---
title: "List card issuing requests"
method: GET
path: "/v1/card_issuing_requests"
tags: ["Card issuing request"]
---

# List card issuing requests

`GET /v1/card_issuing_requests`

Returns a paginated list of card issuing requests for the company. A card
issuing request is what the dashboard creates when a user asks for a card:
it captures the requested budget, interval, and (for physical cards) the
shipping details, and is later approved by Cardda — producing the actual
`VendorCard` and setting `vendor_card_id`.

Authorization is `index? = admin? || in_company?`. A **non-admin** caller
must therefore resolve a company they belong to — supplied via the
`company-id` header (or a `company_id` query param). With neither present the
caller has no company membership, fails the gate, and the request returns
**401**. Admins bypass the gate.

Once authorized, the result is scoped per-caller via `policy_scope`. That
scope is not limited to the resolved company: it spans every company where
the caller holds the `card_issuing_requests_manage` permission, plus the
caller's own requests. Roles within that scope:
- **Admins** see every request.
- **Managers** (`card_issuing_requests_manage` permission) see every request
  of the companies they manage.
- Regular users see only their own requests (`user_id` matches their Firebase
  user id).

Each row includes the computed fields `kyc_completed` (whether the company
finished KYC) and `shipping_municipality_name` (municipality resolved from
the shipping address).

All operators in [Filters](https://docs.cardda.com/docs/filters) are supported
on the columns below.

## Query parameters

- `company_id` string, uuid
- `id` string
- `user_id` string
- `status` 'pending' | 'accepted' | 'declined' | 'printing' | 'printed' | 'sent' | 'delivered'
- `physical` boolean
- `vendor_id` string
- `type` string
- `created_at` string
- `$or` string

## Parameters

- `#/paths/~1v1~1merchants/get/parameters/0` — unresolved $ref
- `#/paths/~1v1~1merchants/get/parameters/2` — unresolved $ref
- `#/paths/~1v1~1merchants/get/parameters/3` — unresolved $ref
- `#/paths/~1v1~1merchants/get/parameters/4` — unresolved $ref
- `#/paths/~1v1~1merchants/get/parameters/5` — unresolved $ref

## Response `200`

Paginated list of card issuing requests. Headers include `X-Total-Count`
and `Content-Range` for offset pagination — see [Pagination](https://docs.cardda.com/docs/pagination).

- CardIssuingRequest[]
  - `id` string, uuid
  - `name` string, nullable — Display name requested for the card.
  - `user_id` string — Firebase user id of the future cardholder (not a UUID).
  - `company_id` string, uuid
  - `status` 'pending' | 'accepted' | 'declined' | 'printing' | 'printed' | 'sent' | 'delivered' — Lifecycle of the request. - `pending` — created, awaiting approval / issuing. - `accepted` — a card was issued and linked (`vendor_card_id` is set). - `declined` — rejected. - `printing` / `printed` — physical card in production. - `sent` — dispatched to the cardholder (admin marks this). - `delivered` — cardholder self-confirmed receipt (see `confirm_delivery`).
  - `budget_cents` integer — Requested spending budget in cents, in `budget_currency`.
  - `budget_currency` string — ISO-4217 code of the requested budget currency.
  - `interval` 'monthly' | 'daily' — Budget renewal interval for the resulting card.
  - `physical` boolean — Whether a physical (plastic) card is requested. `false` for virtual-only.
  - `purchase` 'national' | 'international' | 'both', nullable — Allowed purchase geography for the card.
  - `vendor_id` string, nullable — Issuing partner selected at approval time (e.g. `plh`, `pomelo`, `slash`).
  - `vendor_card_id` string, nullable — Id of the issued `VendorCard` once the request is accepted (vendor-prefixed string, not a UUID).
  - `type` string, nullable — STI subclass derived from `vendor_id` (e.g. `Cards::Plh::Request`).
  - `recipient_name` string, nullable — Recipient full name for physical shipments. Required for physical CLP requests.
  - `contact_phone` string, nullable — Contact phone for the physical shipment.
  - `shipping_address` object, nullable — Shipping address for physical CLP requests. `municipality_name` is enriched server-side from `municipality_id`.
    - `street` string
    - `number` string
    - `municipality_id` integer
    - `municipality_name` string
    - `complement` string, nullable
  - `shipping_municipality_name` string, nullable — Resolved municipality name for the shipping address (computed field).
  - `kyc_completed` boolean — Whether the owning company has completed KYC. Computed field. Serialized as the JSON key `kyc_completed` (the `?` Ruby predicate suffix is stripped).
  - `tracking_number` string, nullable — Carrier tracking number (staff-set). Only present for dispatched physical cards.
  - `tracking_url` string, nullable — Carrier tracking URL (staff-set).
  - `estimated_delivery_date` string, date, nullable — Estimated delivery date (staff-set).
  - `shipment_id` string, nullable — Vendor shipment identifier for physical cards.
  - `printing_at` string, date-time, nullable — When the request entered the `printing` milestone.
  - `sent_at` string, date-time, nullable — When the physical card was dispatched.
  - `delivered_at` string, date-time, nullable — When the cardholder confirmed delivery.
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `401` — Unauthorized — missing or invalid bearer token, or the caller is not permitted to list card issuing requests (Pundit authorization failure). A non-admin caller with no resolvable company context (no `company-id` header and no `company_id` query param) fails the `in_company?` check and lands here. Returned with an empty body.

---

[API](https://skmtc.dev/cardda/apis/banking-api.md) · [All operations](https://skmtc.dev/cardda/apis/banking-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cardda/banking-api/revisions/ff1aeb3fda8b/schema)