# Transactions across every card

Reverse-chronological list spanning all of the company's cards, in one
call. Each row carries `cardId` and `cardMaskedPan` so you can tell them
apart. Recharges are not included — see `GET /cards/recharges`.

Endpoint: GET /cards/transactions
Version: 1.0.0
Security: apiKeyAuth

## Query parameters:

  - `from` (string)
    ISO-8601. Only rows with `transactionTime >= from`.

  - `to` (string)
    ISO-8601. Only rows with `transactionTime <= to`.

  - `limit` (integer)

  - `before` (string)

## Response 200 fields (application/json):

  - `id` (string, required)

  - `cardId` (string, required)

  - `processorBillId` (string, required)
    Issuer's transaction id — quote it in support tickets

  - `processorOrderNo` (string | null)

  - `type` (integer)

  - `typeName` (string | null)
    purchase / refund / recharge / reversal

  - `status` (integer)

  - `statusName` (string | null)
    pending / succeeded / failed

  - `direction` (integer | null)

  - `directionName` (string | null)
    debit / credit

  - `amount` (string, required)
    Decimal string in the card currency

  - `fee` (string | null)

  - `currency` (string | null)
    Example: USD

  - `originalAmount` (string | null)
    Amount at the merchant, before conversion to the card currency.
A 910 TRY purchase reads `amount: "19.6248"`, `currency: "USD"`,
`originalAmount: "910"`, `originalCurrency: "TRY"`.
`null` on operations with no conversion (recharge, card closure).
    Example: 910

  - `originalCurrency` (string | null)
    Example: TRY

  - `cardMaskedPan` (string | null)
    Only populated by the account-wide `GET /cards/transactions`.

  - `merchantName` (string | null)

  - `merchantMcc` (string | null)
    Merchant category code (MCC), as reported by the acquirer. Present on purchases where the acquirer sent it; `null` on top-ups, card closures and rows without a merchant.
    Example: 5816

  - `ditchCode` (string | null)
    Acquiring channel, not a merchant category. Kept for backwards compatibility — use `merchantMcc` for the MCC.
    Example: straitsx

  - `reason` (string | null)

  - `transactionTime` (string, required)

  - `syncedAt` (string)

## Response 401 fields (application/json):

  - `statusCode` (integer, required)
    HTTP status code.
    Example: 400

  - `error` (string, required)
    HTTP reason phrase (legacy `PERMISSION_DENIED` for permission errors).
    Example: Bad Request

  - `errorCode` (string, required)
    Stable machine-readable code — always present. New codes may be
added over time, so treat unknown values as a generic failure for
the given `statusCode`.
    Enum: "VALIDATION_ERROR", "BAD_REQUEST", "UNAUTHORIZED", "FORBIDDEN", "NOT_FOUND", "CONFLICT", "UNPROCESSABLE", "INTERNAL_ERROR", "SERVICE_UNAVAILABLE", "BAD_GATEWAY", "AUTH_REQUIRED", "INVALID_API_KEY", "INVALID_CREDENTIALS", "SESSION_INVALID", "COMPANY_INACTIVE", "NO_COMPANY_MEMBERSHIP", "PERMISSION_DENIED", "ACCOUNT_ALREADY_EXISTS", "QR_AMOUNT_MISSING", "QR_INVALID", "QR_RESOLVE_FAILED", "AMOUNT_BELOW_MIN", "AMOUNT_ABOVE_MAX", "ST00012_SUM_MISSING", "ST00012_SUM_INVALID", "GIBDD_UIN_INVALID", "FINE_ALREADY_PAID", "FINE_NOT_FOUND", "QUOTE_NOT_FOUND", "QUOTE_EXPIRED", "INSUFFICIENT_BALANCE", "COMPANY_NOT_FOUND", "ORDER_NOT_FOUND", "UNSUPPORTED_CALLBACK_STATUS", "DRIVER_HELPER_TRANSIENT", "WALLET_BACKEND_ERROR", "DISPUTE_NOT_FOUND", "DISPUTE_NOT_ALLOWED", "IDEMPOTENCY_KEY_REQUIRED", "CARDS_NOT_ENABLED", "CARD_NOT_FOUND", "CARD_REQUEST_NOT_FOUND", "CARD_REQUEST_NOT_CANCELABLE", "CARD_NOT_ACTIVE", "CARD_NOT_OWNED", "CARD_RECHARGE_INVALID", "CARD_EXTERNAL_ID_TAKEN", "BRIDGE_ERROR", "MEMBER_NOT_FOUND", "CANNOT_CHANGE_OWN_ROLE", "ROLE_CHANGE_NOT_ALLOWED", "INVITE_NOT_FOUND", "INVITE_USED", "INVITE_EXPIRED", "INVITE_INVALID", "WEBHOOK_DELIVERY_NOT_FOUND", "WEBHOOK_URL_NOT_CONFIGURED", "INVALID_SIGNATURE", "PAYOUTS_NOT_ENABLED", "PAYOUT_NOT_FOUND", "PAYOUT_REQUISITE_INVALID", "PAYOUT_BANK_UNKNOWN", "PAYOUT_BANK_REQUIRED", "PAYOUT_ACTIVE_LIMIT", "PAYOUT_REQUISITE_COOLDOWN", "PAYOUT_OUTSIDE_WORKING_HOURS", "PAYOUT_NOT_CANCELABLE", "PAYOUT_DISPUTE_NOT_ALLOWED", "PAYOUT_SERVICE_REJECTED", "PAYOUT_SERVICE_UNAVAILABLE"

  - `message` (any, required)
    Human-readable message (RU). Array of strings for validation errors.

  - `required` (string)
    Present only for `PERMISSION_DENIED` — the permission the API key is missing.
    Example: orders:create

  - `path` (string)
    Request path that produced the error.
    Example: /orders/prepare

  - `timestamp` (string)
    When the error was produced (ISO 8601).
    Example: 2026-05-27T16:41:49.000Z

  - `requestId` (string)
    Correlation id, also returned in the `X-Request-Id` response header.
Quote it when contacting support.
    Example: 439436bd-201c-4084-9063-58cfa2cd40ad