Skip to content
ApiqDevelopers
API v1.64.0Open console
API referencepayments

Get card envelope key

GET/v1/payments/card-key
Accepts X-Api-Key · oauthClientCredentials · bearer

The public key a card is sealed to for payment.mode ENCRYPTED_CARD

The RSA public key, as a JWK, that POST /v1/orders payment.encryptedCard is sealed to (EncryptedCardEnvelope).Show moreThe RSA public key, as a JWK, that POST /v1/orders payment.encryptedCard is sealed to (EncryptedCardEnvelope). Public data, Cache-Control max-age=3600; after a rotation the previous kid still opens for 24 hours. Any authenticated caller, no extra scope. The channel switched off — every PROD deployment — answers 501 NOT_IMPLEMENTED details.reason CARD_PAYMENT_NOT_ENABLED.

Request body

This operation takes no request body.

Responses

  • 200The card-envelope public keyCardEnvelopeKey
  • 401
    UNAUTHENTICATED — missing or expired token.Show moreUNAUTHENTICATED — missing or expired token. Declared on every operation because `security` is declared globally at the document root: every route is authenticated, so every route can answer 401.
    ApiErrorResponse
  • 405
    VALIDATION — the public edge serves GET, POST, PUT, PATCH and DELETE only; any other method is refused before the platform sees it (details.reason METHOD_NOT_ALLOWED, details.source edge).Show moreVALIDATION — the public edge serves GET, POST, PUT, PATCH and DELETE only; any other method is refused before the platform sees it (details.reason METHOD_NOT_ALLOWED, details.source edge). Not retryable as sent.
    ApiErrorResponse
  • 414
    VALIDATION — the request URI (path and query string) is longer than 8 KiB; the public edge refuses it before the platform sees it (details.reason URI_TOO_LONG, details.source edge).Show moreVALIDATION — the request URI (path and query string) is longer than 8 KiB; the public edge refuses it before the platform sees it (details.reason URI_TOO_LONG, details.source edge). Not retryable as sent: send long input in the body of a POST.
    ApiErrorResponse
  • 501
    NOT_IMPLEMENTED — honest fallback; every production 501 is a capabilities-doc bug.Show moreNOT_IMPLEMENTED — honest fallback; every production 501 is a capabilities-doc bug. Also the order read routes (getOrder, listOrderDocuments, listOrderEvents, searchOrders) on a deployment with no order reader assembled; not retryable.
    ApiErrorResponse

Errors you should handle

Branch on code and honour retryable — never on the HTTP status alone.

401UNAUTHENTICATED
The bearer token is expired. Re-authenticate and retry.
not retryable
405VALIDATION
This method is not served.
not retryable
414VALIDATION
The request URI is longer than 8 KiB.
not retryable
501NOT_IMPLEMENTED
seatmap is NOT_APPLICABLE for HTL; GET /v1/capabilities says so
not retryable