From 0dde11e2c9f8fdb7ad03b75bcd8520b02fc37e58 Mon Sep 17 00:00:00 2001 From: Aaryaman Bhute Date: Mon, 27 Jul 2026 22:48:59 +0000 Subject: [PATCH] docs(cards): document that card reveal requires the MANAGE permission Minting a reveal URL exposes the card's full PAN, CVV, and expiry, so it is gated on MANAGE; a VIEW-only token receives a 403. The endpoint's 403 response previously documented only the unattributable-session case. --- mintlify/openapi.yaml | 4 +++- openapi.yaml | 4 +++- openapi/paths/cards/cards_{id}_reveal.yaml | 9 +++++++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/mintlify/openapi.yaml b/mintlify/openapi.yaml index 501f49403..9e355e0d8 100644 --- a/mintlify/openapi.yaml +++ b/mintlify/openapi.yaml @@ -8350,6 +8350,8 @@ paths: Request the reveal right before rendering the iframe and render the returned `panEmbedUrl` immediately; it expires at `expiresAt` (within minutes). Never store, cache, or log the URL — it is a bearer secret for the full card details. The card data renders inside the processor's iframe and never crosses Grid's or your servers. + Requires a token with the `MANAGE` permission; `VIEW` alone is not sufficient to mint a reveal URL. + Every reveal is audit-logged with the requesting actor. operationId: revealCard tags: @@ -8370,7 +8372,7 @@ paths: schema: $ref: '#/components/schemas/Error401' '403': - description: Forbidden. The session has no attributable actor to audit the reveal against (for example, an impersonated dashboard session). + description: Forbidden. The token lacks the `MANAGE` permission, or the session has no attributable actor to audit the reveal against (for example, an impersonated dashboard session). content: application/json: schema: diff --git a/openapi.yaml b/openapi.yaml index 501f49403..9e355e0d8 100644 --- a/openapi.yaml +++ b/openapi.yaml @@ -8350,6 +8350,8 @@ paths: Request the reveal right before rendering the iframe and render the returned `panEmbedUrl` immediately; it expires at `expiresAt` (within minutes). Never store, cache, or log the URL — it is a bearer secret for the full card details. The card data renders inside the processor's iframe and never crosses Grid's or your servers. + Requires a token with the `MANAGE` permission; `VIEW` alone is not sufficient to mint a reveal URL. + Every reveal is audit-logged with the requesting actor. operationId: revealCard tags: @@ -8370,7 +8372,7 @@ paths: schema: $ref: '#/components/schemas/Error401' '403': - description: Forbidden. The session has no attributable actor to audit the reveal against (for example, an impersonated dashboard session). + description: Forbidden. The token lacks the `MANAGE` permission, or the session has no attributable actor to audit the reveal against (for example, an impersonated dashboard session). content: application/json: schema: diff --git a/openapi/paths/cards/cards_{id}_reveal.yaml b/openapi/paths/cards/cards_{id}_reveal.yaml index b5d8c33f1..8f1872a3c 100644 --- a/openapi/paths/cards/cards_{id}_reveal.yaml +++ b/openapi/paths/cards/cards_{id}_reveal.yaml @@ -21,6 +21,10 @@ post: iframe and never crosses Grid's or your servers. + Requires a token with the `MANAGE` permission; `VIEW` alone is not + sufficient to mint a reveal URL. + + Every reveal is audit-logged with the requesting actor. operationId: revealCard tags: @@ -42,8 +46,9 @@ post: $ref: ../../components/schemas/errors/Error401.yaml '403': description: >- - Forbidden. The session has no attributable actor to audit the reveal - against (for example, an impersonated dashboard session). + Forbidden. The token lacks the `MANAGE` permission, or the session has + no attributable actor to audit the reveal against (for example, an + impersonated dashboard session). content: application/json: schema: