Gnosis Pay Cards API

openapi: 3.2.0
info:
  title: User Service Cards API
  version: 0.0.0
servers:
- url: https://core.prod.gnosispay.com/user-api
  description: Production
  variables: {}
- url: https://core.sandbox.gnosispay.in/user-api
  description: Sandbox
  variables: {}
tags:
- name: Cards
paths:
  /cards/virtual:
    post:
      operationId: Cards_createVirtualCard
      summary: Create Virtual Card
      description: 'Create a virtual card for the authenticated user. Virtual cards are issued

        instantly and can be used for online transactions. If the user does not yet

        have a cardholder, one is created automatically using the provided phone

        number (required for first card creation).'
      parameters: []
      responses:
        '202':
          description: Accepted - Virtual card creation accepted (pending process)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateVirtualCardSuccess'
        '400':
          description: Bad Request - User has no account
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateVirtualCardBadRequestBody'
        '401':
          description: Unauthorized - Invalid JWT
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: User not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: The request conflicts with the current state of the server.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateVirtualCardConflict'
        '422':
          description: 'Unprocessable - the request is well formed but the state forbids issuing a card:

            phone missing or malformed, or the partner rejected the issuance.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateVirtualCardUnprocessableEntityBody'
        '500':
          description: Server error - Virtual card creation failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '502':
          description: Bad Gateway - Cardholder creation failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
      - Cards
      requestBody:
        required: false
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateVirtualCardRequest'
      security:
      - BearerAuth: []
      x-ogen-operation-group: Cards
  /cards:
    get:
      operationId: Cards_listCards
      summary: List Cards
      description: 'List all cards for the authenticated user. Returns both virtual and physical

        cards. Returns an empty list if no cardholder has been created yet.'
      parameters: []
      responses:
        '200':
          description: Cards retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListCardsSuccess'
        '401':
          description: Unauthorized - Invalid JWT
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: User not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '500':
          description: Server error - Failed to list cards
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
      - Cards
      security:
      - BearerAuth: []
      x-ogen-operation-group: Cards
  /cards/{cardId}/limit:
    get:
      operationId: Cards_getCardLimit
      summary: Get Card Daily Spending Limit
      description: 'Returns the daily spending limit configured on a card. `currency` is the

        card native currency (`nativeCurrency` on the card from `GET /cards`),

        and `amount` is in minor units of that currency — divide by

        10^`decimals` to get the major-unit value. USD, EUR, and GBP use 2

        decimal places. The card must belong to the authenticated user. Once

        synced, this is a cumulative spending limit, not a per-transaction cap:

        an authorization that meets or exceeds the limit can be approved, after

        which subsequent eligible authorizations are declined.'
      parameters:
      - name: cardId
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/uuid'
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CardLimit'
        '400':
          description: The server could not understand the request due to invalid syntax.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CardLimitBadRequestBody'
        '401':
          description: Unauthorized - Invalid JWT
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: The server cannot find the requested resource.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '502':
          description: Server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetCardLimitBadGateway'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
      - Cards
      security:
      - BearerAuth: []
      x-ogen-operation-group: Cards
    put:
      operationId: Cards_setCardLimit
      summary: Set Card Daily Spending Limit
      description: 'Sets the daily spending limit for a card. `currency` must match the

        card native currency (`nativeCurrency` on the card from `GET /cards`),

        and `amount` is in minor units of that currency. USD, EUR, and GBP use

        2 decimal places, so 1000000 is 10,000.00. The card must belong to the

        authenticated user. The response returns the new limit immediately with

        `syncStatus: pending` and transitions to `synced` once the change has

        been applied. Once synced, this is a cumulative spending limit, not a

        per-transaction cap: an authorization that meets or exceeds the limit

        can be approved, after which subsequent eligible authorizations are

        declined.'
      parameters:
      - name: cardId
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/uuid'
      responses:
        '200':
          description: The request has succeeded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CardLimit'
        '400':
          description: The server could not understand the request due to invalid syntax.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CardLimitBadRequestBody'
        '401':
          description: Unauthorized - Invalid JWT
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: The server cannot find the requested resource.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '502':
          description: Server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SetCardLimitBadGateway'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
      - Cards
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SetCardLimitRequest'
      security:
      - BearerAuth: []
      x-ogen-operation-group: Cards
  /cards/{cardId}/block:
    post:
      operationId: Cards_blockCard
      summary: Block Card
      description: 'Blocks a card temporarily. A blocked card cannot be used for transactions.

