Retrieve all cards attributes / top-up targets

GET/public/v1/core/cards

Bearer token

List cards with the operational attributes used by card-management screens.

Returns a paginated list of cards with their cardholder, status, type and top-up settings. This is the operational view of a card, as opposed to GET /public/v1/erp/cards, which is the accounting view with cost-allocation segments and control flags. Prefer the ERP endpoint for sync and reporting; use this one when you are about to act on a card through the write endpoints below.

Results are scoped to what the authenticated user is permitted to see, which may be narrower than the whole company.

Query parameters

pageinteger

Page number, 1-based. Default 1

Example 1

page_sizeinteger

Records per page. Default 20 (also accepted as limit)

limitinteger

Example 5

Response

One object.

Field	Type	Description
`cards[]`	array	`{ id, nickname, card_number, card_type, status, display_status, user_name, user_email, company_name, velocity_period, allow_atm, allow_replace_card, card_replaced, return_card }`
`page_info`	object	`{ current_page, per_page, total_entries, total_pages, next_page, previous_page, offset }`

Response schema from the OpenAPI document

Field	Type	Description
`status_code`	integer
`success`	boolean
`data`	object
`cards`	object[]
`id`	integer
`user_name`	string
`company_name`	string
`user_email`	string
`status`	string
`display_status`	string
`card_type`	string
`nickname`	string
`card_number`	string
`allow_replace_card`	boolean
`card_replaced`	boolean
`velocity_period`	string
`allow_atm`	string
`return_card`	string
`shipping_card`	string
`terminated_at`	string
`spend_restriction_type`	string
`last_four`	string
`limit_amount_notification`	string
`card_balance_running_low_notification`	boolean
`allowed_countries_list`	string
`allowed_countries_list_active`	string
`foreign_entity`	boolean
`atm_restricted_at`	string
`issuer`	string
`allowed_mccs_active`	string
`spend_limit_active`	string
`atm_limit_active`	boolean
`auto_top_up_amount`	string
`auto_load_on_transaction_approval`	boolean
`tokenization_status`	string
`account_type`	string
`account_id`	string
`currency`	string
`show_pool_balance_to_cardholder`	boolean
`is_manager`	string
`is_account_manager`	string
`is_dept_manager`	string
`can_edit_all_time_limit`	boolean
`can_reset_limit`	boolean
`reset_summary`	string
`issued_at`	string
`first_activated_at`	string
`external_id`	string
`replaced_by_card_external_id`	string
`replaced_by_card_id`	string
`card_usage_type`	string
`card_usage_type_amount`	string
`account_balance`	string
`shipment_tracking`	string
`spend_limit`	string
`atm_limit`	string
`shipping_address`	string
`card_template`	string
`erp_bank_account`	string
`step_up_auth_delegated_user_profile`	string
`created_at`	string
`shipping_details`	object
`wallets_status`	object
`user_profile`	object
`advanced_velocity_limits`	object[]
`atm_transactions_limit_active`	string
`transactions_limit_active`	boolean
`atm_transactions_limit`	string
`transactions_limit`	object
`page_info`	object
`current_page`	integer
`per_page`	integer
`total_entries`	integer
`next_page`	integer
`previous_page`	string
`offset`	integer
`total_pages`	integer
`meta`	object
`request_id`	string
`timestamp`	string

