> ## Documentation Index > Fetch the complete documentation index at: https://docs.whop.com/llms.txt > Use this file to discover all available pages before exploring further. # List Cards > Lists issued Whop virtual cards for an account or user, including pending invitation cards that have not been issued by the card provider yet. Pass exactly one of account_id (a biz_ identifier) or user_id (a user_ identifier). Non-owner team members only see cards assigned to them. Users without the payout:account:read scope can still list cards assigned to them (for example moderators or external cardholders). Use GET /cards/:card_id to retrieve a single card with its secrets. ## OpenAPI ````yaml /openapi/api-v1-native.yml get /cards openapi: 3.1.0 info: title: Whop API description: >- Hand-written V1 endpoints. Merged into the GraphqlRestProxy-generated schema at build time. version: v1 servers: - url: https://{defaultHost} variables: defaultHost: default: api.whop.com/api/v1 security: [] paths: /cards: parameters: - $ref: '#/components/parameters/ApiVersionDate' get: tags: - Cards summary: List Cards description: >- Lists issued Whop virtual cards for an account or user, including pending invitation cards that have not been issued by the card provider yet. Pass exactly one of account_id (a biz_ identifier) or user_id (a user_ identifier). Non-owner team members only see cards assigned to them. Users without the payout:account:read scope can still list cards assigned to them (for example moderators or external cardholders). Use GET /cards/:card_id to retrieve a single card with its secrets. operationId: listCards parameters: - name: account_id in: query required: false schema: type: string description: The owning account ID (a biz_ identifier). Provide this or user_id. - name: user_id in: query required: false schema: type: string description: The owning user ID (a user_ identifier). Provide this or account_id. responses: '200': description: cards listed for an assigned cardholder without the ledger scope content: application/json: schema: type: object properties: data: type: array items: type: object properties: object: type: string enum: - card id: type: string description: Card ID, prefixed `icrd_`. name: type: - string - 'null' description: Card display name. type: type: - string - 'null' enum: - null - virtual - physical description: The card type. status: type: - string - 'null' enum: - null - active - frozen - canceled - invited description: The card status. last4: type: - string - 'null' description: >- Last four digits of the card number. `null` for pending invitation cards. expiration_month: type: - string - 'null' description: Card expiration month. expiration_year: type: - string - 'null' description: Card expiration year. user_id: type: - string - 'null' description: Cardholder user ID, prefixed `user_`, when assigned. spent_last_month: type: - integer - 'null' description: Total spend in the last 30 days, in cents. limit: type: - object - 'null' description: The spending limit configuration. properties: amount: type: number description: The limit amount in dollars. frequency: type: string description: >- Limit window, for example `per24HourPeriod` or `perAuthorization`. required: - amount - frequency billing: type: - object - 'null' description: The billing address. properties: line1: type: - string - 'null' description: Street address line 1. line2: type: - string - 'null' description: Street address line 2. city: type: - string - 'null' description: Billing city. region: type: - string - 'null' description: Billing region or state. postal_code: type: - string - 'null' description: Billing postal code. country_code: type: - string - 'null' description: Billing country code. required: - line1 - line2 - city - region - postal_code - country_code created_at: type: - string - 'null' format: date-time description: When the card was created. canceled_at: type: - string - 'null' format: date-time description: When the card was canceled. secrets: type: - object - 'null' description: >- Sensitive card details. Present only on `GET /cards/:card_id` for active cards; `null` when the card is inactive or details cannot be retrieved. properties: card_number: type: string description: Full card number. cvc: type: string description: Card verification code. name_on_card: type: - string - 'null' description: Cardholder name printed on the card. required: - card_number - cvc - name_on_card required: - object - id - name - type - status - last4 - expiration_month - expiration_year - user_id - spent_last_month - limit - billing - created_at - canceled_at required: - data '400': $ref: '#/components/responses/InvalidParameters' description: neither account_id nor user_id provided '401': $ref: '#/components/responses/Unauthorized' description: missing or invalid authentication '403': $ref: '#/components/responses/Forbidden' description: credential lacks the payout-account-read scope '404': $ref: '#/components/responses/NotFound' description: no ledger for that owner is visible to the credential security: - bearerAuth: - payout:account:read components: parameters: ApiVersionDate: name: Api-Version-Date in: header required: false schema: type: string format: date example: '2026-07-01' description: Pins the request to a dated API version. responses: InvalidParameters: description: Invalid Parameters content: application/json: schema: $ref: '#/components/schemas/V1ErrorResponse' Unauthorized: description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/V1ErrorResponse' Forbidden: description: Forbidden content: application/json: schema: $ref: '#/components/schemas/V1ErrorResponse' NotFound: description: Resource not found content: application/json: schema: $ref: '#/components/schemas/V1ErrorResponse' schemas: V1ErrorResponse: type: object properties: error: type: object properties: type: type: string description: Machine-readable error code. message: type: string description: Human-readable error message. required: - type - message required: - error securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: auth-scheme description: >- An account API key, account scoped JWT, app API key, or user OAuth token. ````