Get All Authorized Users Attached Payment Cards

The GET /api/paymentCards/viewAttachedCards endpoint retrieves a list of payment cards linked to all authorized users (subProfiles) under the authenticated main business account. It provides a comprehensive overview of payment methods associated with each authorized user, enabling the main account holder to maintain financial visibility and control. This endpoint is available to business customers only, as subProfiles are a business-exclusive feature.

Endpoint

GET /api/paymentCards/viewAttachedCards

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when the main account holder needs to review all payment cards assigned to authorized users across the business account. It is useful for financial oversight, monitoring card activity per authorized user, and identifying any cards that may need to be suspended or reviewed for unauthorized usage.

Response

200 OK

[
  {
    "givenName": "Jane",
    "familyName": "Smith",
    "isMainCard": false,
    "paymentCardId": "pc_a1b2c3d4e5f6",
    "subProfileId": 101,
    "nickName": "Jane's Business Card"
  },
  {
    "givenName": "John",
    "familyName": "Doe",
    "isMainCard": false,
    "paymentCardId": "pc_f6e5d4c3b2a1",
    "subProfileId": 102,
    "nickName": "Operations Card"
  },
  {
    "givenName": null,
    "familyName": null,
    "isMainCard": true,
    "paymentCardId": "pc_z9y8x7w6v5u4",
    "subProfileId": 0,
    "nickName": "Main Account Card"
  }
]

Error Codes

Common Mistakes

• Calling this endpoint from a personal customer account — subProfiles and their attached cards are a business-only feature; the request will be rejected with a 403.
• Expecting a single object in the response — the endpoint always returns an array; handle the case where the array may be empty if no authorized users have been created or no cards have been attached.
• Confusing subProfileId of 0 with an error — a value of 0 or a null-like value for subProfileId on a record where isMainCard is true indicates the main account holder's own card, not a missing authorized user.
• Using an expired token — tokens are valid for only 10 minutes; refresh via POST /api/auth/refresh before making this call if the token may have expired.

Related Endpoints

• GET /api/paymentCards — Retrieve all payment cards associated with the authenticated account
• POST /api/paymentCards/attachCard — Attach a payment card to a specific authorized user (subProfile)
• GET /api/subProfiles — List all authorized users under the business account
• POST /api/subProfiles — Create a new authorized user for the business account

Example

curl -X GET https://api.banking.netevia.dev/api/paymentCards/viewAttachedCards \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json"