> ## Documentation Index > Fetch the complete documentation index at: https://developers.portao3.com.br/llms.txt > Use this file to discover all available pages before exploring further. # List account cards > Lists the cards of the organization's account, across all its wallets, newest first. Filter by `name` (a part of the card's name or masked number), `lastDigits`, `status` and `type` — `status` and `type` take several values, comma-separated (`?status=ACTIVE,BLOCKED`) — and page with `limit` + `next`. Only the cards of the environment in `x-environment` are listed, so send `x-environment: LIVE` for production cards. Any member of the organization can list its cards. ## OpenAPI ````yaml /api-reference/banking.openapi.json get /realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/cards openapi: 3.0.3 info: title: Banking version: 1.0.0 description: >- Portão 3 banking API. Every endpoint requires a bearer token in the Authorization header (Authorization: Bearer ) unless its page states otherwise; see the Authentication guide. That requirement is not repeated per endpoint. Generated by tools/openapi from code (routes + security) and the hand-written spec (request/response bodies). Banking attaches a zod validationSchema at the route; request bodies are resolved from it (object + array roots). Responses have no presenter layer, so they stay tier=unknown. Confidence tiers: generated:typed=215 copied:manual=4 unknown=52. servers: - url: https://api.banking.v2.portao3.com.br/ description: production - url: https://api.banking.dev.3pers.com.br/ description: development security: [] tags: - name: Accounts - name: Account Limits - name: Wallets - name: Cards - name: Card Limits - name: Cards 3DS - name: PIX - name: PIX Keys (DICT) - name: PIX Charges - name: PIX Automatic - name: PIX Initiation (Open Finance) - name: PIX Infractions (MED) - name: Boleto - name: Boleto Charges - name: TED - name: Transfers - name: Transactions - name: Cashback - name: Currency Codes - name: Reversals paths: /realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/cards: get: tags: - Cards summary: List account cards description: >- Lists the cards of the organization's account, across all its wallets, newest first. operationId: getRealmsByRealmIdOrganizationsByOrganizationIdAccountsByAccountIdCards parameters: - name: realmId in: path required: true description: |- ID of your realm. Format: `UUID` schema: type: string format: uuid example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b - name: organizationId in: path required: true description: |- ID of the organization the account belongs to. Format: `UUID` schema: type: string format: uuid example: c4bd3f21-dfbd-44e8-8055-68ba15bed410 - name: accountId in: path required: true description: ID of the organization's account (24 hexadecimal characters). schema: type: string pattern: ^[0-9a-fA-F]{24}$ example: 66f2a1c7b4d3e80012c9a0b4 - name: x-environment in: header required: false description: >- Environment whose cards you list: `LIVE` (production) or `TEST` (sandbox). When you omit it, you get the `TEST` cards; any other value is rejected. schema: type: string enum: - LIVE - TEST example: LIVE - name: name in: query required: false description: >- Only cards whose name or masked card number contains this text (case-insensitive). schema: type: string maxLength: 256 example: Marketing - name: lastDigits in: query required: false description: Only cards whose card number ends with these digits. schema: type: string maxLength: 256 example: '4821' - name: status in: query required: false description: >- Only cards in these statuses (case-insensitive): `ACTIVE`, `BLOCKED` or `CANCELLED`. Other values match no card. --- Example (comma-separated list): `?status=ACTIVE,BLOCKED` schema: type: array items: type: string maxLength: 64 style: form explode: false - name: type in: query required: false description: >- Only cards of these types (case-insensitive): `VIRTUAL` or `EMBOSSED` (physical). Other values match no card. --- Example (comma-separated list): `?type=VIRTUAL,EMBOSSED` schema: type: array items: type: string maxLength: 64 style: form explode: false - name: next in: query required: false description: >- Cursor returned as `next` by the previous page. Omit it for the first page. schema: type: string example: NjZmMmE0YjhiNGQzZTgwMDEyYzlhMGUx - name: limit in: query required: false description: Page size. Defaults to 15. schema: type: integer minimum: 0 exclusiveMinimum: true example: 15 responses: '200': description: Successful response content: application/json: schema: type: object properties: items: type: array items: type: object properties: _id: type: string description: >- ID of the card. Use it as `cardId` in the card endpoints. example: 66f2a4b8b4d3e80012c9a0e1 realmId: type: string description: ID of the realm the card belongs to. example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b format: uuid organizationId: type: string description: ID of the organization the card belongs to. example: c4bd3f21-dfbd-44e8-8055-68ba15bed410 format: uuid accountId: type: string description: ID of the organization's account. example: 66f2a1c7b4d3e80012c9a0b4 walletId: type: string description: ID of the wallet the card spends from. example: 