Reveal VCN card data

Use the Sandbox to prepare your integration and validate authentication and the contract.

Returns the PAN, CVV and expiration of an issued VCN. Issuance delivers this data only once; use this route to get it again. The vcnId must belong to the authenticated client.

Security

The response carries PAN and CVV in clear text and comes with Cache-Control: no-store. Keep the data in memory only, do not log or cache it, and prefer showing it once in your interface.

Errors

400 bad-request-exception — invalid vcnId in the path (field path.vcnId).
400 bad-request-exception — missing or malformed X-Partner-Id (field headers.x-partner-id). See Platform identification.
403 caller-not-authorized — the X-Partner-Id partner is not bound to your credential (details.reason PARTNER_NOT_BOUND), or the credential lacks the route scope (details.requiredScope). See Platform identification.
404 vcn-not-found — the VCN does not exist, belongs to another company or was replaced by a reissuance. Right after issuance, retry before concluding.
409 vcn-cancelled — the VCN was cancelled; do not retry. Its state shows up in Get VCN. A blocked one, or one whose window has ended, is still revealed.
500 internal-exception — internal error, including a transient provider failure: this route has no 503. Retrying is safe.

Rules

Retrying calls · Evaluation order

curl -X GET "https://api-sandbox.contasimples.com/credit-cards/v1/vcns/01JQ8ZK7X4M8N2P5R6T7V8W9XY/reveal" \
  -H "Content-Type: application/json" \
  -H "X-Partner-Id: ptn_01JQ8ZK7X4M8N2P5R6T7V8W9XY" \
  -H "Signature-Input: example_string" \
  -H "Signature: example_string" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

import requests
import json

url = "https://api-sandbox.contasimples.com/credit-cards/v1/vcns/01JQ8ZK7X4M8N2P5R6T7V8W9XY/reveal"
headers = {
  "Content-Type": "application/json",
  "X-Partner-Id": "ptn_01JQ8ZK7X4M8N2P5R6T7V8W9XY",
  "Signature-Input": "example_string",
  "Signature": "example_string",
  "Authorization": "Bearer YOUR_API_TOKEN"
}

response = requests.get(url, headers=headers)
print(response.json())

const response = await fetch("https://api-sandbox.contasimples.com/credit-cards/v1/vcns/01JQ8ZK7X4M8N2P5R6T7V8W9XY/reveal", {
  method: "GET",
  headers: {
  "Content-Type": "application/json",
  "X-Partner-Id": "ptn_01JQ8ZK7X4M8N2P5R6T7V8W9XY",
  "Signature-Input": "example_string",
  "Signature": "example_string",
  "Authorization": "Bearer YOUR_API_TOKEN"
}
});

const data = await response.json();
console.log(data);

package main

import (
    "fmt"
    "net/http"
)

func main() {

    req, err := http.NewRequest("GET", "https://api-sandbox.contasimples.com/credit-cards/v1/vcns/01JQ8ZK7X4M8N2P5R6T7V8W9XY/reveal", nil)
    if err != nil {
        panic(err)
    }

    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("X-Partner-Id", "ptn_01JQ8ZK7X4M8N2P5R6T7V8W9XY")
    req.Header.Set("Signature-Input", "example_string")
    req.Header.Set("Signature", "example_string")
    req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    fmt.Println("Response Status:", resp.Status)
}

require 'net/http'
require 'json'

uri = URI('https://api-sandbox.contasimples.com/credit-cards/v1/vcns/01JQ8ZK7X4M8N2P5R6T7V8W9XY/reveal')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

request = Net::HTTP::Get.new(uri)
request['Content-Type'] = 'application/json'
request['X-Partner-Id'] = 'ptn_01JQ8ZK7X4M8N2P5R6T7V8W9XY'
request['Signature-Input'] = 'example_string'
request['Signature'] = 'example_string'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'

response = http.request(request)
puts response.body

{
  "pan": "4111111111111111",
  "cvv": "123",
  "expirationDate": "06/2031"
}

{
  "code": "bad-request-exception",
  "message": "Event failed validation",
  "errors": [
    {
      "field": "headers.x-partner-id",
      "message": "x-partner-id must be a valid partner identifier"
    }
  ]
}

{
  "code": "unauthorized",
  "message": "Authentication failed. Check the API token and the request signature",
  "details": {
    "reason": "SIGNATURE_REQUIRED"
  },
  "requestId": "123e4567-e89b-12d3-a456-426614174000"
}

{
  "code": "unauthorized",
  "message": "Authentication failed. Check the API token and the request signature",
  "details": {
    "reason": "INVALID_SIGNATURE"
  },
  "requestId": "123e4567-e89b-12d3-a456-426614174000"
}

{
  "code": "caller-not-authorized",
  "message": "The request is not allowed for the current credentials",
  "details": {
    "requiredScope": "getVcnCard"
  },
  "requestId": "123e4567-e89b-12d3-a456-426614174000"
}

{
  "code": "caller-not-authorized",
  "message": "The request is not allowed for the current credentials",
  "details": {
    "reason": "PARTNER_NOT_BOUND"
  },
  "requestId": "123e4567-e89b-12d3-a456-426614174000"
}

GET

/credit-cards/v1/vcns/{vcnId}/reveal

GET

Base URLstring

Target server for requests. Edit to use your own host.

Bearer Token

Bearer Tokenstring

Required

Bearer token from OAuth 2.0 client credentials. Format: Bearer TOKEN

path

vcnIdstring

Required

VCN identifier returned at issuance (vcnId field).

header

X-Partner-Idstring

Required

Identifier of the integrator platform (partner) the call is made through: ptn_ followed by a 26-character ULID. Conta Simples generates it and hands it to you at onboarding. See Platform identification.

Pattern: ^ptn_[0-9A-HJKMNP-TV-Z]{26}$

header

Signature-Inputstring

What was signed and the signature parameters, in the RFC 9421 format. A credential with a public key must send it on every call, reads included, or the request is refused with 401. The signature covers the @method, @path, and @query components, and also content-digest when there is a body. created and alg are required, and created is valid for 300 seconds. The full format, with examples, is in Request Signing.

header

Signaturestring

The signature of the base defined by RFC 9421, in base64, between : and under the same label used in Signature-Input, for example sig=:SGVsbG8gd29ybGQ=:. It always goes together with Signature-Input.