Copy page

Marqeta

Twin of the Marqeta Core API.

Twin of the Marqeta Core API.

Covers	sandbox-api.marqeta.com
Auth	Basic, application token and admin access token
Webhooks	No
Operations	62

Coverage

Cardholders and their transitions, card products, cards, program funding sources, GPA orders and balances, spend controls, transactions, and the Simulations 2.0 authorization, clearing, reversal and refund calls.

Everything sits under /v3. Marqeta carries the version in the path and publishes no version header, so /v3 is the only dialect there is.

Credentials

Both tokens ride in one HTTP Basic header, application token as the username and admin access token as the password. Any well-formed pair authenticates by default, so your existing application and admin tokens need no change. Set auth.mode to enforced to accept only the pair the world knows, and note that a rejected pair in enforced mode is Marqeta’s 403 403001, not a 401. See Credentials.

/v3/ping serves with no credential at all.

Vendor specific details

• The credential check beats the router. An unknown path sent without a credential is a 401 401001, not a 404.
• Not found is not one shape. GET /v3/users/{unknown} is a 404 with code 404004, GET /v3/balances/{unknown} is a 400 with 400036, and some sub-lists answer HTTP 400 while carrying 404004 in the body.
• Idempotency is the body token, not a header. The same token with the same payload replays the created object; the same token with a different payload is a 409 409002.
• An unrecognised field in the body is a 400 400037 carrying a Java “Unrecognized field” message. An extra field your SDK version started sending is a hard failure, not a silent ignore.
• A count above 100 is not an error on /v3/users or /v3/cardproducts. You get HTTP 206 and the page. On /v3/transactions the same value is a 400 400400.

Its own notes

Once a sandbox is running, this twin serves its own operating notes at {control_url}/veris/manual: the credentials it accepts, the API versions it serves, and the fault statuses you can arm against it. They are generated from the same source as its behaviour, so they cannot drift.