Card
Get full card number, CVC and expiry
GET
Every call queries the card issuer; UPP does not store these details. The response has Cache-Control: no-store: do not cache or log it. Each view is recorded in the card's activity timeline (the view only, not the details).
- Only issued, non-terminated cards with no freeze, unfreeze or termination in progress can be viewed (any status except
pending_active,terminated,freezing,unfreezingandterminating). - Not every issuer supports this; gift cards that have no card number cannot be viewed.
- When the issuer returns an expiry that cannot be read (masked for terminated cards, for example),
exp_monthandexp_yearare null.
merchantApiKeymerchantTimestampmerchantNoncemerchantSignatureheader
X-API-KEY<token>Merchant API key (starts with upk_, also accepts api-key); signing headers are also required
header
X-Timestamp<token>Unix timestamp in seconds, within 300 seconds of server time
header
X-Nonce<token>Unique per request; cannot be reused with the same credential during the timestamp validity window
header
X-Signature<token>Hex HMAC-SHA256 signature (either letter case) of the method, full path, timestamp, nonce and body digest
cardId*stringFull card number, CVC and expiry
application/json- response
card_id*stringnumber*stringFull card number, digits only
cvc*|Card security code; null when the issuer does not return it
exp_month*|Range
1 <= value <= 12exp_year*|Four-digit year
curl -X GET 'https://sandbox.getupp.net/api/v1/cards/string/sensitive-details'Example Response
{ "card_id": "card_01m5nspbjc0ar8vsnxqc1e0wgp", "number": "4242420000001234", "cvc": "123", "exp_month": 10, "exp_year": 2029}