business

card

{reference}

reveal

Reveal full card details (sensitive)

curl --request POST \
  --url https://api.usenumero.com/numeroaccount/api/v1/business/card/{reference}/reveal \
  --header 'X-Numero-Api-Key: <api-key>' \
  --header 'X-Numero-Signature: <api-key>'

import requests

url = "https://api.usenumero.com/numeroaccount/api/v1/business/card/{reference}/reveal"

headers = {
    "X-Numero-Api-Key": "<api-key>",
    "X-Numero-Signature": "<api-key>"
}

response = requests.post(url, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'X-Numero-Api-Key': '<api-key>', 'X-Numero-Signature': '<api-key>'}
};

fetch('https://api.usenumero.com/numeroaccount/api/v1/business/card/{reference}/reveal', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.usenumero.com/numeroaccount/api/v1/business/card/{reference}/reveal",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "X-Numero-Api-Key: <api-key>",
    "X-Numero-Signature: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.usenumero.com/numeroaccount/api/v1/business/card/{reference}/reveal"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("X-Numero-Api-Key", "<api-key>")
	req.Header.Add("X-Numero-Signature", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.usenumero.com/numeroaccount/api/v1/business/card/{reference}/reveal")
  .header("X-Numero-Api-Key", "<api-key>")
  .header("X-Numero-Signature", "<api-key>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.usenumero.com/numeroaccount/api/v1/business/card/{reference}/reveal")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Numero-Api-Key"] = '<api-key>'
request["X-Numero-Signature"] = '<api-key>'

response = http.request(request)
puts response.read_body

{
  "data": {
    "cardReference": "<string>",
    "pan": "<string>",
    "cvv": "<string>",
    "expiryMonth": "<string>",
    "expiryYear": "<string>",
    "cardholderName": "<string>"
  },
  "error": {
    "message": "<string>",
    "param": "<string>"
  },
  "meta": {
    "request_id": "<string>",
    "pagination": {
      "page": 123,
      "page_size": 123,
      "total": 123,
      "has_more": true
    }
  }
}

Authorizations

X-Numero-Api-Key

string

header

required

Your business API key (live_key_...). Issued on approval; managed in Dashboard → Settings → Developer.

X-Numero-Signature

string

header

required

Base64(HMAC-SHA256(publicApiKey, input)) over the raw request body (POST) or canonicalized query string (signed GET). Also send X-Numero-Signature-Version: v2. Required on money-movement / state-changing endpoints (marked 🔒).

The HMAC key is your Public Key as raw UTF-8 bytes — a SECRET despite the name, and a different value from the X-Numero-Api-Key authentication header. Signing with the API key will never produce a valid signature.

Path Parameters

reference

string

required

Response

Sensitive card material

Canonical response envelope for the public surface. data on success, error on failure.

data

object

required

Sensitive material — returned only by the reveal endpoint. Never logged or stored by Numero.

Show child attributes

error

object | null

required

Show child attributes

Utilities

Balance

Cards

Cardholders

Transfers

Virtual Accounts

Airtime

Data

Electricity

Cable TV

Betting

Verification

Credit

Customers

Invoices

Sandbox

Customer Wallets

API Reference

Reveal full card details (sensitive)

Authorizations

Path Parameters

Response