curl --request GET \
--url https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/cardsimport requests
url = "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/cards"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/cards', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/cards",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/cards"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/cards")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/cards")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_body{
"items": [
{
"_id": "66f2a4b8b4d3e80012c9a0e1",
"realmId": "f495ff0c-ab54-4f99-8e92-ca8682e4de9b",
"organizationId": "c4bd3f21-dfbd-44e8-8055-68ba15bed410",
"accountId": "66f2a1c7b4d3e80012c9a0b4",
"walletId": "66f2a3d1b4d3e80012c9a0d2",
"environment": "LIVE",
"panMasked": "524674******4821",
"external": {
"cardId": "3f1c9a52-7d4e-4b8a-9e21-6c0d8b7a5f43",
"instrumentId": "8b2e4f60-1a3c-4d5e-9f70-2b4c6d8e0a12"
},
"status": "ACTIVE",
"createdAt": "2026-11-02T13:05:11.000Z",
"updatedAt": "2026-11-02T13:05:12.000Z",
"expiryDate": "11/2031",
"tokenisationPermitted": true,
"singleUse": false,
"type": "VIRTUAL",
"customFields": {
"cost-center": "CC-1020"
},
"issuedAt": "2026-11-02T13:05:11.000Z",
"name": "Marketing - Ads",
"ownerName": "MARIANA COSTA",
"isSuper": false,
"walletProduct": "NORMAL",
"cardLimitIds": [
"66f2a5c2b4d3e80012c9a0f3"
],
"createdBy": "e3553bc1-5e20-4e17-b22a-a796fda0aa99",
"updatedBy": "e3553bc1-5e20-4e17-b22a-a796fda0aa99",
"__v": 0
}
],
"next": "NjZmMmE0YjhiNGQzZTgwMDEyYzlhMGUx"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "BAD_REQUEST",
"origin": "BANKING",
"message": "Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields.",
"fields": [
{
"field": "name",
"message": "Too big: expected string to have <=256 characters",
"code": "NAME_MAX"
}
]
}List organization cards
Lists the organization’s cards, across all its wallets, newest first.
curl --request GET \
--url https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/cardsimport requests
url = "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/cards"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/cards', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/cards",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/cards"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/cards")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/cards")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_body{
"items": [
{
"_id": "66f2a4b8b4d3e80012c9a0e1",
"realmId": "f495ff0c-ab54-4f99-8e92-ca8682e4de9b",
"organizationId": "c4bd3f21-dfbd-44e8-8055-68ba15bed410",
"accountId": "66f2a1c7b4d3e80012c9a0b4",
"walletId": "66f2a3d1b4d3e80012c9a0d2",
"environment": "LIVE",
"panMasked": "524674******4821",
"external": {
"cardId": "3f1c9a52-7d4e-4b8a-9e21-6c0d8b7a5f43",
"instrumentId": "8b2e4f60-1a3c-4d5e-9f70-2b4c6d8e0a12"
},
"status": "ACTIVE",
"createdAt": "2026-11-02T13:05:11.000Z",
"updatedAt": "2026-11-02T13:05:12.000Z",
"expiryDate": "11/2031",
"tokenisationPermitted": true,
"singleUse": false,
"type": "VIRTUAL",
"customFields": {
"cost-center": "CC-1020"
},
"issuedAt": "2026-11-02T13:05:11.000Z",
"name": "Marketing - Ads",
"ownerName": "MARIANA COSTA",
"isSuper": false,
"walletProduct": "NORMAL",
"cardLimitIds": [
"66f2a5c2b4d3e80012c9a0f3"
],
"createdBy": "e3553bc1-5e20-4e17-b22a-a796fda0aa99",
"updatedBy": "e3553bc1-5e20-4e17-b22a-a796fda0aa99",
"__v": 0
}
],
"next": "NjZmMmE0YjhiNGQzZTgwMDEyYzlhMGUx"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "BAD_REQUEST",
"origin": "BANKING",
"message": "Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields.",
"fields": [
{
"field": "name",
"message": "Too big: expected string to have <=256 characters",
"code": "NAME_MAX"
}
]
}name (a part of the card’s name or masked number), lastDigits, status and type — status and type take several values, comma-separated (?status=ACTIVE,BLOCKED) — and page with limit + next. Only the cards of the environment in x-environment are listed, so send x-environment: LIVE for production cards.
Any member of the organization can list its cards.Headers
Environment whose cards you list: LIVE (production) or TEST (sandbox). When you omit it, you get the TEST cards; any other value is rejected.
LIVE, TEST Path Parameters
ID of your realm.
Format: UUID
ID of the organization.
Format: UUID
Query Parameters
Only cards whose name or masked card number contains this text (case-insensitive).
256Only cards whose card number ends with these digits.
256Only cards in these statuses (case-insensitive): ACTIVE, BLOCKED or CANCELLED. Other values match no card.
Example (comma-separated list): ?status=ACTIVE,BLOCKED
64Only cards of these types (case-insensitive): VIRTUAL or EMBOSSED (physical). Other values match no card.
Example (comma-separated list): ?type=VIRTUAL,EMBOSSED
64Cursor returned as next by the previous page. Omit it for the first page.
Page size. Defaults to 15.
x > 0