> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developer.americanexpress.ferndocs.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer.americanexpress.ferndocs.com/_mcp/server.

# Retrieve a Card User

GET https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/{cardUserId}

Return the details of a specific Card User.

Reference: https://developer.americanexpress.ferndocs.com/payment-services/card-on-demand/api-reference/retrieve-card-user

## Authentication

- `Authorization` header (bearer token, required) — OAuth 2.0 client credentials. Exchange your API key and secret for a bearer token, then send it as `Authorization: Bearer <token>`.

## Servers

- `https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand` (Sandbox, default)
- `https://api.americanexpress.com/commercial/v1/card_on_demand` (Production)

## Request

### Path parameters

- `cardUserId` (string, required) — A unique ID that is created for the Card User.

## Response

### 200

Successful operation

- `cardUserId` (string, required) — A unique ID that is created for the Card User.
- `buyerId` (string, required) — A unique Buyer ID that is created during the Buyer enrollment.
- `name` (name, required) — The name of the Card User.
- `dateOfBirth` (string, required) — The Date of Birth of the Card User in YYYY-MM-DD format.
- `email` (list of EmailItems, required) — The email of the Card User; currently supports only one email.
- `phone` (list of PhoneItems, required) — The phone details of the Card User; currently supports only one phone.
- `address` (list of AddressItems, required) — The residential address of the Card User; currently supports only one address with the type RESIDENCE. P.O. boxes or commercial mail-receiving agencies are prohibited. The address will be validated using the [USPS address validation API](https://www.usps.com/business/web-tools-apis/address-information-api.htm).
- `status` (enum, required) — The status of the Card User. A Card User may have any of the following statuses: - ACTIVATED indicates that the Card User has been successfully verified and can be assigned Virtual Cards. - VERIFICATION_PENDING indicates that the Card User is under review and additional information is required to complete the Card User's verification. - VERIFICATION_FAILED indicates that American Express was unable to successfully verify the Card User, and hence Virtual Cards cannot be assigned to the User. - DEACTIVATED indicates that the Card User was deactivated by the Buyer and cannot be assigned Virtual Cards.
  - Allowed values: `ACTIVATED`, `VERIFICATION_PENDING`, `VERIFICATION_FAILED`, `DEACTIVATED`
- `expressConsentObtained` (boolean, required) — The Card User's consent to send their PII to American Express for verification.
- `dateCreated` (string, required) — The date on which the Card User was created in YYYY-MM-DD format.
- `employeeId` (string, optional) — The unique ID assigned by the Buyer resource to the Card User being enrolled. Alphabetic characters, spaces and numbers are allowed.

## Errors

### 400 Bad Request Error

Bad Request

- `errors` (list of 400ErrorItems, required)

### 401 Unauthorized Error

Unauthorized

- `errorCode` (string, required) — A machine-readable field indicating the type of error.
- `errorDescription` (string, optional) — Provides a short description of the error.

### 403 Forbidden Error

Unauthenticated

- `errorCode` (string, required) — A machine-readable field indicating the type of error.
- `errorDescription` (string, optional) — Provides a short description of the error.

### 404 Not Found Error

Resource not found

- `errorCode` (string, required) — A machine-readable field indicating the type of error.
- `errorDescription` (string, optional) — Provides a short description of the error.

### 500 Internal Server Error

Service error

- `errorCode` (string, required) — A machine-readable field indicating the type of error.
- `errorDescription` (string, optional) — Provides a short description of the error.

### 503 Service Unavailable Error

Service unavailable

- `errorCode` (string, required) — A machine-readable field indicating the type of error.
- `errorDescription` (string, optional) — Provides a short description of the error.

## Types

### name

The name of the Card User.

- `first` (string, required) — The first name. The allowed characters are alphabets, spaces, hyphen (-) and apostrophe (').
- `last` (string, required) — The last name. The allowed characters are alphabets, spaces, hyphen (-) and apostrophe (').
- `middle` (string, optional) — The middle name or initial. The allowed characters are alphabets, spaces, hyphen (-) and apostrophe (').
- `suffix` (string, optional) — The suffix, e.g., Jr. Only alphabetic characters and periods are allowed.

