Get Available Payment Cards for Subprofile Assignment

The GET /api/subProfiles/availablePaymentCards endpoint returns all payment cards associated with the authenticated business customer that have not yet been assigned to any authorized user (subprofile). Each card entry includes its form factor, network, status, linked financial account, and notification preferences. This endpoint is intended to support the workflow of assigning cards to subprofiles.

Endpoint

GET /api/subProfiles/availablePaymentCards

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint before linking a payment card to an authorized user (subprofile) to determine which cards are currently unassigned and therefore eligible for linking. This is useful when onboarding new authorized users and when auditing card assignments across a business account. Only business customers with at least one subprofile or the intent to create one will find this endpoint relevant.

Response

200 OK

Returns an array of payment card objects. Each object represents one unassigned payment card.

financialAccount object fields:

[
  {
    "id": "card_abc123def456",
    "formFactor": "PHYSICAL",
    "bin": "411111",
    "last4": "4242",
    "status": "ACTIVE",
    "financialAccountId": "fa_xyz789",
    "isMainCard": true,
    "network": "VISA",
    "isEmailNotify": true,
    "isPushNotify": false,
    "financialAccount": {
      "id": "fa_xyz789",
      "last4": "0011",
      "name": "Business Checking",
      "type": "CHECKING",
      "accountStatus": "ACTIVE",
      "routingNumber": "021000021",
      "clientName": "Acme Corp"
    },
    "cardName": "Operations Card",
    "expirationDate": "2027-08"
  },
  {
    "id": "card_vrt987ghi321",
    "formFactor": "VIRTUAL",
    "bin": "411111",
    "last4": "8888",
    "status": "ACTIVE",
    "financialAccountId": "fa_xyz789",
    "isMainCard": false,
    "network": "VISA",
    "isEmailNotify": false,
    "isPushNotify": true,
    "financialAccount": {
      "id": "fa_xyz789",
      "last4": "0011",
      "name": "Business Checking"
    },
    "cardName": "Online Purchases",
    "expirationDate": "2026-12"
  }
]

Error Codes

Common Mistakes

• Calling this endpoint with a personal customer token — subprofile card management is available to business customers only.
• Expecting this endpoint to return cards already assigned to authorized users — it returns only unassigned cards eligible for linking.
• Assuming the financialAccount object always contains all fields — the response may return either a base variant (with id, last4, name only) or a full variant depending on account context.
• Not refreshing the Bearer token before calling — tokens expire after 10 minutes and will result in a 401 response.

Related Endpoints

• POST /api/subProfiles — Create a new authorized user (subprofile) for a business account
• GET /api/subProfiles — List all authorized users associated with the business account
• POST /api/subProfiles/{subProfileId}/paymentCards — Assign an available payment card to a specific authorized user
• DELETE /api/subProfiles/{subProfileId}/paymentCards/{cardId} — Remove a payment card from an authorized user

Example

curl -X GET https://api.banking.netevia.dev/api/subProfiles/availablePaymentCards \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json"