> ## Documentation Index
> Fetch the complete documentation index at: https://www.marqeta.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Retrieve card by PAN

> Retrieves the usertoken and cardtoken for a primary account number (PAN).

POST/cards/getbypan

Retrieves the `user_token` and `card_token` for a primary account number (PAN). In the case of a reissued card, where multiple cards share the same PAN, the information for the most recently issued card is returned.

This request is useful in IVR scenarios where a user has telephoned and identifies the card by the PAN. The retrieval of these tokens is implemented as a `POST` request because supplying the PAN in the request body is more secure than supplying it in the URL (as would be required with a `GET`).

> [!CAUTION]
>
> **Warning**\
> Sending a request to this endpoint requires PCI DSS compliance. You must comply with PCI DSS data security requirements if you want to store, transmit, or process sensitive card data such as the cardholder's primary account number (PAN), personal identification number (PIN), and card expiration date.

## Request body

| Fields | Description |
| - | - |
| cvv\_number string  Optional | Three-digit card verification value (CVV2) included on the back of the card. This value cannot be updated. **Allowable Values:**  3 char max |
| expiration string  Optional | Card expiration date. **Allowable Values:**  Format: MMyy |
| pan string  Required | Primary account number (PAN) of the card whose information you want to retrieve. Send a `GET` request to `/cards/{token}/showpan` to retrieve the PAN for a specific card. **Allowable Values:**  16 char max |

## Sample request body

```json JSON lines wrap theme={null}
{
  "pan": "5454545454545454"
}
```

## Response body

| Fields | Description |
| - | - |
| card\_token string  Returned | Unique identifier of the card. **Allowable Values:**  Existing card token |
| created\_time datetime  Returned | Date and time when the resource was created, in UTC. **Allowable Values:**  datetime **Format:** yyyy-MM-ddThh:mm:ssZ |
| last\_modified\_time datetime  Returned | Date and time when the resource was last modified, in UTC. **Allowable Values:**  datetime **Format:** yyyy-MM-ddThh:mm:ssZ |
| user\_token string  Returned | Unique identifier of the cardholder. **Allowable Values:**  Existing user token |

## Sample response body

```json JSON lines wrap theme={null}
{
  "user_token": "my_user",
  "card_token": "my_card1",
  "created_time": "2022-02-26T20:03:15Z",
  "last_modified_time": "2022-02-26T20:05:20Z"
}
```


## Related topics

- [Cards Overview](https://www.marqeta.com/docs/core-api/cards.md)
- [Show card PAN](https://www.marqeta.com/docs/core-api/cards/show-pan.md)
- [Retrieve digital wallet token PAN](https://www.marqeta.com/docs/core-api/digital-wallets-management/digital-wallet-tokens-wallets/retrieve-token-pan.md)
- [Retrieve digital wallet token with PAN visible](https://www.marqeta.com/docs/core-api/tokenization-as-a-service/digital-wallet-tokens-taas/retrieve-digital-wallet-token-with-pan-visible.md)
- [Retrieve card](https://www.marqeta.com/docs/core-api/cards/retrieve-card.md)