List spending cards

List Moov issued cards existing for the account.

To access this endpoint using an access token you'll need to specify the /accounts/{accountID}/issued-cards.read scope.

GET
/issuing/{accountID}/cards
curl -X GET "https://api.moov.io/issuing/{accountID}/cards" \
  -H "Authorization: Bearer {token}" \
  -H "X-Moov-Version: v2026.07.00"
mc, _ := moov.NewClient()

var accountID string

mc.ListIssuedCards(ctx, accountID)
import { Moov } from "@moovio/sdk";

const moov = new Moov({
  security: {
    username: "",
    password: "",
  },
});

async function run() {
  const result = await moov.cardIssuing.list({
    accountID: "17c958e0-3abe-46e5-8afb-98742f1fb8ac",
    skip: 60,
    count: 20,
  });

  console.log(result);
}

run();
declare(strict_types=1);

require 'vendor/autoload.php';

use Moov\MoovPhp;
use Moov\MoovPhp\Models\Components;

$sdk = MoovPhp\Moov::builder()
    ->setSecurity(
        new Components\Security(
            username: '',
            password: '',
        )
    )
    ->build();



$response = $sdk->cardIssuing->list(
    accountID: '17c958e0-3abe-46e5-8afb-98742f1fb8ac',
    skip: 60,
    count: 20

);

if ($response->issuedCards !== null) {
    // handle response
}
package hello.world;

import io.moov.sdk.Moov;
import io.moov.sdk.models.components.Security;
import io.moov.sdk.models.operations.ListIssuedCardsResponse;
import java.lang.Exception;

public class Application {

    public static void main(String[] args) throws Exception {

        Moov sdk = Moov.builder()
                .security(Security.builder()
                    .username("")
                    .password("")
                    .build())
            .build();

        ListIssuedCardsResponse res = sdk.cardIssuing().list()
                .accountID("17c958e0-3abe-46e5-8afb-98742f1fb8ac")
                .skip(60L)
                .count(20L)
                .call();

        if (res.issuedCards().isPresent()) {
            System.out.println(res.issuedCards().get());
        }
    }
}
from moovio_sdk import Moov
from moovio_sdk.models import components


with Moov(
    security=components.Security(
        username="",
        password="",
    ),
) as moov:

    res = moov.card_issuing.list(account_id="17c958e0-3abe-46e5-8afb-98742f1fb8ac", skip=60, count=20)

    # Handle response
    print(res)
require 'moov_ruby'

Models = ::Moov::Models
s = ::Moov::Client.new(
  security: Models::Components::Security.new(
    username: '',
    password: ''
  )
)
res = s.card_issuing.list(account_id: '17c958e0-3abe-46e5-8afb-98742f1fb8ac', skip: 60, count: 20)

unless res.issued_cards.nil?
  # handle response
end
using Moov.Sdk;
using Moov.Sdk.Models.Components;

var sdk = new MoovClient(security: new Security() {
    Username = "",
    Password = "",
});

var res = await sdk.CardIssuing.ListAsync(
    accountID: "17c958e0-3abe-46e5-8afb-98742f1fb8ac",
    skip: 60,
    count: 20
);

// handle response
The request completed successfully.
application/json
[
  {
    "issuedCardID": "string",
    "brand": "Visa",
    "lastFourCardNumber": "string",
    "expiration": {
      "month": "01",
      "year": "21"
    },
    "fundingWalletID": "string",
    "authorizedUserAccountID": "string",
    "nickname": "string",
    "metadata": {
      "optional": "metadata"
    },
    "billingAddress": {
      "addressLine1": "123 Main Street",
      "addressLine2": "Apt 302",
      "city": "Boulder",
      "stateOrProvince": "CO",
      "postalCode": "80301",
      "country": "US"
    },
    "state": "active",
    "formFactor": "virtual",
    "controls": {
      "singleUse": true,
      "velocityLimits": [
        {
          "amount": 10000,
          "count": 0,
          "interval": "per-transaction",
          "amountUsed": 0,
          "amountRemaining": 0,
          "countUsed": 0,
          "countRemaining": 0,
          "resetsOn": "2019-08-24T14:15:22Z"
        }
      ],
      "merchantCategoryRestrictions": {
        "mode": "allow",
        "categories": [
          "advertising"
        ],
        "customMCCs": [
          "string"
        ],
        "exemptMerchants": [
          {
            "mid": "string",
            "descriptorPattern": "string",
            "name": "string"
          }
        ]
      },
      "merchantRestrictions": {
        "mode": "allow",
        "merchants": [
          {
            "mid": "string",
            "descriptorPattern": "string",
            "name": "string"
          }
        ]
      },
      "allowedSchedule": {
        "timezone": "string",
        "windows": [
          {
            "days": [
              "monday"
            ],
            "startTime": "string",
            "endTime": "string"
          }
        ]
      },
      "expiresOn": "2019-08-24T14:15:22Z"
    },
    "createdOn": "2019-08-24T14:15:22Z",
    "updatedOn": "2019-08-24T14:15:22Z"
  }
]

x-request-id

string required
A unique identifier used to trace requests.
The request contained missing or expired authentication.

x-request-id

string required
A unique identifier used to trace requests.
The user is not authorized to make the request.

x-request-id

string required
A unique identifier used to trace requests.
Request was refused due to rate limiting.

x-request-id

string required
A unique identifier used to trace requests.
The request failed due to an unexpected error.

x-request-id

string required
A unique identifier used to trace requests.
The request failed because a downstream service failed to respond.

x-request-id

string required
A unique identifier used to trace requests.