55 nested fields

`data.cards[].shipping_details.method`	string
`data.cards[].shipping_details.return_address`	object
`data.cards[].shipping_details.shipping_address`	object
`data.cards[].wallets_status.apple_pay`	boolean
`data.cards[].wallets_status.google_pay`	boolean
`data.cards[].wallets_status.samsung_pay`	boolean
`data.cards[].user_profile.department_name`	string
`data.cards[].user_profile.first_name`	string
`data.cards[].user_profile.last_name`	string
`data.cards[].user_profile.company_name`	string
`data.cards[].user_profile.user_name`	string
`data.cards[].user_profile.system_role_name`	string
`data.cards[].user_profile.email`	string
`data.cards[].user_profile.user_email`	string
`data.cards[].user_profile.external_id`	string
`data.cards[].user_profile.user_id`	integer
`data.cards[].user_profile.status`	string
`data.cards[].user_profile.fullname`	string
`data.cards[].user_profile.employee_id`	string
`data.cards[].user_profile.department_id`	integer
`data.cards[].user_profile.managing_departments`	object[]
`data.cards[].user_profile.managing_departments[].id`	integer
`data.cards[].user_profile.managing_departments[].name`	string
`data.cards[].advanced_velocity_limits[].id`	string
`data.cards[].advanced_velocity_limits[].title`	string
`data.cards[].advanced_velocity_limits[].limit_by_type`	string
`data.cards[].advanced_velocity_limits[].active`	boolean
`data.cards[].advanced_velocity_limits[].amount`	integer
`data.cards[].advanced_velocity_limits[].currency`	string
`data.cards[].advanced_velocity_limits[].period`	string
`data.cards[].advanced_velocity_limits[].remote_linked`	string
`data.cards[].advanced_velocity_limits[].remote_sync`	string
`data.cards[].advanced_velocity_limits[].remaining_balance`	integer
`data.cards[].advanced_velocity_limits[].limit_type`	string
`data.cards[].advanced_velocity_limits[].issuer`	string
`data.cards[].advanced_velocity_limits[].external_id`	string
`data.cards[].advanced_velocity_limits[].effective_from`	string
`data.cards[].advanced_velocity_limits[].effective_to`	string
`data.cards[].advanced_velocity_limits[].frequency`	integer
`data.cards[].advanced_velocity_limits[].remaining_frequency`	integer
`data.cards[].advanced_velocity_limits[].consumed_limit`	integer
`data.cards[].advanced_velocity_limits[].consumed_frequency`	integer
`data.cards[].advanced_velocity_limits[].expense_category_ids`	object[]
`data.cards[].advanced_velocity_limits[].expense_category_ids[].id`	string
`data.cards[].advanced_velocity_limits[].expense_category_ids[].name`	string
`data.cards[].advanced_velocity_limits[].expense_category_ids[].label`	string
`data.cards[].advanced_velocity_limits[].expense_category_ids[].code`	string
`data.cards[].advanced_velocity_limits[].expense_category_ids[].erp_internal_id`	string
`data.cards[].advanced_velocity_limits[].expense_category_ids[].erp_code`	string
`data.cards[].transactions_limit.max_amount`	integer
`data.cards[].transactions_limit.min_amount`	integer
`data.cards[].transactions_limit.currency`	string
`data.cards[].transactions_limit.period`	string
`data.cards[].transactions_limit.frequency`	integer
`data.cards[].transactions_limit.transaction_scope`	string[]

Errors

401.

401Unauthorized - missing or invalid Bearer token

Every error carries an errors[] array and a meta.request_id. See Errors for the full envelope.

GET/public/v1/core/cards

curl -X GET 'https://api.qashio.com/public/v1/core/cards?page=1&limit=5' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer <access_token>'

const accessToken = process.env.QASHIO_ACCESS_TOKEN;

const response = await fetch('https://api.qashio.com/public/v1/core/cards?page=1&limit=5', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: `Bearer ${accessToken}`,
  },
});

if (!response.ok) {
  throw new Error(`Qashio API ${response.status}: ${await response.text()}`);
}

const { data, meta } = await response.json();
console.log(meta.request_id, data);

import https from 'node:https';

const url = new URL('https://api.qashio.com/public/v1/core/cards?page=1&limit=5');

const payload = await new Promise((resolve, reject) => {
  const req = https.request(
    url,
    {
      method: 'GET',
      headers: {
      Accept: 'application/json',
      Authorization: `Bearer ${process.env.QASHIO_ACCESS_TOKEN}`,
      },
    },
    (res) => {
      let raw = '';
      res.on('data', (chunk) => (raw += chunk));
      res.on('end', () => resolve(JSON.parse(raw)));
    },
  );
  req.on('error', reject);
  req.end();
});

