Looking at the getCustomerProfileResponse XML, cardNumber and expirationDate are completely masked. In order to 1.) help our customers with multiple credits cards on file identify which they want to use, and 2.) send email notifications regarding upcoming card expirations, I'd like to access last 4 digits and expiration dates from an API call.

Is this not possible?

When I log in to the CIM web interface, this information is available. If it's not available from the API, is it against the ToS to scrape it?