---
title: "Read card capture state"
method: GET
path: "/vault/card-captures/current"
tags: ["Vaults"]
---

# Read card capture state

`GET /vault/card-captures/current`

## Request

- Base URL: `https://api.onkernel.com`
- URL: `https://api.onkernel.com/vault/card-captures/current`
- Auth: none required

Capability-only browser protocol for embedded card capture. Authorization is Bearer <capture_token>, not an API key. No cookies. Cross-origin GET, POST and OPTIONS are allowed without credentials. Query strings are rejected.

## Headers

- `Authorization` string, required

## Response `200`

Capture state; active includes create-only Collect credentials, completed includes only status.

- object
  - `access_token` string
  - `capture_session` string: Stored as the capture_session meta of each card the Collect form creates. Enrollment accepts only a card that carries it.
  - `environment` 'sandbox' | 'live'
  - `expires_at` string, date-time
  - `status` 'active' | 'completed', required
  - `vault_id` string

## Other responses

- `400`: invalid_request, invalid_capture, or card_rejected.
- `401`: capture_unauthorized.
- `409`: capture_in_progress, card_in_use, or capture_unconfirmed.
- `410`: capture_expired or capture_unavailable.
- `429`: rate_limited.
- `500`: capture_failed.
- `503`: capture_retry.

## Changes

- **2026-11-02** `0f6cf4f58fe6`: 1 info
  - added the optional property `capture_session` to the response with the `200` status
- **2026-10-20** `d68735be0749`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/kernel/apis/kernel-api/changes/vault/card-captures/current/get.md)

---

[API](https://skmtc.dev/kernel/apis/kernel-api.md) - [All operations](https://skmtc.dev/kernel/apis/kernel-api/llms.txt) - [OpenAPI document](https://skmtc.dev/kernel/apis/kernel-api/revisions/0f6cf4f58fe6?raw)