> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qash.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Authenticated partner endpoints for card status, controls, limits, balances, and transactions.

<Note>
  Requires `Authorization: Bearer <user-access-token>` — the token from [Verify login code](/api-reference/users/verify-otp). The JWT identifies which user's card is being accessed; you do not need to send `X-Api-Key`/`X-Api-Secret` on these calls.
</Note>

The primary card is identified automatically from the authenticated user JWT. You do not need to send the card ID in most requests.

## Endpoints

| Method  | Endpoint                           | Description                                     |
| ------- | ---------------------------------- | ----------------------------------------------- |
| `GET`   | `/api/v1/cards/application/status` | Return the card application and issuance status |
| `GET`   | `/api/v1/cards/me`                 | List the authenticated user's cards             |
| `GET`   | `/api/v1/cards/status`             | Return the current card status                  |
| `GET`   | `/api/v1/cards/details`            | Return masked details for the primary card      |
| `GET`   | `/api/v1/cards/details/full`       | Return masked details, plus PAN and CVC         |
| `GET`   | `/api/v1/cards/pin`                | Return the primary card PIN                     |
| `PUT`   | `/api/v1/cards/pin`                | Change the primary card PIN                     |
| `GET`   | `/api/v1/cards/secrets`            | Return the primary card PAN and CVC             |
| `POST`  | `/api/v1/cards/lock`               | Temporarily block the primary card              |
| `POST`  | `/api/v1/cards/unlock`             | Reactivate a previously locked card             |
| `PATCH` | `/api/v1/cards/limit`              | Update the primary card spending limit          |
| `GET`   | `/api/v1/cards/balance`            | Return the current balance by currency          |
| `GET`   | `/api/v1/cards/transactions`       | Return transaction history                      |

## Important notes

* Pass `x-idempotency-key` with a unique UUID per request on `lock`, `unlock`, `limit`, and `PUT /pin` — without it, duplicate-request detection is skipped and a retried call may be processed twice
* A card with status `canceled` cannot be reactivated
* If a card is `locked`, secret endpoints such as PAN and CVC do not return data

## Common errors

| HTTP status | Cause                                                                             |
| ----------- | --------------------------------------------------------------------------------- |
| `400`       | Duplicate request — a call with the same `x-idempotency-key` is already in flight |
| `401`       | Invalid or expired token                                                          |
| `404`       | The authenticated user does not have a registered card                            |