---
title: "Query Card"
method: POST
path: "/v1/clients/{ClientID}/cards"
tags: ["Card"]
---

# Query Card

`POST /v1/clients/{ClientID}/cards`

Returns the attributes for the requested Payment Card.

Request to enable <Glossary>ANI</Glossary> or <Glossary>AVS</Glossary> at [TabaPay Support](https://tabapay.zendesk.com/hc/en-us/requests/new#/) or [help@tabapay.com](mailto:help@tabapay.com)

## Path parameters

- `ClientID` string, required

## Query parameters

- `AU` string
- `AVS` string
- `ANI` string
- `Fees` string

## Request body

- QueryCard
  - `account` object — TabaPay Account Details Incompatible with `card`. Exclusively use `account` or `card`.
    - `accountID` string, required — 22-character <<glossary:Account ID>>.
    - `securityCode` string — 3-4 digit <<glossary:Security Code>>, <<glossary:CVV>>, or <<glossary:CVV2>>. Optional. Include to request the verification of the security code.
  - `card` object — Payment Card Data. Choose ***exactly ONE*** of the following: - [Payment Card Not Encrypted](https://developers.tabapay.com/docs/glossary#payment-not-encrypted) - <<glossary:Payment Card Encrypted>> - `token` - `device` *object* - `mobilePay` *object* Incompatible with `account`. Exclusively use: `card` or `account`.
    - `accountNumber` string — Required field of ***[Payment Card Not Encrypted](https://developers.tabapay.com/docs/glossary#payment-not-encrypted)*** 13-19 digit Primary Account Number (PAN/Card Number) Compatible with `expirationDate` and `securityCode`, nothing else.
    - `expirationDate` string — Conditionally required field of ***[Payment Card Not Encrypted](https://developers.tabapay.com/docs/glossary#payment-not-encrypted)*** Expiration Date in YYYYMM format. Compatible with `accountNumber` and `securityCode`, nothing else.
    - `securityCode` string — Optional field of ***[Payment Card Not Encrypted](https://developers.tabapay.com/docs/glossary#payment-not-encrypted)*** 3-4 digit <<glossary:Security Code>>. Coorelates with <<glossary:CVV>>, or <<glossary:CVV2>>. Optional. Include to request the verification of the security code. Compatible with `accountNumber` and `expirationDate`, nothing else.
    - `keyID` string — Required field of ***<<glossary:Payment Card Encrypted>>*** 22 character KeyID. Ensure the RSA key you're using to encrypt the card data is consistent with this keyID Compatible with `data` and nothing else.
    - `data` string — Required field of ***<<glossary:Payment Card Encrypted>>*** [RSA-encrypted card data](https://developers.tabapay.com/reference/pci-helper-rsa#/what-data-do-i-encrypt) using RSA key with KeyID `keyID`. Compatible with `keyID` and nothing else
    - `token` string, byte — Card Token (from the [PCI-compliant iFrame](https://developers.tabapay.com/reference/browser-sdk#/basic-custom-iframe)) Incompatible with any other `card` field.
    - `device` Device — Card Data - From a [Secure Device](https://developers.tabapay.com/docs/card-present-transactions) - From a [GooglePay PaymentMethodToken](https://developers.tabapay.com/reference/googlepay#/y) Incompatible with any other `card` object(s) or field(s)
      - `id` string, required — Either a: - TabaPay-assigned device ID - [GooglePay|gatewayMerchantId](https://developers.tabapay.com/reference/googlepay#/)
      - `blob` string, required — URL-safe, Base64 encoded card data
    - `mobilePay` MobilePay — A Decrypted [Apple Pay](https://developers.tabapay.com/docs/apple-pay) Token
      - `accountNumber` string, required — Pseudo Payment Card Account Number
      - `expirationDate` string, required — Expiration Date in YYYYMM. Note: Convert YYMMDD format to YYYYMM.
      - `cryptogram` string, byte, required — Payment Data Cryptogram
      - `transactionID` string, byte, required — Transaction Identifier in Hex
      - `eciIndicator` string — 1-digit <<glossary:ECI>> Indicator. Remove any leading `0`s. For example if received ECI is `05` convert to `5` and populate this field Usually only present when `network` is `Visa`
      - `network` string, required — Card Network. - `Visa` - `MasterCard` - `Discover` - `Amex` - etc...
      - `type` string, required — Card Type. Either - `Debit` - `Credit` - `PrePaid` etc...
  - `owner` object, required — Owner Details
    - `name` Name, required — Name Use Either: (1) `company` **OR** (2) `first`, `middle`, `last`, and `suffix` If choosing (2), `first` and `last` are required, `middle` and `suffix` are optional*
      - `company` string — Company Name Incompatible with any other `name` field.
      - `first` string — First Name Incompatible with `company` name
      - `middle` string — Middle Name Incompatible with `company` name
      - `last` string — Last Name Incompatible with `company` name
      - `suffix` string — Suffix Incompatible with `company` name
    - `address` object — Address. *All fields optional.* However, if you're planning on using <<glossary:AVS>> in [QueryCard](https://developers.tabapay.com/reference/cardquery#/), provide an accurate `zipcode` at the minimum. And, if you can, provide an accurate `line1` value as well.
      - `line1` string — Address Line 1
      - `line2` string — Address Line 2
      - `city` string — City
      - `state` string — State Code [State Code](https://developers.tabapay.com/reference/us-state-codes#/) must be a valid 2-character code if `country` is [840](https://developers.tabapay.com/reference/country-codes#/) or [Canadian 2-char code](https://developers.tabapay.com/reference/canadian-province-codes#/) if [124](https://developers.tabapay.com/reference/country-codes#/).
      - `zipcode` string — Zip Code If `country` is `840`, `zipcode` must be 5 or 9 digits. If country is `124`, `zipcode` must be in the *A1A 1A1* format. Zip codes from other countries will not be checked.
      - `country` string — [Country Code](https://developers.tabapay.com/reference/country-codes#/) *Optional. Default is `840`*

