{ "schema": "aaes/capability-pack/1", "provider": "marqeta", "version": "1.0.0", "description": "Read Marqeta cards, users, transactions, and balances; change card states to enable or withdraw authorization eligibility. Card reads can expose full card numbers or security codes until response fields are fixed outside the agent's control.", "notes": "The API host varies by environment — Marqeta's Core API Quick Start shows the shared public sandbox host sandbox-api.marqeta.com, and production programs run on dedicated hosts issued by Marqeta — so the registered authority your-program.marqeta.invalid is a placeholder on the reserved.invalid domain, not a reachable host. Replace it with the deployment's actual program host and keep the egress allowlist in step; the allowlist entry is the authority only. USER_TOKEN and ACCOUNT_HOLDER_TOKEN are path placeholders to replace before enabling.\n\nThe card read is not enforced metadata-only: Marqeta's card object returns pan by default — the documentation's own sample card response carries a full PAN — the fields query parameter that shapes the response is caller-controlled on this registered GET (left blank it returns all fields), and show_pan and show_cvv_number are caller-settable query parameters on card endpoints; saying those parameters are not registered does not exclude them from a registered route.\n\nRequired handling: the deployment must pin response shaping outside the agent's reach (an executor-fixed fields list that excludes pan and cvv_number), treat every response from this capability as potentially PCI-scope cardholder data until that pinning is verified, and keep such responses out of logs, traces and crash reports. The dedicated PAN- and CVV-bearing endpoints (GET /cards/{token}/showpan, POST /cards/getbypan) remain unregistered.\n\nThe card-transition capability changes a card's state (for example UNACTIVATED to ACTIVE, or ACTIVE to SUSPENDED): a state transition is a card authorization control — activating enables the card for authorization subject to program configuration, funding and spend controls (not a promise that every transaction up to a limit will be honored), suspending withdraws that eligibility — and it is registered at the pay verb's R3 floor under the finance-pack rule that card authorization control sits with money-committing actions, even though no money moves at request time.\n\nThis pack does not register card creation (POST /cards issues spending power and is left out until separately reviewed), user or business creation, user transitions, PIN endpoints, funding endpoints (/gpaorders, /fundingsources), program or intra-account transfers, spend-control management (/authcontrols, /velocitycontrols), webhooks, or the /simulate endpoints. AAES has not been certified by Marqeta; the endpoints here are configuration to review and test; the vendor has not endorsed it.", "credential": { "secret_ref_id": "secret-ref-marqeta-api-basic", "custody": "customer_vault", "inject": "header", "inject_name": "Authorization", "note": "Store the complete Marqeta Core API Authorization header in the client's secret manager: 'Basic '. The application token is the username and the admin access token is the password. Marqeta lists these keys in its Dashboard; issuance and rotation run outside the agent and executor.\n\nWhere available, use Marqeta's self-service credential API (POST /credentials/apikeys/applications/self/accesstokens) to issue an admin access token with only the required roles: read for reads, plus write for card transitions; never pci for this pack. The new token cannot exceed the issuing token's roles. This API is limited release and requires access through a Marqeta representative. Set expires_at explicitly.\n\nWithout that access, a Dashboard-issued admin access token carries broad program authority. Treat it accordingly: restrictions then come from the registered capabilities, not from credential scoping.\n\nRole-scoped tokens expire after 90 days by default; expires_at can set 1–365 days. The external process must replace the token and update the vault reference before expiry. Deleting a token sets expiry to seven days after deletion rather than revoking it immediately. Plan emergency cut-off around that residual window.\n\nThe agent never receives the value. At execution it is present in executor memory only for injection; the deployment owns memory, log, trace, and crash handling." }, "capabilities": [ { "capability_id": "marqeta.cards.