Card Access Audit
GET
/v1/transactions/card-accessOptionalMerchant-scoped card-vault audit rows (who detokenized which card token, when).
Authentication
Signature Pattern
HMAC-SHA256(secretKey, "{timestamp}\nGET\n/v1/transactions/card-access\n{sha256(\"\")}")| Header | Value | Description |
|---|---|---|
X-Api-Key | pk_live_a1b2c3d4e5f6g7h8 | Merchant public API key |
X-Signature | {hmac_sha256_hex} | Hex HMAC-SHA256 request signature |
X-Timestamp | 2026-04-13T10:00:00Z | ISO 8601 UTC request time (±5 min) |
Request Parameters
| Name | Type | Required | Description |
|---|---|---|---|
from | string | Optional | ISO 8601 lower bound |
to | string | Optional | ISO 8601 upper bound |
limit | integer | Optional | Page size |
cursor | string | Optional | Opaque keyset cursor |
Response Parameters
| Field | Type | Example |
|---|---|---|
items | array | […] |
items[].op | string | "detokenize" |
items[].cardToken | string | "tok_9f8e7d6c5b4a" |
items[].callerService | string | "payment-engine" |
items[].result | string | "ok" |
items[].createdAt | string | "2026-04-13T10:00:01Z" |
Response Example
JSONResponse
{
"items": [
{
"op": "detokenize",
"cardToken": "tok_9f8e7d6c5b4a",
"callerService": "payment-engine",
"result": "ok",
"createdAt": "2026-04-13T10:00:01Z"
}
]
}Status Codes
200Success
201Created
400Bad Request
401Unauthorized
404Not Found
429Rate Limited
Try itMock
GEThttps://api.pay.sandbox.kvell.group