> ## Documentation Index
> Fetch the complete documentation index at: https://docs.jointransfer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Retrieve payment details

> Request protected checkout access for your assigned active card.

```http theme={"theme":{"light":"github-light","dark":"vesper"}}
GET /api/v1/cards/me/payment-details
```

```bash theme={"theme":{"light":"github-light","dark":"vesper"}}
curl "$TRANSFER_BASE_URL/api/v1/cards/me/payment-details" \
  -H "Authorization: Bearer $TRANSFER_AGENT_KEY"
```

The response is a `card_payment_details` resource in `data`, with the assigned card's ID. It contains no wallet identity or balance. Disabled Transfer access or a paused agent denies new sessions with `403 forbidden`.

## External card attributes

| Attribute | Meaning |
| - | - |
| `mode` | `external`. |
| `credentialType` | `browser_token`. |
| `number` | Short-lived Browser Token, not the raw bank card number. |
| `expiryMonth`, `expiryYear` | Card expiry. |
| `cvc` | `null`; external CVC is never collected or stored. |
| `proxy` | Required proxy server, username, and password. |
| `expiresAt` | Session expiry, at most five minutes after creation. |
| `allowedHosts` | `["*"]` for all destinations by default; older saved exact-host lists remain honored. |
| `requiresOwnerCvc` | `true`; owner CVC entry may be needed directly at the merchant. |
| `message` | Checkout requirements and limitations. |

The browser must use the returned proxy and trust the Evervault CA. Never use the returned number token as an ordinary card number outside that proxy. A client that cannot configure that browser environment cannot use this checkout flow. Bank authentication or 3D Secure can require the owner.

Checkout configuration and Browser Tokens preview approval are required. Securely linking a card does not require that approval; while it is pending, this endpoint returns `503 unavailable` without creating a provider session. Even after approval, configured settings alone do not verify merchant compatibility. Retrieving a session does not charge a card, confirm payment/settlement, or debit a Transfer wallet. Already-issued tokens can remain valid after Transfer access is disabled until they expire. Keep tokens and proxy credentials out of logs, analytics, repositories, and shared chats.

## Simulation details

A simulation card returns `credentialType: "dummy"`, `usableForCheckout: false`, an invalid `SIMULATION-ONLY-` number, expiry `00/0000`, and CVC `SIM`. These cannot be used at merchants. Transfer-issued cards and wallet funding are **coming soon**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.