--- title: "List Cards" method: GET path: "/v1/issuing/cards" tags: ["Card Lifecycle"] --- # List Cards `GET /v1/issuing/cards` Returns a list of issuing card objects. The objects are sorted in descending order by creation date, with the most recently created object appearing first. ## Query parameters - `page_size` integer, required - `page_number` integer, required - `card_number` string - `card_status` 'PENDING' | 'ACTIVE' | 'FROZEN' | 'BLOCKED' | 'PRE_CANCEL' | 'CANCELLED' | 'LOST' | 'STOLEN' | 'FAILED' — Card status enum. See the Card lifecycle and statuses guide for more information. - `PENDING`: The request to create the card has been received and is under review. - `ACTIVE`: The request to create the card was successful and the card is ready to use. - `FROZEN`: All incoming authorization requests will be declined. The card can be reactivated to accept new authorizations. - `BLOCKED`: The card was blocked by UQPAY due to suspicious activity. - `PRE_CANCEL`: The card is scheduled for cancellation and is in a waiting period during which all incoming authorization requests are declined. It transitions to `CANCELLED` when the waiting period ends. - `CANCELLED`: The card cannot be reactivated from this state, all incoming authorization requests will be permanently declined. - `LOST`: The card has been reported as lost to UQPAY. - `STOLEN`: The card has been reported as stolen to UQPAY. - `FAILED`: The request to create a card using [Create Card](/card-issuance/v1.6/api-reference/create-card) failed. - `cardholder_id` string, uuid — The cardholder's unique identifier. ## Headers - `x-on-behalf-of` string ## Response `200` OK - Successfully retrieved a list of cards. - object - `total_pages` integer — The total pages of available items. - `total_items` integer — The total counts of available items. - `data` ListCardsResponse[] - `card_id` string, required — Unique identifier for the card. - `card_bin` string, required — Card number prefix (BIN). - `card_scheme` string, required — Card scheme. - `card_currency` 'SGD' | 'USD' | 'XUSD' — The card currency. - `card_number` string, required — Masked card number - `form_factor` 'VIRTUAL' | 'PHYSICAL', required — Form of the card - `VIRTUAL` or `PHYSICAL`, currently only support virtual card. - `mode_type` 'SHARE' | 'SINGLE', required — Mode type enum - SINGLE or SHARE. * `SINGLE` - A single card only has prepaid mode. * `SHARE` - A share card can have debit mode, meaning it is associated with debit program and account. - `card_product_id` string, uuid — The card product's unique identifier. - `card_limit` number, required — The total credit limit assigned to the card, currency refer to `card_currency`. This is **not a cumulative balance**, but a fixed credit limit similar to that of a credit card. ##### Field behavior by card product: - **Business Mastercard** and **Personal Visa**: `card_limit` is **required** during card creation and must be **greater than or equal to 0.01**. - **Business Visa**: `card_limit` is **optional**. - If omitted, the system defaults `card_limit` to 0. - If provided, the value must be **greater than or equal to 0**, with up to two decimal places. **Negative values are not allowed.** See [Card products](/card-issuance/v1.6/guide/card-products) for the full capability matrix. - `available_balance` string, required — The available balance, currency refer to `card_currency`. - `cardholder` CardholderListCardsResponse, required - `cardholder_id` string, uuid — The cardholder's unique identifier. - `cardholder_status` 'FAILED' | 'PENDING' | 'SUCCESS' | 'INCOMPLETE' — The cardholder's status. - `create_time` string — Time at which the object was created. - `email` string — The cardholder's email address. - `first_name` string — The first name of this cardholder. Required before activating Cards. This field cannot contain any numbers, special characters (except periods, commas, hyphens, spaces and apostrophes) or non-latin letters. - `last_name` string — The last name of this cardholder. Required before activating Cards. This field cannot contain any numbers, special characters (except periods, commas, hyphens, spaces and apostrophes) or non-latin letters. - `risk_controls` RiskControls — User-customized risk control settings. Supported configurations depend on the card product. See [Card products](/card-issuance/v1.6/guide/card-products) for the capability matrix. - `enable_3ds` 'Y' | 'N' — Controls whether [3D Secure](https://en.wikipedia.org/wiki/3-D_Secure) is registered for this card. - `Y` — Register 3DS. The challenge behavior at transaction time is then governed by `allow_3ds_transactions`. - `N` — Do not