[{"data":1,"prerenderedAt":882},["ShallowReactive",2],{"search-files-en":3,"search-nav-en":840},[4,10,14,20,26,31,36,41,46,51,55,60,65,70,75,80,85,89,94,99,104,109,114,119,124,129,133,138,143,148,153,158,163,168,172,176,181,185,190,195,200,205,210,215,219,224,229,234,239,242,247,252,257,262,267,272,277,281,286,291,296,301,306,311,314,318,323,328,333,337,342,347,352,356,361,366,371,376,381,386,391,396,401,405,410,415,420,425,430,435,440,444,449,454,459,463,468,473,478,482,487,492,497,502,507,511,516,521,526,530,535,540,545,549,554,559,564,569,574,579,584,589,594,599,604,609,614,619,624,629,634,639,643,647,652,657,662,667,672,677,681,686,691,696,701,706,711,716,721,726,731,736,741,746,751,756,760,765,770,775,780,785,790,795,800,805,810,815,820,825,830,835],{"id":5,"title":6,"titles":7,"content":8,"level":9},"\u002Fapi\u002Foverview","Developer API Overview",[],"What the server-to-server v1 API is, base URL, quick start examples, and the async write model.",1,{"id":11,"title":6,"titles":12,"content":13,"level":9},"\u002Fapi\u002Foverview#developer-api-overview",[],"This document is for developers of workspaces subscribed to the DEVELOPER product. It describes the outward-facing, server-to-server API called with a workspace API token — a different API from the internal SPA endpoints that power the Dotva Vue front-end.Source of truth: resources\u002Fopenapi\u002Fv1.yaml (OpenAPI 3.1). Interactive docs: GET \u002Fapi\u002Fv1\u002Fdocs (Swagger UI); raw spec at GET \u002Fapi\u002Fv1\u002Fopenapi.yaml.",{"id":15,"title":16,"titles":17,"content":18,"level":19},"\u002Fapi\u002Foverview#what-this-api-is","What this API is",[6],"Purpose: programmatically manage virtual cards and read orders \u002F wallet \u002F transactions.Base URL: \u002Fapi\u002Fv1Authentication: every request carries Authorization: Bearer \u003Ctoken>, where the token looks like dotva_sk_... and is created in the workspace's \"Developer Settings\" page.Writes are asynchronous: any operation that moves money or changes card state returns 202 Accepted plus an Order, which you then poll until terminal.Rate limiting + idempotency: every token and every IP has a per-minute ceiling; all write endpoints support X-Idempotency-Key for safe retries.",2,{"id":21,"title":22,"titles":23,"content":24,"level":25},"\u002Fapi\u002Foverview#prerequisites","Prerequisites",[6,16],"The workspace must subscribe to the DEVELOPER product (otherwise it cannot create API tokens).At least one token must be created in \"Developer Settings\" and granted the required abilities.If the token has an IP allowlist, the calling IP must be within it.",3,{"id":27,"title":28,"titles":29,"content":30,"level":19},"\u002Fapi\u002Foverview#quick-start","Quick start",[6],"# 1) Validate the token; see the bound workspace and granted abilities.\ncurl -s https:\u002F\u002Fdotva.io\u002Fapi\u002Fv1\u002Fping \\\n  -H \"Authorization: Bearer dotva_sk_xxx\"\n\n# Response\n# {\n#   \"data\": {\n#     \"workspace_slug\": \"acme\",\n#     \"workspace_name\": \"Acme Inc.\",\n#     \"abilities\": [\"cards.read\", \"cards.write\", \"wallet.read\"]\n#   }\n# } # 2) Issue a card (asynchronous; returns 202 + Order).\ncurl -s -X POST https:\u002F\u002Fdotva.io\u002Fapi\u002Fv1\u002Fcards \\\n  -H \"Authorization: Bearer dotva_sk_xxx\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -H \"X-Idempotency-Key: order-2026-0001\" \\\n  -d '{\n        \"card_product_id\": 1,\n        \"initial_topup_amount\": \"100.00\",\n        \"cardholder_first_name\": \"Jane\",\n        \"cardholder_last_name\": \"Doe\"\n      }'\n\n# 3) Poll the Order until status becomes terminal (completed \u002F failed).\ncurl -s https:\u002F\u002Fdotva.io\u002Fapi\u002Fv1\u002Forders\u002F\u003Corder_uuid> \\\n  -H \"Authorization: Bearer dotva_sk_xxx\"",{"id":32,"title":33,"titles":34,"content":35,"level":19},"\u002Fapi\u002Foverview#system","System",[6],"",{"id":37,"title":38,"titles":39,"content":40,"level":25},"\u002Fapi\u002Foverview#get-ping-health-token-probe","GET \u002Fping — health \u002F token probe",[6,33],"Ability: none (any valid token)Purpose: validate the token and return the bound workspace and granted abilities. Success 200 {\n  \"data\": {\n    \"workspace_slug\": \"acme\",\n    \"workspace_name\": \"Acme Inc.\",\n    \"abilities\": [\"cards.read\", \"wallet.read\"]\n  }\n} Errors: 401 api.unauthenticated",{"id":42,"title":43,"titles":44,"content":45,"level":19},"\u002Fapi\u002Foverview#async-write-model","Async write model",[6],"Write endpoints return 202 Accepted plus an Order: {\n  \"data\": {\n    \"uuid\": \"8f1c...\",\n    \"type\": \"issue_card\",\n    \"status\": \"pending\",\n    \"related_card_id\": null,\n    \"held_amount\": \"106.00\",\n    \"currency\": \"USD\",\n    \"created_at\": \"2026-06-08T01:00:00+00:00\"\n  }\n} Take the uuid and poll GET \u002Forders\u002F{uuid} until status reaches a terminal value (completed \u002F failed). See Orders & Wallet for the full Orders endpoint reference, including Order status and type enums. html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}",{"id":47,"title":48,"titles":49,"content":50,"level":9},"\u002Fapi\u002Fauthentication","API Authentication",[],"Bearer token authentication, IP allowlist, workspace state checks, and token ability scopes for the developer API.",{"id":52,"title":48,"titles":53,"content":54,"level":9},"\u002Fapi\u002Fauthentication#api-authentication",[],"All requests to the server-to-server API (\u002Fapi\u002Fv1) must be authenticated with a workspace API token.",{"id":56,"title":57,"titles":58,"content":59,"level":19},"\u002Fapi\u002Fauthentication#bearer-token","Bearer token",[48],"Include the token in the Authorization header on every request: Authorization: Bearer dotva_sk_... Tokens are created per-workspace in \"Developer Settings\". Each token is bound to a single workspace — every resource is automatically scoped to that workspace. ConditionResponseMissing \u002F invalid \u002F expired \u002F disabled token401 api.unauthenticatedToken belongs to a frozen \u002F deleted workspace403 api.workspace_inactiveCalling IP not in the token's allowlist403 api.ip_not_allowedToken lacks the required ability403 api.insufficient_ability",{"id":61,"title":62,"titles":63,"content":64,"level":19},"\u002Fapi\u002Fauthentication#ip-allowlist","IP allowlist",[48],"A token may optionally define an IP allowlist in CIDR notation. If set, any request originating from an IP outside the allowlist is rejected with 403 api.ip_not_allowed. Leave the allowlist empty to allow all IPs (useful for development; tighten for production).",{"id":66,"title":67,"titles":68,"content":69,"level":19},"\u002Fapi\u002Fauthentication#workspace-state","Workspace state",[48],"If the token's workspace is frozen or soft-deleted, all requests return 403 api.workspace_inactive regardless of the token's validity or abilities.",{"id":71,"title":72,"titles":73,"content":74,"level":19},"\u002Fapi\u002Fauthentication#token-abilities","Token abilities",[48],"Each token is granted a set of abilities at creation time. Routes require specific abilities — a missing ability returns 403 api.insufficient_ability. AbilityDescriptionApplicable endpointscards.readRead cards and card transactionsGET \u002Fcards, GET \u002Fcards\u002F{uuid}, GET \u002Fcards\u002F{uuid}\u002Ftransactionscards.writeIssue cards and run card lifecyclePOST \u002Fcards, topup \u002F freeze \u002F unfreeze \u002F closeorders.readRead ordersGET \u002Forders, GET \u002Forders\u002F{uuid}wallet.readRead wallet balancesGET \u002Fwallettransactions.readRead wallet ledgerGET \u002Ftransactions Grant only the abilities your integration actually needs — follow the principle of least privilege.",{"id":76,"title":77,"titles":78,"content":79,"level":19},"\u002Fapi\u002Fauthentication#creating-a-token","Creating a token",[48],"Navigate to Developer Settings in your workspace.Click New API Token.Enter a name, select abilities, and optionally set an IP allowlist and rate limit.Copy the token immediately — it is shown only once. Tokens can be rotated or revoked from the same settings page at any time. html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"id":81,"title":82,"titles":83,"content":84,"level":9},"\u002Fapi\u002Fconventions","API Conventions",[],"Response envelope format, pagination, money & time conventions, rate limiting, idempotency keys, and error codes.",{"id":86,"title":82,"titles":87,"content":88,"level":9},"\u002Fapi\u002Fconventions#api-conventions",[],"These conventions apply uniformly to every endpoint in the server-to-server API (\u002Fapi\u002Fv1).",{"id":90,"title":91,"titles":92,"content":93,"level":19},"\u002Fapi\u002Fconventions#response-envelope","Response envelope",[82],"ScenarioShapeSuccess — single resource{ \"data\": { ... } }Success — paginated list{ \"data\": [ ... ], \"meta\": { ... } }Failure{ \"code\": \"business_code\", \"message\": \"human-readable\", \"data\": null }",{"id":95,"title":96,"titles":97,"content":98,"level":19},"\u002Fapi\u002Fconventions#pagination","Pagination",[82],"All list endpoints accept the following query parameters: QueryTypeDefaultBoundspageint1≥ 1per_pageint25 (orders & transactions: 50)1–100 meta shape: { \"current_page\": 1, \"last_page\": 8, \"per_page\": 25, \"total\": 192 }",{"id":100,"title":101,"titles":102,"content":103,"level":19},"\u002Fapi\u002Fconventions#money-time","Money & time",[82],"Money: always a decimal string (e.g. \"100.00\") paired with a currency code (e.g. \"USD\"). Never use floating-point arithmetic when processing amounts.Time: UTC, ISO 8601 (e.g. 2026-06-08T01:00:00+00:00).",{"id":105,"title":106,"titles":107,"content":108,"level":19},"\u002Fapi\u002Fconventions#enumerations-snake_case-strings","Enumerations (snake_case