---
title: "List transactions"
method: GET
path: "/transactions"
tags: ["Transaction"]
---

# List transactions

`GET /transactions`

List transactions.

## Query parameters

- `card_token` string, uuid
- `result` 'APPROVED' | 'DECLINED'
- `begin` string, date-time
- `end` string, date-time
- `page` integer
- `page_size` integer

## Response `200`

OK

- object
  - `data` Transaction[]
    - `acquirer_reference_number` string, nullable — A fixed-width 23-digit numeric identifier for the Transaction that may be set if the transaction originated from the Mastercard network. This number may be used for dispute tracking.
    - `amount` integer — Authorization amount (in USD cents) of the transaction. This may change over time, and will represent the settled amount once the transaction is settled.
    - `authorization_amount` integer — Authorization amount (in USD cents) of the transaction. This amount always represents the amount authorized for the transaction, unaffected by settlement.
    - `cardholder_authentication` CardholderAuthentication, nullable
      - `3ds_version` string, nullable, required — 3-D Secure Protocol version. Possible values: * `1`: 3-D Secure Protocol version 1.x applied to the transaction. * `2`: 3-D Secure Protocol version 2.x applied to the transaction. * `null`: 3-D Secure was not used for the transaction
      - `acquirer_exemption` 'AUTHENTICATION_OUTAGE_EXCEPTION' | 'LOW_VALUE' | 'MERCHANT_INITIATED_TRANSACTION' | 'NONE' | 'RECURRING_PAYMENT' | 'SECURE_CORPORATE_PAYMENT' | 'STRONG_CUSTOMER_AUTHENTICATION_DELEGATION' | 'TRANSACTION_RISK_ANALYSIS', required — Exemption applied by the ACS to authenticate the transaction without requesting a challenge. Possible values: * `AUTHENTICATION_OUTAGE_EXCEPTION`: Authentication Outage Exception exemption. * `LOW_VALUE`: Low Value Payment exemption. * `MERCHANT_INITIATED_TRANSACTION`: Merchant Initiated Transaction (3RI). * `NONE`: No exemption applied. * `RECURRING_PAYMENT`: Recurring Payment exemption. * `SECURE_CORPORATE_PAYMENT`: Secure Corporate Payment exemption. * `STRONG_CUSTOMER_AUTHENTICATION_DELEGATION`: Strong Customer Authentication Delegation exemption. * `TRANSACTION_RISK_ANALYSIS`: Acquirer Low-Fraud and Transaction Risk Analysis exemption. Maps to the 3-D Secure `transChallengeExemption` field.
      - `liability_shift` '3DS_AUTHENTICATED' | 'ACQUIRER_EXEMPTION' | 'NONE' | 'TOKEN_AUTHENTICATED', required — Indicates whether chargeback liability shift applies to the transaction. Possible values: * `3DS_AUTHENTICATED`: The transaction was fully authenticated through a 3-D Secure flow, chargeback liability shift applies. * `ACQUIRER_EXEMPTION`: The acquirer utilised an exemption to bypass Strong Customer Authentication (`transStatus = N`, or `transStatus = I`). Liability remains with the acquirer and in this case the `acquirer_exemption` field is expected to be not `NONE`. * `NONE`: Chargeback liability shift has not shifted to the issuer, i.e. the merchant is liable. * `TOKEN_AUTHENTICATED`: The transaction was a tokenized payment with validated cryptography, possibly recurring. Chargeback liability shift to the issuer applies.
      - `verification_attempted` 'APP_LOGIN' | 'BIOMETRIC' | 'NONE' | 'OTHER' | 'OTP', required — Verification attempted values: * `APP_LOGIN`: Out-of-band login verification was attempted by the ACS. * `BIOMETRIC`: Out-of-band biometric verification was attempted by the ACS. * `NONE`: No cardholder verification was attempted by the Access Control Server (e.g. frictionless 3-D Secure flow, no 3-D Secure, or stand-in Risk Based Analysis). * `OTHER`: Other method was used by the ACS to verify the cardholder (e.g. Mastercard Identity Check Express, recurring transactions, etc.) * `OTP`: One-time password verification was attempted by the ACS.
      - `verification_result` 'CANCELLED' | 'FAILED' | 'FRICTIONLESS' | 'NOT_ATTEMPTED' | 'REJECTED' | 'SUCCESS', required — This field partially maps to the `transStatus` field in the [EMVCo 3-D Secure specification](https://www.emvco.com/emv-technologies/3d-secure/) and Mastercard SPA2 AAV leading indicators. Verification result values: * `CANCELLED`: Authentication/Account verification could not be performed, `transStatus = U`. * `FAILED`: Transaction was not authenticated. `transStatus = N`, note: the utilization of exemptions could also result in `transStatus = N`, inspect the `acquirer_exemption` field for more information. * `FRICTIONLESS`: Attempts processing performed, the transaction was not authenticated, but a proof of attempted authentication/verification is provided. `transStatus = A` and the leading AAV indicator was one of {`kE`, `kF`, `kQ`}. * `NOT_ATTEMPTED`: A 3-D Secure flow was not applied to this transaction. Leading AAV indicator was one of {`kN`, `kX`} or no AAV was provided for the transaction. * `REJECTED`: Authentication/Account Verification rejected; `transStatus = R`. Issuer is rejecting authentication/verification and requests that authorization not be attempted. * `SUCCESS`: Authentication verification successful. `transStatus = Y` and leading AAV indicator for the transaction was one of {`kA`, `kB`, `kC`, `kD`, `kO`, `kP`, `kR`, `kS`}. Note that the following `transStatus` values are not represented by this field: * `C`: Challenge Required * `D`: Challenge Required; decoupled authentication confirmed * `I`: Informational only * `S`: Challenge using Secure Payment Confirmation (SPC)
    - `merchant_amount` integer — Analogous to the "amount" property, but represents the amount in the local currency at the time of the transaction.
    - `merchant_authorization_amount` integer — Analogous to the "authorization_amount" property, but represents the amount in the local currency at the time of the transaction.
    - `merchant_currency` string — 3-digit alphabetic ISO 4217 code for the local currency of the transaction.
    - `authorization_code` string — A fixed-width 6-digit numeric identifier that can be used to identify a transaction with networks.
