List a user's vaulted cards

curl "https://api.agentcard.sh/api/v2/vault_cards?user_id=usr_8f3k2m" \
  -H "Authorization: Bearer $ORG_TOKEN"

{
  "object": "list",
  "data": [
    {
      "object": "vault_card", "id": "vc_7f3a9c2e1b4d6f8a0c2e4b6d", "brand": "visa", "last4": "4832", "expiry_month": 12, "expiry_year": 2029, "created_at": "2026-09-02T18:41:07Z",
      "payment_permission": { "card_id": "vc_7f3a9c2e1b4d6f8a0c2e4b6d", "grant_id": null, "revision": null, "status": "pending", "ready": false }
    }
  ]
}

GET

api

vault_cards

curl "https://api.agentcard.sh/api/v2/vault_cards?user_id=usr_8f3k2m" \
  -H "Authorization: Bearer $ORG_TOKEN"

{
  "object": "list",
  "data": [
    {
      "object": "vault_card", "id": "vc_7f3a9c2e1b4d6f8a0c2e4b6d", "brand": "visa", "last4": "4832", "expiry_month": 12, "expiry_year": 2029, "created_at": "2026-09-02T18:41:07Z",
      "payment_permission": { "card_id": "vc_7f3a9c2e1b4d6f8a0c2e4b6d", "grant_id": null, "revision": null, "status": "pending", "ready": false }
    }
  ]
}

Use it to skip enrollment for a returning user, and to pick the id to pass as card_id on a checkout authorization.

string

required

The user whose cards to list.

curl "https://api.agentcard.sh/api/v2/vault_cards?user_id=usr_8f3k2m" \
  -H "Authorization: Bearer $ORG_TOKEN"

{
  "object": "list",
  "data": [
    {
      "object": "vault_card", "id": "vc_7f3a9c2e1b4d6f8a0c2e4b6d", "brand": "visa", "last4": "4832", "expiry_month": 12, "expiry_year": 2029, "created_at": "2026-09-02T18:41:07Z",
      "payment_permission": { "card_id": "vc_7f3a9c2e1b4d6f8a0c2e4b6d", "grant_id": null, "revision": null, "status": "pending", "ready": false }
    }
  ]
}

object

Whether your app can pay with this card without an approval link: card_id, grant_id, revision, status, and ready, as on Get a vault session. A card the user never gave your app reads pending, with ready false. unavailable means Agentcard couldn’t read the permission: read again. See Enable auto-approval.

The response never includes a card number or anything that could decrypt one.

Overview

Access tokens

Connections

Vault

Purchases

Cards

Identity verification

Webhook endpoints

Blooio connection

List a user's vaulted cards