---
title: "List the business's card accounts."
method: GET
path: "/ledger/card-accounts"
tags: ["ledger-card accounts"]
---

# List the business's card accounts.

`GET /ledger/card-accounts`

## Request

- Base URL: `https://external.dev.onboardpay.co`
- URL: `https://external.dev.onboardpay.co/ledger/card-accounts`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/nestechops/apis/onboard-external-api-gateway/docs/ledger/card-accounts/get.ts> (a function with typed inputs; its response is checked against the schema)

## Query parameters

- `size` integer
- `page` integer

## Response `200`

Card accounts fetched successfully

- CardAccountList: Base object for paginated list
  - `name` string: Descriptive name for the list
  - `size` integer: Positive integer
  - `totalItems` integer: Positive integer
  - `nextPage` integer: Positive integer
  - `previousPage` integer: Positive integer
  - `content` CardAccount[], required
    - `id` string, uuid, required: Unique card account ID.
    - `accountId` string, uuid, required: The MAIN account this card is funded from.
    - `currency` string, required
    - `status` 'PENDING_KYC' | 'PENDING_PROVISIONING' | 'ACTIVE' | 'FROZEN' | 'TERMINATED' | 'KYC_REJECTED' | 'CREATION_FAILED', required: Lifecycle of a card account. PENDING_KYC and PENDING_PROVISIONING are transient - a card only starts moving money once it reaches ACTIVE. KYC_REJECTED and CREATION_FAILED are terminal with no funds ever moved (the dedicated ledger account is only created once KYC is approved).
    - `balance` number, required: The card's live spendable balance.
    - `failureReason` string: Populated when status is KYC_REJECTED or CREATION_FAILED.
    - `spendControls` CardSpendControls
      - `dailyLimit` number
      - `transactionLimit` number
      - `whitelistedMccs` string[]
      - `blacklistedMccs` string[]
      - `contactlessPaymentEnabled` boolean
    - `createdDate` string, date-time, required
    - `cardDetails` CardDetails: Physical/visual card attributes, kept separate from the account-level fields above.
      - `displayName` string
      - `cardBrand` 'VISA' | 'MASTERCARD' | 'VERVE'
      - `cardType` string: Always VIRTUAL in this release.
      - `cardHolderName` string: The name embossed on the card, as assigned by the card provider.
      - `maskedCardNumber` string
      - `expiryMonth` string
      - `expiryYear` string
      - `billingAddress` CardBillingAddress: The card's billing address, as returned by the card provider. Response-only - fields are populated only when the provider supplies them, so none are required here (contrast CardHolderAddress, which validates a request body where every field must be present).
        - `address` string
        - `city` string
        - `state` string
        - `country` string
        - `postalCode` string
        - `zipCode` string
        - `houseNo` string
      - `encryptedCardDetails` string: Base64 RSA-encrypted {pan, cvv, expiryMonth, expiryYear} blob, populated only when fetched via GET /card-accounts/{cardAccountId}/details with a public key.

## Other responses

- `401`: Client is not authorized to make request
- `403`: Expected permission is not available.
- `default`: Internal Server Error

## Changes

- **2026-09-08** `5b7b2c163546`: 2 info
  - added the optional property `allOf[subschema #2]/content/items/cardDetails/billingAddress` to the response with the `200` status
  - added the optional property `allOf[subschema #2]/content/items/cardDetails/cardHolderName` to the response with the `200` status
- **2026-09-03** `1805362fe220`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/nestechops/apis/onboard-external-api-gateway/changes/ledger/card-accounts/get.md)

---

[API](https://skmtc.dev/nestechops/apis/onboard-external-api-gateway.md) - [All operations](https://skmtc.dev/nestechops/apis/onboard-external-api-gateway/llms.txt) - [OpenAPI document](https://skmtc.dev/nestechops/apis/onboard-external-api-gateway/revisions/5da9ec1b2573?raw)