Create member card reveal session

Mints a single-use, short-lived session that lets the member reveal their debit card number, expiry, and security code inside a provider-hosted iframe. Load embed_url as the iframe source; the card is never returned to the caller or to the hosting page. Sessions are consumed on reveal and rate limited per member and per organization. Returns 404 when the member or account is not visible to the caller, 409 when no card has been provisioned, and 429 when the provider rate limit is exceeded.

Mints a single-use, short-lived session that lets the member reveal their debit card number, expiry, and security code inside a provider-hosted iframe. Load `embed_url` as the iframe source; the card is never returned to the caller or to the hosting page. Sessions are consumed on reveal and rate limited per member and per organization. Returns 404 when the member or account is not visible to the caller, 409 when no card has been provisioned, and 429 when the provider rate limit is exceeded.

Authentication

AuthorizationBearer

API Key or Access Token authentication using Bearer token in Authorization header. API keys use the vit_apk_ prefix, access tokens use the vit_at_ prefix.

Path parameters

member_idstringRequired

Unique member identifier (mbr_*)

payment_account_idstringRequired

Headers

X-Vitable-OrganizationstringOptional

Organization to act as for this request (e.g. org_SGVsbG8gV29ybGQ). Optional when your credentials reach a single organization. Required when they reach several — omitting it then returns 400 organization_required. A malformed value returns 400 invalid_organization_header, and naming an organization you do not have access to returns 403 organization_access_denied.

Organization to act as for this request (e.g. `org_SGVsbG8gV29ybGQ`). Optional when your credentials reach a single organization. Required when they reach several — omitting it then returns 400 `organization_required`. A malformed value returns 400 `invalid_organization_header`, and naming an organization you do not have access to returns 403 `organization_access_denied`.

Response headers

X-RateLimit-Limitinteger

Maximum number of requests allowed within the rate limit window

X-RateLimit-Remaininginteger

Number of requests remaining in the current rate limit window

X-RateLimit-Resetinteger

Unix timestamp (seconds) when the rate limit window resets

Response

dataobject

Errors

400

Bad Request Error

401

Unauthorized Error

403

Forbidden Error

404

Not Found Error

409

Conflict Error

429

Too Many Requests Error

500

Internal Server Error

502

Bad Gateway Error