# Balances of all company cards

Last known balances of every company card, including closed ones, in
one call (stored snapshots, refreshed in the background — no live read
per card) — up to 100 cards per page, ordered by `cardId`. Pass
`meta.nextCursor` as `after` to get the next page; it is `null` on the
last page.
`balance` is a decimal string without rounding. When the balance is
unknown (card not `assigned`, or not reported yet) `balance`,
`currency` and `fetchedAt` are `null` — `null` means unknown, not
zero. `fetchedAt` is when the issuer reported the value, not the
response time. Requires `cards.read`.

Endpoint: GET /cards/balances
Version: 1.0.0
Security: apiKeyAuth

## Security:

  - `apiKeyAuth` (unknown)
    apiKey in header X-API-Key

## Query parameters:

  - `limit` (integer)

  - `after` (string)
    `meta.nextCursor` from the previous page.

## Response 200:

  - `200` (unknown)
    Card balances page

## Response 200 fields (application/json):

  - `data` (array, required)

  - `data.cardId` (string, required)

  - `data.externalId` (string | null, required)

  - `data.balance` (string | null, required)
    Decimal string without rounding; `null` when unknown
    Example: 42.17

  - `data.currency` (string | null, required)
    Example: USD

  - `data.fetchedAt` (string | null, required)
    When the issuer reported the balance, not the response time

  - `meta` (object, required)

  - `meta.limit` (integer, required)
    Example: 100

  - `meta.nextCursor` (string | null, required)
    Pass as `after` to get the next page; `null` on the last page

## Response 400:

  - `400` (unknown)
    Invalid request (validation or malformed input)

## Response 400 fields (application/json):

  - `statusCode` (integer, required)
    HTTP status code.
    Example: 400

  - `error` (string, required)
    HTTP reason phrase (legacy `PERMISSION_DENIED` for permission errors).
    Example: Bad Request

  - `errorCode` (string, required)
    Stable machine-readable code — always present. New codes may be
added over time, so treat unknown values as a generic failure for
the given `statusCode`.
    Enum: "VALIDATION_ERROR", "BAD_REQUEST", "UNAUTHORIZED", "FORBIDDEN", "NOT_FOUND", "CONFLICT", "UNPROCESSABLE", "INTERNAL_ERROR", "SERVICE_UNAVAILABLE", "BAD_GATEWAY", "AUTH_REQUIRED", "INVALID_API_KEY", "INVALID_CREDENTIALS", "SESSION_INVALID", "COMPANY_INACTIVE", "NO_COMPANY_MEMBERSHIP", "PERMISSION_DENIED", "ACCOUNT_ALREADY_EXISTS", "QR_AMOUNT_MISSING", "QR_INVALID", "QR_RESOLVE_FAILED", "AMOUNT_BELOW_MIN", "AMOUNT_ABOVE_MAX", "ST00012_SUM_MISSING", "ST00012_SUM_INVALID", "GIBDD_UIN_INVALID", "FINE_ALREADY_PAID", "FINE_NOT_FOUND", "QUOTE_NOT_FOUND", "QUOTE_EXPIRED", "INSUFFICIENT_BALANCE", "COMPANY_NOT_FOUND", "ORDER_NOT_FOUND", "UNSUPPORTED_CALLBACK_STATUS", "RATE_UNAVAILABLE", "DRIVER_HELPER_TRANSIENT", "WALLET_BACKEND_ERROR", "DISPUTE_NOT_FOUND", "DISPUTE_NOT_ALLOWED", "IDEMPOTENCY_KEY_REQUIRED", "CARDS_NOT_ENABLED", "CARD_NOT_FOUND", "CARD_REQUEST_NOT_FOUND", "CARD_REQUEST_NOT_CANCELABLE", "CARD_NOT_ACTIVE", "CARD_NOT_OWNED", "CARD_RECHARGE_INVALID", "CARD_EXTERNAL_ID_TAKEN", "BRIDGE_ERROR", "MEMBER_NOT_FOUND", "CANNOT_CHANGE_OWN_ROLE", "ROLE_CHANGE_NOT_ALLOWED", "INVITE_NOT_FOUND", "INVITE_USED", "INVITE_EXPIRED", "INVITE_INVALID", "WEBHOOK_DELIVERY_NOT_FOUND", "WEBHOOK_URL_NOT_CONFIGURED", "INVALID_SIGNATURE", "PAYOUTS_NOT_ENABLED", "PAYOUT_NOT_FOUND", "PAYOUT_REQUISITE_INVALID", "PAYOUT_BANK_UNKNOWN", "PAYOUT_BANK_REQUIRED", "PAYOUT_ACTIVE_LIMIT", "PAYOUT_REQUISITE_COOLDOWN", "PAYOUT_OUTSIDE_WORKING_HOURS", "PAYOUT_NOT_CANCELABLE", "PAYOUT_DISPUTE_NOT_ALLOWED", "PAYOUT_SERVICE_REJECTED", "PAYOUT_SERVICE_UNAVAILABLE"

