Reveal PIN

POST//

Reveals the personal identification number (PIN) of an existing card. The card must be in ACTIVE state, or in SUSPENDED state with a suspend reason that’s on the allow list configured for your program; PIN Reveal remains blocked for cards in any other state. Marqeta evaluates only the card’s most recent suspend reason. If a card is re-suspended with a different reason, the latest reason determines eligibility. Marqeta configures the allow list of suspend reasons eligible for PIN Reveal per program. To set up this allow list, contact your Marqeta representative. Be aware that while a cardholder can only set a four-digit PIN using the Marqeta Set PIN widget or PUT /pins API, you can or might see a four-, five-, or six-digit PIN in cases where your cardholders have set a new PIN at an automated teller machine.

Warning
Only use this endpoint to access a PIN in order to reveal it to its cardholder. Do not use this endpoint for the purpose of storing a PIN at any location.

Sending a request to this endpoint requires PCI DSS compliance. You must comply with PCI DSS data security requirements if you want to store, transmit, or process sensitive card data such as the cardholder’s primary account number (PAN), personal identification number (PIN), and card expiration date. If you want to update a card’s PIN instead, send a PUT request to the /pins endpoint. See Create or Update PIN on this page for details. Revealing a card’s PIN is a two-step process. You must first create a new control token for the card by sending a POST request to /pins/controltoken, and then use that token to reveal the PIN.

Request body

Fields	Description
cardholder_verification_method string Required	The supplemental method used to verify the cardholder’s identity before revealing the card’s personal identification number (PIN). The possible cardholder verification methods are: - BIOMETRIC_FACE: In-app authentication via facial recognition - BIOMETRIC_FINGERPRINT: In-app authentication via biometric fingerprint - EXP_CVV: In-app authentication by entering the card’s expiration date and card verification value (CVV) - LOGIN: In-app authentication by re-entering the app password - OTP: Two-factor authentication involving a one-time password (OTP) - OTP_CVV: Two-factor authentication involving the card’s CVV and an OTP - OTHER: Authentication that relies on other secure methods Allowable Values: `BIOMETRIC_FACE`, `BIOMETRIC_FINGERPRINT`, `LOGIN`, `EXP_CVV`, `OTP_CVV`, `OTP`, `OTHER`
control_token string Required	Unique value generated as a result of issuing a `POST` request to the `/pins/controltoken` endpoint. This value cannot be updated. Allowable Values: 1–36 chars

Sample request body

JSON

{
  "control_token": "b4647c9a-d4b8-4091-a5ff-dd67a7bb9ffc",
  "cardholder_verification_method": "BIOMETRIC_FINGERPRINT"
}

Sample response body

JSON

{ 
"pin": "string"
}

Getting Started

Testing

Card Issuing

Card Processing

Accounts & Money Movement

Risk, Fraud, and Disputes

Cardholder User Experience

Request body

Sample request body

Sample response body

​Request body

​Sample request body

​Sample response body

Request body

Sample request body

Sample response body