Used to get a card when the cardId is known. This is the only API that can be used to get the PAN, CVV of a card and in order to do so, the API enforces that it must be called by the cardholder. Either a JWT issued to the customer can be used from the IP address that logged in, or a valid card access password should be passed with no JWT. A card access password can be created by a POST to a customers identities. This API must only be called from the customers device if masked=false is passed.