### EmailItems

- `type` (enum, required) — The type of email; currently supports only PERSONAL.
  - Allowed values: `PERSONAL`, `WORK`, `ALTERNATE`
- `emailAddress` (string, required) — The email address.

### PhoneItems

- `countryCode` (string, required) — The country code must be three digits. Only numeric values accepted. Currently supports only the U.S. country code.
- `number` (string, required) — The phone number of the Card User.
- `type` (enum, required) — The allowed value is MOBILE.
  - Allowed values: `MOBILE`

### AddressItems

- `type` (enum, required) — The type of the Card User's address. The current version only supports the enum value as RESIDENCE. More enum values, such as WORK will be supported in the upcoming releases.
  - Allowed values: `RESIDENCE`
- `purpose` (enum, required) — The purpose for which the address will be used. The current version only supports PRIMARY, which includes the following purposes: KYC or identity verification, servicing communication, and default for delivering PLASTIC Cards. More enum values, such as PLASTIC_DELIVERY and STATEMENT_DELIVERY will be supported in the upcoming releases.
  - Allowed values: `PRIMARY`
- `line1` (string, required) — Address line one.
- `city` (string, required) — The city of the Card User's address.
- `state` (string, required) — The state of the Card User's address. Only alphabetic characters are allowed.
- `country` (string, required) — The two-letter country code of the Card User's address. Please find the full list in the [ISO Country Codes](iso-country-codes.pdf) list. The column to reference is Alpha 2 Code.
- `postalCode` (string, required) — The Postal Code of the Card User's address. Only numeric values and hyphens are allowed. For the most accurate address, please use the full nine-digit Postal Code. Some examples are 85260 or 85260-7706.
- `line2` (string, optional) — Address line two.

### 400ErrorItems

- `code` (string, required) — A machine-readable field indicating the type of error.
- `message` (string, required) — Provides a short description of the error.
- `detail` (string, optional) — Provides a detailed description of the error.
- `link` (string, optional) — The link to documentation that explains the error.

## Examples

**Response**

```json
{
  "cardUserId": "123456",
  "buyerId": "OBpB8D9X93VO03sm",
  "name": {
    "first": "John",
    "last": "Smith",
    "middle": "M",
    "suffix": "Jr."
  },
  "dateOfBirth": "1999-05-24",
  "email": [
    {
      "type": "PERSONAL",
      "emailAddress": "someone@example.com"
    }
  ],
  "phone": [
    {
      "countryCode": "001",
      "number": "5555551111",
      "type": "MOBILE"
    }
  ],
  "address": [
    {
      "type": "RESIDENCE",
      "purpose": "PRIMARY",
      "line1": "100 Elm Street",
      "city": "Phoenix",
      "state": "Arizona",
      "country": "US",
      "postalCode": "12345",
      "line2": "Suite A"
    }
  ],
  "status": "ACTIVATED",
  "expressConsentObtained": true,
  "dateCreated": "2024-02-07",
  "employeeId": "2322199833"
}
```

**SDK Code**

```python retrieveCardUser_example
import requests

url = "https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript retrieveCardUser_example
const url = 'https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go retrieveCardUser_example
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby retrieveCardUser_example
require 'uri'
require 'net/http'

url = URI("https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body
```

```java retrieveCardUser_example
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456")
  .header("Authorization", "Bearer <token>")
  .asString();
```

```php retrieveCardUser_example
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456', [
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp retrieveCardUser_example
using RestSharp;

var client = new RestClient("https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "Bearer <token>");
IRestResponse response = client.Execute(request);
```

```swift retrieveCardUser_example
import Foundation

let headers = ["Authorization": "Bearer <token>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.qasb2s.americanexpress.com/commercial/v1/card_on_demand/cardusers/123456")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```