> ## Documentation Index
> Fetch the complete documentation index at: https://nextgen-docs.enfuce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# View Card Data

This feature enables your cardholders to view card data (such as the card number, the expiration date, and the CVV2/CVC2) on the issuer-provided mobile and/or web applications. When the card format is virtual or when the physical card is unavailable, viewing card data is essential as the cardholder needs the information to complete ecommerce transactions.

<Info>This method of viewing sensitive card information on the mobile/web application is Payment Card Industry Data Security Standard (PCI DSS) compliant.</Info>

## View Card Data | Workflow

1. A cardholder completes Strong Customer Authentication (SCA) and initiates a request in the mobile/web application to view card data.

2. Your system sends an API request to Enfuce to generate a unique access token and two URLs — one is for viewing card details on the mobile device and another URL is for viewing the data on web.

<div style={{marginLeft: '40px'}}>
  <strong>Related endpoint</strong>: [Initiate Card Data Retrieval](https://nextgen-docs.enfuce.com/api/cards/post-card/initiate-card-data-retrieval).
</div>

```
curl --location --request POST "{{host}}/issuer/v1/cards/{{cardId}}/controlToken" \
--header "Authorization: ••••••"

```

<Note>We do not perform any additional validation, except verifying the card ID. Hence, if the card ID is invalid, the request fails. If you want to check whether the card is eligible for payments, you must send additional API requests to verify the card status and balance.</Note>

3. In the endpoint response, a unique access token and two URLs are returned — `cardDataURL` for viewing card details on the mobile device and `cardDataFrameUrl` is for viewing the data on web.

<img src="https://mintcdn.com/preview-docs/2Ueu8Wiqtu_soOb7/images/card-data-retrieval.png?fit=max&auto=format&n=2Ueu8Wiqtu_soOb7&q=85&s=c16505a9c9e1c2ebe55669b7e9b21c9c" alt="Card Data Retrieval Endpoint Response" width="2660" height="864" data-path="images/card-data-retrieval.png" />

4. The cardholder accesses either the `cardDataURL` or the `cardDataFrameUrl` URL, based on where they are viewing the card information.

<Note>The token is valid for 30 seconds. The cardholder must access the appropriate URL within these 30 seconds to retrieve the HTML snapshot.</Note>

5. Another API request is sent to retrieve the card data in an HTML snapshot.

<div style={{marginLeft: '40px'}}>
  <ul>
    <li><strong>Mobile applications</strong>: A <code>POST</code> API request is sent to the <code>cardDataUrl</code>, including the token previously returned. </li>

    ```
    curl --location "{{cardDataUrl}}" \
    --header "Content-Type: application/x-www-form-urlencoded" \
    --data-urlencode "token={{token}}"

    ```

    <li><strong>Web applications</strong>: The browser opens iframe to <code>cardDataFrameUrl</code>. Then the parent page sends a <code>window\.postMessage()</code> to the iframe. The posted message object includes a <code>view-pan</code> operation parameter and the token previously returned.</li>

    ```
    iframe.addEventListener('load', () => { 
    iframe.contentWindow.postMessage({operation: 'view-pan', token}, cardDataFrameUrl);
    })

    ```
  </ul>

  A HTML snapshot is returned with the card information, including the card number, expiration date, and CVV2/CVC2.
</div>