View Card Data

This feature enables your cardholders to view card data (such as the card number, the expiration date, and the CVV2/CVC2) on the issuer-provided mobile and/or web applications. When the card format is virtual or when the physical card is unavailable, viewing card data is essential as the cardholder needs the information to complete ecommerce transactions.

This method of viewing sensitive card information on the mobile/web application is Payment Card Industry Data Security Standard (PCI DSS) compliant.

View Card Data | Workflow

A cardholder completes Strong Customer Authentication (SCA) and initiates a request in the mobile/web application to view card data.
Your system sends an API request to Enfuce to generate a unique access token and two URLs — one is for viewing card details on the mobile device and another URL is for viewing the data on web.

Related endpoint: Initiate Card Data Retrieval.

curl --location --request POST "{{host}}/issuer/v1/cards/{{cardId}}/controlToken" \
--header "Authorization: ••••••"

We do not perform any additional validation, except verifying the card ID. Hence, if the card ID is invalid, the request fails. If you want to check whether the card is eligible for payments, you must send additional API requests to verify the card status and balance.

In the endpoint response, a unique access token and two URLs are returned — cardDataURL for viewing card details on the mobile device and cardDataFrameUrl is for viewing the data on web.

The cardholder accesses either the cardDataURL or the cardDataFrameUrl URL, based on where they are viewing the card information.

The token is valid for 30 seconds. The cardholder must access the appropriate URL within these 30 seconds to retrieve the HTML snapshot.

Another API request is sent to retrieve the card data in an HTML snapshot.

Mobile applications: A POST API request is sent to the cardDataUrl, including the token previously returned.

curl --location "{{cardDataUrl}}" \
--header "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode "token={{token}}"

Web applications: The browser opens iframe to cardDataFrameUrl. Then the parent page sends a window.postMessage() to the iframe. The posted message object includes a view-pan operation parameter and the token previously returned.

iframe.addEventListener('load', () => { 
iframe.contentWindow.postMessage({operation: 'view-pan', token}, cardDataFrameUrl);
})

A HTML snapshot is returned with the card information, including the card number, expiration date, and CVV2/CVC2.

Getting Started

Cards

Cardholders

PIN

Digital Wallets

Transaction Lifecycle

Spend Controls

Exchange Rates

View Card Data

View Card Data | Workflow

​View Card Data | Workflow

View Card Data | Workflow