        Use unblock to restore access. The card must belong to the authenticated

        user''s cardholder.'
      parameters:
      - name: cardId
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/uuid'
      responses:
        '204':
          description: Card blocked successfully
        '400':
          description: Bad Request - User has no cardholder
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CardStatusBadRequestBody'
        '401':
          description: Unauthorized - Invalid JWT
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found - User or card not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: 'Conflict - the request cannot be applied in the current state. `error` is one of:

            - `INVALID_CARD_STATUS`: the card is not in a state that allows this change

            - `ACCOUNT_BLOCKED`: the card status is valid but the account is not active

            - `CONFLICT`: any other state conflict'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CardStatusConflict'
        '500':
          description: Internal server error - Failed to block card
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
      - Cards
      security:
      - BearerAuth: []
      x-ogen-operation-group: Cards
  /cards/{cardId}/unblock:
    post:
      operationId: Cards_unblockCard
      summary: Unblock Card
      description: 'Unblocks a previously blocked card. Restores the card to active status,

        allowing transactions again. The card must belong to the authenticated

        user''s cardholder.'
      parameters:
      - name: cardId
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/uuid'
      responses:
        '204':
          description: Card unblocked successfully
        '400':
          description: Bad Request - User has no cardholder
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CardStatusBadRequestBody'
        '401':
          description: Unauthorized - Invalid JWT
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found - User or card not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: 'Conflict - the request cannot be applied in the current state. `error` is one of:

            - `INVALID_CARD_STATUS`: the card is not in a state that allows this change

            - `ACCOUNT_BLOCKED`: the card status is valid but the account is not active

            - `CONFLICT`: any other state conflict'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CardStatusConflict'
        '500':
          description: Internal server error - Failed to unblock card
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
      - Cards
      security:
      - BearerAuth: []
      x-ogen-operation-group: Cards
  /cards/{cardId}/cancel:
    post:
      operationId: Cards_cancelCard
      summary: Cancel Card
      description: 'Cancels a card permanently. Once canceled, the card cannot be reactivated.

        A new card must be issued. The card must belong to the authenticated user''s

        cardholder.'
      parameters:
      - name: cardId
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/uuid'
      responses:
        '204':
          description: Card canceled successfully
        '400':
          description: Bad Request - User has no cardholder
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CardStatusBadRequestBody'
        '401':
          description: Unauthorized - Invalid JWT
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found - User or card not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: 'Conflict - the request cannot be applied in the current state. `error` is one of:

            - `INVALID_CARD_STATUS`: the card is not in a state that allows this change

            - `ACCOUNT_BLOCKED`: the card status is valid but the account is not active

            - `CONFLICT`: any other state conflict'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CardStatusConflict'
        '500':
          description: Internal server error - Failed to cancel card
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      tags:
      - Cards
      security:
      - BearerAuth: []
      x-ogen-operation-group: Cards
components:
  schemas:
    CardStatusValidationError:
      type: object
      required:
      - kind
      - success
      - error
      properties:
        kind:
          type: string
          enum:
          - validation
        success:
          type: boolean
          enum:
          - false
        error:
          $ref: '#/components/schemas/ValidationErrorDetail'
    CardStatusConflict:
      type: object
      required:
      - success
      - error
      properties:
        success:
          type: boolean
          enum:
          - false
        error:
          type: string
      description: 'Conflict - the request cannot be applied in the current state. `error` is one of:

        - `INVALID_CARD_STATUS`: the card is not in a state that allows this change

        - `ACCOUNT_BLOCKED`: the card status is valid but the account is not active

        - `CONFLICT`: any other state conflict'
    CardLimitValidationError:
      type: object
      required:
      - kind
      - success
      - error
      properties:
        kind:
          type: string
          enum:
          - validation
        success:
          type: boolean
          enum:
          - false
        error:
          $ref: '#/components/schemas/ValidationErrorDetail'
    CardStatusBusinessError:
      type: object
      required:
      - kind
      - success
      - error
      properties:
        kind:
          type: string
          enum:
          - business
        success:
          type: boolean
          enum:
          - false
        error:
          type: string
    CardType:
      type: string
      enum:
      - virtual
      - plastic
    CreateVirtualCardRejectionReason:
      type: string
      enum:
      - PHONE_REQUIRED
      - INVALID_PHONE_FORMAT
      - CREATE_CARD_LIMIT_EXCEEDED
      - CARD_CREATION_REJECTED
      description: 'Machine-readable causes for a 422 on POST /cards/virtual. `CARD_CREATION_REJECTED`

        is the fallback for any partner-api rejection this service does not map explicitly.'
    CardLimitSyncStatus:
      type: string
      enum:
      - pending
      - synced
      - failed
    SetCardLimitRequest:
      type: object
      required:
      - amount
      - currency
      properties:
        amount:
          type: integer
          format: int64
          minimum: 1
          description: 'Daily spending limit in minor units of `currency`.