66f2a3d1b4d3e80012c9a0d2 environment: type: string enum: - LIVE - TEST description: >- Environment of the card: `LIVE` (production) or `TEST` (sandbox). example: LIVE panMasked: type: string description: >- Card number with its middle digits masked: the first six and the last four digits. Read the full number with the card-details endpoint. example: 524674******4821 expiryDate: type: string description: Expiry month and year of the card, as `MM/YYYY`. example: 11/2031 tokenisationPermitted: type: boolean description: >- Whether the card can be added to a device wallet such as Apple Pay, Google Pay or Samsung Pay. example: true singleUse: type: boolean description: >- Whether the card is single-use: blocked after its first cleared transaction. Absent on some older cards. example: false type: type: string enum: - VIRTUAL - EMBOSSED description: >- Kind of card: `VIRTUAL` or `EMBOSSED` (a physical card). Absent on a few old cancelled cards. example: VIRTUAL external: type: object properties: cardId: type: string description: Identifier of the card at the issuer. example: 3f1c9a52-7d4e-4b8a-9e21-6c0d8b7a5f43 instrumentId: type: string description: >- Identifier the issuer uses to apply the card's spending limits. Absent on older cards. example: 8b2e4f60-1a3c-4d5e-9f70-2b4c6d8e0a12 description: Identifiers of the card at the card issuer. status: type: string enum: - ACTIVE - BLOCKED - CANCELLED description: >- Status of the card: `ACTIVE` (it can be used), `BLOCKED` (blocked — unblock it to use it again) or `CANCELLED` (closed by the issuer for good). example: ACTIVE customFields: type: object additionalProperties: {} description: >- Values of the organization's card custom fields, keyed by each field's `slug`. Absent when the card has none. --- Example: `{"cost-center":"CC-1020"}` example: cost-center: CC-1020 issuedAt: type: string description: >- When the card was issued, or linked to the wallet for a physical card. Absent on a few older cards. example: '2026-11-02T13:05:11.000Z' format: date-time name: type: string description: >- Name of the card. Absent when it was issued without one. example: Marketing - Ads ownerName: type: string description: >- Cardholder name associated with the card: in upper case, without accents, abbreviated to about 26 characters. Absent on older cards. example: MARIANA COSTA isSuper: type: boolean description: >- Whether the card is on the premium card product. Absent on older cards. example: false walletProduct: type: string description: >- Card product of the wallet when the card was issued. Absent on older cards. example: NORMAL cardLimitIds: type: array items: type: string example: 66f2a5c2b4d3e80012c9a0f3 description: >- Legacy field kept on older cards: IDs of limits created with the card. It is not kept up to date — list the card's limits with the card-limits endpoint instead. --- Example: `["66f2a5c2b4d3e80012c9a0f3"]` createdBy: type: string nullable: true description: >- ID of the user who issued the card. Absent, or `null`, on older cards. example: e3553bc1-5e20-4e17-b22a-a796fda0aa99 updatedBy: type: string nullable: true description: >- ID of the user who last changed the card. Absent, or `null`, on older cards. example: e3553bc1-5e20-4e17-b22a-a796fda0aa99 createdAt: type: string description: When the card record was created. example: '2026-11-02T13:05:11.000Z' format: date-time updatedAt: type: string description: When the card record last changed. example: '2026-11-02T13:05:12.000Z' format: date-time __v: type: number description: Version of the record, incremented by some updates. example: 0 required: - _id - realmId - organizationId - accountId - walletId - environment - panMasked - external - status - createdAt - updatedAt description: A payment card of a wallet. description: The cards of this page. next: type: string nullable: true description: >- Cursor of the next page: pass it as `next` to read it. `null` on the last page. example: NjZmMmE0YjhiNGQzZTgwMDEyYzlhMGUx required: - items - next description: A page of cards, newest first. '422': description: >- `BAD_REQUEST` — A path or query parameter is invalid; `fields` lists each one. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - BAD_REQUEST description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - BANKING description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. fields: type: array description: >- One entry per invalid request field (validation errors only). items: type: object properties: field: type: string description: >- Path of the invalid field, e.g. `label` or `values[0].value`. example: label message: type: string description: Why the field was rejected. example: label is required code: type: string description: >- `_` — e.g. `LABEL_REQUIRED`, `TYPE_ONE_OF`, `VALUES_VALUE_TYPE_ERROR`. example: LABEL_REQUIRED values: type: array items: type: string description: >- The accepted values, when the field is an enumeration. required: - field - message - code required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: BAD_REQUEST origin: BANKING message: >- Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields. fields: - field: name message: 'Too big: expected string to have <=256 characters' code: NAME_MAX ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.