> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fyatu.com/llms.txt
> Use this file to discover all available pages before exploring further.
# List Cards
> Retrieve a paginated list of cards for your business. GET /cards. Requires cards:read scope.
## Overview
Returns a paginated list of cards issued by your business, scoped to the API key's environment. Supports filtering by cardholder and status.
The environment is always taken from your API key — there is no `environment` query parameter. A `SANDBOX` key only returns sandbox cards; a `LIVE` key only returns live cards.
## Query Parameters
| Parameter | Type | Default | Description |
| -------------- | ------- | ------- | --------------------------------------------- |
| `limit` | integer | 20 | Results per page (max 100) |
| `offset` | integer | 0 | Number of records to skip |
| `cardholderId` | string | — | Filter cards for a specific cardholder |
| `status` | string | — | Filter by `ACTIVE`, `FROZEN`, or `TERMINATED` |
## Example
```bash cURL theme={null}
curl -G https://api.fyatu.com/api/v3.20/cards \
-H "Authorization: Bearer $FYATU_API_KEY" \
-d cardholderId=chl_01HXYZ1234ABCDEF5678 \
-d status=ACTIVE \
-d limit=20
```
```javascript Node.js theme={null}
const params = new URLSearchParams({
cardholderId: 'chl_01HXYZ1234ABCDEF5678',
status: 'ACTIVE',
limit: '20'
});
const resp = await fetch(
`https://api.fyatu.com/api/v3.20/cards?${params}`,
{ headers: { 'Authorization': `Bearer ${process.env.FYATU_API_KEY}` } }
);
const body = await resp.json();
console.log(`${body.pagination.total} cards`);
for (const card of body.data) {
console.log(card.id, card.last4, card.status);
}
```
```python Python theme={null}
import os, requests
resp = requests.get(
'https://api.fyatu.com/api/v3.20/cards',
headers={'Authorization': f'Bearer {os.environ["FYATU_API_KEY"]}'},
params={
'cardholderId': 'chl_01HXYZ1234ABCDEF5678',
'status': 'ACTIVE',
'limit': 20
}
)
body = resp.json()
for card in body['data']:
print(card['id'], card['last4'], card['status'])
```
## Success Response (200)
```json theme={null}
{
"success": true,
"status": 200,
"message": "Cards retrieved",
"data": [
{
"id": "crd_01HXYZ5555ABCDEF1111",
"cardholderId": "chl_01HXYZ1234ABCDEF5678",
"productId": "prd_01HXYZ1111ABCDEF0001",
"status": "ACTIVE",
"cardType": "VIRTUAL",
"cardBrand": "VISA",
"maskedPan": "445123******4123",
"last4": "4123",
"expirationDate": "06/2030",
"createdAt": "2026-05-26T10:00:00Z"
}
],
"pagination": {
"total": 3,
"limit": 20,
"offset": 0,
"hasMore": false
},
"meta": {
"requestId": "req_01HXY123456ABCDEF",
"platform": "Fyatu CaaS",
"timestamp": "2026-05-26T10:00:00Z"
}
}
```
## Response Fields
| Field | Type | Description |
| ---------------- | ------ | ---------------------------------------------------------------------------- |
| `id` | string | Card identifier (prefix `crd_`) |
| `cardholderId` | string | The cardholder this card belongs to |
| `productId` | string | The product the card was issued under |
| `status` | string | `CREATING`, `ACTIVE`, `FROZEN`, or `TERMINATED` |
| `cardType` | string | `VIRTUAL` or `PHYSICAL` |
| `cardBrand` | string | `VISA` or `MASTERCARD` |
| `maskedPan` | string | BIN-masked PAN — first 6 digits + 6 stars + last 4 (e.g. `445123******4123`) |
| `last4` | string | Last 4 digits of the PAN |
| `expirationDate` | string | Card expiry in `MM/YYYY` format (e.g. `06/2030`) |
| `createdAt` | string | ISO 8601 creation timestamp |
`balance` and `cvv` are not included in list responses. Use `GET /cards/{id}` to retrieve live balance and CVV for a specific card.
