List card issuing requests
Returns a paginated list of card issuing requests for the company. A card issuing request is what the dashboard creates when a user asks for a card: it captures the requested budget, interval, and (for physical cards) the shipping details, and is later approved by Cardda — producing the actual VendorCard and setting vendor_card_id.
Authorization is index? = admin? || in_company?. A non-admin caller must therefore resolve a company they belong to — supplied via the company-id header (or a company_id query param). With neither present the caller has no company membership, fails the gate, and the request returns 401. Admins bypass the gate.
Once authorized, the result is scoped per-caller via policy_scope. That scope is not limited to the resolved company: it spans every company where the caller holds the card_issuing_requests_manage permission, plus the caller's own requests. Roles within that scope:
- Admins see every request.
- Managers (card_issuing_requests_manage permission) see every request of the companies they manage.
- Regular users see only their own requests (user_id matches their Firebase user id).
Each row includes the computed fields kyc_completed (whether the company finished KYC) and shipping_municipality_name (municipality resolved from the shipping address).
All operators in Filters are supported on the columns below.
Query parameters
Company-context fallback used when the company-id header is absent. A non-admin caller must resolve a company they belong to (header or this query param) to pass the in_company? gate; admins may omit both.
Filter by request id. Use id={"$in":[...]} for batch lookups.
Firebase user id of the requesting cardholder.
Lifecycle status. Use $or/$in to paint a dashboard, e.g. hide finished requests with status={"$nin":["accepted","declined"]}.
Whether the request is for a physical card.
Issuing partner selected at approval time (e.g. plh, pomelo, slash).
STI subclass derived from vendor_id.
Creation timestamp. Accepts a single ISO-8601 date-time string or a JSON-encoded operator object ({"$gte":"...","$lt":"..."}). Schema is type: string (no format) so both forms validate.
Logical OR across sub-conditions, e.g. $or=[{"status":"pending"},{"status":"printing"}].
Parameters
Response
Paginated list of card issuing requests. Headers include X-Total-Count and Content-Range for offset pagination — see Pagination.
Example response
[
{
"id": "9f8b2c1d-4e5a-6b7c-8d9e-0f1a2b3c4d5e",
"name": "Marketing — María Pérez",
"user_id": "U2MGkNZT6zNPKtB85OpJi9SjFvG2",
"company_id": "550e8400-e29b-41d4-a716-446655440000",
"status": "pending",
"budget_cents": 500000,
"budget_currency": "CLP",
"interval": "monthly",
"purchase": "both",
"vendor_id": "plh",
"vendor_card_id": "Q2FyZDoxMDIwNjQ5Mw==",
"type": "Cards::Plh::Request",
"recipient_name": "María Pérez",
"contact_phone": "+56912345678",
"shipping_address": {
"street": "Av. Apoquindo",
"number": "4700",
"municipality_id": 13114,
"municipality_name": "Las Condes",
"complement": "Oficina 501"
},
"shipping_municipality_name": "Las Condes",
"kyc_completed": true,
"tracking_number": "CL123456789",
"tracking_url": "https://tracking.example.com/CL123456789",
"estimated_delivery_date": "2026-08-01"
}
]