Appearance
Get one card
GET
/cards/{id}
One holder's card, with the program it was minted from, the locations it works at (derived from the PROGRAM's scope — a card carries no location of its own) and what its barcode contains. installed_at is the field to check before offering an edit: once it is set, the pass is on a device and the holder fields are frozen. barcode is what to print on a badge: scan_url is the form a phone's own camera app can open, legacy_payload the original tlp: string. Do NOT print install_qr_svg from the issue response for this — that is the single-use install token, not the card. Requires an UNRESTRICTED key: a key limited to specific locations is refused with 403 location_scope_unsupported, and shop-wide data is never silently served to it instead. A card is not attributed to a location anywhere in TesserApp — it belongs to a program, and programs belong to the whole shop — so there is no correct subset of cards to serve such a key.
Authorizations
ApiKeyBearer
A shop-scoped API key created in the dashboard and shown exactly once. An MCP tmk_ key presented here returns a 401 that names the mistake.
Type
HTTP (bearer)
Parameters
Path Parameters
id*
An opaque id. The API never promises an id format.
Type
Requiredstring
Responses
Get one card
application/json
JSON "id": "cin_docsfixture0001", "program_id": "prg_docsfixture0001", "program_name": "Coffee Card", "program_type": "standard", "external_ref": "EMP-00417", "holder_name": "Ada Lovelace", "holder_email": "ada@docsfixture.invalid", "status": "active", "stamps_count": 4, "current_value": 4, "expires_at": "2026-10-04T10:15:00.000Z", "installed_at": "2026-09-04T10:15:00.000Z", "created_at": "2026-08-05T10:15:00.000Z", "all_locations": true, "locations": [ { "id": "loc_docsfixture0001", "name": "Via Roma 1" } ], "barcode": { "scan_url": "https://tesserapp.eu/scan/prg_docsfixture0001/cin_docsfixture0001", "legacy_payload": "tlp:prg_docsfixture0001:cin_docsfixture0001" }
{
}
GET
/cards/{id}