View Card Details (Full Card Number + CVV)
Retrieves the full (unmasked) card number, CVV, and expiry date for a card. This is a sensitive operation that reveals complete card details.
Security Requirements
Depending on the product configuration, this API may require one or more of:
- OTP verification — Generate and validate OTP before calling this API
- Card action rule — Provide card expiry date for server-side validation
- PIN verification — Verify PIN before revealing card details
Service Codes
The serviceCode field identifies the card type:
226— Forex card620— GPR (General Purpose Reloadable) card000— Default / auto-detect
When to Use
- "View Card Details" feature in mobile/web app
- Tokenization flows that require full card number
- Card-on-file registration for e-commerce
⚠️ PCI-DSS Compliance
Partners must ensure that card details are displayed securely and never stored in logs or databases. Follow PCI-DSS guidelines for handling sensitive card data.
Authorization
bearerAuth tenantId JWT Bearer token from the Authentication API
In: header
Your unique tenant identifier assigned during onboarding
In: header
Header Parameters
Your unique tenant identifier
Request Body
application/json
Card identification with security validation
Phone number with country code
Card kit number
Entity identifier
Card expiry date in YYMM format (e.g., 2708 = August 2027)
Service code identifying card type:
226— Forex card620— GPR card000— Default/auto-detect
Security validation rules (must include expiry in MM/YY format)
OTP verification (if required by product configuration)
Response Body
application/json
application/json
application/json
curl -X POST "https://sandbox-api.m2pprepaid.com/prepaid/customer/v1/cards/card/detail" \ -H "X-TENANT-ID: ACME_CORP" \ -H "Content-Type: application/json" \ -d '{ "mobile": { "value": "9600106382", "countryCode": 91 }, "kitNo": "20004574", "entityId": "858471735620004574050925", "expiryDate": "2708", "serviceCode": "226", "rule": { "expiryDate": "08/27" } }'{
"result": {
"kitNo": "20004574",
"entityId": "858471735620004574050925",
"expiryDate": "2708",
"cardNumber": "4678132800001004",
"cvv": "001"
},
"pagination": null
}{
"type": "https://www.m2pfintech.com/problem/constraint-violation",
"title": "Method argument not valid",
"status": 400,
"message": "error.validation",
"fieldErrors": [
{
"field": "mobile",
"message": "Invalid contact",
"objectName": "changeCardPin"
}
]
}{
"type": "https://www.m2pfintech.com/problem/problem-with-message",
"title": "Invalid request for card action, missing required parameters :Card Expiry",
"status": 409,
"detail": "Invalid request for card action, missing required parameters :Card Expiry",
"message": "error.business",
"businessCode": "PPCUST_119"
}Validate Card PIN POST
Verifies whether the provided PIN is correct for the given card. This is a read-only check — it does not modify the PIN. ### When to Use - Pre-validate PIN before a sensitive operation (e.g., viewing card details) - Implement "confirm PIN" flows in your mobile/web app - PIN-based authentication for in-app transactions ### Important Notes - Returns `{ valid: true/false }` — never reveals the actual PIN - Uses the same `ChangeCardPinDto` as Set/Update PIN but only reads `oldPin` - No OTP required for validation
Fetch Approved Purpose of Travel List GET
Retrieves the last approved master list of travel purposes. These purpose codes are required when creating forex issuance or load requests. ### Common Purpose Codes | Code | Purpose | |------|---------| | `S0301` | Business Travel | | `S0304` | Medical Treatment | | `S0305` | Studies Abroad | | `PERSONAL_VISIT` | Personal Visit / Tourism | | `S0301_CONF` | Attending Conference | ### Server This endpoint is served by **pp-configs**, not pp-corporate. Use the configs base URL.
