Comma-separated list of related resources to embed on the transaction under _embedded, so one call
returns the transaction together with its card subscription, card and cardholder instead of follow-up
calls to GET /card-subscriptions?cardId=, GET /cards/{cardId} and GET /cards/{cardId}/cardholder.
cardSubscription embeds the card subscription exactly as GET /card-subscriptions/{subscriptionId}
serves it (without its own _embedded) and requires the card-subscriptions:read scope.card embeds the transaction's card exactly as GET /cards/{cardId} serves it (without its own
_embedded) and requires the cards:read scope.cardholder embeds the card's cardholder as GET /cards/{cardId}/cardholder serves it, with one
difference: corporate is the cardholder's corporate as of the transaction (see below). Requires the
cardholder:read scope.
Each value is checked separately: a request asking to expand a resource its credentials cannot read is
refused with 403.
The embedded subscription is the card's subscription in the transaction's sub-account: the one from
the transaction's network bulk feed when the transaction has a networkBulkFeedId, otherwise the
card's current subscription, otherwise its most recent one.
cardSubscription and card show their current values, not the values they had when the transaction
happened. So does the cardholder, except for cardholder.corporate: its id, employeeId,
alternativeEmployeeId and legalEntity are the values in effect on the transaction's
transactionOccurrenceDate (through the end of that UTC day), or at the transaction's createdAt when
transactionOccurrenceDate is null. A card that moved to another company or legal entity after the
transaction therefore still shows the one it belonged to at the time. firstName, lastName, email,
postalCode, cardReference, createdAt and updatedAt are the cardholder's current values. Changes
are dated by when Astrada received them from the card network or through the API. For a transaction
dated before Astrada started recording the card's corporate history, the earliest recorded values are
returned instead. Either way, a value that was not set in the values returned is null, or for
legalEntity absent.
A key is present only when it was requested and the related resource exists, and it is never null.
A transaction with no card (cardId is null, for example a bank-sourced transaction with no linked
card) has no cardSubscription, card or cardholder. A card without cardholder data has no
cardholder. A card that GET /cards/{cardId} no longer returns (it responds 404, for example
because all of its card subscriptions were deleted) is not embedded: both card and cardholder are
absent. _links are unchanged. Without expand, _embedded is absent. Whether cardholder is embedded
is decided on the card and cardholder as they are now, not as of the transaction's date.
Send one comma-separated value (expand=cardSubscription,card,cardholder). A repeated expand key,
an empty value or an unknown value is refused with 400.
