---
title: "Get Cards"
method: GET
path: "/cards"
---

# Get Cards

`GET /cards`

Fetches cards according to query parameters.

## Query parameters

- `page` integer
- `limit` integer

## Response `200`

Cards fetched successfully.

- object
  - `statusCode` integer — Status code of the response. `200` indicates a successful request.
  - `message` string — Human-readable description of the result.
  - `data` object[] — Array of objects for the requested page.
    - `business` string — Identifier of the business that owns this object.
    - `customer` string — Associated customer — an id, or a summary object on nested resources.
    - `account` string — Associated account — an id, or a summary object on nested resources.
    - `fundingSource` string — Identifier of the funding source backing this object.
    - `type` string — Type of the object.
    - `brand` string — Card scheme/brand (e.g. `Verve`, `MasterCard`).
    - `currency` string — ISO 4217 currency code (e.g. `NGN`).
    - `maskedPan` string — Masked card number (PAN).
    - `expiryMonth` string — Card expiry month (MM).
    - `expiryYear` string — Card expiry year (YYYY).
    - `metadata` object — Arbitrary key-value pairs attached to the object.
      - `createdBy` string — Identifier of the actor that created the object.
      - `purpose` string — Free-text purpose of the card.
    - `status` string — Current status of the object.
    - `spendingControls` object — Spending limits and channel/category controls applied to the card.
      - `channels` object — Channels through which the card may be used.
        - `atm` boolean — Whether ATM usage is allowed.
        - `pos` boolean — Whether POS usage is allowed.
        - `web` boolean — Whether web/online usage is allowed.
        - `mobile` boolean — Whether mobile usage is allowed.
        - `_id` string — Unique identifier of the object.
      - `allowedCategories` unknown[] — Merchant category codes (MCC) explicitly allowed.
        - unknown
      - `blockedCategories` unknown[] — Merchant category codes (MCC) explicitly blocked.
        - unknown
      - `spendingLimits` object[] — Configured spending limits.
        - `amount` integer — Amount in the minor currency unit (e.g. kobo).
        - `interval` string — Interval the limit applies over (`daily`, `weekly`, `monthly`, `yearly`).
        - `categories` unknown[] — Merchant category codes the limit applies to.
          - unknown
        - `_id` string — Unique identifier of the object.
      - `_id` string — Unique identifier of the object.
    - `is2FAEnrolled` boolean — Whether the card is enrolled for 3-D Secure / 2FA.
    - `isDefaultPINChanged` boolean — Whether the default PIN has been changed.
    - `disposable` boolean — Whether the card is single-use / disposable.
    - `refundAccount` unknown
    - `isDeleted` boolean — Whether the object has been soft-deleted.
    - `createdAt` string, date-time — ISO 8601 timestamp of when the object was created.
    - `updatedAt` string, date-time — ISO 8601 timestamp of when the object was last updated.
    - `_id` string — Unique identifier of the object.
    - `__v` integer — Internal document version (Mongo).
  - `pagination` object — Pagination metadata for the result set.
    - `total` integer — Total number of records matching the query across all pages.
    - `pages` integer — Total number of pages available for the current query.
    - `page` integer — Current page index (zero-based; matches the `page` query parameter).
    - `limit` integer — Maximum number of records returned per page (matches the `limit` query parameter).

## Other responses

- `400` — Validation error.
- `401` — Authentication failed — missing or invalid API key.

---

[API](https://skmtc.net/sudo/apis/sudo-sandbox-api.md) · [All operations](https://skmtc.net/sudo/apis/sudo-sandbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sudo/sudo-sandbox-api/versions/52be624fcb53/schema)