Check for stored cards

curl "https://api.agentcard.sh/api/v2/vault_cards?user_id=usr_8f3k2m" \
  -H "Authorization: Bearer $ORG_TOKEN"

{
  "object": "list",
  "data": [
    {
      "object": "vault_card",
      "id": "vc_9m4t2p",
      "brand": "visa",
      "last4": "4832",
      "expiry_month": 12,
      "expiry_year": 2029,
      "created_at": "2026-09-02T18:41:07Z"
    }
  ]
}

const res = await fetch(
  `https://api.agentcard.sh/api/v2/vault_cards?user_id=${userId}`,
  { headers: { Authorization: `Bearer ${orgToken}` } },
);

if (res.status === 404) {
  await sendVaultLink(userId);        // not your user yet, enroll them
  return;
}
if (!res.ok) throw new Error((await res.json()).error.message);

const { data: cards } = await res.json();

if (cards.length === 0) {
  await sendVaultLink(userId);        // create a vault session, send its url
} else {
  await startPurchase(userId, cards[0].id);
}

{
  "error": {
    "code": "connection_not_found",
    "message": "No production connection exists for that user. Sandbox and production users are separate: run the connect flow (POST /api/v2/connect/start) for this user with your production credentials first."
  }
}