Get card by id

GET/public/v1/erp/cards/{cardId}

Bearer token

Retrieve one card with the actual values of every spend control applied to it.

Returns a single card. The payload is the list entry plus the full configuration behind each control flag: the spend limit amount and period, the allowed or blocked country list, the merchant categories and groups, the top-up and auto-top-up settings, and the ATM rules. Use it when you need to display or audit a card's controls rather than just know they exist.

Path parameters

cardIdstringrequired: the card identifier (CA…).

Response

One card object. All list fields, plus:

Field	Type	Description
`purchase_limits`	object	`{ enabled, amount, frequency, limit_currency, number_of_purchases }`
`country_limits`	object	`{ restriction_mode, allowed_countries, blocked_countries }`
`merchant_category_limits`	object	`{ restriction_type, categories, merchant_groups }`: categories carry their MCC codes
`topup_configuration`	object	`{ auto_topup_enabled, auto_topup_amount, frequency }`
`auto_top_up_configuration`	object	Auto top-up amount and trigger
`atm_configuration`	object	`{ atm_withdrawal_allowed, frequency, max_amount, number_of_withdrawals, limit_per_withdrawal }`

Response schema from the OpenAPI document

Field	Type	Description
`status_code`	integer
`success`	boolean
`data`	object
`id`	string
`card_nickname`	string
`company_name`	string
`status`	string
`card_type`	string
`masked_card_number`	string
`account_external_id`	string
`account_type`	string
`card_currency`	string
`allowed_max_balance`	string
`float_management_enabled`	boolean
`topup_type`	string
`card_replaced`	boolean
`transaction_limits_active`	boolean
`purchase_limits_active`	boolean
`country_limits_active`	boolean
`category_limits_active`	boolean
`atm_withdrawal_allowed`	boolean
`low_balance_notification_active`	boolean
`low_balance_notification_amount`	string
`terminated_at`	string
`activated_at`	string
`issued_at`	string
`auto_top_up_configuration`	string
`created_at`	string
`cardholder`	object
`name`	string
`email`	string
`employee_id`	string
`segments`	object[]
`id`	string
`name`	string
`label`	string
`code`	string
`erp_internal_id`	string
`erp_code`	string
`custom_segments`	object[]
`id`	string
`name`	string
`label`	string
`code`	string
`erp_internal_id`	string
`erp_code`	string
`purchase_limits`	object
`frequency`	string
`amount`	string
`limit_currency`	string
`enabled`	boolean
`number_of_purchases`	string
`country_limits`	object
`restriction_mode`	string
`allowed_countries`	object[]
`blocked_countries`	object[]
`merchant_category_limits`	object
`restriction_type`	string
`categories`	object[]
`merchant_groups`	object[]
`topup_configuration`	object
`auto_topup_enabled`	boolean
`auto_topup_amount`	string
`frequency`	string
`atm_configuration`	object
`atm_withdrawal_allowed`	boolean
`frequency`	string
`max_amount`	string
`number_of_withdrawals`	string
`limit_per_withdrawal`	string
`meta`	object
`request_id`	string
`timestamp`	string

20 nested fields

`data.country_limits.allowed_countries[].id`	string
`data.country_limits.allowed_countries[].name`	string
`data.country_limits.allowed_countries[].label`	string
`data.country_limits.allowed_countries[].code`	string
`data.country_limits.allowed_countries[].erp_internal_id`	string
`data.country_limits.allowed_countries[].erp_code`	string
`data.country_limits.blocked_countries[].id`	string
`data.country_limits.blocked_countries[].name`	string
`data.country_limits.blocked_countries[].label`	string
`data.country_limits.blocked_countries[].code`	string
`data.country_limits.blocked_countries[].erp_internal_id`	string
`data.country_limits.blocked_countries[].erp_code`	string
`data.merchant_category_limits.categories[].name`	string
`data.merchant_category_limits.categories[].mcc_codes`	string[]
`data.merchant_category_limits.merchant_groups[].id`	string
`data.merchant_category_limits.merchant_groups[].name`	string
`data.merchant_category_limits.merchant_groups[].label`	string
`data.merchant_category_limits.merchant_groups[].code`	string
`data.merchant_category_limits.merchant_groups[].erp_internal_id`	string
`data.merchant_category_limits.merchant_groups[].erp_code`	string

Errors

401, 403, 404.

