The CardAdvisor Public API

Just need to show a card? Embed it — no key, no JSON

Every card and every published comparison has an embeddable box: the issuer's published facts — fees, reward rates, forex markup, income requirement, perks — that keeps itself current and carries a caveat the moment a card closes or pauses applications. Paste two lines:

<iframe src="https://cardadvisor.in/embed/card/hdfc-infinia" width="100%" height="360"
        style="border:1px solid #ddd;border-radius:8px" loading="lazy"
        title="HDFC Infinia — fees, rewards and eligibility (CardAdvisor)"></iframe>
<p style="font:12px/1.5 system-ui,sans-serif;color:#555">Card facts by <a href="https://cardadvisor.in/cards/hdfc-infinia">CardAdvisor</a>.</p>

/embed/card/{cardKey} with ?layout=row or ?layout=badge for a compact version, ?theme=dark, and ?apply=0 to drop the Apply button; /embed/compare/{a}-vs-{b} for two cards side by side. Card keys are the slugs in every card URL and in /data/cards.json. The box shows what the issuer states — never our rating, verdict or valuations. Keep the credit line under the frame: the frame itself is noindex, so that line is the only part a search engine can read, and it is what we ask for in return. Every card page has a ready-made snippet under “Share this card”. Try it: a live card box.

What you get

Stated = the issuer published it. Concluded = we worked it out.

Without a key the card record is byte-for-byte the open dataset row (CC BY 4.0), one realistic point value per reward row included, because a rate read without its point value overstates returns several-fold.

Bounded on purpose

Cards are served one at a time, and a card’s change history is capped at its 5 most recent events. There is no paging, no date window and no type filter on changes. For anything wider, start from the bulk files.

Nothing open was taken back. Every fact published under CC BY 4.0 is still free, still complete, and still downloadable in bulk at /data — including the frozen, citable releases. A released snapshot is never retracted.

If you need more than the API serves — the editorial detail behind each change, per-route point values, or an answer our redemption engine computes — that is licensed rather than served. Tell us what you need at /partnerships and we’ll say whether we can serve it.

Withdrawn endpoints return 410 Gone with a pointer, plus Deprecation, Sunset and a Link naming the replacement, so nothing fails silently:

• GET /cards — Fetch one card at a time; the complete key index and every open fact is still free in bulk at /data/cards.json.
• GET /changes/{noticeId} — Per card: /changes?cardKey={cardKey}. Every change fact, with its noticeId, is in bulk at /data/changes.json.
• GET /valuations — The open per-card and per-programme values are at /data/valuations.json. Route-level values are licensed, not served.
• GET /transfers — The open graph — ratios, caps, gates, sources — is at /data/transfers.json.

Quickstart

# facts, no key
curl -s https://cardadvisor.in/api/public/v1/cards/hdfc-infinia | jq .data.card

# the issuer-stated record, with a key
curl -s -H "Authorization: Bearer ca_live_XXXXXXXXXXXXXXXX.YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY" \
  https://cardadvisor.in/api/public/v1/cards/hdfc-infinia | jq '.data.view, .data.card.fees, .data.card.excludedCategories'

# the 5 most recent changes to one card (cardKey is required)
curl -s "https://cardadvisor.in/api/public/v1/changes?cardKey=sbi-cashback" | jq '.data.items, .data.totalForCard'

# every card key, free and in bulk: this is the index, not an endpoint
curl -s https://cardadvisor.in/data/cards.json | jq -r '.cards[].cardKey'

# what am I talking to, and how much quota is left
curl -s -H "X-Api-Key: ca_live_..." https://cardadvisor.in/api/public/v1/meta | jq .data.you

Every response is { success, data, error }. Business errors are 4xx, never a 200 with an error inside. Nothing is paginated — each endpoint returns one card, or one card’s five most recent changes. For anything wider, start from the bulk files at /data. Send a descriptive User-Agent — our bot protection challenges a few default library agents.

Endpoints

The full request/response contract, with schemas, is the OpenAPI document. Our own release gate validates every live endpoint against it, and asserts that the anonymous card record is byte-identical to the same card’s row in /data/cards.json — so the docs cannot drift from the API, and the API cannot drift from the dataset.

Auth, limits, caching

Errors

Every error is { success: false, data: null, error: { code, message, docs } }. Branch on code; the message is for people and may be reworded.

Terms

Short, and meant to be read. Requesting a key is accepting them.

