Skip to content

Get sensitive card details

Request

Fetches the card's Primary Account Number (PAN), security code (CVV2), expiry date, and cardholder name.

Requires an encrypted JWE payload for security. See the sensitive card details guide for implementation details.

To retrieve sensitive card details, the card must be in either ACTIVE or FROZEN status. A 403 response is returned for cards in any other status.

SCA protected endpoint

This endpoint is SCA protected. SCA requirements apply to profiles registered outside of the following regions: US, AU, NZ, SG, CA, MY.

Review the Strong Customer Authentication guide for more details.

Security
UserToken
Headers
x-tw-twcard-card-tokenstring, (uuid)required

The card token identifying which card to retrieve details for.

Example:ca0c8154-1e14-4464-a1ce-dcea7dc3de52
X-External-Correlation-Idstring, (uuid), <= 36 characters

Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more.

Example:f47ac10b-58cc-4372-a567-0e02b2c3d479
Bodyapplication/jsonrequired
keyVersioninteger, (int32)required

The version of the encryption key to use. Always set to 1.

Example:1
encryptedPayloadstringrequired

Your JWE encrypted payload.

Example:"<your JWE>"
curl -i -X POST \
  https://twcard.wise.com/twcard-data/v1/sensitive-card-data/details \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>' \
  -H 'Content-Type: application/json' \
  -H 'X-External-Correlation-Id: f47ac10b-58cc-4372-a567-0e02b2c3d479' \
  -H 'x-tw-twcard-card-token: ca0c8154-1e14-4464-a1ce-dcea7dc3de52' \
  -d '{
    "keyVersion": 1,
    "encryptedPayload": "<your JWE>"
  }'

Responses

Sensitive card details retrieved successfully.

Headers
X-External-Correlation-Idstring, (uuid), <= 36 characters

Echoed back when X-External-Correlation-Id was included in the request. Learn more.

Example:"f47ac10b-58cc-4372-a567-0e02b2c3d479"
x-trace-idstring

Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.

Example:"fba501b6d453b96789f52338f019341f"
Bodyapplication/json
noncestring, (uuid)

An arbitrary UUID issued from the cryptographic communication.

Example:"33d51227-9ad6-4624-b4b7-7853b56076dd"
cvv2string

The card CVV2 security code.

Example:"111"
panstring

The card Primary Account Number.

Example:"4396910000012345"
expiryDatestring

The card expiry date in MM/YY format.

Example:"10/31"
cardholderNamestring

Name on the card.

Example:"John Smith"
Response
{
  "nonce": "33d51227-9ad6-4624-b4b7-7853b56076dd",
  "cvv2": "111",
  "pan": "4396910000012345",
  "expiryDate": "10/31",
  "cardholderName": "John Smith"
}