API reference · Owned cards
Reveal a card
POST
/v1/wallets/{walletId}/cards/{soldCardId}/revealShows one bought card’s codes. Sends no body.
Permission
cards:revealAuthenticationSigned change
Staff-set limits it counts towardAll requests, Reveals
.NET SDK
anis.OwnedCards.RevealAsync(walletId, soldCardId)Parameters
| Name | In | Type | Notes |
|---|---|---|---|
walletIdrequired | path | UUID | A UUID, lower-case with hyphens. |
soldCardIdrequired | path | UUID | A UUID, lower-case with hyphens. |
Request
Signed with your key, with a one-time nonce and a digest of the body.
Headers: Signature-Input, Signature, Content-Digest, Nonce, X-Anis-Date, Accept-Language (optional). The SDKs set all of them for you.
Body: No body at all — not even {}. Any byte is refused with validation_failed. The signature still covers the digest of the empty body.
Responses
| Status | Meaning | Body |
|---|---|---|
| 200 | Success. | RevealedCredential |
| 401 | Refused: not authenticated. | Problem |
| 403 | Refused: not allowed. | Problem |
| 404 | Refused: not found, or not yours. | Problem |
| 409 | Refused: conflicts with the current state. | Problem |
| 422 | Refused: the request breaks a rule. | Problem |
| 429 | Refused: a limit was reached. | Problem |
| 503 | No decision: a dependency was unavailable. | Problem |
Every answer is signed by Anis; the SDKs check it before you see it.
Refusals
Every refusal is a signed problem. Branch on its code; each links to what it means and what to do.
| Error | Code | Status |
|---|---|---|
| Invalid credentials | invalid_credentials | 401 |
| Insufficient scope | insufficient_scope | 403 |
| Source address not allowed | source_ip_not_allowed | 403 |
| Rate limited | rate_limited | 429 |
| Replay detected | replay_detected | 409 |
| Account not authorised | binding_not_authorized | 403 |
| Account inactive | account_inactive | 403 |
| Wallet not granted | wallet_not_granted | 404 |
| Card not found | card_not_found | 404 |
| Validation failed | validation_failed | 422 |
| Reveal not allowed | reveal_not_allowed | 409 |
| Business subscription required | business_subscription_required | 409 |
| Wallet disabled | wallet_disabled | 409 |
| Wallet expired | wallet_expired | 409 |
| Service unavailable | dependency_unavailable | 503 |
| Request timeout | request_timeout | 504 |
| Internal error | internal_error | 500 |
Types
RevealedCredential
| Field | Type | Notes |
|---|---|---|
soldCardIdalways present | UUID | The sold card these codes belong to. |
serialNumber | string | The card’s serial number. A secret: store it where you keep secrets and never log it. |
voucher | string | The card’s voucher code. A secret: store it where you keep secrets and never log it. |
revealedAt | string (date-time) | When it was revealed. |