401Unauthorized - missing or invalid Bearer token
404Not Found - the requested resource does not exist

Every error carries an errors[] array and a meta.request_id. See Errors for the full envelope.

GET/public/v1/erp/cards/{cardId}

curl -X GET 'https://api.qashio.com/public/v1/erp/cards/%3AcardId' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer <access_token>'

const accessToken = process.env.QASHIO_ACCESS_TOKEN;

const response = await fetch('https://api.qashio.com/public/v1/erp/cards/%3AcardId', {
  method: 'GET',
  headers: {
    Accept: 'application/json',
    Authorization: `Bearer ${accessToken}`,
  },
});

if (!response.ok) {
  throw new Error(`Qashio API ${response.status}: ${await response.text()}`);
}

const { data, meta } = await response.json();
console.log(meta.request_id, data);

import https from 'node:https';

const url = new URL('https://api.qashio.com/public/v1/erp/cards/%3AcardId');

const payload = await new Promise((resolve, reject) => {
  const req = https.request(
    url,
    {
      method: 'GET',
      headers: {
      Accept: 'application/json',
      Authorization: `Bearer ${process.env.QASHIO_ACCESS_TOKEN}`,
      },
    },
    (res) => {
      let raw = '';
      res.on('data', (chunk) => (raw += chunk));
      res.on('end', () => resolve(JSON.parse(raw)));
    },
  );
  req.on('error', reject);
  req.end();
});

console.log(payload.data);

import os
import requests

url = "https://api.qashio.com/public/v1/erp/cards/%3AcardId"
headers = {
    "Accept": "application/json",
    "Authorization": f"Bearer {os.environ['QASHIO_ACCESS_TOKEN']}",
}

response = requests.get(url, headers=headers, timeout=30)
response.raise_for_status()

body = response.json()
print(body["meta"]["request_id"], body["data"])

<?php

$ch = curl_init('https://api.qashio.com/public/v1/erp/cards/%3AcardId');

curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST  => 'GET',
  CURLOPT_HTTPHEADER     => [
      'Accept: application/json',
      'Authorization: Bearer ' . getenv('QASHIO_ACCESS_TOKEN'),
  ],
]);

$response = curl_exec($ch);
curl_close($ch);

$body = json_decode($response, true);
print_r($body['data']);

package main

import (
	"encoding/json"
	"fmt"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.qashio.com/public/v1/erp/cards/%3AcardId", nil)
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Authorization", "Bearer "+os.Getenv("QASHIO_ACCESS_TOKEN"))

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	var out map[string]any
	json.NewDecoder(res.Body).Decode(&out)
	fmt.Println(out["data"])
}

require 'net/http'
require 'json'
require 'uri'

uri = URI('https://api.qashio.com/public/v1/erp/cards/%3AcardId')
request = Net::HTTP::Get.new(uri)
request['Accept'] = 'application/json'
request['Authorization'] = "Bearer #{ENV.fetch('QASHIO_ACCESS_TOKEN')}"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

body = JSON.parse(response.body)
puts body['data']

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class QashioExample {
  public static void main(String[] args) throws Exception {
    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://api.qashio.com/public/v1/erp/cards/%3AcardId"))
        .header("Accept", "application/json")
        .header("Authorization", "Bearer " + System.getenv("QASHIO_ACCESS_TOKEN"))
        .method("GET", HttpRequest.BodyPublishers.noBody())
        .build();

    HttpResponse<String> response = HttpClient.newHttpClient()
        .send(request, HttpResponse.BodyHandlers.ofString());

    System.out.println(response.body());
  }
}

using System;
using System.Net.Http;
using System.Threading.Tasks;

var client = new HttpClient();

var request = new HttpRequestMessage(new HttpMethod("GET"), "https://api.qashio.com/public/v1/erp/cards/%3AcardId");
request.Headers.Add("Accept", "application/json");
request.Headers.Add("Authorization", $"Bearer {Environment.GetEnvironmentVariable("QASHIO_ACCESS_TOKEN")}");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();

Console.WriteLine(await response.Content.ReadAsStringAsync());

import Foundation

var request = URLRequest(url: URL(string: "https://api.qashio.com/public/v1/erp/cards/%3AcardId")!)
request.httpMethod = "GET"
request.setValue("application/json", forHTTPHeaderField: "Accept")
let token = ProcessInfo.processInfo.environment["QASHIO_ACCESS_TOKEN"]!
request.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")

let (data, _) = try await URLSession.shared.data(for: request)
print(String(data: data, encoding: .utf8)!)