    - `card_token` string, uuid — Globally unique identifier for the Card.
    - `created` string, date-time — Date and time when the transaction first occurred. UTC time zone.
    - `events` Event[] — A list of all events that have modified this transaction.
      - `amount` integer, required — Amount (in cents) of the transaction event.
      - `created` string, date-time, required — ISO 8601 date and time this event entered the system. UTC time zone.
      - `result` 'ACCOUNT_STATE_TRANSACTION' | 'APPROVED' | 'BANK_CONNECTION_ERROR' | 'BANK_NOT_VERIFIED' | 'CARD_CLOSED' | 'CARD_PAUSED' | 'FRAUD_ADVICE' | 'GLOBAL_TRANSACTION_LIMIT' | 'GLOBAL_WEEKLY_LIMIT' | 'GLOBAL_MONTHLY_LIMIT' | 'INACTIVE_ACCOUNT' | 'INCORRECT_PIN' | 'INVALID_CARD_DETAILS' | 'INSUFFICIENT_FUNDS' | 'MERCHANT_BLACKLIST' | 'SINGLE_USE_RECHARGED' | 'SWITCH_INOPERATIVE_ADVICE' | 'UNAUTHORIZED_MERCHANT' | 'UNKNOWN_HOST_TIMEOUT' | 'USER_TRANSACTION_LIMIT', required — `APPROVED` or decline reason. Result types: * `ACCOUNT_STATE_TRANSACTION_FAIL` - Contact [support@privacy.com](mailto:support@privacy.com). * `APPROVED` - Transaction is approved. * `BANK_CONNECTION_ERROR` - Please reconnect a funding source. * `BANK_NOT_VERIFIED` - Please confirm the funding source. * `CARD_CLOSED` - Card state was closed at the time of authorization. * `CARD_PAUSED` - Card state was paused at the time of authorization. * `FRAUD_ADVICE` - Transaction declined due to risk. * `GLOBAL_TRANSACTION_LIMIT` - Platform spend limit exceeded, contact [support@privacy.com](mailto:support@privacy.com). * `GLOBAL_WEEKLY_LIMIT` - Platform spend limit exceeded, contact [support@privacy.com](mailto:support@privacy.com). * `GLOBAL_MONTHLY_LIMIT` - Platform spend limit exceeded, contact [support@privacy.com](mailto:support@privacy.com). * `INACTIVE_ACCOUNT` - Account is inactive. Contact [support@privacy.com](mailto:support@privacy.com). * `INCORRECT_PIN` - PIN verification failed. * `INVALID_CARD_DETAILS` - Incorrect CVV or expiry date. * `INSUFFICIENT_FUNDS` - Please ensure the funding source is connected and up to date. * `MERCHANT_BLACKLIST` - This merchant is disallowed on the platform. * `SINGLE_USE_RECHARGED` - Single use card attempted multiple times. * `SWITCH_INOPERATIVE_ADVICE` - Network error, re-attempt the transaction. * `UNAUTHORIZED_MERCHANT` - Merchant locked card attempted at different merchant. * `UNKNOWN_HOST_TIMEOUT` - Network error, re-attempt the transaction. * `USER_TRANSACTION_LIMIT` - User-set spend limit exceeded.
      - `token` string, uuid, required — Globally unique identifier.
      - `type` 'AUTHORIZATION' | 'AUTHORIZATION_ADVICE' | 'CLEARING' | 'RETURN' | 'VOID' | 'TRANSACTION_CORRECTION_DEBIT' | 'TRANSACTION_CORRECTION_CREDIT', required — Event types: * `AUTHORIZATION` - Authorize a transaction. * `AUTHORIZATION_ADVICE` - Advice on a transaction. * `CLEARING` - Transaction is settled. * `RETURN` - A return authorization. * `VOID` - Transaction is voided. * `TRANSACTION_CORRECTION_DEBIT` - Manual transaction correction (Debit). * `TRANSACTION_CORRECTION_CREDIT` - Manual transaction correction (Credit).
    - `funding` object — A list of objects that describe how this transaction was funded, with the `amount` represented in cents. A reference to the funding account for the `card` that made this transaction may appear here and the `token` will match the `token` for the funding account in the `card` field. If any promotional credit was used in paying for this transaction, its `type` will be `PROMO`.
      - `amount` integer — Funding amount (in cents).
      - `token` string — Funding account token.
      - `type` 'PROMO' — Types of funding: * `PROMO` - Any promotional credit was used in paying for this transaction.
    - `merchant` Merchant
      - `acceptor_id` string — Unique identifier to identify the payment card acceptor.
      - `city` string — City of card acceptor.
      - `country` string — Uppercase country of card acceptor (see ISO 8583 specs).
      - `descriptor` string — Short description of card acceptor.
      - `mcc` string — Merchant category code (MCC). A four-digit number listed in ISO 18245. An MCC is used to classify a business by the types of goods or services it provides.
      - `state` string — Geographic state of card acceptor (see ISO 8583 specs).
    - `network` string — Card network of the authorization. Can be `INTERLINK`, `MAESTRO`, `MASTERCARD`, `VISA`, or `UNKNOWN`. Value is `UNKNOWN` when Privacy cannot determine the network code from the upstream provider.
    - `result` 'ACCOUNT_STATE_TRANSACTION' | 'APPROVED' | 'BANK_CONNECTION_ERROR' | 'BANK_NOT_VERIFIED' | 'CARD_CLOSED' | 'CARD_PAUSED' | 'FRAUD_ADVICE' | 'GLOBAL_TRANSACTION_LIMIT' | 'GLOBAL_WEEKLY_LIMIT' | 'GLOBAL_MONTHLY_LIMIT' | 'INACTIVE_ACCOUNT' | 'INCORRECT_PIN' | 'INVALID_CARD_DETAILS' | 'INSUFFICIENT_FUNDS' | 'MERCHANT_BLACKLIST' | 'SINGLE_USE_RECHARGED' | 'SWITCH_INOPERATIVE_ADVICE' | 'UNAUTHORIZED_MERCHANT' | 'UNKNOWN_HOST_TIMEOUT' | 'USER_TRANSACTION_LIMIT' — `APPROVED` or decline reason. See Event result types
    - `settled_amount` integer — Amount (in cents) of the transaction that has been settled. This may change over time.
    - `status` 'BOUNCED' | 'DECLINED' | 'PENDING' | 'SETTLED' | 'SETTLING' | 'VOIDED' — Status types: * `BOUNCED` - There was an error settling the transaction against the funding source. Your API account may be disabled. * `DECLINED` - The transaction was declined. * `PENDING` - Authorization is pending completion from the merchant. * `SETTLED` - The transaction is complete. * `SETTLING` - The merchant has completed the transaction and the funding source is being debited. * `VOIDED` - The merchant has voided the previously pending authorization.
    - `token` string, uuid — Globally unique identifier.
  - `page` integer — Page of the result.
  - `total_entries` integer — Number of matched rows.
  - `total_pages` integer — Total pages of result.