strings)",[82],"All enum-like fields in API requests and responses use lowercase snake_case strings (never integers or PascalCase). Filter query parameters use the same string values. DomainFieldValuesCardsstatuspending_issue, active, frozen, pending_close, closed, issue_failedOrdersstatuspending, processing, completed, failed, awaiting_platform, …Orderstypeissue_card, topup_card, close_card, freeze, unfreezeWallet ledgerdirectiondebit (out), credit (in)Depositsstatuscredited, failed, manual_reviewWebhook deliveriesstatuspending, delivered, failed, dead_letter Invalid enum values in filters return 422 validation errors.",{"id":110,"title":111,"titles":112,"content":113,"level":19},"\u002Fapi\u002Fconventions#rate-limiting","Rate limiting",[82],"Two-axis throttle: Each token has its own per-minute ceiling (rate_limit_per_minute), configured when the token is created.Each IP has a coarser cross-token ceiling (default 600 req\u002Fmin). Successful responses carry: X-RateLimit-Limit — the token's per-minute ceilingX-RateLimit-Remaining — remaining requests in the current window Exceeding the limit returns 429 api.rate_limited with a Retry-After: \u003Cseconds> header. Back off exactly by that duration.",{"id":115,"title":116,"titles":117,"content":118,"level":19},"\u002Fapi\u002Fconventions#idempotency","Idempotency",[82],"All write endpoints accept an optional X-Idempotency-Key header (≤ 200 chars). ScenarioBehaviourFirst request with a given keyExecutes and stores the responseReplay: same key + same body (within 24 h)Returns original result with Idempotent-Replayed: true; no side effectsSame key + different body422 api.idempotency_key_conflictKey exceeds 200 chars422 api.idempotency_key_invalid5xx responseNot stored — safe to retry Strongly recommended: send a unique X-Idempotency-Key on every write (e.g. your own order ID). This prevents double-charge or double-issue when the network retries a request.",{"id":120,"title":121,"titles":122,"content":123,"level":19},"\u002Fapi\u002Fconventions#error-code-reference","Error code reference",[82],"HTTPCodeMeaning401api.unauthenticatedToken missing \u002F invalid \u002F expired \u002F disabled403api.ip_not_allowedCalling IP not in the token allowlist403api.insufficient_abilityToken lacks the ability this endpoint requires403api.workspace_inactiveThe owning workspace is not active402wallet.insufficient_balanceInsufficient wallet balance (issue \u002F top-up)404*.not_foundResource not found in this workspace (e.g. card.not_found, order.not_found)409(state conflict)The resource's current state forbids the action (e.g. double freeze)422api.idempotency_key_invalidIdempotency key too long422api.idempotency_key_conflictIdempotency key reused with a different body422(validation)Request parameters or business rules failed429api.rate_limitedRate limit exceeded; back off per Retry-After html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"id":125,"title":126,"titles":127,"content":128,"level":9},"\u002Fapi\u002Fvirtual-cards","Virtual Cards API",[],"Issue, top-up, freeze, unfreeze, and close Visa virtual cards programmatically. Includes card transactions and lifecycle enums.",{"id":130,"title":126,"titles":131,"content":132,"level":9},"\u002Fapi\u002Fvirtual-cards#virtual-cards-api",[],"All write operations are asynchronous — they return 202 Accepted plus an Order. Poll the order until its status is terminal (completed \u002F failed).\nAll write endpoints support X-Idempotency-Key. Required abilities: cards.read (reads) · cards.write (writes).",{"id":134,"title":135,"titles":136,"content":137,"level":19},"\u002Fapi\u002Fvirtual-cards#get-card-products-list-issuable-card-products","GET \u002Fcard-products — list issuable card products",[126],"Ability: cards.read or cards.write Before issuing a card you must call this endpoint to obtain a valid card_product_id and check fee\u002Flimit constraints. The catalogue is platform-global; each row is annotated for your workspace. Success 200 — { \"data\": [ ... ] } (not paginated). Each product: FieldTypeNotesidintPass as card_product_id to POST \u002Fcardscode \u002F display_name \u002F descriptionstringcurrencystringProduct currencybin \u002F issuer_countrystringBIN prefix and issuing countrysupports_custom_holder_nameboolWhether a custom cardholder name can be specifiedsupports_custom_billing_addressboolWhether a custom billing address can be specifieddefault_billing_addressobject?Used when supports_custom_billing_address is falsefees.card_issue_fixedstringOne-time issuance fee (decimal, deducted from initial top-up)fees.topup_fixedstringFixed fee per subsequent top-upfees.topup_percentstringPercentage fee per subsequent top-up (e.g. \"0.0300\" = 3 %)min_initial_topup_amountstringMinimum initial_topup_amount for POST \u002Fcardsmin_topup_amountstringMinimum amount for subsequent top-upsrequired_subscription_product_codestring?Subscription prerequisite, if anyrequires_subscriptionboolWhether a subscription prerequisite existssubscription_satisfiedboolWhether this workspace meets the prerequisite (true when none)currency_matchboolWhether product currency equals the workspace base currency (informational)availableboolWhether this workspace may issue this product (= subscription_satisfied) Workflow: call this endpoint to render a product picker → use the selected product's id as card_product_id, and validate the user's initial_topup_amount against min_initial_topup_amount client-side before submitting. Errors: 401, 403",{"id":139,"title":140,"titles":141,"content":142,"level":19},"\u002Fapi\u002Fvirtual-cards#get-cards-list-cards","GET \u002Fcards — list cards",[126],"Ability: cards.read QueryTypeDescriptionpage \u002F per_pageintPaginationstatusstringComma-separated card statuses (see Card status)cardholder_typestringuser or staff (see Cardholder type)searchstringKeyword search Success 200 — paginated list. Each card row: FieldTypeNotesuuiduuidstatusstringCard status — see Card statuscardholder_typestringuser \u002F staffcardholder_first_name \u002F cardholder_last_namestringmasked_panstringMasked card numberpan_last4 \u002F pan_binstringcurrencystringcard_balancestringDecimal stringcard_product_idintissued_at \u002F last_active_txn_at \u002F created_atdatetime? Errors: 401, 403",{"id":144,"title":145,"titles":146,"content":147,"level":19},"\u002Fapi\u002Fvirtual-cards#post-cards-issue-a-card","POST \u002Fcards — issue a card",[126],"Ability: cards.write · Idempotent: yes · Async: yes (202) Body FieldTypeRequiredDescriptioncard_product_idint✓Card product IDinitial_topup_amountstring✓Initial top-up amount, e.g. \"100.00\"cardholder_first_namestring✓Cardholder first namecardholder_last_namestring✓Cardholder last namebilling_addressobject—Billing address (see below)purposestring—Purpose notenotesstring—Free-form notes billing_address fields: line1 (string), line2 (string?), city (string), state (string?), postal_code (string), country (2-letter ISO code). Responses: 202 — Order accepted. Encrypted card secrets are delivered separately via the card.issued.secrets webhook — they never appear in regular API responses.402 wallet.insufficient_balance401, 403, 422, 429",{"id":149,"title":150,"titles":151,"content":152,"level":19},"\u002Fapi\u002Fvirtual-cards#get-cardsuuid-get-one-card","GET \u002Fcards\u002F{uuid} — get one card",[126],"Ability: cards.read Response: 200 card detail \u002F 404 card.not_found All fields from the list response, plus: FieldTypeNotesworkspace_idintcard_balancestringRaw card balanceheld_amountstringAmount held in pending authorizationavailable_balancestringcard_balance − held_amountlifetime_topup_amount \u002F lifetime_spend_amount \u002F lifetime_refund_amountstringCumulative amountsavs_billing_addressobject?line1, line2, city, state, postal_code, countrysupports_freeze \u002F supports_unfreeze \u002F supports_balance_queryboolCapability flags — show\u002Fhide action buttons based on theseappeal_terminatedboolWhether appeals are permanently closedclosed_at \u002F updated_atdatetime?",{"id":154,"title":155,"titles":156,"content":157,"level":19},"\u002Fapi\u002Fvirtual-cards#get-cardsuuidconsumption-bills-consumption-bills-merged-view","GET \u002Fcards\u002F{uuid}\u002Fconsumption-bills — consumption bills (merged view)",[126],"Ability: cards.read Unlike \u002Ftransactions which returns one row per network event, this endpoint returns one item per purchase, merging the Authorization → Capture \u002F Refund \u002F Reversal lifecycle into a single bill. Use this for end-user transaction history displays. Query: from \u002F to (datetime), page \u002F per_page Each bill: FieldTypeNotesidintBill identifierkindstringpurchase \u002F refund \u002F decline \u002F chargeback \u002F otherstatusstringauthorized \u002F settled \u002F reversed \u002F expired \u002F declined \u002F refunded \u002F chargeback_opened \u002F chargeback_resolvedamountstringBase amountcurrencystringSettlement currency (e.g. USD)authorized_amountstring?Amount authorized (available when status is authorized)settled_amountstring?Amount settled (available when status is settled \u002F refunded)merchant_amountstringMerchant leg — what the customer attempted, in the merchant's currency. Always populatedmerchant_currencystringMerchant currency (e.g. HKD)fx_ratestring?amount \u002F merchant_amount; null unless a conversion actually happenedmerchantobject?raw_name, canonical_name, mcc, countryauth_codestring?decline_reasonstring?See Decline reasonoccurred_atdatetimeTime of most recent event on this billsettled_atdatetime?Settlement timelinesarrayRaw transaction rows included in this bill Display rule: show authorized_amount when status === \"authorized\"; show settled_amount when settled or refunded. For kind: \"decline\" show merchant_amount — nothing settled, so amount and settled_amount are both 0.00 and the merchant leg is the only meaningful figure. Never sum merchant_amount across rows (mixed currencies).