/cards/{userId}List Debit Cards
Returns Debit Card summaries for a broker-owned managed customer.
Never returns full PAN, CVV, or PIN.
If the customer exists and the broker has access but no cards exist, returns HTTP 200 with ResponseData as the string "Card not available" (not 404).
Access: Broker profile must have financial transactions enabled and must own the customer via brokerings.
curl -X GET "{{API_BASE_URL}}/cards/{{userId}}" \
-H "session-token: {{sessionToken}}" \
-H "Accept: application/json"Path variables
| Field | Type | Required | Possible values | Description |
|---|---|---|---|---|
userId | string | Required | -8202289338547523753 | Masked customer ID (same masking pattern as other partner APIs). Must match `/^-?\d+$/`. |
Headers
| Field | Type | Required | Possible values | Description |
|---|---|---|---|---|
session-token | string | Required | — | SessionToken obtained from the Create GMA Session endpoint. All secured endpoints require this header. |
Additional info
| Field | Type | Required | Possible values | Description |
|---|---|---|---|---|
200 — Card not available | object | Optional | — | Customer exists and broker has access, but no cards are on file. |
404 — Customer not found | object | Optional | — | Masked userId does not resolve to a customer. |
403 — No access | object | Optional | — | Broker does not own this customer via brokerings. |
Example— 200 — Card not available
{
"ResponseCode": 200,
"ResponseMessage": "Success",
"ResponseData": "Card not available"
}Example— 404 — Customer not found
{
"ResponseCode": 404,
"ResponseMessage": "Customer not found",
"ResponseData": null
}Example— 403 — No access
{
"ResponseCode": 403,
"ResponseMessage": "Broker does not have access to this customer",
"ResponseData": null
}Header on all calls: `session-token: {SessionToken}`. Path param stays camelCase (`userId`).
Response
| Field | Type | Possible values | Description |
|---|---|---|---|
ResponseCode | integer | 200 | 201 | 204 | 301 | 400 | 401 | 403 | 404 | 410 | 422 | 500 | 503 | API result code in the response envelope. Indicates success or the error category (e.g. 200 success, 400 bad request, 401 unauthorized). |
ResponseMessage | string | Success | Created | NoContent | BadRequest | Unauthorized | Forbidden | NotFound | Gone | UnprocessableContent | ServerError | ResourceMoved | ServiceUnAvailable | UnProcessableEntity | Human-readable label paired with ResponseCode (e.g. Success, BadRequest, Unauthorized). Use with ResponseCode to interpret the outcome. |
ResponseData | array | Please refer to below example for response body | Array of card summaries. When no cards exist: the string `"Card not available"`. |
ResponseData[].CardId | string | — | Card reference ID. Use this as `{cardId}` on other Cards endpoints. |
ResponseData[].MaskedPan | string | — | Masked PAN. Full PAN is never returned. |
ResponseData[].CardholderName | string | — | Cardholder display name. |
ResponseData[].CardType | string | — | Product/type name (e.g. FV Bank Visa Debit). |
ResponseData[].CardNetwork | string | — | Brand/network from card type config (typically Visa). |
ResponseData[].CardStatus | string | Active | Ordered | Expired | Card lifecycle status. Additional processor values may appear. |
ResponseData[].DeliveryStatus | string | null | Delivered | Pending | null | Delivery status, or null when unknown. |
ResponseData[].ActivationStatus | string | Activated | PendingActivation | NotActivated | Activation state. Activation itself is outside this API. |
ResponseData[].ExpiryMonth | string | null | — | Expiry month (MM). |
ResponseData[].ExpiryYear | string | null | — | Expiry year (20YY). |
ResponseData[].Bin | string | null | — | BIN number/title. |
ResponseData[].Last4Digits | string | — | Last 4 digits of the card. |
ResponseData[].IssueDate | string | — | Activated date or record creation date (YYYY-MM-DD). |
ResponseData[].ShippingType | string | PriorityDelivery | RegularDelivery | Shipping method used for the physical card. |
ResponseData[].AtmEnabled | boolean | — | Whether ATM usage is enabled. |
ResponseData[].TransactionSuspended | boolean | — | True if FV/org suspension is in effect or card transactions are disabled. |
ResponseData[].InternationalUsage | boolean | — | International usage flag. Currently always true. |
ResponseData[].DailyPurchaseLimit | number | null | — | Daily purchase limit snapshot. |
ResponseData[].DailyAtmLimit | number | null | — | Daily ATM limit snapshot. |
ResponseData[].ContactlessEnabled | boolean | — | Contactless flag. Currently always true. |
Example response
{
"ResponseCode": 200,
"ResponseMessage": "Success",
"ResponseData": [
{
"CardId": "55d0c52f-79ee-4d38-acf4-a16c07957898",
"MaskedPan": "************1234",
"CardholderName": "Jane Doe",
"CardType": "FV Bank Visa Debit",
"CardNetwork": "Visa",
"CardStatus": "Active",
"DeliveryStatus": "Delivered",
"ActivationStatus": "Activated",
"ExpiryMonth": "12",
"ExpiryYear": "2028",
"Bin": "4xxxxx",
"Last4Digits": "1234",
"IssueDate": "2026-01-15",
"ShippingType": "RegularDelivery",
"AtmEnabled": true,
"TransactionSuspended": false,
"InternationalUsage": true,
"DailyPurchaseLimit": 5000,
"DailyAtmLimit": 500,
"ContactlessEnabled": true
},
{
"CardId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
"MaskedPan": "************9876",
"CardholderName": "Jane Doe",
"CardType": "FV Bank Visa Debit",
"CardNetwork": "Visa",
"CardStatus": "Ordered",
"DeliveryStatus": "Pending",
"ActivationStatus": "PendingActivation",
"ExpiryMonth": "12",
"ExpiryYear": "2028",
"Bin": "4xxxxx",
"Last4Digits": "9876",
"IssueDate": "2026-01-15",
"ShippingType": "RegularDelivery",
"AtmEnabled": false,
"TransactionSuspended": false,
"InternationalUsage": true,
"DailyPurchaseLimit": 5000,
"DailyAtmLimit": 500,
"ContactlessEnabled": true
}
]
}No pagination.
Requires `session-token: {SessionToken}` from Create GMA Session. Use the same client IP as authentication.