Never send full card numbers

The API needs the first 6 to 11 digits of a card number only. Do not send more.

Why

• Full card numbers are sensitive data under PCI DSS.
• The API does not need them. The first 6 to 11 digits identify the issuer.

What the API does

• The API rejects a number value with more than 11 digits.
• In a batch response, the API shows a value with more than 11 digits as [REDACTED].

Recommendation

Cut the card number to the first 8 digits in your application before you send it.