console.log(payload.data);

import os
import requests

url = "https://api.qashio.com/public/v1/core/cards"
headers = {
    "Accept": "application/json",
    "Authorization": f"Bearer {os.environ['QASHIO_ACCESS_TOKEN']}",
}

params = {
    "page": 1,
    "limit": 5,
}

response = requests.get(url, headers=headers, params=params, timeout=30)
response.raise_for_status()

body = response.json()
print(body["meta"]["request_id"], body["data"])

<?php

$ch = curl_init('https://api.qashio.com/public/v1/core/cards?page=1&limit=5');

curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST  => 'GET',
  CURLOPT_HTTPHEADER     => [
      'Accept: application/json',
      'Authorization: Bearer ' . getenv('QASHIO_ACCESS_TOKEN'),
  ],
]);

$response = curl_exec($ch);
curl_close($ch);

$body = json_decode($response, true);
print_r($body['data']);

package main

import (
	"encoding/json"
	"fmt"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.qashio.com/public/v1/core/cards?page=1&limit=5", nil)
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Authorization", "Bearer "+os.Getenv("QASHIO_ACCESS_TOKEN"))

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	var out map[string]any
	json.NewDecoder(res.Body).Decode(&out)
	fmt.Println(out["data"])
}

require 'net/http'
require 'json'
require 'uri'

uri = URI('https://api.qashio.com/public/v1/core/cards?page=1&limit=5')
request = Net::HTTP::Get.new(uri)
request['Accept'] = 'application/json'
request['Authorization'] = "Bearer #{ENV.fetch('QASHIO_ACCESS_TOKEN')}"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

body = JSON.parse(response.body)
puts body['data']

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class QashioExample {
  public static void main(String[] args) throws Exception {
    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://api.qashio.com/public/v1/core/cards?page=1&limit=5"))
        .header("Accept", "application/json")
        .header("Authorization", "Bearer " + System.getenv("QASHIO_ACCESS_TOKEN"))
        .method("GET", HttpRequest.BodyPublishers.noBody())
        .build();

    HttpResponse<String> response = HttpClient.newHttpClient()
        .send(request, HttpResponse.BodyHandlers.ofString());

    System.out.println(response.body());
  }
}

using System;
using System.Net.Http;
using System.Threading.Tasks;

var client = new HttpClient();

var request = new HttpRequestMessage(new HttpMethod("GET"), "https://api.qashio.com/public/v1/core/cards?page=1&limit=5");
request.Headers.Add("Accept", "application/json");
request.Headers.Add("Authorization", $"Bearer {Environment.GetEnvironmentVariable("QASHIO_ACCESS_TOKEN")}");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();

Console.WriteLine(await response.Content.ReadAsStringAsync());

import Foundation

var request = URLRequest(url: URL(string: "https://api.qashio.com/public/v1/core/cards?page=1&limit=5")!)
request.httpMethod = "GET"
request.setValue("application/json", forHTTPHeaderField: "Accept")
let token = ProcessInfo.processInfo.environment["QASHIO_ACCESS_TOKEN"]!
request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")

let (data, _) = try await URLSession.shared.data(for: request)
print(String(data: data, encoding: .utf8)!)