## Other responses

- `400` — A parameter in the query given in the request does not match the valid queries for the endpoint.
- `401` — | | | |---|---| | User has not been authenticated | Invalid or missing API key | | API key is not active | The API key used is no longer active | | Could not find API key | The API key provided is not associated with any user | | Please provide API key in Authorization header | The Authorization header is not in the request | | Please provide API key in the form Authorization: api-key [api-key] | The Authorization header is not formatted properly | | Insufficient privileges. Issuing API key required | Write access requires an Issuing API key. Please contact [api@privacy.com](mailto:api@privacy.com) | | Insufficient privileges to create unlocked cards. | Creating unlocked cards requires an additional privilege | Please contact [api@privacy.com](mailto:api@privacy.com) |
- `404` — The specified resource was not found.
- `429` — Client has exceeded the number of allowed requests in a given time period. | | | |---|---| | Rate limited, too many requests per second | User has exceeded their per second rate limit | | Rate limited, reached daily limit | User has exceeded their daily rate limit | | Rate limited, too many keys tried | One IP has queried too many different API keys |

---

[API](https://skmtc.dev/privacy/apis/privacy-developer-api.md) · [All operations](https://skmtc.dev/privacy/apis/privacy-developer-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/privacy/privacy-developer-api/revisions/85ef2cf28e6b/schema)