## Error Codes
| Code | HTTP | Cause |
| -------------------- | ---- | ---------------------------- |
| `INSUFFICIENT_SCOPE` | 403 | Key lacks `cards:read` scope |
| `INTERNAL_ERROR` | 500 | Server error |
## OpenAPI
````yaml v3.20/openapi.json GET /cards
openapi: 3.1.0
info:
title: FYATU CaaS API v3.20
description: >-
FYATU Cards-as-a-Service API — API key authentication, Cardholder
lifecycle, Card issuance, Transactions, Webhooks, and Programs.
version: 3.20.0
contact:
name: FYATU Support
url: https://fyatu.com
email: support@fyatu.com
servers:
- url: https://api.fyatu.com/api/v3.20
description: >-
FYATU CaaS API — the environment (LIVE or SANDBOX) is determined by the
API key, not the URL
security:
- BearerAuth: []
tags:
- name: Meta
description: Liveness, account info, and supported event types
- name: Account
description: Account-level balance and funding status
- name: Programs
description: Read card program configuration
- name: Cardholders
description: Create and manage cardholder profiles
- name: Cards
description: Issue, fund, freeze, and terminate virtual cards
- name: Transactions
description: Read-only card transaction history
- name: Webhooks
description: Manage webhook endpoints for real-time event delivery
- name: Products
description: Read card product configurations
paths:
/cards:
get:
tags:
- Cards
summary: List cards
description: Returns a paginated list of cards for your business.
operationId: listCards
parameters:
- name: limit
in: query
schema:
type: integer
minimum: 1
maximum: 100
default: 20
- name: offset
in: query
schema:
type: integer
minimum: 0
default: 0
- name: cardholderId
in: query
schema:
type: string
- name: status
in: query
schema:
type: string
enum:
- ACTIVE
- FROZEN
- TERMINATED
responses:
'200':
description: Cards retrieved
content:
application/json:
schema:
$ref: '#/components/schemas/CardListResponse'
example:
success: true
status: 200
message: Cards retrieved
data:
- id: crd_01HXYZ5555ABCDEF1111
cardholderId: chl_01HXYZ1234ABCDEF5678
productId: prd_01HXYZ1111ABCDEF0001
status: ACTIVE
cardType: VIRTUAL
cardBrand: VISA
maskedPan: 445123******4123
last4: '4123'
expirationDate: 06/2030
createdAt: '2026-05-26T10:00:00Z'
pagination:
total: 3
limit: 20
offset: 0
hasMore: false
meta:
requestId: req_01HXY123456ABCDEF
platform: Fyatu CaaS
timestamp: '2026-05-26T10:00:00Z'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'429':
$ref: '#/components/responses/RateLimitExceeded'
'500':
$ref: '#/components/responses/InternalError'
components:
schemas:
CardListResponse:
type: object
properties:
success:
type: boolean
example: true
status:
type: integer
example: 200
message:
type: string
example: Cards retrieved
data:
type: array
items:
$ref: '#/components/schemas/Card'
pagination:
$ref: '#/components/schemas/Pagination'
meta:
$ref: '#/components/schemas/Meta'
example:
success: true
status: 200
message: Cards retrieved
data:
- id: crd_01HXYZ5555ABCDEF1111
cardholderId: chl_01HXYZ1234ABCDEF5678
productId: prd_01HXYZ1111ABCDEF0001
status: ACTIVE
cardType: VIRTUAL
cardBrand: VISA
maskedPan: 445123******4123
last4: '4123'
expirationDate: 06/2030
createdAt: '2026-05-26T10:00:00Z'
pagination:
total: 3
limit: 20
offset: 0
hasMore: false
meta:
requestId: req_01HXY123456ABCDEF
platform: Fyatu CaaS
timestamp: '2026-05-26T10:00:00Z'
Card:
type: object
description: Lightweight card object returned in list responses.
