curl --request GET \
--url https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/policy \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/policy"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/policy', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/policy",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/policy"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/policy")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/policy")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"success": true,
"data": {
"cardId": "6f1c…",
"version": 3,
"areas": {
"mcc": {
"enabled": true,
"mode": "ALLOW_ALL_EXCEPT_BLOCKED",
"editable": true,
"card": {
"allow": [],
"block": [
"7995"
]
},
"effective": {
"mode": "ALLOW_ALL_EXCEPT_BLOCKED",
"blocked": [
"5813",
"5921",
"7273",
"7297",
"7995"
]
}
},
"limits": {
"enabled": true,
"mode": "PER_CHANNEL",
"editable": true,
"card": null,
"effective": {
"atm": {
"single": 20000,
"daily": 50000,
"weekly": 0,
"monthly": 0,
"annual": 0
},
"pos": {
"single": 100000,
"daily": 250000,
"weekly": 0,
"monthly": 0,
"annual": 0
}
}
},
"country": {
"enabled": true,
"mode": "ALLOW_ALL_EXCEPT_BLOCKED",
"editable": true,
"card": null,
"effective": {
"mode": "ALLOW_ALL_EXCEPT_BLOCKED",
"countries": [
"AF",
"BY",
"CU",
"IR",
"KP",
"RU",
"SY"
],
"regions": []
}
}
}
}
}Get this card's policy
What this card is allowed to do, and what the cardholder may change.
Each area reports three things: card (the cardholder’s own override, null if none), effective (what is actually applied, including restrictions set by the program or by Orenda), and mode — which decides whether to render a block list or a pick-from-allowed list. Rendering the wrong control makes every save fail validation, so read mode before drawing anything.
A restriction set above the cardholder appears in effective but not in card, and they cannot remove it. If the program has no policy template for this card’s tier there is nothing to enforce and nothing to show, and the route returns 404 CARD_POLICY_NOT_APPLICABLE. That is a template check, not a provider check — the handler does not inspect the card provider.
curl --request GET \
--url https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/policy \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/policy"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/policy', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/policy",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/policy"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/policy")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.next.orenda.finance/v1/customers/{customerId}/accounts/{accountId}/cards/{cardId}/policy")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"success": true,
"data": {
"cardId": "6f1c…",
"version": 3,
"areas": {
"mcc": {
"enabled": true,
"mode": "ALLOW_ALL_EXCEPT_BLOCKED",
"editable": true,
"card": {
"allow": [],
"block": [
"7995"
]
},
"effective": {
"mode": "ALLOW_ALL_EXCEPT_BLOCKED",
"blocked": [
"5813",
"5921",
"7273",
"7297",
"7995"
]
}
},
"limits": {
"enabled": true,
"mode": "PER_CHANNEL",
"editable": true,
"card": null,
"effective": {
"atm": {
"single": 20000,
"daily": 50000,
"weekly": 0,
"monthly": 0,
"annual": 0
},
"pos": {
"single": 100000,
"daily": 250000,
"weekly": 0,
"monthly": 0,
"annual": 0
}
}
},
"country": {
"enabled": true,
"mode": "ALLOW_ALL_EXCEPT_BLOCKED",
"editable": true,
"card": null,
"effective": {
"mode": "ALLOW_ALL_EXCEPT_BLOCKED",
"countries": [
"AF",
"BY",
"CU",
"IR",
"KP",
"RU",
"SY"
],
"regions": []
}
}
}
}
}Authorizations
The user's id_token from authentication — the ID token, not the access_token. The program and environment come from the token.