  - `message` (any, required)
    Human-readable message (RU). Array of strings for validation errors.

  - `details` (object)
    Optional structured context for the error, e.g.
`{ "required": "orders.create" }`, `{ "minAmountRub": 100 }`,
or `{ "nspkCode": "RQ00010" }`.
    Example: {"nspkCode":"RQ00010"}

  - `required` (string)
    Present only for `PERMISSION_DENIED` — the permission the API key is missing.
    Example: orders.create

  - `path` (string)
    Request path that produced the error, including the query string.
    Example: /orders/prepare

  - `timestamp` (string)
    When the error was produced (ISO 8601).
    Example: 2026-05-27T16:41:49.000Z

  - `requestId` (string)
    Correlation id, also returned in the `X-Request-Id` response header.
Quote it when contacting support.
    Example: 439436bd-201c-4084-9063-58cfa2cd40ad

## Response 401:

  - `401` (unknown)
    Missing or invalid credentials (API key / session token).

## Response 401 fields (application/json):

  - `statusCode` (integer, required)
    HTTP status code.
    Example: 400

  - `error` (string, required)
    HTTP reason phrase (legacy `PERMISSION_DENIED` for permission errors).
    Example: Bad Request

  - `errorCode` (string, required)
    Stable machine-readable code — always present. New codes may be
added over time, so treat unknown values as a generic failure for
the given `statusCode`.
    Enum: "VALIDATION_ERROR", "BAD_REQUEST", "UNAUTHORIZED", "FORBIDDEN", "NOT_FOUND", "CONFLICT", "UNPROCESSABLE", "INTERNAL_ERROR", "SERVICE_UNAVAILABLE", "BAD_GATEWAY", "AUTH_REQUIRED", "INVALID_API_KEY", "INVALID_CREDENTIALS", "SESSION_INVALID", "COMPANY_INACTIVE", "NO_COMPANY_MEMBERSHIP", "PERMISSION_DENIED", "ACCOUNT_ALREADY_EXISTS", "QR_AMOUNT_MISSING", "QR_INVALID", "QR_RESOLVE_FAILED", "AMOUNT_BELOW_MIN", "AMOUNT_ABOVE_MAX", "ST00012_SUM_MISSING", "ST00012_SUM_INVALID", "GIBDD_UIN_INVALID", "FINE_ALREADY_PAID", "FINE_NOT_FOUND", "QUOTE_NOT_FOUND", "QUOTE_EXPIRED", "INSUFFICIENT_BALANCE", "COMPANY_NOT_FOUND", "ORDER_NOT_FOUND", "UNSUPPORTED_CALLBACK_STATUS", "RATE_UNAVAILABLE", "DRIVER_HELPER_TRANSIENT", "WALLET_BACKEND_ERROR", "DISPUTE_NOT_FOUND", "DISPUTE_NOT_ALLOWED", "IDEMPOTENCY_KEY_REQUIRED", "CARDS_NOT_ENABLED", "CARD_NOT_FOUND", "CARD_REQUEST_NOT_FOUND", "CARD_REQUEST_NOT_CANCELABLE", "CARD_NOT_ACTIVE", "CARD_NOT_OWNED", "CARD_RECHARGE_INVALID", "CARD_EXTERNAL_ID_TAKEN", "BRIDGE_ERROR", "MEMBER_NOT_FOUND", "CANNOT_CHANGE_OWN_ROLE", "ROLE_CHANGE_NOT_ALLOWED", "INVITE_NOT_FOUND", "INVITE_USED", "INVITE_EXPIRED", "INVITE_INVALID", "WEBHOOK_DELIVERY_NOT_FOUND", "WEBHOOK_URL_NOT_CONFIGURED", "INVALID_SIGNATURE", "PAYOUTS_NOT_ENABLED", "PAYOUT_NOT_FOUND", "PAYOUT_REQUISITE_INVALID", "PAYOUT_BANK_UNKNOWN", "PAYOUT_BANK_REQUIRED", "PAYOUT_ACTIVE_LIMIT", "PAYOUT_REQUISITE_COOLDOWN", "PAYOUT_OUTSIDE_WORKING_HOURS", "PAYOUT_NOT_CANCELABLE", "PAYOUT_DISPUTE_NOT_ALLOWED", "PAYOUT_SERVICE_REJECTED", "PAYOUT_SERVICE_UNAVAILABLE"

