Card secrets

PAN, CVC and PIN, encrypted under a key only you hold.

📄️Get a card’s encrypted PAN and CVC

Your backend generates a 32-hex secret, wraps it RSA-OAEP under the issuer’s public key for this environment, and sends only the wrapped form. The response is AES-128-GCM ciphertext that only you can open — the service relays it and holds no key. `expiryMonth`/`expiryYear` come back in CLEAR: they are merged in from the card read, not returned by the issuer’s secrets call. Sessions are single-use; create one per reveal. Rate-limited per card.

📄️Get a card’s encrypted PIN

Same session mechanism as `POST /cards/:id/secrets`. The plaintext is an ISO 9564-1 Format 2 PIN block, not a bare PIN. Rate-limited per card.

📄️Update a card’s PIN

Encrypt an ISO 9564-1 Format 2 PIN block under the same secret your `sessionId` wraps. No `Idempotency-Key`: the body carries the whole desired state, so repeating it converges. A timeout answers `PIN_WRITE_UNCONFIRMED` rather than a generic outage — read the PIN back before writing again. NOT rate-limited per card: throttling a partner’s ability to change a compromised PIN is the wrong failure to protect against.