List cards
Lists your cards, excluding team-member cards (see GET /api/cards/team-members).
Authorizations
Your workspace client id.
All calls must include four headers:
X-Auth-Client— your workspace client idX-Auth-Timestamp— Unix secondsX-Auth-Nonce— 16-byte random hexX-Auth-Signature— hex(HMAC-SHA256({client_id}:{timestamp}:{nonce}:{raw_body}, client_secret))
The playground computes the timestamp, nonce and signature for you.
Your sandbox client secret. The playground uses it to sign the request in your browser and removes it before the request is sent. Never send your client secret as a header in your own integration.
Query Parameters
Only cards held by this customer.
Only this card.
Comma-separated card statuses (pending, active, frozen, blocked, pending_termination, terminated, failed).
Comma-separated card types (virtual, physical, lite).
Card currency.
Card reference.
Only cards with (true) or without (false) a stablecoin address.
Page size. Clamped to at most 50. Alias: limit.
1 <= x <= 50Alias of first.
1 <= x <= 50Cursor from page_info.next_cursor. Alias: cursor.
Alias of after.
Created at or after (RFC3339). Cannot be combined with period.
Created at or before (RFC3339). Cannot be combined with period.
Creation-date window. custom needs start_date and end_date.
all_time, last_7_days, last_1_month, last_3_months, last_6_months, last_12_months, year_to_date, custom Start for period=custom (RFC3339 or YYYY-MM-DD).
End for period=custom (RFC3339 or YYYY-MM-DD).
Minimum spend, micro-units (1 USD = 1,000,000).
x >= 0Maximum spend, micro-units. Must not be below spending_min.
x >= 0Minimum balance, micro-units.
x >= 0Maximum balance, micro-units. Must not be below balance_min.
x >= 0Exactly 4 digits.
^[0-9]{4}$Exactly 6 digits.
^[0-9]{6}$Cardholder name, at most 255 characters.
255Cardholder email, at most 255 characters.
255Free-text search, at most 255 characters.
255Card brand.
visa, mastercard Provisioning status (processing, completed, failed).
Contactless enabled.
Only cards with (true) or without (false) a webhook_url.
Channel the card was created from.
Stablecoin network of the card address.
Response
OK
Successful responses are wrapped in this envelope, and so are errors a handler answers itself (request body and field validation, some not-found and conflict cases, ORG_NOT_ACTIVE): success is false and error carries a code and message. Errors raised by authentication and by the services behind a handler are a Problem instead.
true on success
When the response was written.
The payload; its shape is given per operation. Omitted when there is none.
Human-readable summary; omitted when empty.
List metadata. Page lists set page, per_page, total and total_pages; offset and cursor lists set limit, offset, has_more and next_cursor. Zero and empty fields are omitted, and metadata is absent when nothing is set.
Set on error envelopes: the request's correlation id (req_ followed by a UUID), the same value as the X-Correlation-ID response header. Quote it to support.