Pliant Card Sensitive Data API

openapi: 3.2.0
info:
  contact:
    name: API Support
    email: support@getpliant.com
    url: https://www.getpliant.com
  title: Pliant Customer Card Sensitive Data API
  description: Pliant Customer API
  version: 2.1.0
  license:
    name: MIT
    url: https://opensource.org/license/MIT
servers:
- url: https://partner-api.getpliant.com/api
  description: Pliant Production Server
- url: https://sandbox.partner-api.getpliant.com/api
  description: Pliant Sandbox Server
- url: https://pci-api.getpliant.com
  description: PCI Vault Production Server
- url: https://pci-sandbox.partner-api.getpliant.com
  description: PCI Vault Sandbox Server
security:
- bearerAuth: []
tags:
- name: Card Sensitive Data
  description: This tag is for operations related to card sensitive data
paths:
  /card-details/widget/{cardId}/otp:
    get:
      summary: Get OTP for PCI Widget
      description: 'This endpoint is used to get an OTP for the PCI Widget (Web and Mobile). The OTP is used to authenticate the cardholder request and to retrieve the sensitive card data.

        The request has to be made from the backend of your application. Directly calling this endpoint from your frontend is not allowed due to security reasons.


        **A dedicated host URL `pci-api.getpliant.com` is used for this endpoint!** Please refer to the documentation for more information.'
      tags:
      - Card Sensitive Data
      operationId: get-otp-for-pci-widget
      parameters:
      - name: cardId
        in: path
        required: true
        description: The Pliant card id (UUIDv4) of the card for which the OTP is requested.
        schema:
          type: string
          format: uuid
          maxLength: 36
          minLength: 36
      - name: Pliant-Trace-Id
        in: header
        required: true
        description: A random, unique trace id (UUIDv4) per request, generated by the partner. This id is used for logging and troubleshooting purposes throughout all systems. It has to be newly generated per request.
        schema:
          type: string
          format: uuid
          maxLength: 36
          minLength: 36
      responses:
        '200':
          description: Ok
          content:
            application/json:
              schema:
                type: string
                example: '12345678'
                description: The OTP for the PCI Widget
        '400':
          $ref: '#/paths/~1cards/get/responses/400'
        '401':
          $ref: '#/paths/~1cards/get/responses/401'
        '403':
          $ref: '#/paths/~1cards/get/responses/403'
        '404':
          $ref: '#/paths/~1cards/post/responses/404'
        '429':
          $ref: '#/paths/~1cards/get/responses/429'
        '500':
          $ref: '#/paths/~1cards/get/responses/500'
  /card-details/{cardId}:
    get:
      summary: Get PAN & CVV (PCI-DSS)
      description: 'This endpoint is only available for **PCI-DSS certified companies**. They can use this endpoint to retrieve the (encrypted) PAN and CVV of a card.


        **A dedicated host URL `pci-api.getpliant.com` is used for this endpoint!** Please refer to the documentation for more information.'
      tags:
      - Card Sensitive Data
      operationId: card-pan-and-cvv-pci-vault
      parameters:
      - name: cardId
        in: path
        required: true
        description: The Pliant card id (UUIDv4) of the card for which the PAN and CVV are requested.
        schema:
          type: string
          format: uuid
          maxLength: 36
          minLength: 36
      responses:
        '200':
          description: Ok
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    format: uuid
                    description: The Pliant internal ID of the card.
                  pan:
                    type: string
                    minLength: 16
                    maxLength: 16
                    description: The PAN (Primary Account Number) of the card, also known as the credit card number.
                  cvv:
                    type: string
                    minLength: 3
                    maxLength: 3
                    description: The CVV (Card Verification Value) of the card, also known as the card security code.
                  expiryMonth:
                    type: integer
                    description: The expiry month of the card.
                  expiryYear:
                    type: integer
                    description: The expiry year of the card.
