Reveal card details

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/cards/{id}/reveal \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "cssUrl": "https://acme.com/card-reveal-dark.css"
}
'

const options = {
  method: 'POST',
  headers: {Authorization: 'Basic <encoded-value>', 'Content-Type': 'application/json'},
  body: JSON.stringify({cssUrl: 'https://acme.com/card-reveal-dark.css'})
};

fetch('https://api.lightspark.com/grid/2025-10-13/cards/{id}/reveal', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

val client = OkHttpClient()

val mediaType = MediaType.parse("application/json")
val body = RequestBody.create(mediaType, "{\n  \"cssUrl\": \"https://acme.com/card-reveal-dark.css\"\n}")
val request = Request.Builder()
  .url("https://api.lightspark.com/grid/2025-10-13/cards/{id}/reveal")
  .post(body)
  .addHeader("Authorization", "Basic <encoded-value>")
  .addHeader("Content-Type", "application/json")
  .build()

val response = client.newCall(request).execute()

{
  "panEmbedUrl": "https://embed.lithic.com/iframe/...?t=...",
  "expiresAt": "2026-05-08T14:16:00Z"
}

{
  "code": "UNAUTHORIZED",
  "reason": "<string>",
  "details": {}
}

{
  "code": "FORBIDDEN",
  "reason": "<string>",
  "details": {}
}

{
  "code": "TRANSACTION_NOT_FOUND",
  "reason": "<string>",
  "details": {}
}

{
  "code": "TRANSACTION_NOT_PENDING_PLATFORM_APPROVAL",
  "reason": "<string>",
  "details": {}
}

{
  "code": "GRID_SWITCH_ERROR",
  "reason": "<string>",
  "details": {}
}

{
  "code": "UNRECOGNIZED_MANDATORY_PAYEE_DATA_KEY",
  "reason": "<string>",
  "details": {}
}

Cards

Reveal card details

When the card’s cardCapabilities.supportsPanReveal is true, mint a signed, short-lived URL for the card processor’s iframe that displays the card’s full PAN, CVV, and expiry to the cardholder. The Card resource never carries a reveal URL.

When cardCapabilities.supportsPanReveal is false, this endpoint cannot reveal the card. Use the card issuer’s challenge-based hosted reveal flow instead.

Request the reveal right before rendering the iframe and render the returned panEmbedUrl immediately; it expires at expiresAt (within minutes). Never store, cache, or log the URL — it is a bearer secret for the full card details. The card data renders inside the processor’s iframe and never crosses Grid’s or your servers.

Set cardConfigs.panRevealCssUrl on your platform config to style the iframe with your own stylesheet, or send cssUrl in the body to override it for one reveal.

Every reveal is audit-logged with the requesting actor.

POST

cards

{id}

reveal

Reveal card details

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/cards/{id}/reveal \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "cssUrl": "https://acme.com/card-reveal-dark.css"
}
'

const options = {
  method: 'POST',
  headers: {Authorization: 'Basic <encoded-value>', 'Content-Type': 'application/json'},
  body: JSON.stringify({cssUrl: 'https://acme.com/card-reveal-dark.css'})
};

fetch('https://api.lightspark.com/grid/2025-10-13/cards/{id}/reveal', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

val client = OkHttpClient()

val mediaType = MediaType.parse("application/json")
val body = RequestBody.create(mediaType, "{\n  \"cssUrl\": \"https://acme.com/card-reveal-dark.css\"\n}")
val request = Request.Builder()
  .url("https://api.lightspark.com/grid/2025-10-13/cards/{id}/reveal")
  .post(body)
  .addHeader("Authorization", "Basic <encoded-value>")
  .addHeader("Content-Type", "application/json")
  .build()

val response = client.newCall(request).execute()

{
  "panEmbedUrl": "https://embed.lithic.com/iframe/...?t=...",
  "expiresAt": "2026-05-08T14:16:00Z"
}

{
  "code": "UNAUTHORIZED",
  "reason": "<string>",
  "details": {}
}

{
  "code": "FORBIDDEN",
  "reason": "<string>",
  "details": {}
}

{
  "code": "TRANSACTION_NOT_FOUND",
  "reason": "<string>",
  "details": {}
}

{
  "code": "TRANSACTION_NOT_PENDING_PLATFORM_APPROVAL",
  "reason": "<string>",
  "details": {}
}

{
  "code": "GRID_SWITCH_ERROR",
  "reason": "<string>",
  "details": {}
}

{
  "code": "UNRECOGNIZED_MANDATORY_PAYEE_DATA_KEY",
  "reason": "<string>",
  "details": {}
}

Authorizations

Authorization

string

header

required

API token authentication using format <api token id>:<api client secret>

Path Parameters

string

required

System-generated unique card identifier

Body

application/json

Optional overrides for one reveal. Omit the body entirely to use your platform's configured settings.

cssUrl

string<uri> | null

HTTPS URL of a stylesheet for this reveal only, overriding cardConfigs.panRevealCssUrl for this call without changing your platform config. Use it to style one reveal differently from the rest — to match the cardholder's light or dark theme, for example. Subject to the same rules as the platform-level setting: it must be reachable over HTTPS without credentials, it styles the same selectors, and it loads into the page rendering the live card details, so host it somewhere you would trust with them. Omit the field, or send null, to fall back to your platform config.

Maximum string length: 512

Pattern: ^https://[^@]*$

Example:

"https://acme.com/card-reveal-dark.css"

Response

Reveal URL minted.

panEmbedUrl

string<uri>

required

Signed URL of the card processor's iframe that securely displays the PAN, CVV, and expiry to the cardholder. The full PAN and CVV never cross Grid's servers — render this URL in an iframe in your client to reveal card details. The URL is a short-lived bearer secret: render it immediately and never store, cache, or log it.

Example:

"https://embed.lithic.com/iframe/...?t=..."

expiresAt

string<date-time>

required

When the signed URL stops loading. Request a new reveal rather than re-rendering an expired URL.

Example:

"2026-05-08T14:16:00Z"

Using the API

API documentation

Reveal card details

Authorizations

Path Parameters

Body

Response