# Get card metadata

`POST /card-metadata`

API version: `v2026.07.00`. Send `X-Moov-Version: v2026.07.00` to get the behavior described here.

> AI agents: search and read all Moov docs with the docs MCP server at https://docs.moov.io/mcp (no API key). Setup: https://docs.moov.io/guides/developer-tools/mcp-ai/docs-mcp/index.md

Look up metadata for a card without linking it to a Moov account.
  
Only use this endpoint if you have provided Moov with a copy of your PCI attestation of compliance.

To access this endpoint using an [access token](https://docs.moov.io/api/authentication/access-tokens/) 
you'll need to specify the `/card-metadata.read` scope.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Moov-Version` | header | string |  | Set this header to v2026.07.00 to use the API described in this specification. When omitted, the server defaults to v2024.01.00, the earliest supported version, which may not match the behavior documented here. An unrecognized well-formed version uses the latest supported version that is not newer than the requested version, when one exists. For example, `v2026.08.00` uses `v2026.07.00`. A malformed value, such as `2022`, returns a `404` response. Values: `v2026.07.00`. |

## Request body

Content type: `application/json`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `e2ee` | object |  | Wraps a compact-serialized JSON Web Encryption (JWE) token used for secure transmission of sensitive data (e.g., PCI information) through intermediaries. This token is encrypted using the public key from /end-to-end-keys and wraps an AES key. For details and examples, refer to our [GitHub repository](https://github.com/moovfinancial/moov-go/blob/main/examples/e2ee/e2ee_test.go). |
| `e2ee.token` | string (jwe) | Yes | An [RFC](https://datatracker.ietf.org/doc/html/rfc7516) compact-serialized JSON Web Encryption (JWE) token. |
| `cardNumber` | string |  | The full card number (PAN). |

Example:

```json
{
  "cardNumber": "4111111111111111"
}
```

## Response 200

The request completed successfully.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `bin` | string | Yes | The first six to eight digits of the card number, which identifies the financial institution that issued the card. |
| `brand` | string | Yes | The card brand. Values: `American Express`, `Discover`, `Mastercard`, `Visa`, `Unknown`. |
| `cardCategory` | string |  | The category or level of the card defined by the issuer. Examples include, but not limited to, "REWARDS", "TRADITIONAL REWARDS", "CLASSIC", and "CORPORATE PURCHASING". |
| `cardType` | string | Yes | The type of the card. Values: `debit`, `credit`, `prepaid`, `unknown`. |
| `commercial` | boolean |  | If true, the card is for commercial use, or associated with a business. If false, the card is associated with a general consumer. |
| `regulated` | boolean |  | If true, the card issuing bank is regulated, and the scheme fees for debit transactions will be limited based on the Durbin Amendment. If false, the card issuing bank is not regulated, and the scheme fees will not be limited. |
| `issuer` | string |  | Financial institution that issued the card. |
| `issuerCountry` | string |  | Country where the card was issued. |
| `issuerPhone` | string |  | Phone number of the issuer. |
| `issuerURL` | string (uri) |  | URL of the issuer. |
| `domesticPullFromCard` | string |  | Indicates if the card supports domestic pull-from-card transfer. Values: `not-supported`, `supported`, `unknown`. |
| `domesticPushToCard` | string |  | Indicates which level of domestic push-to-card transfer is supported by the card, if any. Values: `not-supported`, `standard`, `fast-funds`, `unknown`. |

## Errors

| Status | Meaning |
| --- | --- |
| 400 | The server could not understand the request due to invalid syntax. |
| 401 | The request contained missing or expired authentication. |
| 403 | The user is not authorized to make the request. |
| 404 | The requested resource was not found. |
| 409 | The request conflicted with the current state of the target resource. |
| 422 | The request was well-formed, but the contents failed validation. Check the request for missing or invalid fields. |
| 429 | Request was refused due to rate limiting. |
| 500 | The request failed due to an unexpected error. |
| 504 | The request failed because a downstream service failed to respond. |

## Examples

### cURL

```bash
curl -X POST "https://api.moov.io/card-metadata" \
  -H "Authorization: Bearer {token}" \
  -H "X-Moov-Version: v2026.07.00" \
  -d '{
  "cardNumber": "4111111111111111"
}'
```

### Typescript (SDK)

```typescript
import { Moov } from "@moovio/sdk";

const moov = new Moov({
  security: {
    username: "",
    password: "",
  },
});

async function run() {
  const result = await moov.cards.getMetadata({
    cardNumber: "4111111111111111",
  });

  console.log(result);
}

run();
```

Full reference with SDK examples in every language: https://docs.moov.io/api/sources/cards/metadata/