Cards

Overview

Base path: /v1/cards · Scope: tb:internal-cards:read / tb:internal-cards:write

Order physical and virtual cards, read their details in encrypted form, and manage their state.

Card data never travels in the clear.

Card details and the PIN are encrypted with the public key from GET /v1/cards/public-key — both when you read them and when you set a new PIN.

v1/cards/public-key

GET/v1/cards/public-key

Auth: None — public endpoint

Returns the public key used to encrypt card data (PIN) before sending it, and to receive encrypted card details.

GET/v1/cards/public-key

curl 'https://sandbox-bank.tedr.com/open-banking/v1/cards/public-key'

const response = await fetch('https://sandbox-bank.tedr.com/open-banking/v1/cards/public-key');


const { data } = await response.json();

import requests


response = requests.get(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards/public-key',
)


data = response.json()['data']

{
  "status": "SUCCESS",
  "data": { "publicKey": "-----BEGIN PUBLIC KEY-----..." }
}

Authorization: not required.

v1/cards/can-order-card

GET/v1/cards/can-order-card

Auth: Bearer access token — how to use the access token.

Whether the current client may order a card (tariff, KYC status and so on).

GET/v1/cards/can-order-card

curl 'https://sandbox-bank.tedr.com/open-banking/v1/cards/can-order-card' \
  -H 'Authorization: Bearer <access-token>'

const response = await fetch('https://sandbox-bank.tedr.com/open-banking/v1/cards/can-order-card', {
  headers: { Authorization: 'Bearer <access-token>' },
});


const { data } = await response.json();

import requests


response = requests.get(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards/can-order-card',
    headers={'Authorization': 'Bearer <access-token>'},
)


data = response.json()['data']

{ "status": "SUCCESS", "data": { "result": true } }

v1/cards/programs

Available card programs.

Card program fields
Field	Description
`id · name · description`	Program identity.
`currencies[]`	Currencies the program can be issued in.
`processingType`	`VISA` or `MASTERCARD`.
`cardType`	`PHYSICAL` or `VIRTUAL`.
`cost`	`issue`, `service`, `currency`.

GET /v1/cards/programs

GET/v1/cards/programs

Auth: Bearer access token — how to use the access token.

Query: ids[], pagination[limit], pagination[skip].

GET/v1/cards/programs

curl 'https://sandbox-bank.tedr.com/open-banking/v1/cards/programs' \
  -H 'Authorization: Bearer <access-token>'

const response = await fetch('https://sandbox-bank.tedr.com/open-banking/v1/cards/programs', {
  headers: { Authorization: 'Bearer <access-token>' },
});


const { data } = await response.json();

import requests


response = requests.get(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards/programs',
    headers={'Authorization': 'Bearer <access-token>'},
)


data = response.json()['data']

GET /v1/cards/programs/:programId

GET/v1/cards/programs/:programId

Auth: Bearer access token — how to use the access token.

GET/v1/cards/programs/:programId

curl 'https://sandbox-bank.tedr.com/open-banking/v1/cards/programs/<programId>' \
  -H 'Authorization: Bearer <access-token>'

const response = await fetch('https://sandbox-bank.tedr.com/open-banking/v1/cards/programs/<programId>', {
  headers: { Authorization: 'Bearer <access-token>' },
});


const { data } = await response.json();

import requests


response = requests.get(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards/programs/<programId>',
    headers={'Authorization': 'Bearer <access-token>'},
)


data = response.json()['data']

v1/cards/delivery-methods

Available delivery methods.

Each method contains id, name, description and cost (amount, currency).

GET /v1/cards/delivery-methods

GET/v1/cards/delivery-methods

Auth: Bearer access token — how to use the access token.

Query: ids[], pagination[limit], pagination[skip].

GET/v1/cards/delivery-methods

curl 'https://sandbox-bank.tedr.com/open-banking/v1/cards/delivery-methods' \
  -H 'Authorization: Bearer <access-token>'

const response = await fetch('https://sandbox-bank.tedr.com/open-banking/v1/cards/delivery-methods', {
  headers: { Authorization: 'Bearer <access-token>' },
});


const { data } = await response.json();

import requests


response = requests.get(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards/delivery-methods',
    headers={'Authorization': 'Bearer <access-token>'},
)


data = response.json()['data']

GET /v1/cards/delivery-methods/:deliveryMethodId

GET/v1/cards/delivery-methods/:deliveryMethodId

Auth: Bearer access token — how to use the access token.

