Funding Sources

Base URL: https://api.codespar.dev

Every operation below requires a Bearer token. See Authentication.

GET /v1/funding-sources

List consumer funding sources

The funding sources of this project's consumers.

This path does NOT fetch live balance, and that is not an omission. The alias GET /v1/consumers/funding-sources accepts ?with_balance=1 and, for the pix-celcoin rows, fetches the balance from the provider one by one. The canonical path leaves that out on purpose: a listing of every consumer with live balance is a fan-out of N provider calls per request. If you need a balance, ask for the balance of ONE consumer, and the suppression here fails CLOSED: any route this handler does not recognize as the alias does not get a balance.

unattributed_count counts the rows no consumer claims.

Query parameters

Responses

Response 200

curl -X GET https://api.codespar.dev/v1/funding-sources \
  -H "Authorization: Bearer $CODESPAR_API_KEY"

GET /v1/funding-sources HTTP/1.1
Host: api.codespar.dev
Authorization: Bearer $CODESPAR_API_KEY

import os
import requests

res = requests.get(
    "https://api.codespar.dev/v1/funding-sources",
    headers={"Authorization": f"Bearer {os.environ['CODESPAR_API_KEY']}"},
)
res.raise_for_status()
data = res.json()

const res = await fetch("https://api.codespar.dev/v1/funding-sources", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CODESPAR_API_KEY}`,
  },
});

const data = await res.json();

const result = await cs.api.get("/v1/funding-sources");

{
  "funding_sources": [
    {
      "id": "obj_0000000000000000",
      "project_id": "prj_0000000000000000",
      "consumer_id": "csm_0000000000000000",
      "rail": "string",
      "currency": "BRL",
      "provider": "string",
      "display_label": "Example",
      "branch": "string",
      "status": "active",
      "pix_key": "string",
      "pix_key_type": "string",
      "created_at": "2026-01-15T12:00:00.000Z",
      "expires_at": "2026-01-15T12:00:00.000Z",
      "revoked_at": "2026-01-15T12:00:00.000Z",
      "metadata": {}
    }
  ],
  "unattributed_count": 1
}

GET /v1/funding-sources/{id}

Read one consumer funding source

One consumer rail: which provider holds it, which currency it authorizes, and whether it is still usable. Requires the consumers:fund scope.

RESOLUTION IS SCOPED TO THE ORGANIZATION AND THE PROJECT the credential authenticates for. A funding source held by a SIBLING project in the same organization answers 404 here, indistinguishable from one that never existed. Note that the sibling operations in this group do not all draw the line in the same place: the consent-record read below is scoped to the organization only.

NO LIVE BALANCE, and no query parameter asks for one. balance_minor is always null; the balance lives in the ledger.

No debit credential leaves. The row's provider token is an opaque vault pointer and is not in the response, and metadata is always {}: the account number and the holder's document stay on the row.

Path parameters

Responses

Response 200

curl -X GET https://api.codespar.dev/v1/funding-sources/{id} \
  -H "Authorization: Bearer $CODESPAR_API_KEY"

GET /v1/funding-sources/{id} HTTP/1.1
Host: api.codespar.dev
Authorization: Bearer $CODESPAR_API_KEY

import os
import requests

res = requests.get(
    "https://api.codespar.dev/v1/funding-sources/{id}",
    headers={"Authorization": f"Bearer {os.environ['CODESPAR_API_KEY']}"},
)
res.raise_for_status()
data = res.json()

const res = await fetch("https://api.codespar.dev/v1/funding-sources/{id}", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.CODESPAR_API_KEY}`,
  },
});

const data = await res.json();

const result = await cs.api.get("/v1/funding-sources/{id}", {
  path: {
    id: "fundingsource_0000000000000000"
  }
});

{
  "id": "obj_0000000000000000",
  "project_id": "prj_0000000000000000",
  "consumer_id": "csm_0000000000000000",
  "rail": "string",
  "currency": "BRL",
  "provider": "string",
  "display_label": "Example",
  "branch": "string",
  "status": "active",
  "pix_key": "string",
  "pix_key_type": "string",
  "created_at": "2026-01-15T12:00:00.000Z",
  "expires_at": "2026-01-15T12:00:00.000Z",
  "revoked_at": "2026-01-15T12:00:00.000Z",
  "metadata": {}
}