Create member card reveal session
Mints a single-use, short-lived session that lets the member reveal their debit card number, expiry, and security code inside a provider-hosted iframe. Load embed_url as the iframe source; the card is never returned to the caller or to the hosting page. Sessions are consumed on reveal and rate limited per member and per organization. Returns 404 when the member or account is not visible to the caller, 409 when no card has been provisioned, and 429 when the provider rate limit is exceeded.
Authentication
API Key or Access Token authentication using Bearer token in Authorization header. API keys use the vit_apk_ prefix, access tokens use the vit_at_ prefix.
Path parameters
Unique member identifier (mbr_*)
Headers
Organization to act as for this request (e.g. org_SGVsbG8gV29ybGQ). Optional when your credentials reach a single organization. Required when they reach several — omitting it then returns 400 organization_required. A malformed value returns 400 invalid_organization_header, and naming an organization you do not have access to returns 403 organization_access_denied.
Response headers
Unix timestamp (seconds) when the rate limit window resets