            USD, EUR, and GBP use 2 decimal places, so 1000000 is 10,000.00.'
          examples:
          - 1000000
        currency:
          type: string
          description: 'ISO-4217 currency code. Must match the card native currency

            (`nativeCurrency` on the card from `GET /cards`).'
          examples:
          - EUR
      examples:
      - amount: 1000000
        currency: EUR
    SetCardLimitBadGateway:
      type: object
      required:
      - success
      - error
      properties:
        success:
          type: boolean
          enum:
          - false
        error:
          type: string
    CreateVirtualCardBusinessError:
      type: object
      required:
      - kind
      - success
      - error
      properties:
        kind:
          type: string
          enum:
          - business
        success:
          type: boolean
          enum:
          - false
        error:
          type: string
    CardLimit:
      type: object
      required:
      - spentToday
      - remaining
      properties:
        spentToday:
          type: integer
          format: int64
          description: 'Amount spent today against this card limit, in minor units of

            `currency`. Resets at the start of each calendar day.'
        remaining:
          type: integer
          format: int64
          description: 'Remaining headroom today, in minor units of `currency`. Equals max(0,

            amount - spentToday).'
      allOf:
      - $ref: '#/components/schemas/CardLimitSummary'
    ListCardsSuccess:
      type: object
      required:
      - cards
      properties:
        cards:
          type: array
          items:
            $ref: '#/components/schemas/Card'
      description: Cards retrieved successfully
    CardStatusBadRequestBody:
      type: object
      oneOf:
      - $ref: '#/components/schemas/CardStatusValidationError'
      - $ref: '#/components/schemas/CardStatusBusinessError'
      discriminator:
        propertyName: kind
        mapping:
          validation: '#/components/schemas/CardStatusValidationError'
          business: '#/components/schemas/CardStatusBusinessError'
      description: 'Discriminated 400 body for card status routes. The `kind` field is additive

        and not a breaking change. Clients can keep reading `success` and `error`.'
    CreateVirtualCardConflict:
      type: object
      required:
      - success
      - error
      properties:
        success:
          type: boolean
          enum:
          - false
        error:
          type: string
    CardLimitBusinessError:
      type: object
      required:
      - kind
      - success
      - error
      properties:
        kind:
          type: string
          enum:
          - business
        success:
          type: boolean
          enum:
          - false
        error:
          type: string
    CardLimitSummary:
      type: object
      required:
      - amount
      - currency
      - decimals
      - syncStatus
      - updatedAt
      properties:
        amount:
          type: integer
          format: int64
          description: 'Daily limit in minor units of `currency`. Divide by 10^`decimals` to get

            the major-unit value. USD, EUR, and GBP use 2 decimal places.'
        currency:
          type: string
          description: 'ISO-4217 currency code — the card native currency (`nativeCurrency` on

            the card from `GET /cards`).'
        decimals:
          type: integer
          format: int32
          description: Number of decimal places for this currency (2 for USD, EUR, and GBP).
        syncStatus:
          $ref: '#/components/schemas/CardLimitSyncStatus'
          description: 'Replication state of the limit. `pending` immediately after an update,

            `synced` once the change has been applied, `failed` if the change could

            not be applied after retries.'
        updatedAt:
          type: string
          format: date-time
          description: Last time this limit was modified.
    Card:
      type: object
      required:
      - id
      - accountId
      - cardholderId
      - status
      - name
      - type
      - createdAt
      - canceledAt
      - nativeCurrency
      - additionalCurrencies
      - printedName
      - issuingDate
      - expirationDate
      - contactlessEnabled
      - mode
      - brand
      - bin
      - last4Digits
      - provisionedAt
      - limit
      properties:
        id:
          $ref: '#/components/schemas/uuid'
        accountId:
          $ref: '#/components/schemas/uuid'
        cardholderId:
          $ref: '#/components/schemas/uuid'
        status:
          $ref: '#/components/schemas/CardStatus'
        name:
          type: string
        type:
          $ref: '#/components/schemas/CardType'
        createdAt:
          type: string
          format: date-time
        canceledAt:
          anyOf:
          - type: string
            format: date-time
          - type: 'null'
        nativeCurrency:
          type: string
          description: 'ISO-4217 currency code the card is denominated in. The card daily

            spending limit is set and reported in this currency.'
          examples:
          - EUR
        additionalCurrencies:
          type: array
          items:
            type: string
          description: ISO-4217 currency codes the card supports besides `nativeCurrency`.
        printedName:
          anyOf:
          - type: string
          - type: 'null'
        issuingDate:
          anyOf:
          - type: string
            format: date-time
          - type: 'null'
        expirationDate:
          anyOf:
          - type: string
            format: date-time
          - type: 'null'
        contactlessEnabled:
          anyOf:
          - type: boolean
          - type: 'null'
        mode:
          anyOf:
          - type: string
          - type: 'null'
        brand:
          anyOf:
          - type: string
          - type: 'null'
        bin:
          anyOf:
          - type: string
          - type: 'null'
        last4Digits:
          anyOf:
          - type: string
          - type: 'null'
        provisionedAt:
          anyOf:
          - type: string
            format: date-time
          - type: 'null'
        limit:
          anyOf:
          - $ref: '#/components/schemas/CardLimitSummary'
          - type: 'null'
          description: 'Currently configured daily spending limit. Null if no limit has been set for

            this card. Call `GET /cards/{id}/limit` for today''s spend and remaining

            headroom.'
    CreateVirtualCardUnprocessableEntityBody:
      type: object
      required:
      - success
      - error
      properties:
        success:
          type: boolean
          enum:
          - false
        error:
          $ref: '#/components/schemas/CreateVirtualCardRejectionReason'
      description: 422 body for POST /cards/virtual. Same envelope as `Error`, with `error` closed.
    ValidationErrorDetail:
      type: object
      required:
      - name
      - message
      properties:
        name:
          type: string
          enum:
          - ValidationError
        message:
          type: string
    Error:
      type: object
      required:
      - success
      - error
      properties:
        success:
          type: boolean
          enum:
          - false
        error:
          type: string
    uuid:
      type: string
      format: uuid
    CardStatus:
      type: string
      enum:
      - all
      - provisioning
      - pending_activation
      - active
      - blocked
      - canceled
    GetCardLimitBadGateway:
      type: object
      required:
      - success
      - error
      properties:
        success:
          type: boolean
          enum:
          - false
        error:
          type: string
    CreateVirtualCardRequest:
      type: object
      required:
      - cardName
      properties:
        cardName:
          type: string
          minLength: 1
          maxLength: 50
        phone:
          type: string
          minLength: 6
          maxLength: 20
    CreateVirtualCardValidationError:
      type: object
      required:
      - kind
      - success
      - error
      properties:
        kind:
          type: string
          enum:
          - validation
        success:
          type: boolean
          enum:
          - false
        error:
          $ref: '#/components/schemas/ValidationErrorDetail'
    CardLimitBadRequestBody:
      type: object
      oneOf:
      - $ref: '#/components/schemas/CardLimitValidationError'
      - $ref: '#/components/schemas/CardLimitBusinessError'
      discriminator:
        propertyName: kind
        mapping:
          validation: '#/components/schemas/CardLimitValidationError'
          business: '#/components/schemas/CardLimitBusinessError'
      description: 'Discriminated 400 body for card limit routes. The `kind` field is additive

        and not a breaking change. Clients can keep reading `success` and `error`.'
    CreateVirtualCardBadRequestBody:
      type: object
      oneOf:
      - $ref: '#/components/schemas/CreateVirtualCardValidationError'
      - $ref: '#/components/schemas/CreateVirtualCardBusinessError'
      discriminator:
        propertyName: kind
        mapping:
          validation: '#/components/schemas/CreateVirtualCardValidationError'
          business: '#/components/schemas/CreateVirtualCardBusinessError'
      description: 'Discriminated 400 body for POST /cards/virtual. The `kind` field is additive

        and not a breaking change. Clients can keep reading `success` and `error`.'
    CreateVirtualCardSuccess:
      type: object
      required:
      - cardId
      properties:
        cardId:
          $ref: '#/components/schemas/uuid'
      description: Accepted - Virtual card creation accepted (pending process)
  securitySchemes:
    BearerAuth:
      type: http
      scheme: Bearer