---
title: Get Cards
description: Fetch saved tokenized cards for a buyer.
---

## Get Saved Cards

Retrieve tokenized cards saved for a buyer by phone number. This endpoint returns the buyer's stored card list with masked card data.

## POST

```http
https://kraken.airpay.co.in/airpay/pay/v4/api/getcards
```

## Request Body

| Parameter         | Required | Type / Size         | Description                                                                         | Example              |
| ----------------- | -------- | ------------------- | ----------------------------------------------------------------------------------- | -------------------- |
| `buyer_phone`     | Yes      | Numeric (8-15)      | Buyer phone number used to look up saved cards.                                     | `99999999`           |
| `card_uniquecode` | No       | Alphanumeric (3-64) | Unique tokenized card identifier. Use to select a specific stored card for payment. | `abc123def456ghi789` |

## Success 200

```json
{
  "status_code": "200",
  "response_code": "00",
  "status": "success",
  "message": "success",
  "data": [
    {
      "card_uniquecode": "abc123def456ghi789",
      "card_number": "************1234",
      "card_owner": "John Doe",
      "card_type": "Credit",
      "card_company": "visa",
      "card_last4": "1234"
    }
  ]
}
```

## Response Fields

| Field             | Type   | Description                                         |
| ----------------- | ------ | --------------------------------------------------- |
| `status_code`     | String | HTTP status code returned by the API.               |
| `response_code`   | String | Internal response code indicating success or error. |
| `status`          | String | Status text, usually `success` or `failure`.        |
| `message`         | String | Additional status message.                          |
| `data`            | Array  | List of saved card objects.                         |
| `card_uniquecode` | String | Tokenized identifier for the saved card.            |
| `card_number`     | String | Masked card number.                                 |
| `card_owner`      | String | Cardholder name.                                    |
| `card_type`       | String | Card type, such as `Credit` or `Debit`.             |
| `card_company`    | String | Card network, such as `visa` or `mastercard`.       |
| `card_last4`      | String | Last 4 digits of the card number.                   |

## PHP

```php
<?php

$mercid = "<merchant_id>";
$username = "<username>";
$password = "<password>";
$secret = "<secret>";
$client_id = "<client_id>";
$client_secret = "<client_secret>";

$privatekey = hash('SHA256', $secret . '@' . $username . ":|:" . $password);
$request = array();

$data = [];
$data['buyer_phone'] = '99999999';

$tokenUrl = "https://kraken.airpay.co.in/airpay/pay/v4/api/oauth2";
$request['client_id'] = $client_id;
$request['client_secret'] = $client_secret;
$request['grant_type'] = 'client_credentials';
$request['merchant_id'] = $mercid;

$secretKey = md5($username . "~:~" . $password);
$encre = aes256encrypt(json_encode($request), 'aes-256-cbc', $username, $password);
$req = [
    'merchant_id' => $mercid,
    'encdata' => $encre,
    'checksum' => checksumcal($request)
];

$access_token = sendPostData($tokenUrl, $req);
$decryptData = decrypt(json_decode($access_token, true), $secretKey);
$tokenResponse = json_decode($decryptData, true);

if ((isset($tokenResponse['success']) && !$tokenResponse['success']) || empty($access_token) || empty(trim($access_token))) {
    echo $tokenResponse['msg'];
    exit;
}

$accessToken = $tokenResponse['data']['access_token'];

$checksumReq = checksumcal($data);
$dataJson = json_encode($data);
$request_data = [
    'encdata' => aes256encrypt($dataJson, 'aes-256-cbc', $username, $password),
    'merchant_id' => $mercid,
    'privatekey' => $privatekey,
    'checksum' => $checksumReq
];

$response = sendPostData('https://kraken.airpay.co.in/airpay/pay/v4/api/getcards?token=' . $accessToken, $request_data, 'POST');
$responseArr = json_decode($response, true);
$encdata = $responseArr['response'];

$iv = substr($encdata, 0, 16);
$encdata = substr($encdata, 16);
$decrypted_data = openssl_decrypt(base64_decode($encdata), 'aes-256-cbc', $secretKey, $options = OPENSSL_RAW_DATA, $iv);
print_r($decrypted_data);

function aes256encrypt($data, $cipher = 'aes-256-cbc', $username, $password)
{
    $key = md5($username . "~:~" . $password);
    $iv = bin2hex(openssl_random_pseudo_bytes(8));
    $encrypted = openssl_encrypt($data, $cipher, $key, $options = OPENSSL_RAW_DATA, $iv);
    $encryptedData = base64_encode($encrypted);
    return $iv . $encryptedData;
}

function sendPostData($tokenUrl, $postData)
{
    $ch = curl_init($tokenUrl);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($postData));
    $response = curl_exec($ch);
    curl_close($ch);
    return $response;
}

function checksumcal($postData)
{
    ksort($postData);
    $data = '';
    foreach ($postData as $key => $value) {
        $data .= $value;
    }
    $data = $data . date('Y-m-d');
    $checksum = hash('SHA256', $data);
    return $checksum;
}

function decrypt($requestData, $secretKey)
{
    $data = $requestData['response'];
    $iv = substr($data, 0, 16);
    $encryptedData = substr($data, 16);
    $raw = openssl_decrypt(base64_decode($encryptedData), 'AES-256-CBC', $secretKey, OPENSSL_RAW_DATA, $iv);
    return $raw;
}
?>
```