GET/cards/{cardId}/card-display

Get Virtual Card Details

Returns virtual card details as encrypted HTML for a broker-owned debit card. GET /cards/{cardId}/card-display returns EncryptedHtml directly under ResponseData, alongside Encryption.

Requires session-token. Use cardId from GET /cards/{userId}.

bash

curl -X GET "{{API_BASE_URL}}/cards/{{cardId}}/card-display" \
  -H "session-token: {{sessionToken}}" \
  -H "Accept: application/json"

Path variables

Field	Type	Required	Possible values	Description
`cardId`	string	Required	55d0c52f-79ee-4d38-acf4-a16c07957898	Card reference ID from list cards.

Headers

Field	Type	Required	Possible values	Description
`session-token`	string	Required	—	SessionToken obtained from the Create GMA Session endpoint. All secured endpoints require this header.

Additional info

Field	Type	Required	Possible values	Description
`How to decrypt`	object	Optional	—	You can decrypt `EncryptedHtml` using the following steps. Cipher settings \| \| \| \| --- \| --- \| \| Algorithm \| AES-256-CBC \| \| Padding \| PKCS7 \| \| Key derivation \| PBKDF2-HMAC-SHA256 using `API_Client_Secret` \| \| Key size \| 256 bits \| \| Iterations \| 100 \| \| Payload \| `salt` (32 hex chars) + `iv` (32 hex chars) + `ciphertext` \| Step 1: Take `EncryptedHtml` as one string. You also need the broker `API_Client_Secret` (same secret as today). Step 2: First 32 characters = salt (hex). Step 3: Next 32 characters = iv (hex). Step 4: Remainder = ciphertext. Step 5: Derive a 256-bit key using PBKDF2-HMAC-SHA256 with `API_Client_Secret`, the decoded salt, and 100 iterations. Step 6: Decrypt AES-256-CBC with that key, iv, and PKCS7 padding. Step 7: Result is UTF-8 HTML. Show it in an iframe or WebView. Example (Node) ```js const crypto = require('crypto'); function decryptCardHtml(encryptedHtml, apiClientSecret) { const salt = Buffer.from(encryptedHtml.slice(0, 32), 'hex'); const iv = Buffer.from(encryptedHtml.slice(32, 64), 'hex'); const ciphertext = Buffer.from(encryptedHtml.slice(64), 'base64'); const key = crypto.pbkdf2Sync(apiClientSecret, salt, 100, 32, 'sha256'); const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv); return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8'); } ``` Java / .NET / Python: PBKDF2-HMAC-SHA256 → AES-256-CBC with PKCS7 padding. After decrypt You get an HTML card (name, PAN, expiry, CVV). If CVV is missing, the page shows NOT AVAILABLE. Security Never log `EncryptedHtml` or `API_Client_Secret`. HTTPS only. Do not put `API_Client_Secret` in the mobile or web app.
`401 — Missing session`	object	Optional	—	Missing broker session.
`403 — No access`	object	Optional	—	Broker does not have access to this card.
`404 — Not found`	object	Optional	—	Card not found or card data not available.

Example— 401 — Missing session

{
  "ResponseCode": 401,
  "ResponseMessage": "Unauthorized",
  "ResponseData": null
}

{
  "ResponseCode": 401,
  "ResponseMessage": "Unauthorized",
  "ResponseData": null
}

Example— 403 — No access

{
  "ResponseCode": 403,
  "ResponseMessage": "Forbidden",
  "ResponseData": null
}

{
  "ResponseCode": 403,
  "ResponseMessage": "Forbidden",
  "ResponseData": null
}

Example— 404 — Not found

{
  "ResponseCode": 404,
  "ResponseMessage": "NotFound",
  "ResponseData": null
}

{
  "ResponseCode": 404,
  "ResponseMessage": "NotFound",
  "ResponseData": null
}

Path param stays camelCase (`cardId`).

Response

Field	Type	Possible values	Description
`ResponseCode`	integer	200 \| 201 \| 204 \| 301 \| 400 \| 401 \| 403 \| 404 \| 410 \| 422 \| 500 \| 503	API result code in the response envelope. Indicates success or the error category (e.g. 200 success, 400 bad request, 401 unauthorized).
`ResponseMessage`	string	Success \| Created \| NoContent \| BadRequest \| Unauthorized \| Forbidden \| NotFound \| Gone \| UnprocessableContent \| ServerError \| ResourceMoved \| ServiceUnAvailable \| UnProcessableEntity	Human-readable label paired with ResponseCode (e.g. Success, BadRequest, Unauthorized). Use with ResponseCode to interpret the outcome.
`ResponseData`	object	Please refer to below example for response body	Virtual card details payload. See How to decrypt below.
`ResponseData.EncryptedHtml`	string	—	Single string: salt (32 hex chars) + iv (32 hex chars) + ciphertext. See How to decrypt below.
`ResponseData.Encryption`	object	—	Cipher settings used to decrypt `EncryptedHtml`.

Example response

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "EncryptedHtml": "<32-hex-salt><32-hex-iv><base64-ciphertext>",
    "Encryption": {
      "Algorithm": "AES-256-CBC",
      "Padding": "PKCS7",
      "KeyDerivation": "PBKDF2",
      "KeySizeBits": 256,
      "Iterations": 100,
      "KeyName": "API_Client_Secret",
      "PayloadFormat": "salt(32 hex)+iv(32 hex)+ciphertext"
    }
  }
}

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "EncryptedHtml": "<32-hex-salt><32-hex-iv><base64-ciphertext>",
    "Encryption": {
      "Algorithm": "AES-256-CBC",
      "Padding": "PKCS7",
      "KeyDerivation": "PBKDF2",
      "KeySizeBits": 256,
      "Iterations": 100,
      "KeyName": "API_Client_Secret",
      "PayloadFormat": "salt(32 hex)+iv(32 hex)+ciphertext"
    }
  }
}

Requires `session-token: {SessionToken}` from Create GMA Session. Use the same client IP as authentication.