Headers

X-Moov-Version

string
Set this header to v2026.07.00 to use the API described in this specification. When omitted, the server defaults to v2024.01.00, which may not match the behavior documented here.
Possible values: v2026.07.00

Path parameters

accountID

string required
The Moov business account for which the cards have been issued.

Query parameters

skip

integer <int64>

count

integer <int64>
Default: 200

states

array
Optional, comma-separated states to filter the Moov list issued cards response. For example active,closed

Response

application/json

authorizedUserAccountID

string
Identifier for the account of the card's authorized user.

billingAddress

object
Billing address associated with the card.
Show child attributes

addressLine1

string <=60 characters required Pattern

addressLine2

string <=32 characters Pattern

city

string <=32 characters required Pattern

country

string <=2 characters required

postalCode

string <=5 characters required

stateOrProvince

string <=2 characters required

brand

string<enum>
The card brand.
Possible values: American Express, Discover, Mastercard, Visa, Unknown

controls

object
Spend controls applied to an issued card, including velocity runtime state.
Show child attributes

allowedSchedule

object | null
Limits card usage to specific days and times.
Limits card usage to specific days and times.
Show child attributes

timezone

string required
IANA timezone string used to evaluate window boundaries against the authorization time.

windows

array<object> required
Time windows during which the card may authorize. Any matching window allows the transaction.
Show child attributes

days

array<string>
The days of the week this window applies to.
Possible values: monday, tuesday, wednesday, thursday, friday, saturday, sunday

endTime

string
Exclusive window end time in 24-hour HH:MM format. If earlier than startTime, the window wraps past midnight.

startTime

string
Inclusive window start time in 24-hour HH:MM format.

expiresOn

string<date-time> | null
A spend cutoff date and time. When set, all authorizations after this datetime are declined regardless of other controls.

merchantCategoryRestrictions

object
Restricts card usage by merchant category. When not set, all categories are allowed.
Restricts card usage by merchant category.
Show child attributes

categories

array<string>
Predefined category groups to allow or block.
Possible values: advertising, airlines, alcohol-and-bars, car-rental, education, electronics, fuel-and-gas, gambling, groceries, ground-transportation, hardware-and-home, healthcare, live-entertainment, lodging, movies, office-supplies, parking, personal-care, professional-services, restaurants-and-dining, retail-general, rideshare-and-taxis, software-and-saas, sports-and-recreation, subscriptions, travel-agencies

customMCCs

array<string>
Individual merchant category codes (MCCs) to allow or block, for codes not covered by a predefined category.

exemptMerchants

array<object>
Merchants that are exempt from category restrictions regardless of their category.
Show child attributes

descriptorPattern

string
A case-insensitive RE2 regular expression matched against the merchant descriptor (ISO 8583 DE43).

mid

string
The merchant's unique identifier (ISO 8583 DE42), matched exactly.

name

string
An optional label for this entry.

mode

string required
Whether the listed categories are the only ones allowed, or the ones to block.
Whether the listed items are the only ones allowed (allow) or the ones to block (block).
Possible values: allow, block

merchantRestrictions

object
Restricts card usage to specific merchants, or blocks specific merchants.
Restricts card usage to specific merchants, independent of merchant category.
Show child attributes

merchants

array<object> required
The merchants to allow or block.
Show child attributes

descriptorPattern

string
A case-insensitive RE2 regular expression matched against the merchant descriptor (ISO 8583 DE43).

mid

string
The merchant's unique identifier (ISO 8583 DE42), matched exactly.

name

string
An optional label for this entry.

mode

string required
Whether the listed merchants are the only ones allowed, or the ones to block.
Whether the listed items are the only ones allowed (allow) or the ones to block (block).
Possible values: allow, block

singleUse

boolean
Indicates if the card is single-use. If true, the card closes after the first authorization.

velocityLimits

array<object>
The spending limits per time interval, including current runtime state.
Show child attributes

amount

integer<int64>
The maximum amount in cents that can be spent in a given interval.

amountRemaining

integer<int64>
The amount in cents remaining in the current interval.

amountUsed

integer<int64>
The amount in cents already spent in the current interval.

count

integer<int64>
The maximum number of transactions allowed in the given interval.

countRemaining

integer<int64>
The number of transactions remaining in the current interval.

countUsed

integer<int64>
The number of transactions already made in the current interval.

interval

string<enum>
Specifies the time frame for a velocity limit. per-transaction applies to each individual authorization and never resets. Time-based intervals (where supported) reset at midnight ET.
Possible values: per-transaction, daily, weekly, monthly

resetsOn

string<date-time>
When the current interval resets. Absent for per-transaction limits.

createdOn

string<date-time>

expiration

object
The expiration date of the card or token.
Show child attributes

month

string 2 characters required
Two-digit month the card expires.

year

string 2 characters required
Two-digit year the card expires.

formFactor

string<enum>
Specifies the type of spend card to be issued. Presently supports virtual only, providing a digital number without a physical card.
Possible values: virtual

fundingWalletID

string
Unique identifier for the wallet funding the card.

issuedCardID

string

lastFourCardNumber

string

metadata

object
Free-form key-value pair list. Useful for storing information that is not captured elsewhere.

nickname

string
An optional descriptive name for the card.

state

string<enum>

The state represents the operational status of an issued card. A card can only approve incoming authorizations if it is in an active state.

  • active: The card is operational and can approve authorizations.
  • closed: The card is permanently deactivated and cannot approve authorizations. A card can be closed by request or when it expires.
Possible values: active, closed

updatedOn

string<date-time>