Open a stored card link

What a stored card’s detailsUrl answers, once. Open the detailsUrl itself, never this path on Grid’s host: detailsUrl goes through Evervault’s Relay, which decrypts number and cvc on the way, and Grid answers them only as Evervault ciphertext. The token is the only credential. A link that was already opened, has expired, or whose card or agent lost access answers 404. The same path answers a link from createStoredCardOwnerReveal, which never carries cvc, and the response allows the origin https://ui-components.evervault.com (CORS) so Evervault’s Reveal component can open it.

GET /stored-card-reveals/{token}

Open a stored card link

cURL

curl --request GET \
  --url https://api.lightspark.com/grid/2025-10-13/stored-card-reveals/{token}

200

{
  "number": "<string>",
  "expiryMonth": 8,
  "expiryYear": 2029,
  "holderName": "Jane Doe",
  "cvc": "<string>"
}

Path Parameters

token · string · required

The secret part of a detailsUrl

Maximum string length: 128

Response

200

application/json

The card's details

What a reveal link answers. Grid answers number and cvc as Evervault ciphertext; the Evervault Relay in front of the link decrypts them, so the caller of detailsUrl receives the card's own values.

number · string · required

The card number.

Maximum string length: 2048

expiryMonth · integer · required

Expiry month, 1 to 12.

Required range: 1 <= x <= 12

Example:

8

expiryYear · integer · required

Four-digit expiry year.

Required range: 2000 <= x <= 2199

Example:

2029

holderName · string · required

The name on the card.

Maximum string length: 255

Example:

"Jane Doe"

cvc · string

The security code, present only on an agent's link whose reveal has cvcIncluded true; never on an owner's link.

Maximum string length: 2048