  - `message` (any, required)
    Human-readable message (RU). Array of strings for validation errors.

  - `details` (object)
    Optional structured context for the error, e.g.
`{ "required": "orders.create" }`, `{ "minAmountRub": 100 }`,
or `{ "nspkCode": "RQ00010" }`.
    Example: {"nspkCode":"RQ00010"}

  - `required` (string)
    Present only for `PERMISSION_DENIED` — the permission the API key is missing.
    Example: orders.create

  - `path` (string)
    Request path that produced the error, including the query string.
    Example: /orders/prepare

  - `timestamp` (string)
    When the error was produced (ISO 8601).
    Example: 2026-05-27T16:41:49.000Z

  - `requestId` (string)
    Correlation id, also returned in the `X-Request-Id` response header.
Quote it when contacting support.
    Example: 439436bd-201c-4084-9063-58cfa2cd40ad

## Response 403:

  - `403` (unknown)
    Card access is not available. Either the company does not have cards
enabled, or the API key lacks the required card permission.

## Response 403 fields (application/json):

  - `statusCode` (integer, required)
    HTTP status code.
    Example: 400

  - `error` (string, required)
    HTTP reason phrase (legacy `PERMISSION_DENIED` for permission errors).
    Example: Bad Request

  - `errorCode` (string, required)
    Stable machine-readable code — always present. New codes may be
added over time, so treat unknown values as a generic failure for
the given `statusCode`.
    Enum: "VALIDATION_ERROR", "BAD_REQUEST", "UNAUTHORIZED", "FORBIDDEN", "NOT_FOUND", "CONFLICT", "UNPROCESSABLE", "INTERNAL_ERROR", "SERVICE_UNAVAILABLE", "BAD_GATEWAY", "AUTH_REQUIRED", "INVALID_API_KEY", "INVALID_CREDENTIALS", "SESSION_INVALID", "COMPANY_INACTIVE", "NO_COMPANY_MEMBERSHIP", "PERMISSION_DENIED", "ACCOUNT_ALREADY_EXISTS", "QR_AMOUNT_MISSING", "QR_INVALID", "QR_RESOLVE_FAILED", "AMOUNT_BELOW_MIN", "AMOUNT_ABOVE_MAX", "ST00012_SUM_MISSING", "ST00012_SUM_INVALID", "GIBDD_UIN_INVALID", "FINE_ALREADY_PAID", "FINE_NOT_FOUND", "QUOTE_NOT_FOUND", "QUOTE_EXPIRED", "INSUFFICIENT_BALANCE", "COMPANY_NOT_FOUND", "ORDER_NOT_FOUND", "UNSUPPORTED_CALLBACK_STATUS", "RATE_UNAVAILABLE", "DRIVER_HELPER_TRANSIENT", "WALLET_BACKEND_ERROR", "DISPUTE_NOT_FOUND", "DISPUTE_NOT_ALLOWED", "IDEMPOTENCY_KEY_REQUIRED", "CARDS_NOT_ENABLED", "CARD_NOT_FOUND", "CARD_REQUEST_NOT_FOUND", "CARD_REQUEST_NOT_CANCELABLE", "CARD_NOT_ACTIVE", "CARD_NOT_OWNED", "CARD_RECHARGE_INVALID", "CARD_EXTERNAL_ID_TAKEN", "BRIDGE_ERROR", "MEMBER_NOT_FOUND", "CANNOT_CHANGE_OWN_ROLE", "ROLE_CHANGE_NOT_ALLOWED", "INVITE_NOT_FOUND", "INVITE_USED", "INVITE_EXPIRED", "INVITE_INVALID", "WEBHOOK_DELIVERY_NOT_FOUND", "WEBHOOK_URL_NOT_CONFIGURED", "INVALID_SIGNATURE", "PAYOUTS_NOT_ENABLED", "PAYOUT_NOT_FOUND", "PAYOUT_REQUISITE_INVALID", "PAYOUT_BANK_UNKNOWN", "PAYOUT_BANK_REQUIRED", "PAYOUT_ACTIVE_LIMIT", "PAYOUT_REQUISITE_COOLDOWN", "PAYOUT_OUTSIDE_WORKING_HOURS", "PAYOUT_NOT_CANCELABLE", "PAYOUT_DISPUTE_NOT_ALLOWED", "PAYOUT_SERVICE_REJECTED", "PAYOUT_SERVICE_UNAVAILABLE"

  - `message` (any, required)
    Human-readable message (RU). Array of strings for validation errors.

  - `details` (object)
    Optional structured context for the error, e.g.
`{ "required": "orders.create" }`, `{ "minAmountRub": 100 }`,
or `{ "nspkCode": "RQ00010" }`.
    Example: {"nspkCode":"RQ00010"}

  - `required` (string)
    Present only for `PERMISSION_DENIED` — the permission the API key is missing.
    Example: orders.create

  - `path` (string)
    Request path that produced the error, including the query string.
    Example: /orders/prepare

  - `timestamp` (string)
    When the error was produced (ISO 8601).
    Example: 2026-05-27T16:41:49.000Z

  - `requestId` (string)
    Correlation id, also returned in the `X-Request-Id` response header.
Quote it when contacting support.
    Example: 439436bd-201c-4084-9063-58cfa2cd40ad

## Response 502:

  - `502` (unknown)
    The card issuer did not answer or answered with a server error, so the
outcome is unknown. For a card request the reserve is released, and a
card that was in fact assigned arrives via `card.assigned`. Retry
mutations only with the same `Idempotency-Key`.

## Response 502 fields (application/json):

  - `statusCode` (integer, required)
    HTTP status code.
    Example: 400

  - `error` (string, required)
    HTTP reason phrase (legacy `PERMISSION_DENIED` for permission errors).
    Example: Bad Request

