Skip to main content
All card endpoints require X-Api-Key, X-Api-Secret, and Authorization: Bearer <user-jwt>. The JWT identifies which user’s card is being accessed.
The primary card is identified automatically from the authenticated user JWT. You do not need to send the card ID in most requests.

​
Endpoints

MethodEndpointDescription
GET/api/v1/user/card/statusReturn the current card status
GET/api/v1/user/card/detailsReturn masked details for the primary card
POST/api/v1/user/card/lockTemporarily block the primary card
POST/api/v1/user/card/unlockReactivate a previously locked card
PATCH/api/v1/user/card/limitUpdate the primary card spending limit
GET/api/v1/user/card/balanceReturn the current balance by currency
GET/api/v1/user/card/transactionsReturn transaction history

​
Important notes

  • x-idempotency-key is required for lock, unlock, and limit
  • Use a unique UUID per operation to prevent duplicate processing
  • A card with status canceled cannot be reactivated
  • If a card is locked, secret endpoints such as PAN and CVC do not return data

​
Common errors

HTTP statusCause
401Invalid or expired token
404The authenticated user does not have a registered card
409Duplicate idempotency key