GET/v1/cards/delivery-methods/:deliveryMethodId

curl 'https://sandbox-bank.tedr.com/open-banking/v1/cards/delivery-methods/<deliveryMethodId>' \
  -H 'Authorization: Bearer <access-token>'

const response = await fetch('https://sandbox-bank.tedr.com/open-banking/v1/cards/delivery-methods/<deliveryMethodId>', {
  headers: { Authorization: 'Bearer <access-token>' },
});


const { data } = await response.json();

import requests


response = requests.get(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards/delivery-methods/<deliveryMethodId>',
    headers={'Authorization': 'Bearer <access-token>'},
)


data = response.json()['data']

v1/cards — order a card

POST/v1/cards

Auth: Bearer access token — how to use the access token.

Body parameters
Name	Type	Required	Description
programId	UUID	Required	Card program.
cardholderName	string	Required	Name embossed on the card.
phoneNumber	string	Required	Cardholder phone.
delivery	object	Optional	Required for physical cards.
delivery.deliveryMethodId	UUID	Required	Required inside `delivery`.
delivery.address.line1	string	Required	Street address.
delivery.address.line2	string	Optional	Apartment, suite and so on.
delivery.address.city	string	Required	City.
delivery.address.countryCode	string	Required	ISO alpha-3, e.g. `DEU`.
delivery.address.zipCode	string	Required	Postal code.
delivery.address.region	string	Optional	Region or state.
delivery.address.nameOrCompanyName	string	Required	Recipient of the delivery.

POST/v1/cards

curl -X POST 'https://sandbox-bank.tedr.com/open-banking/v1/cards' \
  -H 'Authorization: Bearer <access-token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "programId": "80d9a3a3-787c-4475-bf2c-14e05424acac",
    "cardholderName": "MAX MUSTERMANN",
    "phoneNumber": "+1234567890",
    "delivery": {
      "deliveryMethodId": "5f4d42e5-60cb-42bc-b0d4-2b73d063560f",
      "address": {
        "line1": "Musterstrasse 1",
        "line2": "Apt. 5",
        "city": "Musterstadt",
        "countryCode": "DEU",
        "zipCode": "12345",
        "region": "Musterland",
        "nameOrCompanyName": "Max Mustermann"
      }
    }
  }'

const response = await fetch('https://sandbox-bank.tedr.com/open-banking/v1/cards', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <access-token>',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    programId: '80d9a3a3-787c-4475-bf2c-14e05424acac',
    cardholderName: 'MAX MUSTERMANN',
    phoneNumber: '+1234567890',
    delivery: {
      deliveryMethodId: '5f4d42e5-60cb-42bc-b0d4-2b73d063560f',
      address: {
        line1: 'Musterstrasse 1',
        line2: 'Apt. 5',
        city: 'Musterstadt',
        countryCode: 'DEU',
        zipCode: '12345',
        region: 'Musterland',
        nameOrCompanyName: 'Max Mustermann',
      },
    },
  }),
});


const { data } = await response.json();

import requests


response = requests.post(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards',
    headers={'Authorization': 'Bearer <access-token>'},
    json={
        'programId': '80d9a3a3-787c-4475-bf2c-14e05424acac',
        'cardholderName': 'MAX MUSTERMANN',
        'phoneNumber': '+1234567890',
        'delivery': {
            'deliveryMethodId': '5f4d42e5-60cb-42bc-b0d4-2b73d063560f',
            'address': {
                'line1': 'Musterstrasse 1',
                'line2': 'Apt. 5',
                'city': 'Musterstadt',
                'countryCode': 'DEU',
                'zipCode': '12345',
                'region': 'Musterland',
                'nameOrCompanyName': 'Max Mustermann',
            },
        },
    },
)


data = response.json()['data']

The delivery data is nested.

deliveryMethodId and address go inside the delivery object, and cardholderName is required.

The card is returned with orderStatus: PROCESSING.

v1/cards — list and read

A card has two independent status fields — orderStatus and state — and they are filtered separately.