## Response `200`

The Payment Card's Attributes are returned.

- QueryCardResponse
  - `SC` integer — [HTTP Status Code](https://developers.tabapay.com/reference/http-status-codes#/)
  - `EC` string — Internal Error Code. This is used to help TabaPay team members trace an error.
  - `EM` string — Short description of the error if an error occurred.
  - `card` object
    - `bin` string — First 6 digits of the card number
    - `last4` string — Last 4 digits of the card number
    - `nameFI` string — Issuer Name *Note:* 1. Not present if no issuer name found. 2. TabaPay will Include (CashApp) in `nameFI` if it is a CashApp BIN.
    - `pull` object — Debit Transaction
      - `enabled` string — Eligible for pull
      - `network` string — Payment network
      - `type` string — Product type – `Credit`, `Debit`, `PrePaid`
      - `regulated` boolean — Exempt/non-exempt from the debit card interchange fee standards
      - `currency` string — Corresponding issuer billing currency [4217 ISO 3-Digit Currency Code](https://developers.tabapay.com/reference/currency-numbers#/)
      - `country` string — [Corresponding issuer country code Country Code](https://developers.tabapay.com/reference/country-codes#/)
    - `push` object — Credit Transaction
      - `enabled` string — Eligible for push
      - `network` string — Payment network
      - `type` string — Product type – `Credit`, `Debit`, `PrePaid`
      - `regulated` boolean — Exempt/non-exempt from the debit card interchange fee standards
      - `currency` string — Corresponding issuer billing currency [ISO 4217 Currency Number](https://developers.tabapay.com/reference/currency-numbers#/)
      - `country` string — Corresponding issuer country code [Country Code](https://developers.tabapay.com/reference/country-codes#/)
      - `availability` string — Estimated Funds Availability: - `Immediate` => Funds are usually available in 30 minutes - `Next Business Day` => Funds are available Next Business day. - `Few Business Days` => Funds are available within a few business days.
  - `AU` object — Real Time Account Updater (RTAU) Results. Returns only if query string `AU` is present.
    - `reasonCode` string — Always present when `AU` is requested. For more info on values, refer to [Account Updater Codes](/reference/account-updater). - `U`: Unsupported card brand (not Visa/MasterCard). No lookup performed; original card unchanged; no card object. **Visa Values**: - `A`: Account number updated - `E`: Expiration date updated - `C`: Closed account advice - `Q`: Contact cardholder advice - `O`: Cardholder opted-out - `V`: Validation, account number and expiration date unchanged - `P`: Participating BIN, no match - `N`: Non-participating BIN - `101`: Non-numeric account number - `103`: Invalid expiry - `104`: Merchant not registered - `122`: Sub-merchant not registered **Mastercard Values:** - `UPDATE`: Account number updated - `EXPIRY`: Expiration date updated - `CONTAC`: Account Closed - `UNKNWN`: Account not found - `VALID`: Valid, details unchanged
    - `card` object — Present whenever at least one card field (below) is produced. Omitted if there is nothing to return (e.g., unsupported brand, or no change and no in-the-clear permission).
      - `accountNumber` string — Contains the effective (updated, or original if unchanged) full card number in the clear. Only when the client has the Receiving Card in the Clear permission.
      - `expirationDate` string — Effective expiration date (updated, or original if unchanged). Only when the client has the Receiving Card in the Clear permission.
      - `token` string — RSA-encrypted, `80`: prefixed token of the effective card payload. Only when the client does not have the in-the-clear permission and the request supplied a raw card number (not an account-based query).
      - `newBIN` string — First 6 digits (BIN) of the new card. Only when the client does not have the in-the-clear permission and the card number changed.