register 3DS. Online transactions bypass 3DS authentication entirely. Supported on **Business Visa** and **Personal Visa** only; ignored on Business Mastercard. See [Card products](/card-issuance/v1.6/guide/card-products). Returned only when explicitly set on the card. When absent, the card follows the account-level 3DS configuration. Modifiable only when the card is in `PENDING` or `ACTIVE` status. - `allow_3ds_transactions` 'Y' | 'N' — Determines whether [3D Secure](https://en.wikipedia.org/wiki/3-D_Secure) challenge flow is allowed when a transaction triggers 3DS. - **When creating a card:** Defaults to `Y` if not provided. - **When updating a card:** No default. If not provided, the existing value remains unchanged. Supported on **Business Visa** only. See [Card products](/card-issuance/v1.6/guide/card-products). > **Note:** This field only takes effect when `enable_3ds` is `Y`. If `enable_3ds` is `N`, the card bypasses 3DS entirely and this field has no effect. > **Important:** When set to `N`, your card uses a frictionless 3DS authentication mechanism — transactions complete without OTP input and are treated as cardholder-authenticated. As a result, disputes based on fraud or unauthorized use cannot be raised for such transactions. For enhanced security, it is recommended to keep this set to `Y`. - `Y`: OTP verification may be required. - `N`: No OTP will be required. - `allowed_mcc` string[] — Specifies a whitelist of Merchant Category Codes (MCCs) that are permitted for transactions. All transactions under MCCs not listed here will be declined. **Note:** Only one of `allowed_mcc` or `blocked_mcc` can be configured per card. If neither is provided, transactions will follow the default risk control logic. - `blocked_mcc` string[] — Specifies a blacklist of Merchant Category Codes (MCCs) that are restricted for transactions. Transactions under these MCCs will be declined, while all other transactions will proceed through the standard UQPAY risk control evaluation. **Note:** Only one of `allowed_mcc` or `blocked_mcc` can be configured per card. If neither is provided, transactions will follow the default risk control logic. - `network_protection` NetworkProtection — ASAF Network Protection state embedded in card response objects. Returned only for Visa cards. - `enabled` boolean — Whether Network Protection is currently active on the card. - `card_scheme` string, nullable - `action_code` '04' | '41' | '43' | '46' | '54' — ASAF action code indicating the reason the card is enrolled in Network Protection. - `04` — Pickup card - `41` — Lost card, pickup - `43` — Stolen card, pickup - `46` — Closed account - `54` — Expired card - `definition` string, nullable — Human-readable description of `action_code`. - `status` 'NOT_ENROLLED' | 'ENROLL_PENDING' | 'ENROLL_FAILED' | 'ENROLLED' | 'REMOVAL_PENDING' — Lifecycle status of an ASAF Network Protection enrollment. - `submitted_time` string, date-time, nullable — Time at which the latest enrollment or removal request was submitted. - `metadata` Metadata — Any key-value object. Max length = 512 bytes. This must be valid JSON data. - `card_status` 'PENDING' | 'ACTIVE' | 'FROZEN' | 'BLOCKED' | 'PRE_CANCEL' | 'CANCELLED' | 'LOST' | 'STOLEN' | 'FAILED', required — Card status enum. See the Card lifecycle and statuses guide for more information. - `PENDING`: The request to create the card has been received and is under review. - `ACTIVE`: The request to create the card was successful and the card is ready to use. - `FROZEN`: All incoming authorization requests will be declined. The card can be reactivated to accept new authorizations. - `BLOCKED`: The card was blocked by UQPAY due to suspicious activity. - `PRE_CANCEL`: The card is scheduled for cancellation and is in a waiting period during which all incoming authorization requests are declined. It transitions to `CANCELLED` when the waiting period ends. - `CANCELLED`: The card cannot be reactivated from this state, all incoming authorization requests will be permanently declined. - `LOST`: The card has been reported as lost to UQPAY. - `STOLEN`: The card has been reported as stolen to UQPAY. - `FAILED`: The request to create a card using [Create Card](/card-issuance/v1.6/api-reference/create-card) failed. - `update_reason` string — The reason for updating card status. - `consumed_amount` string — Reflects the cumulative amount of the card limit that has already been used. --- [API](https://skmtc.dev/uqpay/apis/authentication-api.md) · [All operations](https://skmtc.dev/uqpay/apis/authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/uqpay/authentication-api/revisions/cef532a10777/schema)