---
title: "Retrieve extended card profile"
method: POST
path: "/v1/users/{userId}/creditCards/extendedProfile"
tags: ["User Management"]
---

# Retrieve extended card profile

`POST /v1/users/{userId}/creditCards/extendedProfile`

## Request

- Base URL: `https://sandbox-api.spinwheel.io`
- URL: `https://sandbox-api.spinwheel.io/v1/users/{userId}/creditCards/extendedProfile`
- Auth: API key in header `Authorization`

Returns the data you need to display and transact on a connected user's credit cards: card brand name, card art and, on the secure host, the expiration date.

This endpoint is synchronous. You get one request and one response, with nothing to poll and no webhook.

### Hosts

The request is the same on both hosts. The host you call decides which fields come back.

- **Secure host:** returns all fields, including `expirationDate`.
  - Production: `https://secure-api.spinwheel.io`
  - Sandbox: `https://secure-sandbox-api.spinwheel.io`
- **Standard host:** returns all fields except `expirationDate`.
  - Production: `https://api.spinwheel.io`
  - Sandbox: `https://sandbox-api.spinwheel.io`

> 🚧 Secure API access required
>
> The secure host works only if the secure API is enabled for your account. Contact your Spinwheel representative to turn it on.

### Response behavior

**Only open cards are returned.** Closed accounts are left out of the response, so you don't need to filter them yourself. The one exception: if you name a closed card in `creditCardIds`, it comes back with status `CREDIT_CARD_ACCOUNT_CLOSED`.

> 📘 Card counts may differ from the Debt Profile
>
> Closed cards are left out, so expect this endpoint to return fewer entries than the Debt Profile shows for the same user.

**Check for each field, not for the status.** A card can have status `SUCCESS` and still have no `expirationDate`. On the standard host, no card ever includes one. Check whether the field is present before you use it.

### Statuses that need action

- `USER_INPUT_REQUIRED`: Spinwheel needs the card number or the expiration date from the user. Collect it and send it with [Credit Card Profile Update](ref:update), which is available on the secure host only.
- `CREDIT_CARD_ACCOUNT_CLOSED`: The card you named in `creditCardIds` is closed. No action needed: remove the card from your UI.

## Path parameters

- `userId` string, required

## Request body

- ExtendedCardProfileRequest
  - `creditCardIds` string[]: The cards to retrieve data for, as returned by the Debt Profile. Omit the field entirely to receive every open card the user holds. An empty array is rejected.

## Response `200`

Per-card results. Per-card failures do not fail the request.

- ExtendedCardProfileResponse
  - `status` ResponseStatus, required
    - `code` number
    - `desc` string
    - `messages` Message[]
      - `desc` string, required
      - `type` 'ERROR' | 'WARN' | 'INFO'
  - `data` ExtendedCardProfileData, required
    - `userId` string, required: Echoed from the request path.
    - `creditCards` ExtendedCardProfileCard[], required: One entry per open card, or per card named in the request.
      - `creditCardId` string, required: The card this entry describes.
      - `status` 'SUCCESS' | 'CREDIT_CARD_NOT_SUPPORTED' | 'CREDIT_CARD_ACCOUNT_CLOSED' | 'USER_INPUT_REQUIRED' | 'INVALID_CARD_NUMBER' | 'UNKNOWN_ERROR', required
      - `cardBrand` CreditCardBrand
        - `cardName` string: Name of the card brand
        - `cardArtUrl` string: URL of the card art
        - `updatedOn` number: Timestamp of the last update
      - `expirationDate` ExpirationDate
        - `month` string, required: Two digits, zero-padded.
        - `year` string, required: Four digits.

## Other responses

- `400`: Bad request response
- `401`: Unauthorized response
- `403`: Called on the secure host, and the secure API is not enabled for your account. Call the standard host, which returns every field except `expirationDate`, or contact Spinwheel to enable the secure API.
- `404`: Not found response
- `500`: Internal server error response

---

[API](https://skmtc.dev/spinwheel/apis/optimize.md) - [All operations](https://skmtc.dev/spinwheel/apis/optimize/llms.txt) - [OpenAPI document](https://skmtc.dev/spinwheel/apis/optimize/revisions/6222309663d2?raw)