# Get sensitive card details

Fetches the card's Primary Account Number (PAN), security code (CVV2), expiry date, and cardholder name.
Requires an encrypted JWE payload for security. See the [sensitive card details guide](/guides/product/issue-cards/sensitive-card-details) for implementation details.
To retrieve sensitive card details, the card must be in either `ACTIVE` or `FROZEN` status. A 403 response is returned for cards in any other status.
This endpoint is SCA protected. SCA requirements apply to profiles registered outside of the following regions: US, AU, NZ, SG, CA, MY.
Review the [Strong Customer Authentication guide](/guides/developer/auth-and-security/sca-and-2fa) for more details.

Endpoint: POST /twcard-data/v1/sensitive-card-data/details
Version: 2026Q4
Security: UserToken

## Security:

  - `UserToken` (unknown)
    http bearer JWT

## Header parameters:

  - `x-tw-twcard-card-token` (string, required)
    The card token identifying which card to retrieve details for.

  - `X-External-Correlation-Id` (string)
    Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. [Learn more](/guides/developer/headers/correlation-id).

## Request fields (application/json):

  - `keyVersion` (integer, required)
    The version of the encryption key to use. Always set to 1.
    Example: 1

  - `encryptedPayload` (string, required)
    Your JWE encrypted payload.
    Example: <your JWE>

## Response 200:

  - `200` (unknown)
    Sensitive card details retrieved successfully.

## Response 200 fields (application/json):

  - `nonce` (string)
    An arbitrary UUID issued from the cryptographic communication.
    Example: 33d51227-9ad6-4624-b4b7-7853b56076dd

  - `cvv2` (string)
    The card CVV2 security code.
    Example: 111

  - `pan` (string)
    The card Primary Account Number.
    Example: 4396910000012345

  - `expiryDate` (string)
    The card expiry date in MM/YY format.
    Example: 10/31

  - `cardholderName` (string)
    Name on the card.
    Example: John Smith

## Response 200 headers (application/json):

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f

## Response 429:

  - `429` (unknown)
    Rate limit exceeded. Retry after the number of seconds specified in the `Retry-After` header.

## Response 429 headers (application/json):

  - `Retry-After` (integer)
    Number of seconds to wait before retrying the request.
    Example: 5

  - `X-Rate-Limited-By` (string)
    Identifies the rate limiter that triggered the 429 response.
    Example: wise-public-api

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f