> ## Documentation Index > Fetch the complete documentation index at: https://nextgen-docs.enfuce.com/llms.txt > Use this file to discover all available pages before exploring further. # Retrieve Encrypted PIN > Send a request to this endpoint to retrieve the card PIN (ISO PIN Block Format 1) encrypted with temporary PIN encryption key (tzpk). The tzpk is encrypted with the provided ephemeral RSA 2048 bit public key. Steps for retrieving the ISO PIN Block Format 1: - Decrypt the tzpk with the RSA private key. Now you have the decrypted 3DES double length key. - Decrypt the PIN block with the decrypted tzpk using 3DES decryption. ## OpenAPI ````yaml json-files/pin.openapi.json post /v1/pin/view openapi: 3.0.3 info: version: '1' title: PIN API servers: - url: https://api.{{tenant}}.ext-uat1-sandbox.mycore.enfuce.com/issuer description: UAT Sandbox - url: https://api.{{tenant}}.eu.live.prod.mycore.enfuce.com/issuer description: Production security: - bearerAuth: [] tags: - name: PIN operations with pre-shared key description: >

Endpoints for card PIN operations using pre-shared key.

Note: When using these endpoints, the client with access to the clear PIN must ensure proper PIN handling in compliance with the card scheme's security requirements.

- name: PIN operations using PKI description: >

Endpoint for Card PIN operations using public key cryptography.

Note: If this endpoint is used, the client must make sure that the RSA key pair is generated and used by the card-holder device, giving no access to the private RSA key to any other system. This way, no other system will have any means to access the PIN code.

paths: /v1/pin/view: post: tags: - PIN operations using PKI summary: Retrieve Encrypted PIN description: > Send a request to this endpoint to retrieve the card PIN (ISO PIN Block Format 1) encrypted with temporary PIN encryption key (tzpk). The tzpk is encrypted with the provided ephemeral RSA 2048 bit public key. Steps for retrieving the ISO PIN Block Format 1: - Decrypt the tzpk with the RSA private key. Now you have the decrypted 3DES double length key. - Decrypt the PIN block with the decrypted tzpk using 3DES decryption. operationId: viewPin parameters: - $ref: '#/components/parameters/x-audit-user' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ViewPinRequestBody' description: Request payload for successful PIN retrieval. responses: '200': description: Successful retrieval of PIN. content: application/json: schema: $ref: '#/components/schemas/ViewPinResponseBody' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalServerError' components: parameters: x-audit-user: in: header name: x-audit-user required: false description: Optional audit user header schema: type: string schemas: ViewPinRequestBody: type: object properties: pinControlId: allOf: - $ref: '#/components/schemas/Id' description: >- Control ID that was returned in the [Request PIN Control Access Token Endpoint](https://nextgen-docs.enfuce.com/api/cards/post-card/create-pin-control-access-token). pubKey: type: string description: | RSA 2048 public key in PEM format (X.509 SubjectPublicKeyInfo). The key may contain: - new lines, - the PEM headers ("-----BEGIN PUBLIC KEY-----" and "-----END PUBLIC KEY-----") The key must not contain any spaces. example: >- -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArMRPoM6Za3XDIsomnVObGJsrHHHIRZ5zRsVoU8Unie9QvK9OBf0cCGyXd8XPky7W3m/KDKLGUnfne8vAMOeT1NpBgQnv2lcpIfBMLjSUKT5gIcJMY00Asqjvi4YFwRdW9AxSThxtkb7AIsJJiRwbAGFDnt+Ic/gIQS5s1vnuIjaYBTbzYtwnh3WBQ7DJsCVes81onwapGtdiswQD15cNhAI5853/uB/vno3j3tOq3gpm9+qLa6FYGfWZan07k+RMCVF1v6kxa9teCj6V3cysdtPeK9+gQnBjuuSESQL7/s/BgC7QxLqBCabkFyLo+3QO+iKmfeKPX8imV1rUgyjo3QIDAQAB-----END PUBLIC KEY----- required: - pinControlId - pubKey title: ViewPinRequestBody ViewPinResponseBody: type: object properties: pinBlock: type: string description: >- Hex encoded value of the pin block (ISO PIN Block Format 1). It is 3DES (double length key) encrypted with the key from the tzpk field (which is provided in encrypted form). example: 9358E39632CAAAC2 tzpk: type: string description: >- Terminal Zone PIN Key (TZPK) that decrypts the generated PIN block to retrieve the actual PIN. Hex encoded value, encrypted with the pubKey passed as input. Once decrypted, this is the 3DES key used for decrypting the pin block. example: >- A59DA3A12AF8254034B2167EEF1773B0E5B230C558C5C6CE1BA4D65C43B2C20E24FE41C51BEF799087D55B4EB3E9DA0C8845CF76EF569D3C3F6D5A818F7F18EF634231E102A88830ABAF983BF2FB9C35DDDAAC47DB004EEF80E14B9D9E5CAE30CCF42596F4BD8B524EFCA6F538C13AFC7D1D22C9A31B58F166D85787119AC5A60EA23FCDE274787EC72403CFC313B27B53E4B9E4E414589DE5FD71EBBAC84A792B9B2A3A32335C221D3440F40DA6D9755FE7A15C47174C3595C1EDC685E86740C06FF9B76451E85E8C8934E24563D0D24B4C8E449B72E768A8706895AB574D023D9E9CBBBDC22206E25612FBC7CC5A9DEA7863992CE9C8399BAD4AC2BDFA2404 required: - pinBlock - tzpk title: ViewPinResponseBody Id: type: string format: uuid description: Unique identifier of a resource. example: 20218aae-b15e-406c-9e9f-23735cd86a48 ErrorResponse: type: object properties: type: description: The problem type. type: string title: description: The reason phrase of HttpStatus. type: string status: description: HTTP problem status. type: number detail: description: The problem detail. type: string instance: description: The request path. type: string id: description: Unique error identifier. type: string format: uuid timestamp: description: Date-time when error occurred. type: string format: date-time responses: BadRequest: description: Bad request content: application/problem+json: schema: $ref: '#/components/schemas/ErrorResponse' example: type: about:blank title: Bad Request status: 400 detail: 'JSON parse error: Unexpected character...' instance: /v1/cards id: 5cc541cb-f456-4331-b537-d2380fca0400 timestamp: '2026-02-24T12:34:56Z' Unauthorized: description: Unauthorized Forbidden: description: Forbidden content: application/problem+json: schema: $ref: '#/components/schemas/ErrorResponse' example: type: about:blank title: Forbidden status: 403 detail: Access Denied instance: /v1/cards id: 5cc541cb-f456-4331-b537-d2380fca0403 timestamp: '2026-02-24T12:34:56Z' NotFound: description: Not found content: application/problem+json: schema: $ref: '#/components/schemas/ErrorResponse' example: type: about:blank title: Not Found status: 404 detail: >- Entity not found - Program with id: 2ec117b7-454e-4cc5-8b89-dea5485aab2b instance: /v1/cards id: 5cc541cb-f456-4331-b537-d2380fca0404 timestamp: '2026-02-24T12:34:56Z' InternalServerError: description: Internal server error content: application/problem+json: schema: $ref: '#/components/schemas/ErrorResponse' example: type: about:blank title: Internal Server Error status: 500 detail: Unexpected error occurred. instance: /v1/cards id: 5cc541cb-f456-4331-b537-d2380fca0500 timestamp: '2026-02-24T12:34:56Z' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT ````