Cards

The RFID cards of the people the key can see. Cards are issued in MASK, not through the API. Needs cards:read.

List cards#

GET/integration/cardscards:read

The cards of the people of the key's institutions (or of one, or of one person), oldest first. 403 institution_not_allowed for an institutionId outside the key.

There are no card writes: cards are issued in the MASK web app. cardNumber is the card's identifier, as the MASK web app shows it; a person has at most one active card. status=all adds inactive and lost cards.

curl -s "$MASK/integration/cards?employeeId=24" -H "Authorization: Bearer $KEY"

{
  "list": [
    {"id": 28, "employeeId": 24, "cardNumber": "0D0C0B0A", "description": "Visitor badge 17", "status": "active", "createdAt": 1793813038}
  ],
  "count": 1,
  "page": 1,
  "pageSize": 50,
  "totalPages": 1
}

Parameters

employeeIdqueryinteger
Only this person's cards; a person the key cannot see gives an empty list
institutionIdqueryinteger
One of the key's institutions; omitted = all of them
statusquerystring
active | all (adds inactive and lost cards)
default "active"
pagequeryinteger
1-based
default 1
pageSizequeryinteger
1-200
default 50

Responses

200OKCard page

Fields of Card page

countinteger
listarray of Card
Fields of Card
- cardNumberstring
  The card's identifier, as the MASK web app shows it
- cardSerialstring
- createdAtinteger
  Epoch seconds, UTC
- descriptionstring
- employeeIdinteger
- idinteger
- statusstring
  active, inactive or lost; a person has at most one active card
- updatedAtinteger
pageinteger
pageSizeinteger
totalPagesinteger

Errors this route can answer

400Bad Requestvalidation_failedidempotency_requiredevent_too_old
401Unauthorizedinvalid_api_keykey_expiredkey_revoked
403Forbiddenip_not_allowedscope_missinginstitution_not_allowednot_api_eventadmin_linked_employee
429Too Many Requestsrate_limited
500Internal Server Errorinternal_error
503Service Unavailableunavailable

Each error has the same JSON body; see Errors for what every code means.