> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prava.space/llms.txt
> Use this file to discover all available pages before exploring further.

# List Cards

> Retrieve enrolled cards for a customer

<Note>
  Cards are scoped by `merchant_id` (derived from your secret key) and the `customer_id` query
  parameter. Only non-sensitive card metadata is returned — full PANs (the real card numbers) are
  never exposed.
</Note>

## Notes

* Use `status=all` to include previously deleted cards for historical reference.
* The `card_id` returned here is the same as the `enrollmentId` from the SDK's `collectPAN()`.

## Error responses

| Status | Code                 | Cause                                         |
| ------ | -------------------- | --------------------------------------------- |
| 400    | `INVALID_REQUEST`    | Missing `customer_id` query parameter         |
| 401    | `AUTH_1001`          | Invalid API key                               |
| 401    | `AUTH_1002`          | Missing or invalid Authorization header       |
| 404    | `CUSTOMER_NOT_FOUND` | No customer found for the given `customer_id` |


## OpenAPI

````yaml api-reference/openapi.json GET /v1/listCards
openapi: 3.1.0
info:
  title: Prava Payments API
  description: >-
    Server-side REST API for Prava Payments. All requests are authenticated with
    your secret key (sk_test_* in sandbox, sk_live_* in production).
  version: 1.0.0
servers:
  - url: https://sandbox.api.prava.space
    description: Sandbox
  - url: https://api.prava.space
    description: Production
security:
  - bearerAuth: []
paths:
  /v1/listCards:
    get:
      summary: List Cards
      description: >-
        Retrieve enrolled cards for a customer. Only non-sensitive card metadata
        is returned.
      operationId: listCards
      parameters:
        - name: customer_id
          in: query
          required: true
          description: >-
            The customer ID to retrieve cards for (the user_id used when
            creating the session)
          schema:
            type: string
        - name: status
          in: query
          required: false
          description: Filter by card status
          schema:
            type: string
            enum:
              - active
              - all
            default: active
        - name: include_card_art
          in: query
          required: false
          description: Include card art URL in response
          schema:
            type: string
            enum:
              - 'true'
              - 'false'
            default: 'false'
      responses:
        '200':
          description: Cards retrieved
          content:
            application/json:
              schema:
                type: object
                properties:
                  cards:
                    type: array
                    items:
                      $ref: '#/components/schemas/Card'
                  count:
                    type: number
                    description: Total number of cards returned
        '400':
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Error'
        '404':
          $ref: '#/components/responses/Error'
components:
  schemas:
    Card:
      type: object
      properties:
        card_id:
          type: string
          description: >-
            Unique card identifier (same as enrollmentId from the SDK's
            collectPAN())
        card_last4:
          type: string
          description: Last 4 digits of the card number
        card_brand:
          type:
            - string
            - 'null'
          description: Card brand (e.g. "visa"), or null if unknown
        card_exp_month:
          type:
            - number
            - 'null'
          description: Expiration month (1-12)
        card_exp_year:
          type:
            - number
            - 'null'
          description: Expiration year (4 digits)
        masked_card_number:
          type:
            - string
            - 'null'
          description: Masked card number, or null
        is_default:
          type: boolean
          description: Whether this is the customer's default card
        status:
          type: string
          enum:
            - active
            - deleted
          description: Card status
        card_art_url:
          type:
            - string
            - 'null'
          description: Card art image URL (only when include_card_art=true)
        metadata:
          type:
            - object
            - 'null'
          description: Card display metadata (backgroundColor, foregroundColor, labelColor)
        created_at:
          type: string
          format: date-time
          description: ISO 8601 timestamp of when the card was enrolled
    Error:
      type: object
      properties:
        error:
          type: object
          properties:
            code:
              type: string
              description: Machine-readable error code (e.g. VAL_2001, AUTH_1001)
            message:
              type: string
              description: Human-readable error message
            details:
              type: object
              description: >-
                Optional — included for validation errors to specify which
                fields failed
  responses:
    Error:
      description: Error response
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: 'Your secret key: sk_test_* (sandbox) or sk_live_* (production).'

````