1. Attribution, always. Whatever you build on this, name CardAdvisor and link to https://cardadvisor.in where the data appears. The response header X-CardAdvisor-Attribution says the same.
2. Facts are CC BY 4.0. The anonymous tier is the open dataset; use it commercially, redistribute it, cite the frozen releases when a number must not move.
3. Model fields are ours. Ratings, perk and welcome-bonus valuations, route-level and currency values, editorial detail and verdicts may be displayed and quoted with attribution. They may not be bulk-redistributed, resold, mirrored as a dataset, or used to train models without written consent. Show them; don’t ship them.
4. Fair use. Stay inside the limits; cache; identify your client. Keys are revocable at our discretion, with a note.
5. No warranty, no SLA. The data is checked against issuer sources and the accuracy is published, failures included; it is still not a substitute for the issuer’s own terms, and it is not financial advice.
6. Your application. The application (name, email, link and your two answers) is used to review it, deliver the key, reply to you about it, and tell you about changes to the API. It is not shared or sold. Card data carries no personal data.
7. Versioning. /v1 only ever gains fields; a breaking change becomes /v2 and /v1 keeps working for at least six months after. We broke that rule once, on 12 September 2026, when the card list, the valuations index, the transfer graph and the per-notice endpoint were withdrawn from /v1 and change history was capped, rather than moved to a /v2. It was deliberate; the reason is in the changelog. Key holders were not notified in advance; this changelog and the 410 responses, which name each replacement, were the notice. We are not going to pretend it was additive — but it is the one exception, and the rule above still stands for everything after it.

Get an API key

Free, and reviewed by a person — we aim to come back within one working day. The key is emailed and never appears on this page or in an API response, so a mailbox is what proves it is yours.

Nothing is blocked while you wait. The facts tier needs no key at all, and the open dataset is free in bulk under CC BY 4.0. A key adds the rest of what the issuer states. We read applications rather than count them, so your answers on why you need it and what you will do with the data are worth more here than any other field — and if what you actually need is our analysis rather than the issuer’s facts, say so and we will point you at partnerships instead of leaving you to discover the limit.

Field dictionary — the facts tier

The card row without a key. Nested rewards[] and perks[] are described in their rows; the keyed (stated) shape is in the OpenAPI schema CardFull.

Changelog

• v1 · 2026-09-12 — breaking, and deliberately not a /v2. The previous shape let the complete dataset and our analysis be copied in a handful of calls. Key holders were not notified in advance; this changelog and the 410 responses, which name each replacement, were the notice. Nothing open was retracted: the facts are still CC BY 4.0, still complete, still in bulk at /data, and the frozen releases are untouched.
  1. Four endpoints withdrawn. Each now returns 410 Gone with Deprecation, Sunset and Link headers.
     • GET /cards. Migrate: take every card key and open fact from /data/cards.json, and one card at a time from GET /cards/{cardKey}.
     • GET /changes/{noticeId}. Migrate: GET /changes?cardKey={cardKey} per card, or group /data/changes.json by noticeId.
     • GET /valuations. Migrate: /data/valuations.json.
     • GET /transfers. Migrate: /data/transfers.json.
     GET /changes now requires cardKey and returns that card’s 5 most recent events: no paging, no date window, no type filter. GET /cards/{cardKey} caps its inlined history the same way.
  2. Nothing we concluded is served at any tier. Removed from the keyed record: editorial (rating, verdict, biggest concern, ideal-for, USP, pros/cons), perks[].estimatedAnnualValueRs, welcomeBonusValueRs, eligibility.minCibilScoreEstimate and its deprecated twin, valuation, and a change’s detail, severity and provenance object. The keyed view is now stated, not full: the rest of what the issuer states — the full fee schedule, eligibility documents, carve-out notes, merchant scope, exclusions, perk terms and variants. What we concluded is licensed instead.
  3. Keys are applied for, not issued on the spot. POST /keys takes a name, any valid email, a website or project link, why you need the API and what you will do with the data (a company name is optional); it answers 202 application_received and a person reviews it, usually within a working day. Applications let us know who builds on the API, and let us talk to anyone whose need goes beyond it. Declines are answered with a reason and a pointer to partnerships, not silence. Existing keys are unaffected and keep working.
• v1 · 2026-08-21 — eligibility.minCibilScoreEstimate added to the keyed card record. eligibility.minCibilScore carries the identical value and is now deprecated, to be removed at /v2: the bare name read as a requirement the issuer had published, and no issuer publishes one — the figure is our estimate and is now named as such. Additive; nothing breaks today.
• v1 · 2026-08-16 — first release. Facts tier = open dataset schema v3; keyed tier = full records. Endpoints: cards, cards/{cardKey}, changes, changes/{noticeId}, valuations, transfers, meta, keys.