Get List of Authorized Users

This endpoint retrieves a list of authorized users (subProfiles) associated with the authenticated business customer's primary account. Each record includes the authorized user's identity details, department, attached payment cards, and linked financial accounts. Use this endpoint to review and manage access permissions across your organization's banking application.

Endpoint

GET /api/subProfiles

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when you need to audit or display the full list of authorized users on a business account. It is particularly useful for administrative dashboards where account owners need to review who has access, what cards they hold, and which financial accounts they are linked to. Only business customers can have authorized users (subProfiles).

Response

200 OK

Returns an array of subProfile objects.

SubProfile Object

Payment Card Object (attachedPaymentCards items)

Financial Account Object (financialAccount / attachedFinancialAccounts items)

[
  {
    "id": 1042,
    "email": "[email protected]",
    "givenName": "Jane",
    "familyName": "Doe",
    "department": "Finance",
    "isSync": true,
    "dateOfBirth": "1990-04-15T00:00:00Z",
    "financialAccount": {
      "id": "fa_XXXXXXXXXXXXXXXXXX",
      "last4": "7823",
      "name": "Business Checking",
      "type": "CHECKING",
      "accountStatus": "ACTIVE",
      "routingNumber": "XXXXXXXXX",
      "clientName": "Acme Corp"
    },
    "attachedPaymentCards": [
      {
        "id": "card_XXXXXXXXXXXXXXXXXX",
        "formFactor": "VIRTUAL",
        "bin": "411111",
        "last4": "4242",
        "status": "ACTIVE",
        "financialAccountId": "fa_XXXXXXXXXXXXXXXXXX",
        "isMainCard": true,
        "network": "VISA",
        "isEmailNotify": true,
        "isPushNotify": false,
        "cardName": "Jane's Virtual Card",
        "expirationDate": "2027-08",
        "financialAccount": {
          "id": "fa_XXXXXXXXXXXXXXXXXX",
          "last4": "7823",
          "name": "Business Checking"
        }
      }
    ],
    "attachedFinancialAccounts": [
      {
        "id": "fa_XXXXXXXXXXXXXXXXXX",
        "last4": "7823",
        "name": "Business Checking",
        "type": "CHECKING",
        "accountStatus": "ACTIVE",
        "routingNumber": "XXXXXXXXX",
        "clientName": "Acme Corp"
      }
    ]
  }
]

Error Codes

Common Mistakes

• Calling this endpoint with a personal customer token — subProfiles are only available for business accounts; a 403 will be returned.
• Relying on the deprecated financialName and financialAccountId fields at the top level of each subProfile — use financialAccount.name and financialAccount.id instead.
• Expecting a non-empty list when no authorized users have been created yet — the endpoint returns an empty array [] in that case, which is not an error.
• Not handling the case where attachedPaymentCards or attachedFinancialAccounts is null — these fields are nullable and should be treated as an empty list when absent.

Related Endpoints

• POST /api/subProfiles — Create a new authorized user on the business account
• GET /api/subProfiles/{id} — Retrieve details for a specific authorized user by ID
• PUT /api/subProfiles/{id} — Update an authorized user's information
• DELETE /api/subProfiles/{id} — Remove an authorized user from the business account

Example

curl -X GET https://api.banking.netevia.dev/api/subProfiles \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json"