Response

{
  "status_code": 200,
  "success": true,
  "data": {
    "cards": [
      {
        "id": 12143,
        "user_name": "John Doe",
        "company_name": "Qashio",
        "user_email": "john.doe@example.com",
        "status": "draft",
        "display_status": "draft",
        "card_type": "PHYSICAL",
        "nickname": "Qashio Card - 1",
        "card_number": "******",
        "allow_replace_card": true,
        "card_replaced": false,
        "velocity_period": "MONTHLY",
        "allow_atm": "false",
        "return_card": "company_address",
        "shipping_card": "company_address",
        "terminated_at": "2026-08-06T07:30:44.941Z",
        "spend_restriction_type": "no_limit",
        "last_four": "4554",
        "limit_amount_notification": "250.00",
        "card_balance_running_low_notification": false,
        "allowed_countries_list": "sample",
        "allowed_countries_list_active": "sample",
        "foreign_entity": false,
        "atm_restricted_at": "2026-08-06T07:30:44.941Z",
        "issuer": "John Doe",
        "allowed_mccs_active": "false",
        "spend_limit_active": "sample",
        "atm_limit_active": true,
        "auto_top_up_amount": "1000.00",
        "auto_load_on_transaction_approval": false,
        "tokenization_status": "active",
        "account_type": "individual",
        "account_id": "CAj2w5b3w9hoe0ga",
        "currency": "AED",
        "show_pool_balance_to_cardholder": false,
        "is_manager": "false",
        "is_account_manager": "sample",
        "is_dept_manager": "false",
        "can_edit_all_time_limit": false,
        "can_reset_limit": false,
        "reset_summary": "Limits reset on the 1st of each month",
        "issued_at": "2026-08-06T07:30:44.941Z",
        "first_activated_at": "2026-08-06T07:30:44.941Z",
        "external_id": "CAj2w5b3w9hoe0ga",
        "replaced_by_card_external_id": "CAj2w5b3w9hoe0ga",
        "replaced_by_card_id": "CAj2w5b3w9hoe0ga",
        "card_usage_type": "MANUAL_CARD",
        "card_usage_type_amount": "0",
        "account_balance": "Empty",
        "shipment_tracking": "1Z999AA10123456784",
        "spend_limit": "sample",
        "atm_limit": "2000.00",
        "shipping_address": "Dubai Internet City, Dubai, AE",
        "card_template": "virtual-standard",
        "erp_bank_account": "160104",
        "step_up_auth_delegated_user_profile": "UPc7ws3qre31j5uw",
        "created_at": "2026-09-09T13:31:49.152+04:00",
        "shipping_details": {
          "method": null,
          "return_address": null,
          "shipping_address": null
        },
        "wallets_status": {
          "apple_pay": null,
          "google_pay": null,
          "samsung_pay": null
        },
        "user_profile": {
          "department_name": null,
          "first_name": null,
          "last_name": null,
          "company_name": null,
          "user_name": null,
          "system_role_name": null,
          "email": null,
          "user_email": null,
          "external_id": null,
          "user_id": null,
          "status": null,
          "fullname": null,
          "employee_id": null,
          "department_id": null,
          "managing_departments": null
        },
        "advanced_velocity_limits": [],
        "atm_transactions_limit_active": "false",
        "transactions_limit_active": false,
        "atm_transactions_limit": "5",
        "transactions_limit": {
          "max_amount": null,
          "min_amount": null,
          "currency": null,
          "period": null,
          "frequency": null,
          "transaction_scope": null
        }
      }
    ],
    "page_info": {
      "current_page": 1,
      "per_page": 5,
      "total_entries": 3902,
      "next_page": 2,
      "previous_page": "https://api.qashio.com/public/v1/erp/bank_accounts?page=1",
      "offset": 0,
      "total_pages": 781
    }
  },
  "meta": {
    "request_id": "3adb2d16090c7b3bdbde3b326a814b30",
    "timestamp": "2026-09-09T10:07:52.143Z"
  }
}

{
  "status_code": 401,
  "success": false,
  "message": "Missing Bearer token",
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing Bearer token"
  },
  "errors": [
    {
      "code": "UNAUTHORIZED",
      "message": "Missing Bearer token",
      "field": "authorization"
    }
  ],
  "meta": {
    "request_id": "3adb2d16090c7b3bdbde3b326a814b30",
    "timestamp": "2026-09-09T10:07:52.143Z"
  }
}