API reference · Cards & gift cards

Card secure sessions

POST/card/secure-session/redeemRedeem a secure session
POST/card/{reference}/pin-sessionOpen a session to set the card PIN
POST/card/{reference}/secure-sessionOpen a session to see the card number

POST Redeem a secure session

POST /card/secure-session/redeem

Called by the provider before it renders anything. Allowed exactly once and within three minutes; a replay is refused, so a leaked link shows nothing.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live
`x-api-key`
`x-bridge-signature`
`Content-Type`	application/json

Example

Request body: string · Response: GenericResponseCardSecureSessionRedeemResponse

curl -X POST "https://api.bridgemoni.com/card/secure-session/redeem" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV" \
  -H "Content-Type: application/json" \
  -d '"string"'

"string"

{
  "data": {
    "allowed": true,
    "cardReference": "b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e",
    "kind": "REVEAL",
    "purpose": "HOLDER_VIEW"
  },
  "description": "Allowed"
}

Responses

Status	When
`200`	Allowed
`409`	Already used, or expired
`401`	The signature, key or timestamp did not hold

POST Open a session to set the card PIN

POST /card/{reference}/pin-session

The PIN is typed into the provider's page and never reaches Bridge. Available on a physical card once the holder has confirmed receiving it.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live
`Content-Type`	application/json

Path parameters

Name
`reference`

Example

Request body: CreateCardSecureSessionRequest · Response: GenericResponseCardSecureSessionResponse

curl -X POST "https://api.bridgemoni.com/card/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/pin-session" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV" \
  -H "Content-Type: application/json" \
  -d '{
  "purpose": "HOLDER_VIEW",
  "returnUrl": "https://app.tenant.test/cards/b71e4c98"
}'

{
  "purpose": "HOLDER_VIEW",
  "returnUrl": "https://app.tenant.test/cards/b71e4c98"
}

{
  "data": {
    "sessionReference": "5a1f7d20-8e64-4c19-b3a7-91d2f0c48e63",
    "kind": "REVEAL",
    "status": "CREATED",
    "revealUrl": "https://secure.provider.test/reveal/5a1f7d20",
    "ephemeralToken": "string",
    "expiresAt": "2026-09-25T10:00:00Z",
    "singleUse": true
  },
  "description": "PIN session created"
}

Responses

Status	When
`200`	PIN session created
`409`	A PIN cannot be set on this card yet

POST Open a session to see the card number

POST /card/{reference}/secure-session

The only way a holder sees their full card number and security code, and Bridge never sees either: the provider renders them. Needs a fresh PIN confirmation, lasts three minutes, works once, and is rate limited per card. Shows only the caller's own card; staff use the operator reveal endpoint.

Headers

Name	Notes
`Authorization`	Bearer token
`X-Tenant`	Your tenant
`X-Environment`	test or live
`Content-Type`	application/json

Path parameters

Name
`reference`

Example

Request body: CreateCardSecureSessionRequest · Response: GenericResponseCardSecureSessionResponse

curl -X POST "https://api.bridgemoni.com/card/b3f1c2d4-5e6a-4b7c-8d9e-0f1a2b3c4d5e/secure-session" \
  -H "Authorization: Bearer $BRIDGEMONI_TOKEN" \
  -H "X-Tenant: $BRIDGEMONI_TENANT" \
  -H "X-Environment: $BRIDGEMONI_ENV" \
  -H "Content-Type: application/json" \
  -d '{
  "purpose": "HOLDER_VIEW",
  "returnUrl": "https://app.tenant.test/cards/b71e4c98"
}'

{
  "purpose": "HOLDER_VIEW",
  "returnUrl": "https://app.tenant.test/cards/b71e4c98"
}

{
  "data": {
    "sessionReference": "5a1f7d20-8e64-4c19-b3a7-91d2f0c48e63",
    "kind": "REVEAL",
    "status": "CREATED",
    "revealUrl": "https://secure.provider.test/reveal/5a1f7d20",
    "ephemeralToken": "string",
    "expiresAt": "2026-09-25T10:00:00Z",
    "singleUse": true
  },
  "description": "Secure session created"
}

Responses

Status	When
`200`	Secure session created
`403`	A fresh PIN confirmation is required, or an operator purpose was asked for here
`404`	No such card, or not the caller's
`409`	The card cannot show its details
`429`	Too many reveals on this card

Generated from the OpenAPI document. Branch on the HTTP status: there is no machine-readable error code on the wire. Errors