Get All Authorized Users Payment Cards

This endpoint retrieves a list of payment cards associated with every authorized user (subprofile) linked to a business customer account. Each record includes masked card identifiers, cardholder names, contact details, and department assignments. It is intended for business account owners who need consolidated visibility into the payment cards held by their authorized users.

Endpoint

GET /netevia/subProfiles

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when a business account owner or administrator needs to audit or monitor all payment cards issued to their authorized users. It provides a single call to retrieve cardholder details across the entire authorized user roster, supporting expense management, compliance reviews, and access oversight workflows.

Query Parameters

Response

200 OK

Returns an array of subprofile objects. Each object contains payment card and contact information for one authorized user.

[
  {
    "email": "[email protected]",
    "givenName": "Jane",
    "familyName": "Doe",
    "paymentCardId": "XXXX-XXXX-XXXX-4321",
    "department": "Finance",
    "firstName": "Jane",
    "lastName": "Doe",
    "phone": "+1-555-234-5678"
  },
  {
    "email": "[email protected]",
    "givenName": "John",
    "familyName": "Smith",
    "paymentCardId": "XXXX-XXXX-XXXX-8765",
    "department": "Operations",
    "firstName": "John",
    "lastName": "Smith",
    "phone": "+1-555-876-5432"
  }
]

Error Codes

Common Mistakes

• Passing an invalid or non-business profileId — this endpoint applies only to business customer accounts; personal accounts do not have subprofiles.
• Omitting the Authorization header or using an expired token, resulting in a 401 response. Ensure the token is refreshed before it reaches the 10-minute lifetime.
• Expecting plain card numbers in the response — all payment card identifiers are masked for PCI compliance and will not expose full card numbers.
• Confusing givenName/familyName with firstName/lastName — the response includes both sets of fields; treat them as equivalent name representations.

Related Endpoints

• POST /netevia/subProfiles — Create a new authorized user (subprofile) under a business customer account.
• GET /netevia/subProfiles/{subProfileId} — Retrieve details for a specific authorized user by their subprofile ID.
• PUT /netevia/subProfiles/{subProfileId} — Update an existing authorized user's information or access level.
• DELETE /netevia/subProfiles/{subProfileId} — Remove an authorized user from a business customer account.

Example

curl -X GET "https://api.banking.netevia.dev/netevia/subProfiles?profileId=10045" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json"