REVEAL_VIRTUALCARD scope, plus PCI_COMPLIANCE on your application.
This mutation returns the raw PAN and CVV to your server, which brings your infrastructure into PCI scope.
PCI_COMPLIANCE is granted on request for applications operating on their own account; on accounts belonging to other people it requires a PCI DSS certification on file — see Due diligence.If you only need to show a user their own card, use Secure Elements Card Reveal instead. It renders the details in a Fluz-hosted frame inline in your page, needs no PCI_COMPLIANCE grant, and keeps your systems out of scope entirely.