⚠️ Breaking change (2026-08-01): these two fields were previously named transaction_amount \u002F transaction_currency (and were null for same-currency spend). They are now merchant_amount \u002F merchant_currency and are always populated. Errors: 404 card.not_found",{"id":159,"title":160,"titles":161,"content":162,"level":19},"\u002Fapi\u002Fvirtual-cards#get-cardsuuidtransactions-card-transactions","GET \u002Fcards\u002F{uuid}\u002Ftransactions — card transactions",[126],"Ability: cards.read Query: page \u002F per_page; optional type (see Transaction type), status (see Transaction status), from \u002F to (datetime). FieldTypeNotesuuiduuidtypestringSee Transaction typestatusstringSee Transaction statusamount \u002F currencystringmerchant_amount \u002F merchant_currencystringMerchant leg — what was attempted, in the merchant's currency. Always populated; on a decline it is the only leg with a figurefx_ratestring?amount \u002F merchant_amount; null for same-currency and for declines (nothing settled, so no rate exists)merchantobjectraw_name, canonical_merchant_id, canonical_name, mcc, countryauth_codestring?decline_reasonstring?Null unless declined — see Decline reasonoccurred_at \u002F posted_at \u002F created_atdatetime? ⚠️ Breaking change (2026-08-01): fx_amount \u002F fx_currency were renamed to merchant_amount \u002F merchant_currency and are now always populated (previously null for same-currency spend). Check fx_rate — not the two currency fields — to tell whether a conversion happened. Errors: 404 card.not_found",{"id":164,"title":165,"titles":166,"content":167,"level":19},"\u002Fapi\u002Fvirtual-cards#post-cardsuuidtopup-top-up-a-card","POST \u002Fcards\u002F{uuid}\u002Ftopup — top up a card",[126],"Ability: cards.write · Idempotent: yes · Async: yes FieldRequiredDescriptionamount✓Top-up amount, e.g. \"50.00\"notes—Free-form notes Responses: 202 Order \u002F 404 \u002F 422",{"id":169,"title":170,"titles":171,"content":35,"level":19},"\u002Fapi\u002Fvirtual-cards#post-cardsuuidfreeze-freeze-a-card","POST \u002Fcards\u002F{uuid}\u002Ffreeze — freeze a card",[126],{"id":173,"title":174,"titles":175,"content":35,"level":19},"\u002Fapi\u002Fvirtual-cards#post-cardsuuidunfreeze-unfreeze-a-card","POST \u002Fcards\u002F{uuid}\u002Funfreeze — unfreeze a card",[126],{"id":177,"title":178,"titles":179,"content":180,"level":19},"\u002Fapi\u002Fvirtual-cards#post-cardsuuidclose-close-a-card","POST \u002Fcards\u002F{uuid}\u002Fclose — close a card",[126],"Ability: cards.write · Idempotent: yes · Async: yes Body (optional): { \"reason\": \"up to 500 chars, nullable\" } Responses: 202 Order \u002F 404 card.not_found \u002F 409 (state conflict, e.g. double freeze)",{"id":182,"title":183,"titles":184,"content":35,"level":19},"\u002Fapi\u002Fvirtual-cards#enum-reference","Enum reference",[126],{"id":186,"title":187,"titles":188,"content":189,"level":25},"\u002Fapi\u002Fvirtual-cards#card-status","Card status",[126,183],"ValueMeaningpending_issueIssuance queued, not yet activeactiveActive and usablefrozenTemporarily frozenpending_closeClosure in progressclosedClosed (terminal)issue_failedIssuance failed (terminal)",{"id":191,"title":192,"titles":193,"content":194,"level":25},"\u002Fapi\u002Fvirtual-cards#cardholder-type","Cardholder type",[126,183],"ValueMeaninguserHeld by a main-account userstaffHeld by a staff member",{"id":196,"title":197,"titles":198,"content":199,"level":25},"\u002Fapi\u002Fvirtual-cards#transaction-status","Transaction status",[126,183],"ValueMeaningpendingPendingpostedPosted \u002F settledreversedReversedfailedFailed (e.g. a decline row)",{"id":201,"title":202,"titles":203,"content":204,"level":25},"\u002Fapi\u002Fvirtual-cards#transaction-type","Transaction type",[126,183],"ValueMeaningauthorizationAuthorizationcaptureCapturerefundRefundreversalReversaldeclineDeclinechargeback_openedChargeback openedchargeback_resolvedChargeback resolved",{"id":206,"title":207,"titles":208,"content":209,"level":25},"\u002Fapi\u002Fvirtual-cards#decline-reason","Decline reason",[126,183],"ValueMeaninginsufficient_fundsInsufficient fundscard_frozenCard frozenavs_mismatchBilling-address (AVS) mismatchcvv_mismatchCVV mismatchrisk_blockedBlocked by risk engineotherOther (catch-all for unmapped vendor reasons)",{"id":211,"title":212,"titles":213,"content":214,"level":9},"\u002Fapi\u002Forders-wallet","Orders, Wallet & Transactions",[],"Read orders and poll async results, query wallet balance snapshots, and retrieve full ledger transaction history.",{"id":216,"title":212,"titles":217,"content":218,"level":9},"\u002Fapi\u002Forders-wallet#orders-wallet-transactions",[],"All endpoints on this page are read-only. Use them to poll async operation results, check balances, and retrieve transaction history.",{"id":220,"title":221,"titles":222,"content":223,"level":19},"\u002Fapi\u002Forders-wallet#get-orders-list-orders","GET \u002Forders — list orders",[212],"Ability: orders.read QueryTypeDescriptionpage \u002F per_pageintPagination (per_page default 50)statusstringStatus filter (see Order status)typestringType filter (see Order type) Each order row: FieldTypeNotesuuiduuidtypestringSee Order typestatusstringSee Order statusfailure_reasonstring?Null unless failed — see Failure reasonheld_amount \u002F currencystringcreated_atdatetime",{"id":225,"title":226,"titles":227,"content":228,"level":19},"\u002Fapi\u002Forders-wallet#get-ordersuuid-get-one-order","GET \u002Forders\u002F{uuid} — get one order",[212],"Ability: orders.read Response: 200 order detail (same fields as the list, used to poll async results) \u002F 404 order.not_found Polling pattern: call this endpoint every 2–5 seconds until status becomes completed or failed.",{"id":230,"title":231,"titles":232,"content":233,"level":19},"\u002Fapi\u002Forders-wallet#get-wallet-wallet-balance","GET \u002Fwallet — wallet balance",[212],"Ability: wallet.read Success 200: {\n  \"data\": {\n    \"workspace_id\": 12,\n    \"wallets\": [\n      {\n        \"currency\": \"USD\",\n        \"balance\": \"880.00\",\n        \"held_balance\": \"106.00\",\n        \"available\": \"774.00\",\n        \"frozen_at\": null,\n        \"frozen_reason\": null,\n        \"last_reconciled_at\": \"2026-06-08T00:00:00+00:00\"\n      }\n    ]\n  }\n} wallets is an array of per-currency balances. All amounts are decimal strings. available = balance − held_balance.",{"id":235,"title":236,"titles":237,"content":238,"level":19},"\u002Fapi\u002Forders-wallet#get-transactions-wallet-ledger","GET \u002Ftransactions — wallet ledger",[212],"Ability: transactions.read QueryTypeDescriptionpage \u002F per_pageintPagination (per_page default 50)reasonstringFilter by ledger reason code (see Ledger reason)reference_typestringFilter by reference type (e.g. Card, Ticket, Subscription)reference_uuiduuidFilter by reference UUIDfrom \u002F todatetimeTime window (ISO 8601) Each ledger row: FieldTypeNotesidinttxn_group_idstringGroups the double-entry pairreason_codestringLedger reason — see Ledger reasondirectionstringdebit (out) \u002F credit (in) — snake_caseamount \u002F currencystringAmount is always positive; side given by directionaccount_codestring?account_card_uuiduuid?UUID of the related card, if anyreference_typestring?Type of the related object (e.g. Card, Ticket)reference_uuiduuid?UUID of the related object — use to deep-link to card detail, ticket, etc.descriptionstring?created_atdatetime direction uses snake_case strings (debit \u002F credit), consistent with all other enum fields.",{"id":240,"title":183,"titles":241,"content":35,"level":19},"\u002Fapi\u002Forders-wallet#enum-reference",[212],{"id":243,"title":244,"titles":245,"content":246,"level":25},"\u002Fapi\u002Forders-wallet#order-status","Order status",[212,183],"ValueMeaningpendingCreated, not yet processingprocessingProcessing with the supplierawaiting_platformAwaiting platform intervention (admin retry \u002F async fallback)completedCompleted (terminal ✓)failedFailed (terminal ✗)",{"id":248,"title":249,"titles":250,"content":251,"level":25},"\u002Fapi\u002Forders-wallet#order-type","Order type",[212,183],"ValueMeaningissue_cardIssue a cardtopup_cardTop up a cardclose_cardClose a cardfreezeFreeze a cardunfreezeUnfreeze a card",{"id":253,"title":254,"titles":255,"content":256,"level":25},"\u002Fapi\u002Forders-wallet#order-failure-reason","Order failure reason",[212,183],"⚠️ These API strings differ slightly from internal storage — the API returns supplier5xx \u002F business4xx (no underscore before the digits). ValueMeaningsupplier5xxSupplier returned a 5xx (transient; auto-retried)timeoutRequest timed out (transient; auto-retried)networkNetwork error (transient; auto-retried)signatureSignature verification issue (transient; auto-retried)business4xxSupplier business rejection (terminal; needs admin)not_foundSupplier reports not found (terminal; needs admin)preempted_by_riskPreempted by the risk engineadmin_refund_closeAdmin refund-closed the orderasync_issue_failedAsynchronous issuance failed",{"id":258,"title":259,"titles":260,"content":261,"level":25},"\u002Fapi\u002Forders-wallet#ledger-reason-code","Ledger reason code",[212,183],"ValueMeaningcard_issue_heldFirst top-up at issuance — funds parked in heldcard_topup_heldSubsequent top-up — funds parked in heldheld_captureHeld → final destination (card held + platform revenue)held_releaseHeld → workspace balance (supplier failed)held_release_adminHeld → workspace balance via admin queuecard_issue_feeCard-issue fee → platform revenuecard_topup_feeCard top-up fee → platform revenuecard_close_refundCard closure: card held → workspace balanceusdt_depositUSDT deposit → workspace balanceusdt_deposit_feeUSDT inflow channel fee → platform revenuewithdrawal_heldWithdrawal hold: balance → heldwithdrawal_completedWithdrawal paid out: held → pool + revenuewithdrawal_canceledOwner cancelled withdrawal: held → balancewithdrawal_rejectedAdmin rejected withdrawal: held → balancecard_spendCard spend settled — held → platform (card debit leg)card_spend_refundCard spend refund — platform → workspacecard_spend_reversalCard spend reversal — platform → workspacecard_post_close_clawbackPost-close clawback — workspace → platform (late charge after card closed)card_post_close_refundPost-close refund — platform → workspacecard_reconcile_adjustmentManual reconciliation adjustment (admin only)subscription_chargeSubscription charge → platform revenuerisk_penaltyRisk-engine penalty fee per declined transaction (may push wallet negative)reversalReversal \u002F red-letter correction (admin only)",{"id":263,"title":264,"titles":265,"content":266,"level":25},"\u002Fapi\u002Forders-wallet#ledger-direction","Ledger direction",[212,183],"ValueMeaningdebitDebit side (outflow from workspace perspective)creditCredit side (inflow to workspace)",{"id":268,"title":269,"titles":270,"content":271,"level":19},"\u002Fapi\u002Forders-wallet#schema-order","Schema: Order",[212],"FieldTypeNotesuuiduuidOrder identifiertypestringSee Order typestatusstringSee Order statusrelated_card_uuiduuid?UUID of the related card, if anyheld_amountstringHeld amount, e.g. \"106.00\"currencystringe.g. \"USD\"created_atdatetime html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"id":273,"title":274,"titles":275,"content":276,"level":9},"\u002Fapi\u002Fwebhooks","Webhooks",[],"Configure webhook endpoints, the card.issued.secrets event, JWE encrypted card secrets, and delivery acknowledgment.",{"id":278,"title":274,"titles":279,"content":280,"level":9},"\u002Fapi\u002Fwebhooks#webhooks",[],"Dotva delivers webhook events to your configured HTTP endpoints. Currently one event is available for the server-to-server API: card.issued.secrets, which delivers the encrypted PAN \u002F CVV \u002F expiry after a card is successfully issued.",{"id":282,"title":283,"titles":284,"content":285,"level":19},"\u002Fapi\u002Fwebhooks#cardissuedsecrets","card.issued.secrets",[274],"After a card is issued, if the workspace has configured an RSA public key and has an endpoint subscribed to card.issued.secrets, the platform delivers this webhook. Encrypted card secrets are delivered only via this webhook — they never appear in regular API responses.",{"id":287,"title":288,"titles":289,"content":290,"level":25},"\u002Fapi\u002Fwebhooks#payload","Payload",[274,283],"{\n  \"event\": \"card.issued.secrets\",\n  \"workspace_id\": 12,\n  \"data\": {\n    \"card_id\": 345,\n    \"card_uuid\": \"8f1c...\",\n    \"card_last4\": \"4242\",\n    \"card_bin\": \"411111\",\n    \"secrets_jwe\": \"\u003CJWE compact string>\",\n    \"key_fingerprint\": \"sha256:9c4d...\"\n  }\n} FieldDescriptionsecrets_jweJWE compact serialization (RSA-OAEP-256 + A256GCM). Decrypt with your private key to obtain PAN \u002F CVV \u002F expiry.key_fingerprintSHA-256 fingerprint of the public key used to encrypt, so you know which private key to use for decryption.",{"id":292,"title":293,"titles":294,"content":295,"level":25},"\u002Fapi\u002Fwebhooks#delivery-acknowledgment","Delivery & acknowledgment",[274,283],"Reply 200 (any body) to acknowledge receipt.Non-200 responses trigger retries with exponential back-off.Duplicate deliveries are possible — make your handler idempotent (use card_uuid as the deduplication key). Delivery records in the workspace dashboard use snake_case status values: pending, delivered, failed, dead_letter.",{"id":297,"title":298,"titles":299,"content":300,"level":25},"\u002Fapi\u002Fwebhooks#setting-up","Setting up",[274,283],"Upload your RSA public key in Developer Settings → Webhook Keys.Register your endpoint URL and subscribe it to card.issued.secrets.After issuing a card via POST \u002Fcards, wait for the webhook delivery (typically within seconds of the order completing).",{"id":302,"title":303,"titles":304,"content":305,"level":19},"\u002Fapi\u002Fwebhooks#decrypting-secrets_jwe","Decrypting secrets_jwe",[274],"The JWE uses RSA-OAEP-256 for key encryption and A256GCM for content encryption. Most modern crypto libraries support this out of the box. Node.js example (using jose): import { compactDecrypt } from 'jose'\nimport { createPrivateKey } from 'crypto'\n\nconst privateKey = createPrivateKey({ key: process.env.PRIVATE_KEY_PEM })\nconst { plaintext } = await compactDecrypt(secrets_jwe, privateKey)\nconst secrets = JSON.parse(new TextDecoder().decode(plaintext))\n\u002F\u002F secrets.pan, secrets.cvv, secrets.expiry_month, secrets.expiry_year html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}",{"id":307,"title":308,"titles":309,"content":310,"level":9},"\u002Ffaq\u002Fgeneral","Frequently Asked Questions",[],"Common questions about Dotva's financial management system, virtual cards, workspace setup, deposits, and subscriptions.",{"id":312,"title":308,"titles":313,"content":35,"level":9},"\u002Ffaq\u002Fgeneral#frequently-asked-questions",[],{"id":315,"title":316,"titles":317,"content":35,"level":19},"\u002Ffaq\u002Fgeneral#general","General",[308],{"id":319,"title":320,"titles":321,"content":322,"level":25},"\u002Ffaq\u002Fgeneral#what-is-dotva","What is Dotva?",[308,316],"Dotva is a financial management system built for SMBs, teams, and individuals. It replaces the traditional \"pay out-of-pocket, submit for reimbursement\" workflow with a structured virtual card issuance model — giving organizations real-time control over employee spending without the friction of expense reports. Virtual cards are the instrument Dotva uses to enforce spending policies; the platform itself handles budgeting, approvals, transaction visibility, and reconciliation.",{"id":324,"title":325,"titles":326,"content":327,"level":25},"\u002Ffaq\u002Fgeneral#who-is-dotva-for","Who is Dotva for?",[308,316],"Dotva is designed for any organization that needs to control distributed spending: Finance teams eliminating manual expense reimbursement cyclesRemote and distributed teams that need payment tools without physical card logisticsSaaS companies allocating per-project or per-department budgetsAgencies managing client campaign spendFreelancers and individuals who want separate, purpose-limited cards for subscriptions and online purchases",{"id":329,"title":330,"titles":331,"content":332,"level":25},"\u002Ffaq\u002Fgeneral#is-dotva-a-bank","Is Dotva a bank?",[308,316],"No. Dotva is a financial technology platform. Virtual cards are issued through licensed card program providers. Dotva does not hold a banking license and does not provide deposit insurance.",{"id":334,"title":335,"titles":336,"content":35,"level":19},"\u002Ffaq\u002Fgeneral#accounts-registration","Accounts & Registration",[308],{"id":338,"title":339,"titles":340,"content":341,"level":25},"\u002Ffaq\u002Fgeneral#how-do-i-create-an-account","How do I create an account?",[308,335],"Visit https:\u002F\u002Fwww.dotva.io\u002Fregister, enter your email address, and set a password. After verifying your email, you can create your first workspace.",{"id":343,"title":344,"titles":345,"content":346,"level":25},"\u002Ffaq\u002Fgeneral#how-do-workspaces-work","How do workspaces work?",[308,335],"Each account automatically has one primary workspace created at registration. Workspaces are the unit of financial management — they hold the wallet, cards, staff, and subscription. A single account can be a member of multiple workspaces (e.g. as a delegate or staff member for another organization), and you can switch between them from the sidebar.",{"id":348,"title":349,"titles":350,"content":351,"level":25},"\u002Ffaq\u002Fgeneral#is-two-factor-authentication-required","Is two-factor authentication required?",[308,335],"TOTP-based 2FA is optional for workspace owners and staff but strongly recommended. It is required for platform administrators. Certain sensitive operations — such as viewing card secrets or submitting large withdrawals — trigger a step-up re-verification regardless of whether 2FA is enabled.",{"id":353,"title":354,"titles":355,"content":35,"level":19},"\u002Ffaq\u002Fgeneral#virtual-cards","Virtual Cards",[308],{"id":357,"title":358,"titles":359,"content":360,"level":25},"\u002Ffaq\u002Fgeneral#what-card-networks-does-dotva-support","What card networks does Dotva support?",[308,354],"Dotva currently issues Visa virtual cards, with Mastercard and JCB support in progress. As additional card programs are integrated, new card products will appear in your product catalogue automatically.",{"id":362,"title":363,"titles":364,"content":365,"level":25},"\u002Ffaq\u002Fgeneral#how-fast-are-cards-issued","How fast are cards issued?",[308,354],"Card issuance is typically completed within a few seconds after the order is accepted. The card transitions from pending_issue to active once the issuer confirms.",{"id":367,"title":368,"titles":369,"content":370,"level":25},"\u002Ffaq\u002Fgeneral#what-are-the-card-fees","What are the card fees?",[308,354],"Fees vary by card product. Before issuing a card, the product picker shows the exact issuance fee and top-up fee for each product. A typical example: Issuance fee: $3.00 (one-time, deducted from the initial top-up)Top-up fee: 3% of the top-up amount",{"id":372,"title":373,"titles":374,"content":375,"level":25},"\u002Ffaq\u002Fgeneral#can-i-freeze-a-card","Can I freeze a card?",[308,354],"Freeze support depends on the specific card product. Not all products support freeze \u002F unfreeze. Check the card's capability flags before