Response

{
  "status_code": 200,
  "success": true,
  "data": {
    "id": "CAj2w5b3w9hoe0ga",
    "card_nickname": "Qashio Card - 1",
    "company_name": "Qashio",
    "status": "Draft",
    "card_type": "Virtual",
    "masked_card_number": "************1234",
    "account_external_id": "AChhak778j2251b0",
    "account_type": "company_account",
    "card_currency": "AED",
    "allowed_max_balance": "10000.00",
    "float_management_enabled": false,
    "topup_type": "manual",
    "card_replaced": false,
    "transaction_limits_active": false,
    "purchase_limits_active": false,
    "country_limits_active": false,
    "category_limits_active": false,
    "atm_withdrawal_allowed": true,
    "low_balance_notification_active": false,
    "low_balance_notification_amount": "500.00",
    "terminated_at": "2026-08-06T07:30:44.941Z",
    "activated_at": "2026-08-06T07:30:44.941Z",
    "issued_at": "2026-08-06T07:30:44.941Z",
    "auto_top_up_configuration": "sample",
    "created_at": "2026-09-09T09:31:49.152Z",
    "cardholder": {
      "name": "John Doe",
      "email": "john.doe@example.com",
      "employee_id": ""
    },
    "segments": [
      {
        "id": "73a772d7-35b8-41a9-8d25-8ac4aab2145e",
        "name": "Qashio",
        "label": "id",
        "code": "UNAUTHORIZED",
        "erp_internal_id": "CAj2w5b3w9hoe0ga",
        "erp_code": "sample"
      }
    ],
    "custom_segments": [
      {
        "id": "73a772d7-35b8-41a9-8d25-8ac4aab2145e",
        "name": "Qashio",
        "label": "id",
        "code": "UNAUTHORIZED",
        "erp_internal_id": "CAj2w5b3w9hoe0ga",
        "erp_code": "sample"
      }
    ],
    "purchase_limits": {
      "frequency": "sample",
      "amount": "1000.00",
      "limit_currency": "AED",
      "enabled": false,
      "number_of_purchases": "sample"
    },
    "country_limits": {
      "restriction_mode": "sample",
      "allowed_countries": [
        {
          "id": null,
          "name": null,
          "label": null,
          "code": null,
          "erp_internal_id": null,
          "erp_code": null
        }
      ],
      "blocked_countries": [
        {
          "id": null,
          "name": null,
          "label": null,
          "code": null,
          "erp_internal_id": null,
          "erp_code": null
        }
      ]
    },
    "merchant_category_limits": {
      "restriction_type": "no_limit",
      "categories": [
        {
          "name": null,
          "mcc_codes": null
        }
      ],
      "merchant_groups": [
        {
          "id": null,
          "name": null,
          "label": null,
          "code": null,
          "erp_internal_id": null,
          "erp_code": null
        }
      ]
    },
    "topup_configuration": {
      "auto_topup_enabled": false,
      "auto_topup_amount": "1000.00",
      "frequency": "sample"
    },
    "atm_configuration": {
      "atm_withdrawal_allowed": true,
      "frequency": "sample",
      "max_amount": "5000.00",
      "number_of_withdrawals": "sample",
      "limit_per_withdrawal": "sample"
    }
  },
  "meta": {
    "request_id": "3adb2d16090c7b3bdbde3b326a814b30",
    "timestamp": "2026-09-09T10:07:52.143Z"
  }
}

{
  "status_code": 401,
  "success": false,
  "message": "Missing Bearer token",
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing Bearer token"
  },
  "errors": [
    {
      "code": "UNAUTHORIZED",
      "message": "Missing Bearer token",
      "field": "authorization"
    }
  ],
  "meta": {
    "request_id": "3adb2d16090c7b3bdbde3b326a814b30",
    "timestamp": "2026-09-09T10:07:52.143Z"
  }
}

{
  "status_code": 401,
  "success": false,
  "message": "Missing Bearer token",
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing Bearer token"
  },
  "errors": [
    {
      "code": "UNAUTHORIZED",
      "message": "Missing Bearer token",
      "field": "authorization"
    }
  ],
  "meta": {
    "request_id": "3adb2d16090c7b3bdbde3b326a814b30",
    "timestamp": "2026-09-09T10:07:52.143Z"
  }
}