I have worked with APIs in the past that would only make masked account numbers or last 4 digits available.

Stripe is a great example - after the initial card is created, everything is tokenized, and they only allow you to pull the last 4 digits as an identifier.