        '400':
          $ref: '#/paths/~1cards/get/responses/400'
        '401':
          $ref: '#/paths/~1cards/get/responses/401'
        '403':
          $ref: '#/paths/~1cards/get/responses/403'
        '404':
          $ref: '#/paths/~1cards/post/responses/404'
        '429':
          $ref: '#/paths/~1cards/get/responses/429'
        '500':
          $ref: '#/paths/~1cards/get/responses/500'
  /cards/{cardId}/pin:
    get:
      summary: Get PIN
      description: Returns the 4-digit PIN of a **physical and active** credit card. If the card is neither physical nor active, the response will be a HTTP 400.
      tags:
      - Card Sensitive Data
      operationId: get-card-pin
      parameters:
      - name: cardId
        description: The Pliant card id (UUIDv4) of the card for which the PIN is requested.
        in: path
        required: true
        schema:
          type: string
          format: uuid
          maxLength: 36
          minLength: 36
      responses:
        '200':
          description: Ok
          content:
            application/json:
              schema:
                type: object
                properties:
                  pin:
                    type: string
                    description: The 4-digit PIN of the physical card.
                    minLength: 4
                    maxLength: 4
        '400':
          $ref: '#/paths/~1cards/get/responses/400'
        '401':
          $ref: '#/paths/~1cards/get/responses/401'
        '403':
          $ref: '#/paths/~1cards/get/responses/403'
        '404':
          $ref: '#/paths/~1cards/post/responses/404'
        '429':
          $ref: '#/paths/~1cards/get/responses/429'
        '500':
          $ref: '#/paths/~1cards/get/responses/500'
  /cards/{cardId}/tokenized-pan:
    post:
      summary: Get PAN & CVV (Proxy)
      description: Fetch a tokenized PAN from our partner PCI-Proxy to process and use in your non-PCI compliant environment. **This only works in combination with our partner PCI-Proxy**. You find more details in our guides section.
      tags:
      - Card Sensitive Data
      operationId: card-pan-tokenized-from-pci-proxy
      parameters:
      - name: cardId
        in: path
        required: true
        description: The Pliant `cardId` of the card for which the tokenized PAN should be generated. You can obtain the `cardId` from the [list card endpoint](/reference/getcards).
        schema:
          type: string
          format: uuid
          maxLength: 36
          minLength: 36
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - pciProxyApiKey
              - pciProxyMerchantId
              properties:
                pciProxyApiKey:
                  type: string
                  description: Your API key for using PCI-Proxy. You can find this in your PCI-Proxy dashboard.
                pciProxyMerchantId:
                  type: string
                  description: The merchant id from PCI-Proxy you want to use. You can find this in your PCI-Proxy dashboard.
      responses:
        '200':
          description: Ok
          content:
            application/json:
              schema:
                type: object
                properties:
                  cardId:
                    type: string
                    format: uuid
                    description: The Pliant `cardId` of the card for which the tokenized PAN is requested.
                  tokenizedPan:
                    type: string
                    description: The tokenized PAN, which can be used in your non-PCI compliant environment. This for now only works with our partner PCI-Proxy.
                  tokenizedCvv:
                    type: string
                    description: The tokenized CVV, which can be used in your non-PCI compliant environment. This for now only works with our partner PCI-Proxy.
        '400':
          $ref: '#/paths/~1cards/get/responses/400'
        '401':
          $ref: '#/paths/~1cards/get/responses/401'
        '403':
          $ref: '#/paths/~1cards/get/responses/403'
        '404':
          $ref: '#/paths/~1cards/post/responses/404'
        '429':
          $ref: '#/paths/~1cards/get/responses/429'
        '500':
          $ref: '#/paths/~1cards/get/responses/500'
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: This API uses oAuth2 with client credentials flow to [obtain the Bearer Token](/docs/authenticated-api-usage).
      bearerFormat: JWT
x-provenance:
  method: searched
  source: https://customer-api.getpliant.com/reference
  harvested: '2026-10-14'
  tool: harvest-readme-openapi.py
  note: Assembled verbatim from the OpenAPI definition ReadMe embeds in each operation page of the provider's developer portal; paths and components merged by API title, nothing authored.