Status fields

Card status fields
Field	Values
`orderStatus`	`PROCESSING`, `WAITING_PAY`, `CREATING_CARD`, `DISPATCHED`, `ACTIVATION_CARD`, `APPROVED`, `DECLINED`.
`state`	`ACTIVATION_IN_PROGRESS`, `ACTIVE`, `INACTIVE`, `BLOCKED`, `CLOSED`, `EXPIRED`.
`type`	`PHYSICAL` or `VIRTUAL`.

Card object

Card object fields
Field	Type	Description
`id`	`UUID`	Card id.
`clientId`	`UUID`	Owner.
`programId`	`UUID`	Card program.
`holderName`	`string`	Name embossed on the card.
`holderPhone`	`string`	Cardholder phone.
`orderStatus`	`enum`	Where the order stands.
`state`	`enum`	Whether the card can be used.
`type`	`PHYSICAL \| VIRTUAL`	Card form factor.
`processingType`	`VISA \| MASTERCARD`	Payment network.
`isDefault`	`boolean`	The client's default card.
`virtualAccountId`	`UUID \| null`	Linked account, when there is one.

GET /v1/cards

GET/v1/cards

Auth: Bearer access token — how to use the access token.

Query: ids[], orderStatuses[], states[], types[], pagination[limit], pagination[skip].

GET/v1/cards

curl -G 'https://sandbox-bank.tedr.com/open-banking/v1/cards' \
  -H 'Authorization: Bearer <access-token>' \
  -d 'states[]=ACTIVE' \
  -d 'types[]=VIRTUAL'

const query = new URLSearchParams();
query.append('states[]', 'ACTIVE');
query.append('types[]', 'VIRTUAL');


const response = await fetch(`https://sandbox-bank.tedr.com/open-banking/v1/cards?${query}`, {
  headers: { Authorization: 'Bearer <access-token>' },
});


const { data } = await response.json();

import requests


response = requests.get(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards',
    headers={'Authorization': 'Bearer <access-token>'},
    params=[('states[]', 'ACTIVE'), ('types[]', 'VIRTUAL')],
)


data = response.json()['data']

GET /v1/cards/:cardId

GET/v1/cards/:cardId

Auth: Bearer access token — how to use the access token.

GET/v1/cards/:cardId

curl 'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>' \
  -H 'Authorization: Bearer <access-token>'

const response = await fetch('https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>', {
  headers: { Authorization: 'Bearer <access-token>' },
});


const { data } = await response.json();

import requests


response = requests.get(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>',
    headers={'Authorization': 'Bearer <access-token>'},
)


data = response.json()['data']

Card requisites and PIN

Return the card details (number, CVV, expiry) and the PIN, encrypted with the public key passed in the path.

Decrypt the returned string with your private key on your side.

GET /v1/cards/:cardId/requisites/:publicKey

GET/v1/cards/:cardId/requisites/:publicKey

Auth: Bearer access token — how to use the access token.

GET/v1/cards/:cardId/requisites/:publicKey

curl 'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/requisites/<url-encoded-public-key>' \
  -H 'Authorization: Bearer <access-token>'

const publicKey = '<public-key>';


const response = await fetch(
  `https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/requisites/${encodeURIComponent(publicKey)}`,
  { headers: { Authorization: 'Bearer <access-token>' } },
);


const { data } = await response.json();

import urllib.parse


import requests


public_key = '<public-key>'


response = requests.get(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/requisites/'
    + urllib.parse.quote(public_key, safe=''),
    headers={'Authorization': 'Bearer <access-token>'},
)


data = response.json()['data']

{
  "status": "SUCCESS",
  "data": { "requisites": "<encrypted string>" }
}

GET /v1/cards/:cardId/pin-code/:publicKey

GET/v1/cards/:cardId/pin-code/:publicKey

Auth: Bearer access token — how to use the access token.

GET/v1/cards/:cardId/pin-code/:publicKey

curl 'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/pin-code/<url-encoded-public-key>' \
  -H 'Authorization: Bearer <access-token>'

const publicKey = '<public-key>';


const response = await fetch(
  `https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/pin-code/${encodeURIComponent(publicKey)}`,
  { headers: { Authorization: 'Bearer <access-token>' } },
);


const { data } = await response.json();

import urllib.parse


import requests


public_key = '<public-key>'


response = requests.get(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/pin-code/'
    + urllib.parse.quote(public_key, safe=''),
    headers={'Authorization': 'Bearer <access-token>'},
)


data = response.json()['data']

v1/cards/:cardId/phone-number

PATCH/v1/cards/:cardId/phone-number

Auth: Bearer access token — how to use the access token.

