Overview - QASH API Reference

Requires Authorization: Bearer <user-access-token> — the token from Verify login code. The JWT identifies which user’s card is being accessed; you do not need to send X-Api-Key/X-Api-Secret on these calls.

The primary card is identified automatically from the authenticated user JWT. You do not need to send the card ID in most requests.

Endpoints

Method	Endpoint	Description
`GET`	`/api/v1/cards/application/status`	Return the card application and issuance status
`GET`	`/api/v1/cards/me`	List the authenticated user’s cards
`GET`	`/api/v1/cards/status`	Return the current card status
`GET`	`/api/v1/cards/details`	Return masked details for the primary card
`GET`	`/api/v1/cards/details/full`	Return masked details, plus PAN and CVC
`GET`	`/api/v1/cards/pin`	Return the primary card PIN
`PUT`	`/api/v1/cards/pin`	Change the primary card PIN
`GET`	`/api/v1/cards/secrets`	Return the primary card PAN and CVC
`POST`	`/api/v1/cards/lock`	Temporarily block the primary card
`POST`	`/api/v1/cards/unlock`	Reactivate a previously locked card
`PATCH`	`/api/v1/cards/limit`	Update the primary card spending limit
`GET`	`/api/v1/cards/balance`	Return the current balance by currency
`GET`	`/api/v1/cards/transactions`	Return transaction history

Important notes

Pass x-idempotency-key with a unique UUID per request on lock, unlock, limit, and PUT /pin — without it, duplicate-request detection is skipped and a retried call may be processed twice
A card with status canceled cannot be reactivated
If a card is locked, secret endpoints such as PAN and CVC do not return data

Common errors

HTTP status	Cause
`400`	Duplicate request — a call with the same `x-idempotency-key` is already in flight
`401`	Invalid or expired token
`404`	The authenticated user does not have a registered card