  assembled_from:
  - https://customer-api.getpliant.com/reference/activate-physical-card.md
  - https://customer-api.getpliant.com/reference/assign-project-team.md
  - https://customer-api.getpliant.com/reference/assign-to-team.md
  - https://customer-api.getpliant.com/reference/bulk-upsert-subscriptions.md
  - https://customer-api.getpliant.com/reference/card-pan-and-cvv-pci-vault.md
  - https://customer-api.getpliant.com/reference/card-pan-tokenized-from-pci-proxy.md
  - https://customer-api.getpliant.com/reference/claim-card-as-copilot.md
  - https://customer-api.getpliant.com/reference/create-account-entry-subscription.md
  - https://customer-api.getpliant.com/reference/create-accounting-project-subscription.md
  - https://customer-api.getpliant.com/reference/create-accounting-team-subscription.md
  - https://customer-api.getpliant.com/reference/create-accounting-transaction-subscription.md
  - https://customer-api.getpliant.com/reference/create-card-account-subscription.md
  - https://customer-api.getpliant.com/reference/create-card-account-transfer.md
  - https://customer-api.getpliant.com/reference/create-card-account.md
  - https://customer-api.getpliant.com/reference/create-card-copilot-subscription.md
  - https://customer-api.getpliant.com/reference/create-card-subscription.md
  - https://customer-api.getpliant.com/reference/create-cardholder-subscription.md
  - https://customer-api.getpliant.com/reference/create-custom-field-option.md
  - https://customer-api.getpliant.com/reference/create-custom-field.md
  - https://customer-api.getpliant.com/reference/create-payment-subscription.md
  - https://customer-api.getpliant.com/reference/create-project.md
  - https://customer-api.getpliant.com/reference/create-receipt-automatching-subscription.md
  - https://customer-api.getpliant.com/reference/create-receipt-subscription.md
  - https://customer-api.getpliant.com/reference/create-statement-subscription.md
  - https://customer-api.getpliant.com/reference/create-team.md
  - https://customer-api.getpliant.com/reference/create-transaction-subscription.md
  - https://customer-api.getpliant.com/reference/deactivate-card-account.md
  - https://customer-api.getpliant.com/reference/deactivate-cardholder.md
  - https://customer-api.getpliant.com/reference/deactivate-team.md
  - https://customer-api.getpliant.com/reference/delete-custom-field-option.md
  - https://customer-api.getpliant.com/reference/delete-custom-field.md
  - https://customer-api.getpliant.com/reference/delete-project.md
  - https://customer-api.getpliant.com/reference/delete-receipt.md
  - https://customer-api.getpliant.com/reference/delete-subscription.md
  - https://customer-api.getpliant.com/reference/delete-team.md
  - https://customer-api.getpliant.com/reference/delete-transaction-comment.md
  - https://customer-api.getpliant.com/reference/generate-test-transactions-in-sandbox.md
  - https://customer-api.getpliant.com/reference/get-account-entries.md
  - https://customer-api.getpliant.com/reference/get-accounting-transactions-batch.md
  - https://customer-api.getpliant.com/reference/get-available-cards.md
  - https://customer-api.getpliant.com/reference/get-callback-details.md
  - https://customer-api.getpliant.com/reference/get-callback-log.md
  - https://customer-api.getpliant.com/reference/get-callback-subscriptions.md
  - https://customer-api.getpliant.com/reference/get-callback.md
  - https://customer-api.getpliant.com/reference/get-card-account-details.md
  - https://customer-api.getpliant.com/reference/get-card-accounts-available-currencies.md
  - https://customer-api.getpliant.com/reference/get-card-accounts.md
  - https://customer-api.getpliant.com/reference/get-card-controls-by-card.md
  - https://customer-api.getpliant.com/reference/get-card-pin.md
  - https://customer-api.getpliant.com/reference/get-cardholder-details.md
  - https://customer-api.getpliant.com/reference/get-cards.md
  - https://customer-api.getpliant.com/reference/get-custom-field-options.md
  - https://customer-api.getpliant.com/reference/get-custom-fields.md
  - https://customer-api.getpliant.com/reference/get-multiple-card-details.md
  - https://customer-api.getpliant.com/reference/get-organization-details.md
  - https://customer-api.getpliant.com/reference/get-otp-for-pci-widget.md
  - https://customer-api.getpliant.com/reference/get-payments-detail.md
  - https://customer-api.getpliant.com/reference/get-payments.md
  - https://customer-api.getpliant.com/reference/get-projects.md
  - https://customer-api.getpliant.com/reference/get-receipt-automatcher-status.md
  - https://customer-api.getpliant.com/reference/get-receipt-detail.md
  - https://customer-api.getpliant.com/reference/get-receipts.md
  - https://customer-api.getpliant.com/reference/get-single-card-details.md
  - https://customer-api.getpliant.com/reference/get-statement-csv.md
  - https://customer-api.getpliant.com/reference/get-statement-detail.md
