Reveal a purchase card

Mint a short-lived signed URL that displays one of the agent’s purchase cards. The full card number and CVV never pass through Grid; hand the URL to the customer’s client immediately and never store or log it. Each reveal is audit-logged with the agent as the actor. Standard cards are revealed only on the platform. Requires the MANAGE_CARDS permission.

POST /agents/me/cards/{cardId}/reveal

Reveal a purchase card

cURL

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/agents/me/cards/{cardId}/reveal \
  --header 'Authorization: Bearer <token>'

200

{
  "panEmbedUrl": "https://embed.lithic.com/iframe/...?t=...",
  "expiresAt": "2026-05-08T14:16:00Z"
}

Authorizations

Authorization · string · header · required

Bearer token authentication for agent-scoped endpoints. The token is the accessToken returned when redeeming a device code via POST /agents/device-codes/redeem. Agent credentials are user-scoped: all requests are automatically bound to the agent's associated customer and subject to the agent's policy.

Path Parameters

cardId · string · required

Unique identifier of the card

Response

200

application/json

Reveal URL minted

panEmbedUrl · string<uri> · required

Signed URL of the card processor's iframe that securely displays the PAN, CVV, and expiry to the cardholder. The full PAN and CVV never cross Grid's servers — render this URL in an iframe in your client to reveal card details. The URL is a short-lived bearer secret: render it immediately and never store, cache, or log it.

Example:

"https://embed.lithic.com/iframe/...?t=..."

expiresAt · string<date-time> · required

When the signed URL stops loading. Request a new reveal rather than re-rendering an expired URL.

Example:

"2026-05-08T14:16:00Z"