---
title: "List Cards"
method: GET
path: "/cards"
tags: ["Cards"]
---

# List Cards

`GET /cards`

## Request

- Base URL: `https://api.meow.com/v1`
- URL: `https://api.meow.com/v1/cards`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/meow/apis/meow-api/docs/cards/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns the cards you have access to. As an admin or viewer you see all entity cards; as a card manager you see your team's cards; as a card user you see only your own.

## Query parameters

- `filters` ListCardsFilter
  - `query` string, nullable: Free-text search over card nickname, last 4 digits, and cardholder name.
  - `statuses` CardStatus[], nullable: Filter to one or more card statuses, as a list, e.g. `["active"]`. Omit to return every status.
  - `card_types` CardFormFactor[]: Filter to physical and/or virtual cards. Empty returns both.
  - `from_created_time` string, date-time, nullable: Only return cards created at or after this time (ISO 8601).
  - `to_created_time` string, date-time, nullable: Only return cards created at or before this time (ISO 8601).
- `limit` integer: Maximum number of results to return.
- `offset` string, nullable: Opaque offset identifier for pagination. Use the nextOffset from a previous response.

## Headers

- `x-entity-id` string, uuid

## Response `200`

Successful Response

- CardsResponse
  - `data` CardResponse[], required: The cards you have access to.
    - `id` string, uuid, required: Unique card identifier.
    - `display_name` string, required: Card name or nickname.
    - `last_four` string, nullable, required: Last 4 digits of the card number. Null until the issuer assigns the card number, so pending cards have no value.
    - `status` 'pending' | 'active' | 'suspended' | 'closed' | 'failed', required
    - `is_physical` boolean, required: Whether this is a physical card.
    - `is_single_use` boolean: Whether this is a single-use card.
    - `cardholder` CardCardholder, required
      - `name` string, required: Cardholder's full name.
      - `public_id` string, uuid, nullable: Cardholder's public user ID.
    - `created_at` string, date-time, required: ISO 8601 date-time in the format `YYYY-MM-DDThh:mm:ss.nnn[Z|[+|-]hh:mm]` (per [IETF RFC 3339](https://xml2rfc.tools.ietf.org/public/rfc/html/rfc3339.html#anchor14)).
    - `expiration` string, date-time: ISO 8601 date-time in the format `YYYY-MM-DDThh:mm:ss.nnn[Z|[+|-]hh:mm]` (per [IETF RFC 3339](https://xml2rfc.tools.ietf.org/public/rfc/html/rfc3339.html#anchor14)).
    - `spending_restriction` CardSpendingRestriction
      - `type` 'allow' | 'block', required
      - `merchants` string[], required: Merchant names in the restriction list.
    - `allowed_categories` CardTransactionCategory[], nullable: Merchant categories the card is restricted to. Null means every category is allowed.
  - `page` PageMetadata
    - `nextOffset` string, nullable: Opaque offset identifier.

## Other responses

- `400`: The request could not be processed.
- `401`: Authentication failed.
- `403`: The API key is not authorized for this operation, or the user of a global API key is an admin or controller without approved KYC. The KYC case returns the message `KYC is required for controllers and admins.` until that user completes KYC in the Meow dashboard.
- `429`: Too many requests.

---

[API](https://skmtc.dev/meow/apis/meow-api.md) - [All operations](https://skmtc.dev/meow/apis/meow-api/llms.txt) - [OpenAPI document](https://skmtc.dev/meow/apis/meow-api/revisions/ea2d7e25b63b?raw)