Direct server access
POST /api/v1/cards/{id}/reveal requires cards:read_sensitive. Ordinary card-list responses contain masked card numbers.
Full-detail responses use Cache-Control: no-store. Do not log or cache them or send them to analytics.
Hosted view
POST /api/v1/cards/{id}/view-sessions creates a card-specific, single-use hosted view URL. The current implementation returns expiresIn: 120 seconds.
Treat the returned URL as a temporary secret. It can be consumed once and expires if unused. The permission required is cards:read_sensitive.
Company-console sessions additionally require recent step-up authentication. API-key access uses the key’s explicit scope.