  - https://customer-api.getpliant.com/reference/get-statementpdf.md
  - https://customer-api.getpliant.com/reference/get-statements.md
  - https://customer-api.getpliant.com/reference/get-teams.md
  - https://customer-api.getpliant.com/reference/get-transactions-detail-batch.md
  - https://customer-api.getpliant.com/reference/get-transactions-detail.md
  - https://customer-api.getpliant.com/reference/get-transactions.md
  - https://customer-api.getpliant.com/reference/invite-cardholders.md
  - https://customer-api.getpliant.com/reference/issue-card-instant-with-pci.md
  - https://customer-api.getpliant.com/reference/issue-card-instant.md
  - https://customer-api.getpliant.com/reference/issue-card.md
  - https://customer-api.getpliant.com/reference/list-cardholders.md
  - https://customer-api.getpliant.com/reference/list-organizations.md
  - https://customer-api.getpliant.com/reference/load-cards-batch.md
  - https://customer-api.getpliant.com/reference/lock-card.md
  - https://customer-api.getpliant.com/reference/metadata-receipt-to-automatcher.md
  - https://customer-api.getpliant.com/reference/receipt-as-merged-pdf.md
  - https://customer-api.getpliant.com/reference/receipt-as-pdf.md
  - https://customer-api.getpliant.com/reference/receipt-original.md
  - https://customer-api.getpliant.com/reference/receipt-thumbnail.md
  - https://customer-api.getpliant.com/reference/register-cardholders.md
  - https://customer-api.getpliant.com/reference/remove-account-entry-subscription.md
  - https://customer-api.getpliant.com/reference/remove-accounting-project-subscription.md
  - https://customer-api.getpliant.com/reference/remove-accounting-team-subscription.md
  - https://customer-api.getpliant.com/reference/remove-accounting-transaction-subscription.md
  - https://customer-api.getpliant.com/reference/remove-card-account-subscription.md
  - https://customer-api.getpliant.com/reference/remove-card-copilot-subscription.md
  - https://customer-api.getpliant.com/reference/remove-cardholder-subscription.md
  - https://customer-api.getpliant.com/reference/remove-cards-subscription.md
  - https://customer-api.getpliant.com/reference/remove-payment-subscription.md
  - https://customer-api.getpliant.com/reference/remove-receipt-automatching-subscription.md
  - https://customer-api.getpliant.com/reference/remove-receipt-subscription.md
  - https://customer-api.getpliant.com/reference/remove-statement-subscription.md
  - https://customer-api.getpliant.com/reference/remove-transaction-subscription.md
  - https://customer-api.getpliant.com/reference/replace-card.md
  - https://customer-api.getpliant.com/reference/resend-callbacks.md
  - https://customer-api.getpliant.com/reference/search-callbacks.md
  - https://customer-api.getpliant.com/reference/simulate-prefund-payment.md
  - https://customer-api.getpliant.com/reference/simulate-transaction-status-transition.md
  - https://customer-api.getpliant.com/reference/terminate-card.md
  - https://customer-api.getpliant.com/reference/unassign-from-team.md
  - https://customer-api.getpliant.com/reference/unassign-project-team.md
  - https://customer-api.getpliant.com/reference/unlock-card.md
  - https://customer-api.getpliant.com/reference/update-card-account.md
  - https://customer-api.getpliant.com/reference/update-card-controls-by-card.md
  - https://customer-api.getpliant.com/reference/update-card-copilots.md
  - https://customer-api.getpliant.com/reference/update-card-label.md
  - https://customer-api.getpliant.com/reference/update-card-limit.md
  - https://customer-api.getpliant.com/reference/update-card-validity-period.md
  - https://customer-api.getpliant.com/reference/update-card.md
  - https://customer-api.getpliant.com/reference/update-cardholders.md
  - https://customer-api.getpliant.com/reference/update-custom-field-option.md
  - https://customer-api.getpliant.com/reference/update-custom-field.md
  - https://customer-api.getpliant.com/reference/update-custom-fields-on-accounting-transaction.md
  - https://customer-api.getpliant.com/reference/update-custom-fields-on-card.md
  - https://customer-api.getpliant.com/reference/update-project.md
  - https://customer-api.getpliant.com/reference/update-team.md
  - https://customer-api.getpliant.com/reference/update-transaction-category.md
  - https://customer-api.getpliant.com/reference/update-transaction-comment.md
  - https://customer-api.getpliant.com/reference/update-transaction-partner-submission-status-batch.md
  - https://customer-api.getpliant.com/reference/update-transaction-partner-submission-status.md
  - https://customer-api.getpliant.com/reference/update-transaction-receipt-upload.md
  - https://customer-api.getpliant.com/reference/upload-receipt-to-automatcher.md
  - https://customer-api.getpliant.com/reference/upload-receipt.md
  merge:
    pages: 128
    deduped: 452
    conflicts_kept_first: 0