> ## Documentation Index > Fetch the complete documentation index at: https://docs.apocor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Server-side encrypted PAN/CVV (PCI DSS Level 1) > **Method 2 — Server-side encrypted reveal.** PCI DSS Level 1 organizations only (`pciRevealEnabled` must be true). **Hybrid encryption (`RSA_OAEP_SHA256_AES_256_GCM`):** 1. Generate an RSA-2048+ key pair; keep the private key in your HSM/KMS. 2. Send the public key PEM in `encryption.public_key_pem`. 3. Apocor returns an envelope — never plaintext PAN/CVV. 4. Decrypt: RSA-OAEP (SHA-256) unwrap `encryptedKey` → AES-256-GCM decrypt `ciphertext` with `iv` + `authTag`. Decrypted JSON: `{ pan, cvv, expMonth, expYear, bin, lastFour, cardId }`. Full walkthrough + Node decrypt sample: https://docs.apocor.ai/guides/viewing-card-details Without PCI Level 1, use Method 1: `GET /v1/cards/{id}/secure-details` + Apocor Widget.js. ## OpenAPI ````yaml /openapi.json post /v1/cards/{id}/payment-details openapi: 3.1.0 info: title: Apocor Core API version: 1.0.0 description: >- The Apocor Cards API is the integration surface for issuing and managing cards. Authenticate with your Apocor API key, onboard applicants, run KYC, and issue virtual or physical cards — all through one white-labeled API. contact: name: Apocor Support url: https://apocor.ai servers: - url: https://sandbox.apocor.ai description: Sandbox (live) - url: https://api.apocor.ai description: Production - url: http://localhost:4000 description: Local development security: - bearerAuth: [] tags: - name: Authentication description: Exchange Apocor API keys for a short-lived access token. - name: Applicants description: End-users and businesses, plus their identity verification (KYC). - name: KYC description: >- Identity verification settings, hosted sessions, BYOK share tokens, direct document upload, and issuer readiness. x-group: Identity verification (KYC) - name: Accounts description: Funding accounts that back issued cards. - name: Programs description: Card programs that define product type, currency, and BIN. - name: Cardholders description: Approved applicants turned into cardholders. - name: Cards description: Issue and manage virtual and physical cards. - name: Transactions description: Card transaction history from the issuer or local ledger. - name: Widget SDK description: >- Public Apocor-branded proxy for Method 1 Widget.js (no auth). PAN/CVV still render in issuer PCI iframes. - name: Card funding description: >- Fund prepaid cards with stablecoins: Apocor wallet service or bring-your-own (BYO) external wallet. x-group: Card funding paths: /v1/cards/{id}/payment-details: post: tags: - Cards summary: Server-side encrypted PAN/CVV (PCI DSS Level 1) description: >- **Method 2 — Server-side encrypted reveal.** PCI DSS Level 1 organizations only (`pciRevealEnabled` must be true). **Hybrid encryption (`RSA_OAEP_SHA256_AES_256_GCM`):** 1. Generate an RSA-2048+ key pair; keep the private key in your HSM/KMS. 2. Send the public key PEM in `encryption.public_key_pem`. 3. Apocor returns an envelope — never plaintext PAN/CVV. 4. Decrypt: RSA-OAEP (SHA-256) unwrap `encryptedKey` → AES-256-GCM decrypt `ciphertext` with `iv` + `authTag`. Decrypted JSON: `{ pan, cvv, expMonth, expYear, bin, lastFour, cardId }`. Full walkthrough + Node decrypt sample: https://docs.apocor.ai/guides/viewing-card-details Without PCI Level 1, use Method 1: `GET /v1/cards/{id}/secure-details` + Apocor Widget.js. operationId: postCardsByIdPaymentDetails parameters: - $ref: '#/components/parameters/IdPath' requestBody: required: true content: application/json: schema: type: object required: - encryption properties: encryption: type: object required: - public_key_pem properties: public_key_pem: type: string description: >- RSA-2048+ SPKI public key PEM. Used once to wrap a random AES-256 key (RSA-OAEP SHA-256). example: encryption: public_key_pem: |- -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A... -----END PUBLIC KEY----- responses: '200': description: Encrypted payment details envelope (RSA-OAEP + AES-256-GCM). content: application/json: schema: type: object properties: data: type: object properties: algorithm: type: string example: RSA_OAEP_SHA256_AES_256_GCM encryptedKey: type: string description: Base64 RSA-OAEP (SHA-256) wrapped AES-256 key iv: type: string description: Base64 12-byte GCM IV authTag: type: string description: Base64 GCM auth tag ciphertext: type: string description: >- Base64 AES-GCM ciphertext of JSON { pan, cvv, expMonth, expYear, bin, lastFour, cardId } expiresIn: type: integer example: 120 example: data: algorithm: RSA_OAEP_SHA256_AES_256_GCM encryptedKey: base64... iv: base64... authTag: base64... ciphertext: base64... expiresIn: 120 '400': $ref: '#/components/responses/BadRequest' '403': description: >- Organization is not enabled for PCI server-side reveal (`pciRevealEnabled=false`). Use secure-details + Widget.js. '404': $ref: '#/components/responses/NotFound' components: parameters: IdPath: name: id in: path required: true schema: type: string description: Resource identifier. responses: BadRequest: description: The request was invalid. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: INVALID_REQUEST message: Applicant must be approved NotFound: description: Resource not found. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: NOT_FOUND message: Not found schemas: Error: type: object properties: error: type: object properties: code: type: string description: Stable, machine-readable error code. message: type: string description: Human-readable explanation. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Bearer access token obtained from `POST /v1/oauth/token` using your Apocor API key. ````