List available card products: productCode, currency, issue/topup limits, and whether KYC is required.

Per-merchant pricing for products (e.g. for github, google).

Get an end user's available balance.

💳 Issue a virtual card to an end user. Money operation — a test key runs in sandbox (no real money). Idempotent: retries do not double-issue.

Masked card details (last4, expiry, status). Raw PAN/CVV are never returned here — use reveal_card.

Freeze a card (reversible). Idempotent.

Unfreeze a frozen card. Idempotent.

Close a card permanently (irreversible). Idempotent.

Set a 4-digit PIN. The PIN is not stored by CardOS.

Set soft spend controls (per-transaction / daily / monthly limits, blocked MCC/countries). On breach the card is auto-frozen + an alert is sent (no hard auth-time block).

Mint a one-time hosted link that shows full card details (PAN/CVV) to the end user, bypassing you (PCI on CardOS). Short-lived, single-use.

Mint hosted card screens (manage + transactions) on real data, to open in a webview for the end user — bypassing you. Returns manage_url / transactions_url.

List transactions for a card (amount, currency, commission, FX original amount/currency, merchant, MCC, decline reason, status).

Create a crypto deposit invoice to top up an end-user balance. Money operation — sandbox with a test key. Idempotent.

[SANDBOX] Simulate confirmation of a pending deposit (test key only). In live, an on-chain watcher credits it.

[SANDBOX] Inject a test card transaction (test key only) to exercise webhooks, analytics, controls and cashback.

An end user's statement (summary: spent/received/fees/holds + line items + balance).

Spending breakdown by category (from MCC) for an end user.

Open a dispute on a transaction.

List disputes, optionally filtered by user or status.

Get one dispute by id.

Update a dispute (status / note / provider reference).

Start KYC for an end user. Returns a hosted url_for_user and a uuid to poll.

Status of a KYC session by uuid.

Register an HTTPS endpoint for outbound events (transaction, balance, issued, card_status, kyc). Returns the signing secret once.

List registered webhook endpoints (no secrets).