attempting to freeze — if the Freeze button is visible, the product supports it. Frozen cards will decline all transactions until unfrozen.",{"id":377,"title":378,"titles":379,"content":380,"level":25},"\u002Ffaq\u002Fgeneral#what-happens-to-funds-when-i-close-a-card","What happens to funds when I close a card?",[308,354],"When you close a card, the remaining balance is automatically returned to your workspace wallet within approximately 24–48 hours after the card is settled.",{"id":382,"title":383,"titles":384,"content":385,"level":25},"\u002Ffaq\u002Fgeneral#how-do-i-view-a-cards-pan-cvv-and-expiry","How do I view a card's PAN, CVV, and expiry?",[308,354],"In the card detail page, click Verify & Reveal. You will be prompted to re-enter your password or TOTP code (step-up authentication). After verification, the card number, CVV, and expiry are displayed for a short window. Secrets are shown in-browser only and are never stored in plaintext.",{"id":387,"title":388,"titles":389,"content":390,"level":25},"\u002Ffaq\u002Fgeneral#how-do-i-know-which-merchants-a-card-will-work-with","How do I know which merchants a card will work with?",[308,354],"Each card product has a merchant support view listing the categories and merchants where other cardholders' transactions have recently succeeded (supported) or been declined for a category\u002FMCC restriction (unsupported). You can see it in two places: Before issuing — when you pick a card product, a short summary shows the supported \u002F unsupported categories.After issuing — open the card and expand Where this card works for the full, filterable merchant list. This list is projected from actual transactions across the platform over the last 7 days. It is a reference only and does not guarantee your own purchase will be approved or declined — approval also depends on your balance, billing address (AVS), the merchant's own checks, and risk rules.",{"id":392,"title":393,"titles":394,"content":395,"level":25},"\u002Ffaq\u002Fgeneral#why-did-a-transaction-fail-how-do-i-identify-the-cause","Why did a transaction fail? How do I identify the cause?",[308,354],"There are two scenarios: A declined bill appears in the transaction list — open the bill to see the decline_reason field. Common reasons include insufficient_funds, card_frozen, avs_mismatch, cvv_mismatch, and risk_blocked.No declined bill appears at all — this means the transaction was blocked at the merchant's side (e.g. by their fraud prevention or payment gateway) before it ever reached our card network. In this case we receive no notification and cannot provide a specific failure reason. The most common causes are merchant-side CVV checks, AVS strictness, or velocity controls on the merchant's processor. If you repeatedly experience unexplained failures at a specific merchant, check whether the billing address on the card matches exactly what the merchant expects, and contact the merchant's support for details.",{"id":397,"title":398,"titles":399,"content":400,"level":25},"\u002Ffaq\u002Fgeneral#what-does-a-risk_blocked-decline-mean","What does a risk_blocked decline mean?",[308,354],"The transaction was declined by Dotva's risk engine — for example, because the merchant is in a restricted category (gambling, adult content, cryptocurrency), or because a risk rule was triggered (consecutive failures, multi-country rapid spending, etc.). See the Risk Control Policy for details.",{"id":402,"title":403,"titles":404,"content":35,"level":19},"\u002Ffaq\u002Fgeneral#wallet-deposits","Wallet & Deposits",[308],{"id":406,"title":407,"titles":408,"content":409,"level":25},"\u002Ffaq\u002Fgeneral#what-currency-is-the-wallet-in","What currency is the wallet in?",[308,403],"Wallet balances are denominated in USD.",{"id":411,"title":412,"titles":413,"content":414,"level":25},"\u002Ffaq\u002Fgeneral#how-do-i-deposit-funds","How do I deposit funds?",[308,403],"Go to Wallet → Deposit. The system generates a dedicated USDT (TRC20) address for your workspace. Send USDT to that address. Once the on-chain transaction is confirmed, your USD balance is credited automatically. USDT conversion to USD is handled by our third-party payment partner — the credited amount reflects the rate applied at the time of settlement.",{"id":416,"title":417,"titles":418,"content":419,"level":25},"\u002Ffaq\u002Fgeneral#what-is-the-deposit-fee","What is the deposit fee?",[308,403],"$2.00 flat + 1% of the deposit amount. For example, a $1,000 deposit incurs a $12.00 fee and credits $988.00 to your wallet.",{"id":421,"title":422,"titles":423,"content":424,"level":25},"\u002Ffaq\u002Fgeneral#how-long-does-a-deposit-take","How long does a deposit take?",[308,403],"TRC20 deposits typically confirm within 3–5 minutes, depending on network congestion. The credit appears in your wallet as soon as confirmation is received.",{"id":426,"title":427,"titles":428,"content":429,"level":25},"\u002Ffaq\u002Fgeneral#what-is-the-minimum-deposit","What is the minimum deposit?",[308,403],"200 USDT.",{"id":431,"title":432,"titles":433,"content":434,"level":25},"\u002Ffaq\u002Fgeneral#can-i-withdraw-funds","Can I withdraw funds?",[308,403],"Yes. Go to Wallet → Withdraw and submit a withdrawal request. Withdrawals are processed in USDT and take 7–15 business days after passing compliance review. Only one pending withdrawal request is allowed per workspace at a time.",{"id":436,"title":437,"titles":438,"content":439,"level":25},"\u002Ffaq\u002Fgeneral#why-might-a-withdrawal-be-delayed","Why might a withdrawal be delayed?",[308,403],"Withdrawals may be delayed or held if: The workspace has active risk flags or an outstanding compliance reviewThere are unpaid fee obligations (e.g. negative wallet balance from risk penalties)The requested amount exceeds the available cleared balanceA reserve is held to cover pending or post-closure card charges while cards remain active or within their settlement window",{"id":441,"title":442,"titles":443,"content":35,"level":19},"\u002Ffaq\u002Fgeneral#team-staff","Team & Staff",[308],{"id":445,"title":446,"titles":447,"content":448,"level":25},"\u002Ffaq\u002Fgeneral#do-i-need-a-subscription-to-add-staff","Do I need a subscription to add staff?",[308,442],"Yes. Adding staff members requires the Staff Seats add-on subscription ($1.99\u002Fseat\u002Fmonth; discounts apply for 20+ seats).",{"id":450,"title":451,"titles":452,"content":453,"level":25},"\u002Ffaq\u002Fgeneral#what-can-staff-members-do","What can staff members do?",[308,442],"Staff can: View and use their assigned virtual cardsSubmit tickets for card top-up and card closureView their own transaction history and card details Staff cannot manage the workspace wallet, invite other members, or access workspace settings.",{"id":455,"title":456,"titles":457,"content":458,"level":25},"\u002Ffaq\u002Fgeneral#can-i-grant-a-team-member-elevated-access","Can I grant a team member elevated access?",[308,442],"Yes. You can add a Delegate with owner-level or custom-permission access via RBAC. Delegates can manage most workspace functions depending on the roles granted.",{"id":460,"title":461,"titles":462,"content":35,"level":19},"\u002Ffaq\u002Fgeneral#subscriptions","Subscriptions",[308],{"id":464,"title":465,"titles":466,"content":467,"level":25},"\u002Ffaq\u002Fgeneral#how-are-subscription-fees-charged","How are subscription fees charged?",[308,461],"Subscription fees are deducted directly from your workspace wallet on the billing date. No external payment method is required.",{"id":469,"title":470,"titles":471,"content":472,"level":25},"\u002Ffaq\u002Fgeneral#what-happens-if-my-wallet-balance-is-insufficient-at-renewal","What happens if my wallet balance is insufficient at renewal?",[308,461],"The subscription will not renew automatically. The associated features are suspended until you top up the wallet and manually renew the subscription.",{"id":474,"title":475,"titles":476,"content":477,"level":25},"\u002Ffaq\u002Fgeneral#can-i-cancel-a-subscription","Can I cancel a subscription?",[308,461],"Yes. You can cancel at any time from the Subscription page. The subscription remains active until the end of the current billing period and will not renew.",{"id":479,"title":480,"titles":481,"content":35,"level":19},"\u002Ffaq\u002Fgeneral#developer","Developer",[308],{"id":483,"title":484,"titles":485,"content":486,"level":25},"\u002Ffaq\u002Fgeneral#is-there-an-api","Is there an API?",[308,480],"Yes. Dotva provides a full REST API covering cards, wallet, orders, and webhooks. See the API Overview for documentation.",{"id":488,"title":489,"titles":490,"content":491,"level":25},"\u002Ffaq\u002Fgeneral#is-api-access-available-on-all-plans","Is API access available on all plans?",[308,480],"No. Full API access (token issuance, webhook delivery) requires the Developer subscription ($199\u002Fmonth). Without an active Developer subscription, API token creation and webhook endpoints are disabled.",{"id":493,"title":494,"titles":495,"content":496,"level":25},"\u002Ffaq\u002Fgeneral#does-the-api-use-cookies-or-sessions","Does the API use cookies or sessions?",[308,480],"No. The API uses Bearer token authentication exclusively. There are no cookies, CSRF tokens, or server-side session state.",{"id":498,"title":499,"titles":500,"content":501,"level":25},"\u002Ffaq\u002Fgeneral#how-do-i-receive-real-time-events","How do I receive real-time events?",[308,480],"Configure a webhook endpoint in Settings → Developer → Webhooks. Dotva will POST signed event payloads to your URL as events occur (e.g. card.issued.secrets after card issuance).",{"id":503,"title":504,"titles":505,"content":506,"level":25},"\u002Ffaq\u002Fgeneral#are-webhook-payloads-signed","Are webhook payloads signed?",[308,480],"Yes. Every webhook