Returns a paginated list of vendor cards (corporate cards issued by Cardda) belonging to the specified company. Each row in the response represents a single physical or virtual card and exposes its current status, spending limits, balance, the user it is assigned to, and the underlying issuing vendor (type).

The result is automatically scoped:

• Admins see every card of the company.
• Company members with the vendor_cards_manage permission see every card of the company.
• Regular users see only cards assigned to them (user_id matches their Firebase user id).

Response structure

Each item is a VendorCard plus the following computed fields:

Filtering grammar

Every column documented below accepts the MongoDB-style operators described in Filters: $gt, $gte, $lt, $lte, $in, $nin, $ne, $regex, $or. Combine them on a single field (created_at={"$gte":"2026-01-01T00:00:00Z","$lt":"2026-02-01T00:00:00Z"}) or across fields (status=active&user_id=...).

Common queries

# Active + inactive + pending cards of a specific user (the dashboard's default)
GET /v1/vendor_cards?\
  $or=[{"status":"active"},{"status":"inactive"},{"status":"pending"}]&\
  user_id=<firebase_uid>&\
  _order=desc&_field=created_at&_start=0&_end=25

# Search by name OR last4 (cardholder lookup)
GET /v1/vendor_cards?\
  $or=[{"name":{"$regex":"maria"}},{"last4":{"$regex":"^4242"}}]&\
  _start=0&_end=50

# Cards assigned to a specific person, with allocation-based control
GET /v1/vendor_cards?\
  user_id=<firebase_uid>&\
  spending_control_strategy=allocation_based

# Cards by id (batch lookup, e.g. to refresh a dashboard view)
GET /v1/vendor_cards?id={"$in":["Q2FyZDoxMDIwNjQ5Mw==","Q2FyZDoxMDIwNjQ5NA=="]}