Update the cardholder's phone number.

PATCH/v1/cards/:cardId/phone-number

curl -X PATCH 'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/phone-number' \
  -H 'Authorization: Bearer <access-token>' \
  -H 'Content-Type: application/json' \
  -d '{ "phoneNumber": "+1234567890" }'

const response = await fetch(
  'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/phone-number',
  {
    method: 'PATCH',
    headers: {
      Authorization: 'Bearer <access-token>',
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ phoneNumber: '+1234567890' }),
  },
);


const { data } = await response.json();

import requests


response = requests.patch(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/phone-number',
    headers={'Authorization': 'Bearer <access-token>'},
    json={'phoneNumber': '+1234567890'},
)


data = response.json()['data']

v1/cards/:cardId/pin-code

PATCH/v1/cards/:cardId/pin-code

Auth: Bearer access token — how to use the access token.

Set a new PIN.

PATCH/v1/cards/:cardId/pin-code

curl -X PATCH 'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/pin-code' \
  -H 'Authorization: Bearer <access-token>' \
  -H 'Content-Type: application/json' \
  -d '{ "pin": "<PIN encrypted with the public key>" }'

const response = await fetch(
  'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/pin-code',
  {
    method: 'PATCH',
    headers: {
      Authorization: 'Bearer <access-token>',
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ pin: '<PIN encrypted with the public key>' }),
  },
);


const { data } = await response.json();

import requests


response = requests.patch(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/pin-code',
    headers={'Authorization': 'Bearer <access-token>'},
    json={'pin': '<PIN encrypted with the public key>'},
)


data = response.json()['data']

The PIN is transmitted encrypted, never as plain digits.

Encrypt it with the key from GET /v1/cards/public-key. Sending "1234" will be rejected by the card processor.

Activate, block, unblock and close

No body. All four return the updated card object.

Closing a card is irreversible.

A closed card cannot be reactivated — order a new one instead.

PATCH /v1/cards/:cardId/active

PATCH/v1/cards/:cardId/active

Auth: Bearer access token — how to use the access token.

PATCH/v1/cards/:cardId/active

curl -X PATCH 'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/active' \
  -H 'Authorization: Bearer <access-token>'

const response = await fetch('https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/active', {
  method: 'PATCH',
  headers: { Authorization: 'Bearer <access-token>' },
});


const { data } = await response.json();

import requests


response = requests.patch(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/active',
    headers={'Authorization': 'Bearer <access-token>'},
)


data = response.json()['data']

PATCH /v1/cards/:cardId/block

PATCH/v1/cards/:cardId/block

Auth: Bearer access token — how to use the access token.

PATCH/v1/cards/:cardId/block

curl -X PATCH 'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/block' \
  -H 'Authorization: Bearer <access-token>'

const response = await fetch('https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/block', {
  method: 'PATCH',
  headers: { Authorization: 'Bearer <access-token>' },
});


const { data } = await response.json();

import requests


response = requests.patch(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/block',
    headers={'Authorization': 'Bearer <access-token>'},
)


data = response.json()['data']

PATCH /v1/cards/:cardId/unblock

PATCH/v1/cards/:cardId/unblock

Auth: Bearer access token — how to use the access token.

PATCH/v1/cards/:cardId/unblock

curl -X PATCH 'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/unblock' \
  -H 'Authorization: Bearer <access-token>'

const response = await fetch('https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/unblock', {
  method: 'PATCH',
  headers: { Authorization: 'Bearer <access-token>' },
});


const { data } = await response.json();

import requests


response = requests.patch(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/unblock',
    headers={'Authorization': 'Bearer <access-token>'},
)


data = response.json()['data']

PATCH /v1/cards/:cardId/close

PATCH/v1/cards/:cardId/close

Auth: Bearer access token — how to use the access token.

PATCH/v1/cards/:cardId/close

curl -X PATCH 'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/close' \
  -H 'Authorization: Bearer <access-token>'

const response = await fetch('https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/close', {
  method: 'PATCH',
  headers: { Authorization: 'Bearer <access-token>' },
});


const { data } = await response.json();

import requests


response = requests.patch(
    'https://sandbox-bank.tedr.com/open-banking/v1/cards/<cardId>/close',
    headers={'Authorization': 'Bearer <access-token>'},
)


data = response.json()['data']