      - `newLast4` string — Last 4 digits of the new card. Only when the client does not have the in-the-clear permission and the card number changed.
      - `newExpirationDate` string — The new expiration date. Only when the client does not have the in-the-clear permission and the expiration date changed.
  - `AVS` object — <<glossary:AVS>> Results. Returns only if query string `AVS` is present.
    - `avsID` string — <<glossary:AVS>> Transaction Identifier
    - `networkRC` string — [Network Response Code](https://developers.tabapay.com/reference/iso-network-codes#/)
    - `networkID` string — NetworkID
    - `authorizeID` string — ID
    - `resultText` string — <<glossary:AVS>> Result Text. ***Optional***
    - `codeAVS` string — [<<glossary:AVS>> Response Code](https://developers.tabapay.com/reference/avs-response-codes#/)
    - `codeSecurityCode` string — [Security Code Response Code](https://developers.tabapay.com/reference/cvv2-response-codes#/)
    - `par` string — [Payment Account Reference](https://developers.tabapay.com/docs/payment-account-reference-par#/)
    - `codeMAC` string — [Merchant Advice Code](https://developers.tabapay.com/docs/merchant-advice-code-mac#/). Expected Values: - 01: New account information available - 02: Cannot approve at this time, try again later - 03: Do not try again - 04: Token requirements not fulfilled for this token type - 05: Negotiated value not approved - 21: Payment Cancellation (MasterCard use only) - 22: Merchant does not qualify for product code - 24: Retry after 1 hour (Mastercard use only) - 25: Retry after 24 hours (Mastercard use only) - 26: Retry after 2 days (Mastercard use only) - 27: Retry after 4 days (Mastercard use only) - 28: Retry after 6 days (Mastercard use only) - 29: Retry after 8 days (Mastercard use only) - 30: Retry after 10 days (Mastercard use only) - 40: Consumer non-reloadable prepaid card - 41: Consumer single-use virtual card number
    - `EC` string — Internal Error Code. This is used to help TabaPay team members trace an error.
    - `ANI` object — [<<glossary:ANI>> Results](https://developers.tabapay.com/reference/ani-response-codes). Present only if query string `ANI` is present.
      - `codeMatch` string — Whether the <<glossary:ANI>> match was performed. - `M` Match was performed. - `N` Match was ***not*** performed. - `U` ANI is not supported.
      - `codeFullName` string — Name match result for the full name (first + middle + last) - `M` Match. - `P` Partial Match. - `N` No Match.
      - `codeFirstName` string — First name match result - `M` Match. - `P` Partial Match. - `N` No Match.
      - `codeMiddleName` string — Middle name match result - `M` Match. - `P` Partial Match. - `N` No Match.
      - `codeLastName` string — Last name match result - `M` Match. - `P` Partial Match. - `N` No Match.
  - `fees` object — Fees Check. Present only if query string `Fees` is present.
    - `pull` object — Debit Transaction
      - `interchange` string — Interchange Fees
      - `network` string — Network Fees
      - `tabapay` string — TabaPay Fees
    - `push` object — Credit Transaction
      - `interchange` string — Interchange Fees
      - `network` string — Network Fees
      - `tabapay` string — TabaPay Fees
  - `limits` object — Card and user limits on the account.
    - `card` string — Card limit details for push and pull
    - `user` string — User limit details for push and pull
  - `RTM` string — (Coming Soon) Real-Time Monitoring (RTM) & Blocking details on the card
  - `subClientID` string — Unique subClientID of the merchant or subClient

## Other responses

- `207` — One or more Failures occurred while processing the Request.

---

[API](https://skmtc.dev/tabapay/apis/tabapay-apis.md) · [All operations](https://skmtc.dev/tabapay/apis/tabapay-apis/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/tabapay/tabapay-apis/revisions/154fa3d585cf/schema)