> ## Documentation Index > Fetch the complete documentation index at: https://nextgen-docs.enfuce.com/llms.txt > Use this file to discover all available pages before exploring further. # Initiate Card Data Retrieval > Send a request to this endpoint when the cardholder wants to retrieve card data, such as PAN, expiry and CVV2/CVC2. If no sequence number is specified, the latest card version is used by default. Only card versions not in CLOSED status are allowed. ## OpenAPI ````yaml json-files/card.openapi.json post /v1/cards/{id}/controlToken openapi: 3.0.3 info: description: > Endpoints for doing various actions connected to the Card entity. All date-time fields adhere to the ISO 8601 standard unless specified otherwise. For example: 2024-05-31T06:55:17Z version: '1' title: Card API contact: name: Enfuce Financial Services url: https://enfuce.com email: info@enfuce.com servers: - url: https://api.{{tenant}}.ext-uat1-sandbox.mycore.enfuce.com/issuer description: UAT Sandbox - url: https://api.{{tenant}}.eu.live.prod.mycore.enfuce.com/issuer description: Production security: - bearerAuth: [] tags: - name: Create Card description: Endpoints for creating a card - name: Get card description: Endpoints for fetching a card - name: Update card description: Endpoints for updating a card paths: /v1/cards/{id}/controlToken: post: tags: - Get card summary: Initiate Card Data Retrieval description: > Send a request to this endpoint when the cardholder wants to retrieve card data, such as PAN, expiry and CVV2/CVC2. If no sequence number is specified, the latest card version is used by default. Only card versions not in CLOSED status are allowed. operationId: getCardDataControlToken parameters: - name: id in: path description: Unique identifier of the card. required: true schema: type: string format: uuid - $ref: '#/components/parameters/x-audit-user' requestBody: required: false content: application/json: schema: $ref: '#/components/schemas/ControlTokenRequestBody' responses: '200': description: Control token generated successfully content: application/json: schema: $ref: '#/components/schemas/CardDataControlTokenResponseBody' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalServerError' components: parameters: x-audit-user: in: header name: x-audit-user required: false description: Optional audit user header schema: type: string schemas: ControlTokenRequestBody: type: object properties: sequenceNumber: allOf: - $ref: '#/components/schemas/SequenceNumber' description: > The sequence number of the card version to use. If not specified, the latest card version is used by default. Only card versions not in CLOSED status are allowed. title: ControlTokenRequestBody CardDataControlTokenResponseBody: type: object properties: token: type: string description: The control token. example: >- eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiZGlyIn0..pTLFy-lzse0ZmtOX.vjG0cY1uxH8v80amEjOgPs0zUv9lDXrskW0nM0MBArCBqzZ9Ph2k3Lt85L1uEq2RK0YG6mCTJdGOyOuuO3CmPE-_w941ya5y4RskdHefCkQDdRG3sesQ070d1nMgLRWFLorJKjn7umSyOrRMjMjQg684O5VWxlApPwgIt4sOXbTZKcrRh5qv-8cBDp4IYQ-HznucHiloVtjZf2he.UrmJDmSYeBSveB-uojVDnA cardDataUrl: type: string description: The URL to call on mobile devices for accessing the card's data. example: >- https://api.tenant.sandbox.mycore.enfuce.com/issuer-web/card-data/view cardDataFrameUrl: type: string description: The URL to open in iframe to access the card's data. example: >- https://api.tenant.sandbox.mycore.enfuce.com/issuer-web/card-data/view/frame required: - token title: CardDataControlTokenResponseBody SequenceNumber: type: integer minimum: 1 description: >- The sequence number of the card version, this value is also known as PSN (pan sequence number) example: 1 ErrorResponse: type: object properties: type: description: The problem type. type: string title: description: The reason phrase of HttpStatus. type: string status: description: HTTP problem status. type: number detail: description: The problem detail. type: string instance: description: The request path. type: string id: description: Unique error identifier. type: string format: uuid timestamp: description: Date-time when error occurred. type: string format: date-time responses: BadRequest: description: Bad request content: application/problem+json: schema: $ref: '#/components/schemas/ErrorResponse' example: type: about:blank title: Bad Request status: 400 detail: 'JSON parse error: Unexpected character...' instance: /v1/cards id: 5cc541cb-f456-4331-b537-d2380fca0400 timestamp: '2026-02-24T12:34:56Z' Unauthorized: description: Unauthorized Forbidden: description: Forbidden content: application/problem+json: schema: $ref: '#/components/schemas/ErrorResponse' example: type: about:blank title: Forbidden status: 403 detail: Access Denied instance: /v1/cards id: 5cc541cb-f456-4331-b537-d2380fca0403 timestamp: '2026-02-24T12:34:56Z' NotFound: description: Not found content: application/problem+json: schema: $ref: '#/components/schemas/ErrorResponse' example: type: about:blank title: Not Found status: 404 detail: >- Entity not found - Program with id: 2ec117b7-454e-4cc5-8b89-dea5485aab2b instance: /v1/cards id: 5cc541cb-f456-4331-b537-d2380fca0404 timestamp: '2026-02-24T12:34:56Z' InternalServerError: description: Internal server error content: application/problem+json: schema: $ref: '#/components/schemas/ErrorResponse' example: type: about:blank title: Internal Server Error status: 500 detail: Unexpected error occurred. instance: /v1/cards id: 5cc541cb-f456-4331-b537-d2380fca0500 timestamp: '2026-02-24T12:34:56Z' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT ````