Transactions

List cards

Lists the authenticated company’s locally known individual cards using stable, opaque card_ IDs. Includes inactive cards, cards without booked transactions, and retained identities after provider deletion. Dedicated inventory covers Brex, Ramp, Mercury, and Slash. Rho cards are known only from stored provider transaction metadata; there is no provider-wide Rho card inventory fetch. Plaid credit sources appear as accounts, not individual cards. Inventory is not a connectivity or remote-completeness guarantee.

Requires API access and Transactions: View. Standard authentication, current membership, subscription restrictions, rate limits, usage limits, and usage logging apply. GET never creates or backfills identities or changes bookkeeping; production identity backfill/readiness is a separate release prerequisite.

Results use identity creation order (oldest first), independent of labels, with account filtering before pagination. Paging is not a frozen snapshot. An empty result returns data: [], has_more: false, and next_cursor: null. There is no request body.

GET

cards

List cards

curl --request GET \
  --url https://finta.lol/api/v1/cards \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://finta.lol/api/v1/cards', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://finta.lol/api/v1/cards",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://finta.lol/api/v1/cards"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://finta.lol/api/v1/cards")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "object": "list",
  "url": "<string>",
  "has_more": true,
  "next_cursor": "<string>",
  "data": [
    {
      "id": "<string>",
      "object": "card",
      "account_id": "<string>",
      "name": "<string>",
      "last_four": "<string>",
      "type": "physical",
      "status": "active"
    }
  ]
}

Authorizations

Authorization

string

header

required

API key prefixed with finta_

Query Parameters

limit

integer

default:100

Required range: 1 <= x <= 500

starting_after

string

Pass the previous next_cursor unchanged and URL-encode it; do not pass a card ID. Cursors are bound to company, card collection, and the exact account_id filter. Keep the same filter on every page. Malformed, foreign, or differently scoped cursors return 400 invalid_request.

account_id

string

Filter by a stable account ID from List accounts. Only proven provider relationships match; names and vendors do not establish relationships. Unknown, malformed, blank, and foreign account IDs return the same 404 resource_missing error with param account_id. Known accounts without linked cards return an empty list.

Pattern: ^acct_

Response

Card inventory.

object

enum<string>

required

Available options:

list

url

string

required

has_more

boolean

required

next_cursor

string | null

required

data

object[]

required

Show child attributes

List cards

curl --request GET \
  --url https://finta.lol/api/v1/cards \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://finta.lol/api/v1/cards', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://finta.lol/api/v1/cards",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://finta.lol/api/v1/cards"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://finta.lol/api/v1/cards")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "object": "list",
  "url": "<string>",
  "has_more": true,
  "next_cursor": "<string>",
  "data": [
    {
      "id": "<string>",
      "object": "card",
      "account_id": "<string>",
      "name": "<string>",
      "last_four": "<string>",
      "type": "physical",
      "status": "active"
    }
  ]
}

API Reference

Company

Team

Categories

Rules

Departments

Integrations

Aggregations

Transactions

Journal Entries

Parties

Reports

List cards

Authorizations

Query Parameters

Response