# Get card

Endpoint: GET /people/{personId}/loans/{loanId}/cards/{cardId}
Version: 2025-03-26
Security: oauth2, bearerAuth, apiKeyHeader

## Path parameters:

  - `personId` (string, required)
    A Borrower's unique identifier, tied to a person or a business. Can be Peach or a lender's external identifier.

  - `loanId` (string, required)
    The unique identifier of the Loan we wish to retrieve. Can be
Peach or lender's external identifier.

  - `cardId` (string, required)
    The ID of the card. Can be Peach or lender's external identifier.

## Query parameters:

  - `showPan` (boolean)
    Set to `true` to get the full PAN in the response. Special permission is required.

  - `showCvv` (boolean)
    Set to `true` to get the full CVV2 number in the response. Special permission is required.

  - `refresh` (boolean)
    If `true`, the Peach system will make new API calls to the card issuer to get the most recent card details and balances,
and will store the new details in the Peach database. Otherwise, the Peach system will return the most recent details from its database.

## Response 200 fields (application/json):

  - `message` (string)
    Description of the server action or error.

  - `status` (integer)
    HTTP status code.

  - `data` (any)

  - `data.cardBalances` (object)
    The card balances. Only applicable to `virtualCard` type card objects.

  - `data.cardBalances.originalAmount` (number)
    The original amount of the card before it was used. If null, will default to the loan's `atOrigination.amountFinanced`.

  - `data.cardBalances.refundedAmount` (number)
    The amount of the card that was refunded back to the card or otherwise not used.

  - `data.cardBalances.usedAmount` (number)
    The amount of the card that was used.

  - `data.type` (string)
    The type of card issued. For loanType `installment`, only the only allowable value is virtualCard.
For loanType `lineOfCredit`, virtual and credit card are accepted.
    Enum: "virtualCard"

  - `data.usageRestrictions` (object)
    Additional usage restrictions of the specific card to apply to purchases. These will be applied in addition to `usageRestrictions` created in the program object as part of the card issuer APIs.

  - `data.usageRestrictions.countries` (array)
    The list of countries where the card cannot be used. Any attempt to authorize the card for a
purchase with a country in this list will be declined.

  - `data.usageRestrictions.currencies` (array)
    The list of invalid currencies for card transactions. Any attempt to authorize the card for a
purchase made in a currency in this list will be declined.

  - `data.usageRestrictions.merchantCategoryCodes` (array)
    The list of merchant category codes to restrict. Any attempt to authorize the card for a purchase
with a merchant category code in the list will be declined.

  - `data.usageRestrictions.merchantIds` (array)
    The list of specific merchant ID's where the card cannot be used. Any attempt to authorize
the card for a purchase with a merchant ID in the list will be declined.

  - `data.usageRestrictions.merchantNamesRegex` (array)
    The list of merchant names where the card cannot be used. The format is a regular expression.
Please contact the Peach team to see examples of the merchant names.
Peach will use matching logic using the regex value to decline transactions for merchants included in this list.
Lenders need to carefully assess this restriction because of the challenge in matching names in this
list to the merchant names provided during authorization.