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "financial", "egress_allowlist": [ "your-program.marqeta.invalid" ], "endpoint": "https://your-program.marqeta.invalid/v3/cards/user/USER_TOKEN", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-marqeta-api-basic", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "marqeta-program", "description": "List one user's cards, including token, state, last four digits, expiration, and fulfillment status. The response can also expose full card numbers (pan) and security codes (cvv_number): the card object returns pan by default, and callers control fields, show_pan, and show_cvv_number on this route. Leaving fields blank returns all fields. Not registering those parameters does not block them.\n\nBefore treating this as a metadata-only read, fix a fields list excluding pan and cvv_number outside the agent's control. Until that restriction is verified, treat every response as potentially PCI-scope cardholder data; do not log, trace, or forward it without control. The dedicated GET /cards/{token}/showpan and POST /cards/getbypan endpoints are not registered. Bind USER_TOKEN before enabling.", "requires_review": true }, { "capability_id": "marqeta.users.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "your-program.marqeta.invalid" ], "endpoint": "https://your-program.marqeta.invalid/v3/users", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-marqeta-api-basic", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "marqeta-program", "description": "Read the program's users collection: cardholder records with names, addresses, dates of birth and identification data, which are personal data.", "requires_review": true }, { "capability_id": "marqeta.transactions.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "financial", "egress_allowlist": [ "your-program.marqeta.invalid" ], "endpoint": "https://your-program.marqeta.invalid/v3/transactions", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-marqeta-api-basic", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "marqeta-program", "description": "Read the transactions collection: the payment-processing transaction messages (authorizations, clearings and related records) associated with the program's cards and account holders — financial data.", "requires_review": true }, { "capability_id": "marqeta.balances.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "financial", "egress_allowlist": [ "your-program.marqeta.invalid" ], "endpoint": "https://your-program.marqeta.invalid/v3/balances/ACCOUNT_HOLDER_TOKEN", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-marqeta-api-basic", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "marqeta-program", "description": "Read the general purpose account balances of one user or business: ledger balance, available balance and pending credits — financial data. ACCOUNT_HOLDER_TOKEN is a placeholder to replace before enabling.", "requires_review": true }, { "capability_id": "marqeta.cards.transitions.create", "version": "1.0.0", "kind": "tool", "risk_tier": "R3", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "financial", "egress_allowlist": [ "your-program.marqeta.invalid" ], "endpoint": "https://your-program.marqeta.invalid/v3/cardtransitions", "method": "POST", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-marqeta-api-basic", "inject": "header", "inject_name": "Authorization", "actions": [ "pay" ], "resource_id": "marqeta-program", "description": "Change a card's state, for example from UNACTIVATED to ACTIVE or ACTIVE to SUSPENDED. Activation enables authorization eligibility; suspension withdraws it. No money moves at request time. Whether a transaction is honored still depends on program configuration, funding (just-in-time funding decisions or general-purpose account balance), and velocity and authorization spend controls.\n\nThe capability declares pay at R3 because card authorization controls are grouped with money-committing actions under the finance-pack rule. Pay requires human approval. Review permitted target states: SUSPENDED is protective; TERMINATED is final.", "requires_review": true } ], "resources": [ { "resource_id": "marqeta-program", "kind": "api", "locator": "https://your-program.marqeta.invalid/v3", "data_class": "financial", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" } ], "review": { "state": "library", "date": "2026-09-22", "sources": [ "https://www.marqeta.com/docs/core-api/cards (retrieved 2026-09-21)", "https://www.marqeta.com/docs/core-api/card-transitions (retrieved 2026-09-21)", "https://www.marqeta.com/docs/core-api/users (retrieved 2026-09-21)", "https://www.marqeta.com/docs/core-api/transactions (retrieved 2026-09-21)", "https://www.marqeta.com/docs/core-api/balances (retrieved 2026-09-21)", "https://www.marqeta.com/docs/developer-guides/core-api-quick-start (retrieved 2026-09-21)", "https://www.marqeta.com/docs/core-api/self-service-credentials (retrieved 2026-09-21)" ], "reviewer_id": "aaes-eng" } }