# GET /api/v1/credit/issuer/cardholders

> List spend by cardholder

- **Tag:** credit
- **Operation ID:** `list_issuer_cardholders`

## Description

Card spend per cardholder on the Ramp account connected to this business, highest spend first: transactions, net spend, spend in the last 30 days, the cards used, the newest transaction and the credit lines the cards are registered to. Declined and errored transactions are not spend. Without `start` the window opens at the first stored transaction. `CREDIT_742` when `start` is after `end`.

## Authentication

Bearer token in `Authorization` header.
Required header: `x-business-id: <business uuid>`.

## Parameters

- `start` (query, string · date, optional) — First transaction date to include (inclusive, UTC).
- `end` (query, string · date, optional) — Last transaction date to include (inclusive, UTC).
- `limit` (query, integer, optional) — Page size (1 to 500).
- `cursor` (query, string, optional) — `next_cursor` from the previous page, passed back unchanged.
- `include_total_count` (query, boolean, optional) — Also return `total`, the number of matching rows (one more query).

## Responses

### 200 — Successful Response

Schema: `SuccessEnvelope_IssuerCardholderPage_`

- `success` (boolean)
- `message` (string)
- `code` (string)
- `data` (IssuerCardholderPage)

### 400 — Bad Request - Invalid input

Schema: `ErrorResponse`

- `error` (string · required) — Error category: `validation_error`, `unauthorized`, `forbidden`, `not_found`, `conflict`, `rate_limited`, `server_error`, or `service_unavailable`.
- `message` (string · required) — Human-readable explanation, safe to show to end users.
- `code` (string · required) — Stable machine-readable code in `CATEGORY_NNN` form (e.g. `NOT_FOUND_006`, `AUTH_010`, `GEN_002`).
- `request_id` (string) — Correlation id for support requests. Echoes the `x-request-id` request header when one was supplied.
- `errors` (object) — Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

### 401 — Unauthorized - Missing or expired token, an MCP OAuth token used against the REST API, or no access to this business

Schema: `ErrorResponse`

- `error` (string · required) — Error category: `validation_error`, `unauthorized`, `forbidden`, `not_found`, `conflict`, `rate_limited`, `server_error`, or `service_unavailable`.
- `message` (string · required) — Human-readable explanation, safe to show to end users.
- `code` (string · required) — Stable machine-readable code in `CATEGORY_NNN` form (e.g. `NOT_FOUND_006`, `AUTH_010`, `GEN_002`).
- `request_id` (string) — Correlation id for support requests. Echoes the `x-request-id` request header when one was supplied.
- `errors` (object) — Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

### 403 — Forbidden - Insufficient permissions

Schema: `ErrorResponse`

- `error` (string · required) — Error category: `validation_error`, `unauthorized`, `forbidden`, `not_found`, `conflict`, `rate_limited`, `server_error`, or `service_unavailable`.
- `message` (string · required) — Human-readable explanation, safe to show to end users.
- `code` (string · required) — Stable machine-readable code in `CATEGORY_NNN` form (e.g. `NOT_FOUND_006`, `AUTH_010`, `GEN_002`).
- `request_id` (string) — Correlation id for support requests. Echoes the `x-request-id` request header when one was supplied.
- `errors` (object) — Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

### 422 — Validation Error

Schema: `ErrorResponse`

- `error` (string · required) — Error category: `validation_error`, `unauthorized`, `forbidden`, `not_found`, `conflict`, `rate_limited`, `server_error`, or `service_unavailable`.
- `message` (string · required) — Human-readable explanation, safe to show to end users.
- `code` (string · required) — Stable machine-readable code in `CATEGORY_NNN` form (e.g. `NOT_FOUND_006`, `AUTH_010`, `GEN_002`).
- `request_id` (string) — Correlation id for support requests. Echoes the `x-request-id` request header when one was supplied.
- `errors` (object) — Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

## Code samples

### cURL

```bash
curl -X GET 'https://api.ondayzero.com/api/v1/credit/issuer/cardholders' \
  -H 'Authorization: Bearer dz_your_token' \
  -H 'x-business-id: YOUR_BUSINESS_ID'
```

### JavaScript

```javascript
const response = await fetch('https://api.ondayzero.com/api/v1/credit/issuer/cardholders', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer dz_your_token',
    'x-business-id': 'YOUR_BUSINESS_ID',
  },
});
const data = await response.json();
```

### Python

```python
import httpx

headers = {
    "Authorization": "Bearer dz_your_token",
    "x-business-id": "YOUR_BUSINESS_ID",
}

response = httpx.get("https://api.ondayzero.com/api/v1/credit/issuer/cardholders", headers=headers)
data = response.json()
```

## See also

- HTML version: https://www.ondayzero.com/docs/reference/credit/list-issuer-cardholders
- OpenAPI slice: https://www.ondayzero.com/docs/reference/credit/list-issuer-cardholders/openapi.json
- Other endpoints in **credit**: https://www.ondayzero.com/docs/reference/credit (markdown bundle: https://www.ondayzero.com/docs/reference/credit.md, OpenAPI: https://www.ondayzero.com/docs/reference/credit/openapi.json)
- Endpoint catalog: https://www.ondayzero.com/docs/reference/index.md