# Get card sensitive info

> Query sensitive card information from a secure server-side environment.

```yaml
openapi: 3.1.0
info:
  title: Get card sensitive info
  version: 1.0.0
  description: Query sensitive card information from a secure server-side environment.
paths:
  /api/v1/merchant/card/getSensitiveInfo:
    post:
      summary: Get card sensitive info
      description: Query sensitive card information from a secure server-side environment.
      parameters:
        - name: ApiKey
          in: header
          required: true
          description: Issuing API key request header assigned by Onerway.
          schema:
            type: string
            description: Issuing API key request header assigned by Onerway.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                cardId:
                  type: integer
                  description: Card ID.
              required:
                - cardId
            examples:
              default:
                summary: Get card sensitive info
                value:
                  cardId: 100001
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  respCode:
                    type: string
                    description: Business response code. `20000` means success.
                  respMsg:
                    type: string
                    description: Response message.
                  data:
                    type:
                      - object
                      - "null"
                    properties:
                      cardId:
                        type: integer
                        description: Card ID.
                      cardNumber:
                        type: string
                        description: Card number. Handle and store according to PCI DSS requirements.
                      cvv:
                        type: string
                        description: CVV security code. Handle according to PCI DSS requirements.
                      expiryTime:
                        type: string
                        description: Card expiry date in `MM/YY` format.
                    description: Sensitive card information.
                    x-onerway-value:
                      nullable: true
                      when:
                        en: Returned as `null` when the query fails or access is not available.
                        zh: 查询失败或无访问权限时返回 `null`。
              examples:
                success:
                  summary: Success
                  value:
                    respCode: "20000"
                    respMsg: success
                    data:
                      cardId: 100001
                      cardNumber: 411111******1111
                      cvv: "***"
                      expiryTime: 12/28
      x-onerway-lifecycle:
        phase: active
        access:
          description:
            en: Call this endpoint only from secure server-side environments with approved
              sensitive-data access.
            zh: 仅在已获准访问敏感卡数据的安全服务端环境中调用此接口。
```