  - `errorCode` (string, required)
    Stable machine-readable code — always present. New codes may be
added over time, so treat unknown values as a generic failure for
the given `statusCode`.
    Enum: "VALIDATION_ERROR", "BAD_REQUEST", "UNAUTHORIZED", "FORBIDDEN", "NOT_FOUND", "CONFLICT", "UNPROCESSABLE", "INTERNAL_ERROR", "SERVICE_UNAVAILABLE", "BAD_GATEWAY", "AUTH_REQUIRED", "INVALID_API_KEY", "INVALID_CREDENTIALS", "SESSION_INVALID", "COMPANY_INACTIVE", "NO_COMPANY_MEMBERSHIP", "PERMISSION_DENIED", "ACCOUNT_ALREADY_EXISTS", "QR_AMOUNT_MISSING", "QR_INVALID", "QR_RESOLVE_FAILED", "AMOUNT_BELOW_MIN", "AMOUNT_ABOVE_MAX", "ST00012_SUM_MISSING", "ST00012_SUM_INVALID", "GIBDD_UIN_INVALID", "FINE_ALREADY_PAID", "FINE_NOT_FOUND", "QUOTE_NOT_FOUND", "QUOTE_EXPIRED", "INSUFFICIENT_BALANCE", "COMPANY_NOT_FOUND", "ORDER_NOT_FOUND", "UNSUPPORTED_CALLBACK_STATUS", "RATE_UNAVAILABLE", "DRIVER_HELPER_TRANSIENT", "WALLET_BACKEND_ERROR", "DISPUTE_NOT_FOUND", "DISPUTE_NOT_ALLOWED", "IDEMPOTENCY_KEY_REQUIRED", "CARDS_NOT_ENABLED", "CARD_NOT_FOUND", "CARD_REQUEST_NOT_FOUND", "CARD_REQUEST_NOT_CANCELABLE", "CARD_NOT_ACTIVE", "CARD_NOT_OWNED", "CARD_RECHARGE_INVALID", "CARD_EXTERNAL_ID_TAKEN", "BRIDGE_ERROR", "MEMBER_NOT_FOUND", "CANNOT_CHANGE_OWN_ROLE", "ROLE_CHANGE_NOT_ALLOWED", "INVITE_NOT_FOUND", "INVITE_USED", "INVITE_EXPIRED", "INVITE_INVALID", "WEBHOOK_DELIVERY_NOT_FOUND", "WEBHOOK_URL_NOT_CONFIGURED", "INVALID_SIGNATURE", "PAYOUTS_NOT_ENABLED", "PAYOUT_NOT_FOUND", "PAYOUT_REQUISITE_INVALID", "PAYOUT_BANK_UNKNOWN", "PAYOUT_BANK_REQUIRED", "PAYOUT_ACTIVE_LIMIT", "PAYOUT_REQUISITE_COOLDOWN", "PAYOUT_OUTSIDE_WORKING_HOURS", "PAYOUT_NOT_CANCELABLE", "PAYOUT_DISPUTE_NOT_ALLOWED", "PAYOUT_SERVICE_REJECTED", "PAYOUT_SERVICE_UNAVAILABLE"

  - `message` (any, required)
    Human-readable message (RU). Array of strings for validation errors.

  - `details` (object)
    Optional structured context for the error, e.g.
`{ "required": "orders.create" }`, `{ "minAmountRub": 100 }`,
or `{ "nspkCode": "RQ00010" }`.
    Example: {"nspkCode":"RQ00010"}

  - `required` (string)
    Present only for `PERMISSION_DENIED` — the permission the API key is missing.
    Example: orders.create

  - `path` (string)
    Request path that produced the error, including the query string.
    Example: /orders/prepare

  - `timestamp` (string)
    When the error was produced (ISO 8601).
    Example: 2026-05-27T16:41:49.000Z

  - `requestId` (string)
    Correlation id, also returned in the `X-Request-Id` response header.
Quote it when contacting support.
    Example: 439436bd-201c-4084-9063-58cfa2cd40ad

## Response 400 examples:

  - `Request body/query validation failed` (unknown)

  - `Generic bad request` (unknown)

## Response 401 examples:

  - `No API key or session token provided` (unknown)

  - `Unknown / revoked API key` (unknown)

  - `Expired or malformed session token` (unknown)

  - `Company is disabled (member API key)` (unknown)

  - `The member was removed from the company` (unknown)

## Response 403 examples:

  - `Cards not enabled for this company` (unknown)

  - `API key lacks card permission` (unknown)

  - `Card or request belongs to another company` (unknown)

## Response 502 examples:

  - `Issuer did not answer` (unknown)

  - `Unexpected issuer response` (unknown)