> ## Documentation Index
> Fetch the complete documentation index at: https://direct-api.reap.global/llms.txt
> Use this file to discover all available pages before exploring further.

# Card details

> The reveal endpoint returns a short-lived link to a Reap-hosted view of the card number, expiry and CVV, so card data never touches your servers.

PCI DSS makes raw card numbers expensive to handle: any system that stores,
transmits or displays them falls inside PCI scope. So
[Reveal card](/api-reference/cards/reveal-card-details.md) never returns the PAN, expiry
or CVV. It returns an `accessUrl` to a secure, Reap-hosted window that shows
them. Card details are only ever visible inside that window; there is no way
to retrieve them through the API.

```json theme={"system"}
{ "accessUrl": "https://secure.card.reap.global/api/card/show-card-info?auth=..." }
```

## How it works

* The `accessUrl` is valid for **1 minute**. Request it when the cardholder
  clicks "Show card", then load it immediately. Never store or log it; if it
  expires, call reveal again for a fresh one.
* **Call reveal from your backend only.** Your API key must never reach a
  user's device, and the `cards:read_vault` scope covers every card in the
  business.
* Your app must check that the person asking is allowed to see the card
  before calling reveal.

```html theme={"system"}
<iframe src="ACCESS_URL_FROM_YOUR_BACKEND" title="Card details"
        style="width: 400px; height: 180px; border: 0;"></iframe>
```

The window matches the page's `color-scheme` (light or dark). You can also
open the URL directly outside an iframe. If the frame renders blank on your
domain, your origin isn't allowlisted; contact Reap to enable embedding,
or open the URL in a new tab instead.

## PCI DSS dos and don'ts

Keeping cardholder data out of PCI DSS scope depends entirely on how you
handle the `accessUrl`. The rules:

**Do:**

* Call reveal from your backend only, when a user who is allowed to see the
  card asks for it.
* Serve the `accessUrl` to the frontend of your own authenticated session,
  in memory only.
* Load it in a single iframe (or a new tab), request a fresh URL each time
  the view opens, and discard it when the view closes.
* Keep the API key in your backend's secrets manager.

**Don't:**

* Let your API key reach a user's device. `cards:read_vault` covers every
  card in the business.
* Log, persist, decode or modify the URL, or send it to analytics,
  error-reporting or session-replay tools.

**Cannot be done at all:**

* Retrieve the card number, expiry or CVV through the API. They only exist
  inside the Reap-hosted window.
* Display card data anywhere outside that window, restyle its contents, or
  extract them into your own UI.

Confirm the implications for your environment with your compliance team.

## Related endpoints

* [Reveal card](/api-reference/cards/reveal-card-details.md)
* [Cards](/concepts/cards.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.