delivery includes an X-Dotva-Signature header (sha256=\u003CHMAC-SHA256 hex>). Always verify this signature before processing the payload to prevent replay and spoofing attacks.",{"id":508,"title":509,"titles":510,"content":35,"level":19},"\u002Ffaq\u002Fgeneral#security","Security",[308],{"id":512,"title":513,"titles":514,"content":515,"level":25},"\u002Ffaq\u002Fgeneral#is-my-card-data-safe","Is my card data safe?",[308,509],"Yes. Card secrets (PAN, CVV, expiry) are stored using Envelope Encryption (KEK + DEK) and are never exposed in logs or standard API responses. Revealing secrets requires step-up re-authentication.",{"id":517,"title":518,"titles":519,"content":520,"level":25},"\u002Ffaq\u002Fgeneral#what-encryption-standards-do-you-use","What encryption standards do you use?",[308,509],"Data at rest: AES-256Data in transit: TLS 1.3Card secrets: Envelope encryption with periodic key rotationWebhook signatures: HMAC-SHA256",{"id":522,"title":523,"titles":524,"content":525,"level":25},"\u002Ffaq\u002Fgeneral#what-should-i-do-if-i-suspect-unauthorized-access","What should I do if I suspect unauthorized access?",[308,509],"Immediately change your password via Account → SecurityRevoke all active sessions from the Security pageDisable and re-enable TOTP to rotate your authenticator secretContact us at support@dotva.io",{"id":527,"title":528,"titles":529,"content":35,"level":19},"\u002Ffaq\u002Fgeneral#contact-support","Contact & Support",[308],{"id":531,"title":532,"titles":533,"content":534,"level":25},"\u002Ffaq\u002Fgeneral#how-do-i-get-help","How do I get help?",[308,528],"Email support@dotva.io for general inquiries, billing questions, and technical support.",{"id":536,"title":537,"titles":538,"content":539,"level":25},"\u002Ffaq\u002Fgeneral#what-are-your-support-hours","What are your support hours?",[308,528],"Our support team operates on business days. We aim to respond to all inquiries within 1–2 business days.",{"id":541,"title":542,"titles":543,"content":544,"level":9},"\u002Flegal\u002Fservice-agreement","User Service Agreement",[],"Terms and conditions governing the use of Dotva financial management platform.",{"id":546,"title":542,"titles":547,"content":548,"level":9},"\u002Flegal\u002Fservice-agreement#user-service-agreement",[],"Effective Date: June 18, 2026Last Updated: June 18, 2026 Welcome to Dotva. By registering an account and using our services, you agree to be bound by this User Service Agreement (\"Agreement\"). Please read it carefully before using the platform.",{"id":550,"title":551,"titles":552,"content":553,"level":19},"\u002Flegal\u002Fservice-agreement#_1-definitions","1. Definitions",[542],"\"Dotva\" refers to Dotva Inc., a company incorporated in the State of New York, United States, and the platform, services, and APIs it operates.\"User\" refers to any individual or entity that registers an account on Dotva.\"Workspace\" refers to the organizational unit within Dotva under which virtual cards, wallet funds, and team members are managed.\"Workspace Owner\" refers to the User who created a Workspace and holds primary responsibility for all activities conducted within it.\"Virtual Card\" refers to a Visa virtual card issued via Dotva's card issuer integration.\"Wallet\" refers to the USD balance held within a Workspace.\"Staff\" and \"Delegate\" refer to individuals invited by the Workspace Owner to access the Workspace with defined permissions.",{"id":555,"title":556,"titles":557,"content":558,"level":19},"\u002Flegal\u002Fservice-agreement#_2-eligibility","2. Eligibility",[542],"To use Dotva, you must: Be at least 18 years of age;Have the legal capacity to enter into this Agreement;Not be located in a jurisdiction where use of our services is prohibited under applicable law or OFAC sanctions.",{"id":560,"title":561,"titles":562,"content":563,"level":19},"\u002Flegal\u002Fservice-agreement#_3-account-registration","3. Account Registration",[542],"You agree to provide accurate, current, and complete information when creating your account. You are responsible for maintaining the confidentiality of your login credentials. Dotva is not liable for any unauthorized access resulting from your failure to safeguard your credentials. You must notify Dotva promptly at support@dotva.io if you suspect unauthorized access.",{"id":565,"title":566,"titles":567,"content":568,"level":19},"\u002Flegal\u002Fservice-agreement#_4-workspace-owner-responsibility","4. Workspace Owner Responsibility",[542],"4.1 The Workspace Owner bears sole and full responsibility for all activities, transactions, and conduct occurring within their Workspace, regardless of whether such activities are carried out by the Workspace Owner, a Delegate, a Staff member, or any other party granted access to the Workspace. 4.2 The Workspace Owner is responsible for: Ensuring that all Workspace members comply with this Agreement, the Risk Control Policy, and all applicable laws and regulations;Verifying the identity and authorization of any individual invited to the Workspace as Staff or Delegate;Monitoring card usage and spending within the Workspace;Promptly revoking access for members who no longer require it. 4.3 Any liabilities, financial penalties, losses, regulatory obligations, or legal consequences arising from activities conducted within a Workspace — including those caused by Staff members or Delegates — are the sole responsibility of the Workspace Owner. Dotva is not liable for the actions or omissions of Workspace members. 4.4 If a Workspace is used for any activity that violates this Agreement or applicable law, the Workspace Owner is liable for any resulting damages, fees, or penalties, including those imposed on Dotva by card networks, regulators, or third parties.",{"id":570,"title":571,"titles":572,"content":573,"level":19},"\u002Flegal\u002Fservice-agreement#_5-virtual-cards-and-fees","5. Virtual Cards and Fees",[542],"5.1 Virtual cards are issued via third-party card program providers. Dotva acts as a facilitator and is not a bank or financial institution. 5.2 The following fees apply to card and wallet operations: OperationFeeCard IssuanceUSD 3.00 per card (deducted from initial top-up)Card Top-up3% of the top-up amountUSDT DepositUSD 2.00 flat + 1% of the deposit amountWithdrawalUSD 25.00 flat service fee + 1% of the withdrawal amount Fees for individual card products may vary. Always review the product details before issuance. 5.3 All fees are deducted from the Workspace Wallet at the time of the operation. 5.4 Fees are non-refundable except where explicitly required by applicable law.",{"id":575,"title":576,"titles":577,"content":578,"level":19},"\u002Flegal\u002Fservice-agreement#_6-acceptable-use","6. Acceptable Use",[542],"You agree NOT to use Dotva for: Any illegal activities, including money laundering, fraud, or terrorist financing;Purchasing prohibited goods or services (see Risk Control Policy);Transactions with OFAC-sanctioned individuals, entities, or jurisdictions;Creating multiple accounts to circumvent platform restrictions;Accessing the platform through unauthorized automated means. Violations may result in immediate account suspension and reporting to relevant authorities.",{"id":580,"title":581,"titles":582,"content":583,"level":19},"\u002Flegal\u002Fservice-agreement#_7-wallet-and-funds","7. Wallet and Funds",[542],"7.1 Funds in your Workspace Wallet are denominated in USD. USDT deposits are converted by our third-party payment partner at the prevailing exchange rate at the time of confirmation. 7.2 The minimum deposit amount is 200 USDT. 7.3 Dotva does not pay interest on Wallet balances. 7.4 Withdrawal requests are subject to compliance review and are processed within 7–15 business days. Dotva reserves the right to delay, reduce, or refuse a withdrawal where there is, without limitation, an active risk flag, an outstanding fee obligation, or a pending compliance matter. Each request is reviewed individually as set out in §7.8. 7.5 Dotva is not a custodian or trustee of Wallet funds. Wallet balances are operational funds held for the purpose of funding card operations and are not protected by any deposit insurance scheme. 7.6 Settlement Reserve and Withdrawal Conditions. Card transactions may settle, reverse, or be force-posted by merchants after authorization — including after a card has been frozen or closed. To protect against resulting shortfalls, Dotva may, at its discretion: (a) require that cards be frozen or closed before a full-balance withdrawal is processed; (b) withhold from any withdrawal, or require you to maintain in your Wallet, a reserve sufficient to cover pending authorizations, unsettled transactions, anticipated fees, post-closure clawbacks, and risk penalties; and (c) hold such reserve until the applicable card network settlement and chargeback windows have elapsed. Dotva may decline or reduce any withdrawal that would leave the Wallet with insufficient funds to cover these amounts. 7.7 Negative Balances and Continuing Liability. Withdrawing funds or closing your account or Workspace does not release you from liability for amounts subsequently charged to your Wallet. If your Wallet balance becomes negative — whether due to late or force-posted merchant charges, post-closure clawbacks, fees, or risk penalties — you remain liable for the full negative amount and agree to repay it promptly upon demand. Without limiting its other remedies, Dotva may: (a) set off the outstanding amount against any current or future Wallet balance or other funds you hold with Dotva; (b) suspend the Workspace and all associated cards until the balance is cleared; and (c) pursue collection of the outstanding amount, including reasonable costs of recovery. 