# GET /api/v1/credit/issuer/card-transactions

> List the issuer's card transactions

- **Tag:** credit
- **Operation ID:** `list_issuer_card_transactions`

## Description

Card transactions on the Ramp account connected to this business, as DayZero last synced them, newest first. Each carries the card, the cardholder, Ramp's state, the account it is booked to in DayZero's books, and the credit line and loan when the card is registered to a line on this business. Reimbursements are left out unless `include_reimbursements=true`. Only what the Ramp sync has stored is listed: transactions on credit-line cards are loans, read them under the line. `CREDIT_742` when `start` is after `end`.

## Authentication

Bearer token in `Authorization` header.
Required header: `x-business-id: <business uuid>`.

## Parameters

- `start` (query, string · date, optional) — First transaction date to include (inclusive, UTC).
- `end` (query, string · date, optional) — Last transaction date to include (inclusive, UTC).
- `card_holder` (query, string, optional) — Only this cardholder's transactions (whole name, any case).
- `card_last_four` (query, string, optional) — Only transactions on the card ending in these four digits.
- `state` (query, string, optional) — Only transactions in this Ramp state, e.g. `CLEARED`.
- `include_reimbursements` (query, boolean, optional) — Also list reimbursements (`transaction_type=reimbursement`).
- `limit` (query, integer, optional) — Page size (1 to 500).
- `cursor` (query, string, optional) — `next_cursor` from the previous page, passed back unchanged.
- `include_total_count` (query, boolean, optional) — Also return `total`, the number of matching rows (one more query).

## Responses

### 200 — Successful Response

Schema: `SuccessEnvelope_IssuerCardTransactionPage_`

- `success` (boolean)
- `message` (string)
- `code` (string)
- `data` (IssuerCardTransactionPage)

### 400 — Bad Request - Invalid input

Schema: `ErrorResponse`

- `error` (string · required) — Error category: `validation_error`, `unauthorized`, `forbidden`, `not_found`, `conflict`, `rate_limited`, `server_error`, or `service_unavailable`.
- `message` (string · required) — Human-readable explanation, safe to show to end users.
- `code` (string · required) — Stable machine-readable code in `CATEGORY_NNN` form (e.g. `NOT_FOUND_006`, `AUTH_010`, `GEN_002`).
- `request_id` (string) — Correlation id for support requests. Echoes the `x-request-id` request header when one was supplied.
- `errors` (object) — Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

### 401 — Unauthorized - Missing or expired token, an MCP OAuth token used against the REST API, or no access to this business

Schema: `ErrorResponse`

- `error` (string · required) — Error category: `validation_error`, `unauthorized`, `forbidden`, `not_found`, `conflict`, `rate_limited`, `server_error`, or `service_unavailable`.
- `message` (string · required) — Human-readable explanation, safe to show to end users.
- `code` (string · required) — Stable machine-readable code in `CATEGORY_NNN` form (e.g. `NOT_FOUND_006`, `AUTH_010`, `GEN_002`).
- `request_id` (string) — Correlation id for support requests. Echoes the `x-request-id` request header when one was supplied.
- `errors` (object) — Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

### 403 — Forbidden - Insufficient permissions

Schema: `ErrorResponse`

- `error` (string · required) — Error category: `validation_error`, `unauthorized`, `forbidden`, `not_found`, `conflict`, `rate_limited`, `server_error`, or `service_unavailable`.
- `message` (string · required) — Human-readable explanation, safe to show to end users.
- `code` (string · required) — Stable machine-readable code in `CATEGORY_NNN` form (e.g. `NOT_FOUND_006`, `AUTH_010`, `GEN_002`).
- `request_id` (string) — Correlation id for support requests. Echoes the `x-request-id` request header when one was supplied.
- `errors` (object) — Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

### 422 — Validation Error

Schema: `ErrorResponse`

- `error` (string · required) — Error category: `validation_error`, `unauthorized`, `forbidden`, `not_found`, `conflict`, `rate_limited`, `server_error`, or `service_unavailable`.
- `message` (string · required) — Human-readable explanation, safe to show to end users.
- `code` (string · required) — Stable machine-readable code in `CATEGORY_NNN` form (e.g. `NOT_FOUND_006`, `AUTH_010`, `GEN_002`).
- `request_id` (string) — Correlation id for support requests. Echoes the `x-request-id` request header when one was supplied.
- `errors` (object) — Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

## Code samples

### cURL

```bash
curl -X GET 'https://api.ondayzero.com/api/v1/credit/issuer/card-transactions' \
  -H 'Authorization: Bearer dz_your_token' \
  -H 'x-business-id: YOUR_BUSINESS_ID'
```

### JavaScript

```javascript
const response = await fetch('https://api.ondayzero.com/api/v1/credit/issuer/card-transactions', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer dz_your_token',
    'x-business-id': 'YOUR_BUSINESS_ID',
  },
});
const data = await response.json();
```

### Python

```python
import httpx

headers = {
    "Authorization": "Bearer dz_your_token",
    "x-business-id": "YOUR_BUSINESS_ID",
}

response = httpx.get("https://api.ondayzero.com/api/v1/credit/issuer/card-transactions", headers=headers)
data = response.json()
```

## See also

- HTML version: https://www.ondayzero.com/docs/reference/credit/list-issuer-card-transactions
- OpenAPI slice: https://www.ondayzero.com/docs/reference/credit/list-issuer-card-transactions/openapi.json
- Other endpoints in **credit**: https://www.ondayzero.com/docs/reference/credit (markdown bundle: https://www.ondayzero.com/docs/reference/credit.md, OpenAPI: https://www.ondayzero.com/docs/reference/credit/openapi.json)
- Endpoint catalog: https://www.ondayzero.com/docs/reference/index.md