Browse the docs

Get cardholder

GET /v2/api-gateway/cardholders/{id}

Returns one cardholder of your organization, including the timestamps that tell you where they are in their lifecycle (delegated_kyc_completed_at, banned_at, auth_enabled_at, last_login_at). Look the cardholder up by the Moon id; to find one by your own identifier, filter GET /cardholders by external_id. A cardholder that belongs to another organization returns 404, same as one that does not exist.

Request

Authentication: your API key in the x-api-key header.

Path parameters

Field	Type	Description
`id` required	string, uuid	The Moon cardholder id (`id`, a UUID), not your `external_id`.

Example request

cURL

curl --request GET \
     --url 'https://api.themooncard.com/v2/api-gateway/cardholders/3f5b1c2e-8d4a-4b6f-9e2a-1c7d8e9f0a1b' \
     --header 'x-api-key: YOUR_API_KEY'

Responses

200 Success

Field	Type	Description
`id` required	string	Cardholder id (Moon-assigned).
`external_id` required	string, nullable	Your identifier for this cardholder (the `end_customer_id` you supplied), or null.
`organization_id` required	string	Owning organization.
`email` required	string, nullable
`delegated_kyc_completed_at` required	string, nullable	When delegated KYC was marked complete, or null.
`banned_at` required	string, nullable	When the cardholder was banned, or null.
`auth_enabled_at` required	string, nullable	When cardholder authentication was enabled, or null.
`last_login_at` required	string, nullable	When the cardholder last logged in, or null.
`metadata` required	object	The key-value data you stored on this cardholder, returned exactly as you sent it. An empty object when you never set any — it is never null.
`created_at` required	string, nullable
`updated_at` required	string, nullable

JSON

{
  "id": "3f5b1c2e-8d4a-4b6f-9e2a-1c7d8e9f0a1b",
  "external_id": "customer_123",
  "organization_id": "5c1e2d3f-4a5b-4c6d-8e7f-9a0b1c2d3e4f",
  "email": "jane@example.com",
  "delegated_kyc_completed_at": "2026-08-02T14:20:05.000Z",
  "banned_at": null,
  "auth_enabled_at": "2026-08-02T14:21:00.000Z",
  "last_login_at": "2026-08-15T09:03:44.000Z",
  "metadata": {
    "crm_id": "CRM-4821"
  },
  "created_at": "2026-08-01T09:12:44.000Z",
  "updated_at": "2026-08-15T09:03:44.000Z"
}

400 Error

Validation failed (errors[] lists each offending field) or a domain rule rejected the request ({ message, code }).

The body is the standard error object: see Errors.

401 Error

Missing or invalid credentials, e.g. { "message": "Invalid API Key", "code": "UNAUTHORIZED" }.

The body is the standard error object: see Errors.

404 Error

Cardholder not found or not owned by you.

The body is the standard error object: see Errors.

500 Error

Unexpected server error. Body is { message: "Internal server error", code: "INTERNAL_SERVER_ERROR" }.

The body is the standard error object: see Errors.

Last updated June 5, 2026