# List Cards

> Coming soon, upon request — this feature is turned on for your tenant by the Aurea team. [Contact us](https://www.aureahub.com/contact)

The user's cards.

## Overview

- Each card: `id`, `token`, `lastFour`, `isVirtual`, `statusCode` (`1000` active, `1001` not activated, `1005` frozen), `statusName`, `isFrozen` and `activatedAt` (or `null`).
- A field the card program leaves out takes a default: `token` `""`, `lastFour` `"????"`, `isVirtual` `true`, `statusCode` `0`, `statusName` `""`.
- Inside the card program session (`403` `CARD_PROGRAM_SESSION_EXPIRED`).
- **Illustrative example.** These are the fields Aurea writes for every card; their values are the card program's.

## Endpoint

### `GET /v1/cards`

Authentication: bearer token required.

The user's cards.

**Responses**

`200` OK (illustrative)

```json
[
  {
    "id": "c4f1a2b3-…",
    "token": "9876543210",
    "lastFour": "4821",
    "isVirtual": true,
    "statusCode": 1000,
    "statusName": "Active",
    "isFrozen": false,
    "activatedAt": "2026-10-10T08:12:00.000Z"
  }
]
```

**Example request**

```bash
curl https://api.aureahub.com/v1/cards \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

---

Web version: https://docs.aureahub.com/#cards-list