> ## Documentation Index > Fetch the complete documentation index at: https://docs.agentcard.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a reveal session > Open Agentcard's card page for your user, so the card's number reaches only their browser. Show your user their card's number, expiry and CVC without your server ever holding them. Create a session when your user asks, then open `url` in their browser, in a frame or a new window. Each session shows the card once and expires after five minutes. [Show your user their card](https://docs.agentcard.com/issuing/using-the-cards.md#show-your-user-their-card) walks through it. ## OpenAPI ````yaml openapi.json POST /api/v2/cards/{card_id}/reveal_sessions openapi: 3.1.0 info: title: Agentcard API version: 2.0.0 description: >- The Agentcard v2 API — connect your users and verify their identity from your own backend. Every call is authenticated with a platform access token minted from your `client_id` + `client_secret`. servers: - url: https://api.agentcard.sh description: >- There is one base URL. Sandbox vs production is decided by the client credential you use, never by the host. security: - platformToken: [] tags: - name: Authentication description: >- Exchange your client credentials for a platform access token, and introspect what a token acts as. - name: Connect description: >- Connect a user to your platform: send a one-time code, verify it, record consent, and keep the connection alive. - name: Identity verification description: >- Verify a connected user's identity: upload their ID, submit any extra fields we ask for, then show a short face scan. paths: /api/v2/cards/{card_id}/reveal_sessions: post: tags: - Cards summary: Create a reveal session description: >- A one-look link to Agentcard's card page for one card, for the user who asked to see it. Open `url` in their browser, in a frame or a new window: the number, expiry and CVC reach only that browser. To frame the page, register your site with `PUT /api/v2/embed_origins`. operationId: createCardRevealSession parameters: - name: card_id in: path required: true schema: type: string requestBody: required: false content: application/json: schema: type: object properties: expires_in: type: integer minimum: 60 maximum: 900 default: 300 description: >- Seconds the link works. The session shows the card once within that window. responses: '201': description: The session. content: application/json: schema: $ref: '#/components/schemas/CardRevealSession' '400': description: '`invalid_request`: `expires_in` is outside 60 to 900 seconds.' content: application/json: schema: $ref: '#/components/schemas/Error' '401': $ref: '#/components/responses/Unauthorized' '403': description: >- `credentials_protected`: the user approves each read. `policy_denied`: a card rule refuses a reveal now. content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: >- `card_not_found`: no such card on your company, in this credential's mode. content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: >- `not_issued`: the card was made from a card the user added; its number is the one on their own card. content: application/json: schema: $ref: '#/components/schemas/Error' '410': description: >- `card_closed`: a closed card has no details to show. Issue a new one. content: application/json: schema: $ref: '#/components/schemas/Error' security: - platformToken: [] components: schemas: CardRevealSession: type: object properties: object: type: string enum: - card_reveal_session id: type: string example: crs_9c590edd43234d1ce1f4c22f card_id: type: string example: card_542fdd3856629b3cc74019cc url: type: string format: uri description: >- Agentcard's card page for this session. Open it in your user's browser. example: >- https://reveal.agentcard.sh/r/crs_9c590edd43234d1ce1f4c22f.5d3guB0evMZaTFHkHovUlVwF9kHWfW0wuJPfRzea26c expires_at: type: string format: date-time test_mode: type: boolean description: True for a test card. The page says so. required: - object - id - card_id - url - expires_at - test_mode Error: type: object description: Every v2 error uses the same envelope. properties: error: type: object properties: code: type: string description: A stable, machine-readable string (snake_case). Branch on this. message: type: string description: A human-readable explanation, safe to log. docs: type: string description: A link back to the reference. field_errors: type: object additionalProperties: type: string description: Only on `invalid_fields` — names each field to fix. warnings: type: array items: type: string description: >- Only on document upload errors — actionable feedback safe to show the user. status: type: string description: >- Only on `verification_terminally_rejected` — the user's current verification status, which this call did not change. reason: type: string description: >- The detail behind the failure, on the errors that carry one: on `verification_terminally_rejected` an end-user-safe explanation of the rejection, when the review left one; on `invalid_code` and `invalid_return_url` which part of the input was refused. reason_code: type: string description: >- Only on `verification_terminally_rejected`, and only when the rejection maps to a known class — most final rejections carry no code. responses: Unauthorized: description: >- `unauthorized` — the platform access token is missing or expired. Exchange your client credentials for a fresh one. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: platformToken: type: http scheme: bearer description: >- A platform access token. Get one on the **Create an access token** endpoint by exchanging your `client_id` + `client_secret`, then send it as `Authorization: Bearer `. Tokens live one hour. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.