---
title: "Retrieve a credential request"
method: GET
path: "/mandates/{id}/credential-requests/{cr_id}"
---

# Retrieve a credential request

`GET /mandates/{id}/credential-requests/{cr_id}`

## Path parameters

- `id` string, required
- `cr_id` string, required

## Response `200`

Credential request retrieved

- CredentialRequest
  - `id` string, required — Unique credential request ID.
  - `mandate_id` string, required
  - `amount` integer, required — Requested amount in minor currency units.
  - `currency` string, required
  - `merchant` string, required
  - `merchant_category_code` string
  - `context` string
  - `idempotency_key` string
  - `metadata` object
  - `validation` ValidationResult, required — The system's automatic validation of a credential request against the active mandate rules. No human involvement — this is evaluated instantly.
    - `passed` boolean, required — Whether all mandate constraints were satisfied.
    - `constraints` object, required — Individual constraint checks.
      - `within_amount_limit` object
        - `passed` boolean
        - `detail` string
      - `merchant_match` object
        - `passed` boolean
        - `detail` string
      - `mcc_match` object
        - `passed` boolean
        - `detail` string
      - `within_time_period` object
        - `passed` boolean
        - `detail` string
      - `cadence_not_exhausted` object
        - `passed` boolean
        - `detail` string
      - `velocity_check` object
        - `passed` boolean
        - `detail` string
    - `reasons` string[], required — Human-readable reasons for the validation outcome. Always populated — useful for logging and debugging.
  - `virtual_card` VirtualCard — A single-use virtual card issued when a credential request is approved. The agent uses these details at checkout exactly like a physical card. Safety comes from the card being single-use, amount-capped, merchant-locked, and short-lived — not from hiding credentials.
    - `pan` string, required — 16-digit card number. Use at merchant checkout.
    - `expiry_month` string, required — 2-digit expiry month. Example: '09'.
    - `expiry_year` string, required — 4-digit expiry year. Example: '2026'.
    - `cvv` string, required — 3-digit security code.
    - `billing_zip` string, required — Billing ZIP code for AVS verification.
    - `network` string, required — Card network. Example: visa, mastercard.
    - `expires_at` string, date-time, required — When this virtual card expires. Short-lived — use immediately. Typically 15 minutes.
    - `single_use` boolean, required — Always true. This card is deactivated after one approved transaction regardless of cadence.
    - `amount_limit` integer — The maximum amount this card will approve, in minor units. Matches the credential request amount. Any charge above this is declined at the network level.
    - `merchant_lock` string, nullable — If set, the card is locked to this merchant name. Charges from other merchants are declined at the network level. null if the mandate has no merchant restriction.
  - `status` 'approved' | 'denied' | 'expired', required — approved = token issued, proceed with purchase. denied = mandate rules not satisfied, do not proceed. expired = mandate expired before this request was evaluated.
  - `created_at` string, date-time, required

## Other responses

- `401` — Missing or invalid API key
- `404` — Resource not found
- `501` — Pre-launch: this endpoint is not yet active

---

[API](https://skmtc.dev/useallowance/apis/allowance-api.md) · [All operations](https://skmtc.dev/useallowance/apis/allowance-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/useallowance/allowance-api/revisions/c94c99b9f8c7/schema)