properties:
id:
type: string
example: crd_01HXYZ5555ABCDEF1111
cardholderId:
type: string
example: chl_01HXYZ1234ABCDEF5678
productId:
type: string
nullable: true
example: prd_01HXYZ1111ABCDEF0001
status:
type: string
enum:
- CREATING
- ACTIVE
- FROZEN
- TERMINATED
example: ACTIVE
cardType:
type: string
enum:
- VIRTUAL
- PHYSICAL
example: VIRTUAL
cardBrand:
type: string
enum:
- VISA
- MASTERCARD
example: VISA
maskedPan:
type: string
nullable: true
description: Populated after provisioning completes
example: 445123******4123
last4:
type: string
nullable: true
description: Populated after provisioning completes
example: '4123'
expirationDate:
type: string
nullable: true
description: Card expiry in MM/YYYY format
example: 06/2030
createdAt:
type: string
format: date-time
example: '2026-05-26T10:00:00Z'
Pagination:
type: object
properties:
total:
type: integer
example: 47
limit:
type: integer
example: 20
offset:
type: integer
example: 0
hasMore:
type: boolean
example: true
Meta:
type: object
properties:
requestId:
type: string
example: req_a1b2c3d4e5f6a7b8c9d0e1f2
platform:
type: string
example: Fyatu CaaS
timestamp:
type: string
format: date-time
example: '2026-05-22T15:00:00Z'
Error:
type: object
properties:
success:
type: boolean
example: false
status:
type: integer
example: 422
message:
type: string
example: Human readable message
error:
$ref: '#/components/schemas/ErrorBody'
meta:
$ref: '#/components/schemas/Meta'
ErrorBody:
type: object
properties:
code:
type: string
example: VALIDATION_ERROR
detail:
type: string
example: dateOfBirth must be in YYYY-MM-DD format
responses:
Unauthorized:
description: Missing or invalid API key
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
examples:
missing:
summary: API key missing
value:
success: false
status: 401
message: API key is required
error:
code: AUTH_TOKEN_MISSING
detail: API key is required
meta:
requestId: req_a1b2c3d4e5f6a7b8c9d0e1f2
platform: Fyatu CaaS
timestamp: '2026-05-22T15:00:00Z'
invalid:
summary: API key invalid
value:
success: false
status: 401
message: Invalid API key
error:
code: AUTH_TOKEN_INVALID
detail: Invalid API key
meta:
requestId: req_a1b2c3d4e5f6a7b8c9d0e1f2
platform: Fyatu CaaS
timestamp: '2026-05-22T15:00:00Z'
Forbidden:
description: Scope denied or business suspended
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
success: false
status: 403
message: Scope denied
error:
code: INSUFFICIENT_SCOPE
detail: This endpoint requires the cards:write scope
meta:
requestId: req_a1b2c3d4e5f6a7b8c9d0e1f2
platform: Fyatu CaaS
timestamp: '2026-05-22T15:00:00Z'
RateLimitExceeded:
description: Rate limit exceeded
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
success: false
status: 429
message: Rate limit exceeded
error:
code: RATE_LIMIT_EXCEEDED
detail: Too many requests
meta:
requestId: req_a1b2c3d4e5f6a7b8c9d0e1f2
platform: Fyatu CaaS
timestamp: '2026-05-22T15:00:00Z'
InternalError:
description: Unexpected server error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
success: false
status: 500
message: Internal error
error:
code: INTERNAL_ERROR
detail: An unexpected error occurred
meta:
requestId: req_a1b2c3d4e5f6a7b8c9d0e1f2
platform: Fyatu CaaS
timestamp: '2026-05-22T15:00:00Z'
securitySchemes:
BearerAuth:
type: http
scheme: bearer
description: >-
API key from the FYATU CaaS portal. Pass as `Authorization: Bearer
`.
````