7.8 Withdrawal Review and Discretion. Each withdrawal request is reviewed individually before processing. Dotva may, in its reasonable discretion and acting in good faith, approve a request in whole or in part, reduce the amount payable, delay processing, request additional information or verification, or decline a request. In assessing a request, Dotva may consider any relevant risk and compliance factors, including without limitation: the Workspace's transaction decline and chargeback rates; merchant categories and any flagged or blacklisted merchant activity; the presence of pending authorizations, unsettled transactions, or recently closed cards; current or historical negative Wallet balances; account age and funding history; deposit and withdrawal patterns indicative of abuse; sanctions (OFAC) screening of the destination address; and any applicable anti-money-laundering, Travel Rule, or other legal obligations. Dotva may require you to provide identity or source-of-funds information and may withhold processing until such information is provided and verified. The standard processing time stated in §7.4 may be extended where additional review is warranted. Approval or processing of any withdrawal does not waive Dotva's rights with respect to any other or future request, and is not a representation that the Workspace is free of outstanding obligations.",{"id":585,"title":586,"titles":587,"content":588,"level":19},"\u002Flegal\u002Fservice-agreement#_8-security","8. Security",[542],"8.1 You are responsible for enabling and maintaining two-factor authentication (TOTP) on your account. 8.2 You must immediately notify Dotva if you suspect unauthorized access to your account or Workspace. 8.3 All sensitive operations (card secret reveal, withdrawals) require step-up re-verification. 8.4 You are responsible for the security of any API tokens issued under your Developer subscription. Dotva is not liable for unauthorized API usage resulting from token exposure.",{"id":590,"title":591,"titles":592,"content":593,"level":19},"\u002Flegal\u002Fservice-agreement#_9-privacy","9. Privacy",[542],"Your use of Dotva is subject to our Privacy Policy, which is incorporated by reference into this Agreement.",{"id":595,"title":596,"titles":597,"content":598,"level":19},"\u002Flegal\u002Fservice-agreement#_10-intellectual-property","10. Intellectual Property",[542],"All platform software, designs, trademarks, and content are the exclusive property of Dotva Inc. You are granted a limited, non-exclusive, non-transferable, revocable license to use the platform solely for your internal business purposes. You may not copy, modify, distribute, or reverse-engineer any part of the platform.",{"id":600,"title":601,"titles":602,"content":603,"level":19},"\u002Flegal\u002Fservice-agreement#_11-termination","11. Termination",[542],"11.1 Dotva reserves the right to suspend or terminate any account or Workspace at any time for: Violation of this Agreement or the Risk Control Policy;Suspicious activity or compliance concerns;Non-payment of platform fees or outstanding penalties;Request by a regulatory authority or card network. 11.2 Upon termination, remaining Wallet balances (minus any outstanding fees, penalties, and holds) will be returned to the Workspace Owner within a commercially reasonable time, subject to completion of any required compliance review. 11.3 Dotva is not liable to the Workspace Owner or any Workspace member for losses arising from account suspension or termination where the cause is a violation of this Agreement.",{"id":605,"title":606,"titles":607,"content":608,"level":19},"\u002Flegal\u002Fservice-agreement#_12-limitation-of-liability","12. Limitation of Liability",[542],"12.1 TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, DOTVA'S TOTAL LIABILITY TO YOU FOR ANY CLAIM ARISING FROM OR RELATED TO THIS AGREEMENT SHALL NOT EXCEED THE TOTAL FEES PAID BY YOU TO DOTVA IN THE THREE (3) MONTHS PRECEDING THE CLAIM. 12.2 DOTVA IS NOT LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, LOSS OF DATA, OR BUSINESS INTERRUPTION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 12.3 Dotva is not liable for delays, failures, or losses caused by third-party card issuers, payment networks, blockchain network congestion, or force majeure events beyond Dotva's reasonable control.",{"id":610,"title":611,"titles":612,"content":613,"level":19},"\u002Flegal\u002Fservice-agreement#_13-indemnification","13. Indemnification",[542],"You agree to indemnify, defend, and hold harmless Dotva Inc., its officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, costs, and expenses (including reasonable legal fees) arising out of or related to: (i) your use of the platform; (ii) activities conducted within your Workspace; (iii) your violation of this Agreement or any applicable law; or (iv) any dispute between you and a third party.",{"id":615,"title":616,"titles":617,"content":618,"level":19},"\u002Flegal\u002Fservice-agreement#_14-governing-law-and-dispute-resolution","14. Governing Law and Dispute Resolution",[542],"14.1 This Agreement shall be governed by and construed in accordance with the laws of the State of New York, United States, without regard to its conflict of law provisions. 14.2 Any dispute arising out of or relating to this Agreement shall be subject to the exclusive jurisdiction of the state and federal courts located in New York County, New York. You hereby consent to personal jurisdiction and venue in such courts.",{"id":620,"title":621,"titles":622,"content":623,"level":19},"\u002Flegal\u002Fservice-agreement#_15-changes-to-this-agreement","15. Changes to This Agreement",[542],"Dotva may update this Agreement at any time. We will notify you of material changes via email or in-app notification at least 15 days before they take effect. Continued use of the platform after the effective date of any update constitutes your acceptance of the revised terms.",{"id":625,"title":626,"titles":627,"content":628,"level":19},"\u002Flegal\u002Fservice-agreement#_16-severability","16. Severability",[542],"If any provision of this Agreement is found to be unenforceable, the remaining provisions will continue in full force and effect.",{"id":630,"title":631,"titles":632,"content":633,"level":19},"\u002Flegal\u002Fservice-agreement#_17-contact","17. Contact",[542],"For questions regarding this Agreement, contact us at: support@dotva.io",{"id":635,"title":636,"titles":637,"content":638,"level":9},"\u002Flegal\u002Fprivacy-policy","Privacy Policy",[],"How Dotva collects, uses, and protects your personal information, in compliance with New York State law.",{"id":640,"title":636,"titles":641,"content":642,"level":9},"\u002Flegal\u002Fprivacy-policy#privacy-policy",[],"Effective Date: June 18, 2026Last Updated: June 18, 2026 Dotva Inc. (\"Dotva\", \"we\", \"us\", \"our\") is a company incorporated in the State of New York, United States. We are committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you use the Dotva platform, and explains your rights under applicable law.",{"id":644,"title":645,"titles":646,"content":35,"level":19},"\u002Flegal\u002Fprivacy-policy#_1-information-we-collect","1. Information We Collect",[636],{"id":648,"title":649,"titles":650,"content":651,"level":25},"\u002Flegal\u002Fprivacy-policy#_11-account-information","1.1 Account Information",[636,645],"Full name and email addressPassword (stored as a bcrypt hash — never in plaintext)Workspace name and slug",{"id":653,"title":654,"titles":655,"content":656,"level":25},"\u002Flegal\u002Fprivacy-policy#_12-identity-information","1.2 Identity Information",[636,645],"Cardholder names associated with virtual cards (first name and last name)Billing address provided for card issuance",{"id":658,"title":659,"titles":660,"content":661,"level":25},"\u002Flegal\u002Fprivacy-policy#_13-financial-information","1.3 Financial Information",[636,645],"USDT wallet addresses used for depositsTransaction amounts, merchant names, and transaction metadataLedger entries and wallet balance historySubscription and fee records",{"id":663,"title":664,"titles":665,"content":666,"level":25},"\u002Flegal\u002Fprivacy-policy#_14-technical-information","1.4 Technical Information",[636,645],"IP address at login and during sensitive operationsBrowser user agentSession timestamps and durationAPI request logs (used for rate limiting and security monitoring)",{"id":668,"title":669,"titles":670,"content":671,"level":25},"\u002Flegal\u002Fprivacy-policy#_15-communications","1.5 Communications",[636,645],"Support ticket messages and email correspondence with our team We do not collect Social Security Numbers, government-issued ID numbers, or biometric data unless specifically required for a compliance verification process, in which case we will notify you separately.",{"id":673,"title":674,"titles":675,"content":676,"level":19},"\u002Flegal\u002Fprivacy-policy#_2-how-we-use-your-information","2. How We Use Your Information",[636],"We use collected information to: Provide, operate, and maintain the Dotva platform and services;Process virtual card issuance and transactions;Verify identity for account security and step-up authentication;Detect, investigate, and prevent fraud, abuse, and suspicious activity;Comply with legal, regulatory, and card network obligations (including AML, OFAC, BSA, and GLBA);Send service notifications, security alerts, and billing communications;Improve platform reliability, performance, and security. We do not use your information for advertising or sell it to third parties.",{"id":678,"title":679,"titles":680,"content":35,"level":19},"\u002Flegal\u002Fprivacy-policy#_3-data-storage-and-security","3. Data Storage and Security",[636],{"id":682,"title":683,"titles":684,"content":685,"level":25},"\u002Flegal\u002Fprivacy-policy#_31-encryption-at-rest","3.1 