Reveal a registration's credentials

Decrypt and return specific stored credentials for a registration. Name the fields to reveal in the request body; each must be one of username, password, pin, security_questions, jurisdictionSpecificFields. jurisdictionSpecificFields returns a map of the registration's decrypted jurisdiction secrets (for example California's CDTFA third-party access code or Idaho's TAP access code), gated to the registration's jurisdiction. A field you do not name, or one with nothing stored, comes back null, so the response never confirms which credentials exist beyond what you asked for.

This is a privileged, audited operation: only an owner of the organization (or an API key scoped to it) may call it. The response is never cached (Cache-Control: no-store). Returns 404 if the registration does not exist or belongs to an organization your credential cannot access, so the API never confirms an id exists; 403 if your credential may read the organization but is not permitted to reveal credentials.