Cards — list of endpoints

Every endpoint in the Cards section of the API Reference →. Click any row to open the full reference page with payload, examples, and the Try it widget.

Listing & details

Method	Endpoint	What it does
GET	/cards	Full partner-wide card list across every linked B2B tenant and individual. Includes a count; no pagination.
GET	/cardholders	Full partner-wide cardholder list across every linked B2B tenant + direct individuals. Includes a count.
GET	/cards/{cardKey}	Fetch a single card's full details.
GET	/cards/{cardKey}/status	Get the current status of a card.

Cards under a B2B cardholder

The cardholder-scoped variant of these endpoints is documented under Business Accounts (B2B) → — see /business/cardholders/{id}/cards, /business/cardholders/{id}/cards/virtual, and /business/cardholders/{id}/cards/physical for issuing cards against a cardholder.

Prepaid cards

Prepaid virtual and physical cards have their own endpoints (.../cards/prepaid/virtual and .../cards/prepaid/physical, for individuals and for B2B cardholders). The card is created in the background, so read the Prepaid cards guide first: it explains the request body, the fees, how to find the card, how to load it, and how to read its balance.

Prepaid load & balance

A prepaid card spends only money loaded onto it. Full flow, statuses, and examples: Prepaid cards guide →.

Method	Endpoint	What it does
GET	/cards/{cardKey}/prepaid/load-options	Card, owner, and main accounts the card can be loaded from (with balances).
POST	/cards/{cardKey}/prepaid/loads	Load the card from one of those accounts (sourceAccountId, amount, idempotencyKey).
GET	/cards/{cardKey}/prepaid/loads	Loads of the card, newest first (page / limit).
GET	/cards/{cardKey}/prepaid/loads/{loadId}	One load — poll until SUCCESS or FAILED. A load of another card is 404.
GET	/cards/prepaid/balances	Balance of prepaid cards (?cardKeys=a,b,c, up to 50). A card you do not own is answered found: false.

Lifecycle

Method	Endpoint	What it does
POST	/cards/{cardKey}/activate	Activate a newly issued card.
POST	/cards/{cardKey}/lock	Lock a card.
POST	/cards/{cardKey}/unlock	Unlock a previously locked card.
POST	/cards/{cardKey}/temporary-lock-card	Temporarily lock a card with auto-expiry.

Restrictions

Method	Endpoint	What it does
POST	/cards/{cardKey}/restrict	Apply a generic restriction.
POST	/cards/{cardKey}/restrict-card-as-lost	Mark the card as lost.
POST	/cards/{cardKey}/restrict-card-as-stolen	Mark the card as stolen.
POST	/cards/{cardKey}/restrict-card-as-closed	Close the card.
POST	/cards/{cardKey}/restrict-card-fraud	Mark the card as compromised (fraud).

Rename / replace / resign

Method	Endpoint	What it does
POST	/cards/{cardKey}/embossName	Set the embossed name on a physical card.
POST	/cards/{cardKey}/replace-card	Replace the card (damaged / lost).
POST	/cards/{cardKey}/resign-card	Re-issue the card without changing the PAN.

Sensitive operations

Method	Endpoint	What it does
GET	/cards/{cardKey}/card-number	Retrieve the full PAN (sensitive).
GET	/cards/{cardKey}/card-cvv	Retrieve the CVV (sensitive).
PUT	/cards/{cardKey}/3dsAnswer	Submit the 3-D Secure challenge answer.
POST	/cards/{cardKey}/change-3ds-phone	Change the phone number used for 3DS OTP.
GET	/cards/{cardKey}/resetPinTries	Reset the wrong-PIN attempt counter.
POST	/cards/{cardKey}/change-pin	Change the card PIN.
POST	/cards/{cardKey}/holder/authorize	Re-authorize a sensitive operation with PIN.

Limits

Limit name codes are listed in Limit types →.

Method	Endpoint	What it does
GET	/cards/{cardKey}/limits	Full limit set for the card; not paginated.
PATCH	/cards/{cardKey}/limits	Update one or more limits in a single call.
GET	/cards/{cardKey}/limits/{limitName}/available	Get the remaining available amount for a limit.

Hold limits (per-account issuance caps)

These endpoints return the maximum number of physical / virtual cards a single account may hold. They are general — not scoped to a :id — because the cap is per-account, not per-card.

Method	Endpoint	What it does
GET	/cards/hold-limits/physical	Maximum number of physical cards an account may hold.
GET	/cards/hold-limits/virtual	Maximum number of virtual cards an account may hold.

Rolling virtual-card issuance quota

A second, independent gate alongside the per-account hold limits above — measures issuance within a rolling window (default 30 days, default limit 10).

Method	Endpoint	What it does
GET	/cards/virtual-card-quota	Rolling virtual-card quota for the partner's first direct individual onboarding (default).
GET	/cards/virtual-card-quota/{cardholderId}	Rolling virtual-card quota for a specific cardholder — must belong to the calling partner.

When the quota does not apply (B2B cardholders)

For B2B cardholders (any cardholder that carries a b2bClient) the response is always applies: false, status: 'OK', used: 0, with remaining = limit and nextSlotFreesAt: null. B2B cardholders are governed instead by the per-account concurrent cap (GET /cards/hold-limits/virtual), not the rolling cap. The quota object is still returned (never omitted), so the partner client never has to branch on scope — any code that reads data.status === 'LIMIT_EXCEEDED' simply never fires for B2B cardholders, and any code that reads data.used sees 0 instead of a misleading real count.

Read-only

Both quota endpoints are read-only pre-flight checks. The authoritative block lives in the issuance path (POST /business/cardholders/{id}/cards/virtual, POST /individual/accounts/{id}/cards/virtual). Both reads and the issuance block share the same underlying quota evaluation, so a warning shown in the partner UI can never disagree with what enforcement actually does. A skipped check can never let an extra card through.

See the Overview → page for the full conceptual guide (scope, status field meanings, pre-flight vs enforcement).

When to use which endpoint

• GET /cards/{cardKey}/limits — read the per-limit configuration (POS_PUR_LMT, ATM_CCA_LMT, …) on a specific card.
• GET /cards/hold-limits/{physical|virtual} — read the issuance cap that applies to a whole account, used to decide whether a new card can be issued.
• GET /cards/virtual-card-quota{/:cardholderId} — read the rolling issuance cap for one cardholder (or the partner's default). Pre-flight check; never authoritative.

Pagination note

The card list endpoint GET /cards is a full-result endpoint and does not use page / limit. The card limit list GET /cards/{cardKey}/limits is also returned in one payload without pagination. GET /cards/{cardKey}/prepaid/loads uses page and limit, as do the transaction and audit/history endpoints.