curl --request POST \
--url https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/secure \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"confirmation": {
"method": "passkey",
"passkeySession": "pks_5e8a3c1d9b7f",
"assertion": "{\"id\":\"AQIDBAUGBwgJCgsMDQ4PEA\",\"response\":{\"clientDataJSON\":\"eyJ0eXBlIjoid2ViYXV0aG4uZ2V0In0\",\"authenticatorData\":\"SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2M\",\"signature\":\"MEUCIQ\"}}"
},
"cipher": "v1.7c1d8e4a.8f3b2a9d6e4c1f0b"
}
'{
"success": true,
"data": {
"cardId": "crd_9f2a1c4b",
"pan": "BASE64_ENCRYPTED_PAN==",
"cvc2": "BASE64_ENCRYPTED_CVV==",
"expiry": "12/29",
"printedName": "Ada Lovelace"
}
}{
"success": false,
"code": "VALIDATION_ERROR",
"message": "PIN must be between 4 and 6 digits"
}{
"success": false,
"code": "UNAUTHORIZED",
"message": "Unauthorized"
}{
"success": false,
"code": "CARD_NOT_FOUND",
"message": "Card not found"
}{
"success": false,
"code": "INVALID_CARD_STATE",
"message": "Card is already active"
}Get secure card details
Returns the full PAN, CVV, and expiry, encrypted with the secretKey from Get secure key. Needs a step-up: send a confirmation object (passkey, 2FA code, or PIN) along with the cipher from the secure key. For a passkey, first call secure passkey-challenge and complete it on the device.
curl --request POST \
--url https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/secure \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"confirmation": {
"method": "passkey",
"passkeySession": "pks_5e8a3c1d9b7f",
"assertion": "{\"id\":\"AQIDBAUGBwgJCgsMDQ4PEA\",\"response\":{\"clientDataJSON\":\"eyJ0eXBlIjoid2ViYXV0aG4uZ2V0In0\",\"authenticatorData\":\"SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2M\",\"signature\":\"MEUCIQ\"}}"
},
"cipher": "v1.7c1d8e4a.8f3b2a9d6e4c1f0b"
}
'{
"success": true,
"data": {
"cardId": "crd_9f2a1c4b",
"pan": "BASE64_ENCRYPTED_PAN==",
"cvc2": "BASE64_ENCRYPTED_CVV==",
"expiry": "12/29",
"printedName": "Ada Lovelace"
}
}{
"success": false,
"code": "VALIDATION_ERROR",
"message": "PIN must be between 4 and 6 digits"
}{
"success": false,
"code": "UNAUTHORIZED",
"message": "Unauthorized"
}{
"success": false,
"code": "CARD_NOT_FOUND",
"message": "Card not found"
}{
"success": false,
"code": "INVALID_CARD_STATE",
"message": "Card is already active"
}Authorizations
The user's id_token from authentication — the ID token, not the access_token. The program and environment come from the token.
Path Parameters
The customer's id.
The account the card belongs to. A customer can have several accounts; cards are issued against one.
The card id from create / get cards.
Body
Step-up confirmation. Set method to passkey, totp, or pin and include that method's fields. pin is a program capability — see Program capabilities.
- Passkey
- 2FA code
- PIN
Show child attributes
Show child attributes
The cipher from Get secure key.