Reveal a stored card to its owner

Issues a single-use link, valid for two minutes, that answers the card’s number, expiry and holder name to the customer who owns the card. Call it only after the platform has verified the customer is present (for example with a fresh step-up), and hand the link only to that customer’s browser, for Evervault’s Reveal component to open: the link goes through Evervault’s Relay, which decrypts the number on the way, so whoever opens it receives the card number in plaintext. The link never answers a security code. Only an ACTIVE card can be revealed. Each issue and each opening is recorded in the card’s audit log with the customer as the actor.

POST /customers/{customerId}/stored-cards/{storedCardId}/reveal

Reveal a stored card to its owner

cURL

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/customers/{customerId}/stored-cards/{storedCardId}/reveal \
  --header 'Authorization: Basic <encoded-value>'

201

{
  "detailsUrl": "<string>",
  "expiresAt": "2023-11-07T05:31:56Z"
}

Authorizations

Authorization · string · header · required

API token authentication using format <api token id>:<api client secret>

Path Parameters

customerId · string · required

System-generated unique customer identifier

storedCardId · string · required

System-generated unique stored card identifier

Response

201

application/json

The link

A single-use link that answers a stored card's details to its owner.

detailsUrl · string<uri> · required

The single-use link on Evervault's Relay. Open it with Evervault's Reveal component in the owner's browser; it answers StoredCardRevealDetails without cvc, once, until expiresAt. It is a bearer secret: do not log or store it.

Maximum string length: 2048

expiresAt · string<date-time> · required

When the link stops working, two minutes after it was issued.