Encryption at Rest",[636,679],"All sensitive data is encrypted at rest using AES-256. Virtual card secrets (PAN, CVV, expiry) are protected using Envelope Encryption (KEK + DEK architecture) and are never stored in plaintext.",{"id":687,"title":688,"titles":689,"content":690,"level":25},"\u002Flegal\u002Fprivacy-policy#_32-encryption-in-transit","3.2 Encryption in Transit",[636,679],"All data in transit is protected by TLS 1.3. Connections using older or deprecated protocols are rejected.",{"id":692,"title":693,"titles":694,"content":695,"level":25},"\u002Flegal\u002Fprivacy-policy#_33-access-controls","3.3 Access Controls",[636,679],"Internal access to production data is role-restricted and audit-logged.Administrative portal access is restricted to authorized personnel via IP allowlist.Step-up authentication is required for all sensitive internal operations.",{"id":697,"title":698,"titles":699,"content":700,"level":25},"\u002Flegal\u002Fprivacy-policy#_34-cybersecurity-program","3.4 Cybersecurity Program",[636,679],"In compliance with the New York SHIELD Act (NY General Business Law § 899-bb), Dotva maintains a written cybersecurity program that includes reasonable administrative, technical, and physical safeguards appropriate to the size and complexity of our operations and the sensitivity of the personal information we hold.",{"id":702,"title":703,"titles":704,"content":705,"level":25},"\u002Flegal\u002Fprivacy-policy#_35-data-location","3.5 Data Location",[636,679],"Your data is stored on servers located in the United States. We do not transfer personal data outside the United States without ensuring appropriate contractual or regulatory safeguards are in place.",{"id":707,"title":708,"titles":709,"content":710,"level":19},"\u002Flegal\u002Fprivacy-policy#_4-data-breach-notification","4. Data Breach Notification",[636],"In the event of a security breach affecting \"private information\" as defined under the New York SHIELD Act, Dotva will: Notify affected New York residents in the most expedient time possible and without unreasonable delay;Notify the New York Attorney General, the Department of State, and the Division of State Police as required by law;Provide notification to other affected users in accordance with the laws of their respective states or jurisdictions. Notification will be delivered by email to the address on file, or by substitute notice if direct notification is not reasonably feasible.",{"id":712,"title":713,"titles":714,"content":715,"level":19},"\u002Flegal\u002Fprivacy-policy#_5-data-sharing","5. Data Sharing",[636],"We do not sell your personal information. We share data only in the following circumstances: RecipientPurposeCard IssuerRequired to issue, manage, and process virtual card transactionsPayment Network (Visa)Card authorization and settlementUSDT Processing PartnerBlockchain deposit confirmation and USDT-to-USD conversionLegal and regulatory authoritiesWhen required by applicable law, court order, or lawful government request All third-party service providers are contractually required to handle personal information in a manner consistent with this policy.",{"id":717,"title":718,"titles":719,"content":720,"level":19},"\u002Flegal\u002Fprivacy-policy#_6-data-retention","6. Data Retention",[636],"Data TypeRetention PeriodAccount informationDuration of account + 7 years after closureTransaction and financial records7 years (required by financial regulations including BSA)Audit and security logs5 yearsAPI request logs90 daysSupport tickets3 years We may be required to retain certain financial records beyond these periods pursuant to applicable law. Retention obligations will take precedence over any deletion requests.",{"id":722,"title":723,"titles":724,"content":725,"level":19},"\u002Flegal\u002Fprivacy-policy#_7-your-rights","7. Your Rights",[636],"Depending on your jurisdiction, you may have the right to: Access — request a copy of the personal data we hold about you;Correction — request correction of inaccurate or incomplete information;Deletion — request deletion of your account and associated personal data, subject to legal retention obligations;Portability — receive your data in a structured, machine-readable format;Objection — object to certain processing activities. New York residents are entitled to the protections afforded by the NY SHIELD Act, including the right to be notified of data breaches affecting their private information. To exercise any of these rights, contact us at support@dotva.io. We will respond within 30 days of receiving a verifiable request.",{"id":727,"title":728,"titles":729,"content":730,"level":19},"\u002Flegal\u002Fprivacy-policy#_8-cookies-and-local-storage","8. Cookies and Local Storage",[636],"Dotva uses minimal browser storage: dotva_locale — stores your language preference (cookie, 1 year)Authentication session token — stored in localStorage, not a cookie, expires with your session We do not use third-party tracking cookies, advertising pixels, or behavioral analytics tools.",{"id":732,"title":733,"titles":734,"content":735,"level":19},"\u002Flegal\u002Fprivacy-policy#_9-childrens-privacy","9. Children's Privacy",[636],"Dotva is not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected information from a minor, we will delete it promptly.",{"id":737,"title":738,"titles":739,"content":740,"level":19},"\u002Flegal\u002Fprivacy-policy#_10-california-and-other-state-residents","10. California and Other State Residents",[636],"While Dotva is incorporated in New York, we respect the privacy rights of residents of other U.S. states. If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA). Please contact us at support@dotva.io to submit a request.",{"id":742,"title":743,"titles":744,"content":745,"level":19},"\u002Flegal\u002Fprivacy-policy#_11-changes-to-this-policy","11. Changes to This Policy",[636],"We will notify you of material changes to this Privacy Policy via email or in-app notice at least 14 days before the change takes effect. The \"Last Updated\" date at the top of this document will always reflect the most recent revision.",{"id":747,"title":748,"titles":749,"content":750,"level":19},"\u002Flegal\u002Fprivacy-policy#_12-contact","12. Contact",[636],"For privacy-related inquiries or to exercise your rights: Email: support@dotva.ioData Controller: Dotva Inc., New York, NY, United States",{"id":752,"title":753,"titles":754,"content":755,"level":9},"\u002Frisk\u002Frisk-policy","Risk Control Policy",[],"Prohibited activities, transaction monitoring rules, regulatory compliance, and enforcement actions for Dotva financial tools.",{"id":757,"title":753,"titles":758,"content":759,"level":9},"\u002Frisk\u002Frisk-policy#risk-control-policy",[],"Effective Date: June 18, 2026 Dotva is a financial management platform. As part of that service, we provide virtual cards as a spending instrument for teams and organizations. Like all financial tools, their use is subject to card network rules, issuer requirements, and applicable regulations. This policy describes the risk controls that govern how these tools may be used and what happens when violations occur.",{"id":761,"title":762,"titles":763,"content":764,"level":19},"\u002Frisk\u002Frisk-policy#_1-prohibited-activities","1. Prohibited Activities",[753],"The following activities are strictly prohibited when using Dotva's financial tools:",{"id":766,"title":767,"titles":768,"content":769,"level":25},"\u002Frisk\u002Frisk-policy#illegal-transactions","Illegal Transactions",[753,762],"Money launderingTerrorism financingFraudulent activitiesAny transaction that violates local or international law",{"id":771,"title":772,"titles":773,"content":774,"level":25},"\u002Frisk\u002Frisk-policy#platform-abuse","Platform Abuse",[753,762],"Attempting to bypass our security measuresCreating multiple accounts to circumvent restrictionsExploiting system vulnerabilitiesAny activity that may compromise the integrity of our platform",{"id":776,"title":777,"titles":778,"content":779,"level":25},"\u002Frisk\u002Frisk-policy#merchant-abuse","Merchant Abuse",[753,762],"Unauthorized transactionsAny activity that may harm our merchant partners",{"id":781,"title":782,"titles":783,"content":784,"level":25},"\u002Frisk\u002Frisk-policy#card-network-violations","Card Network Violations",[753,762],"Violating card network rules and regulationsCircumventing card network security measuresAbusing card network services",{"id":786,"title":787,"titles":788,"content":789,"level":19},"\u002Frisk\u002Frisk-policy#_2-prohibited-merchant-categories-mcc","2. Prohibited Merchant Categories (MCC)",[753],"Virtual cards issued via Dotva may not be used at merchants in the following categories: CategoryExamplesGambling \u002F BettingOnline casinos, sports betting, lotteryAdult ContentAdult entertainment platformsCryptocurrency ExchangesDirect crypto purchase via cardMoney ServicesUnlicensed money transfer operatorsWeaponsFirearms and ammunition dealersControlled SubstancesNon-licensed pharmaceutical, illicit marketsSanctioned EntitiesOFAC-listed merchants or countries Transactions at prohibited merchant categories are subject to compliance review. Repeated violations may result in card closure and account termination.",{"id":791,"title":792,"titles":793,"content":794,"level":19},"\u002Frisk\u002Frisk-policy#_3-automated-risk-rules","3. Automated Risk Rules",[753],"Dotva's risk engine evaluates every card transaction in real time. The rules below are active on all accounts as of the effective date above. Thresholds are managed by Dotva and may be adjusted without notice.",{"id":796,"title":797,"titles":798,"content":799,"level":25},"\u002Frisk\u002Frisk-policy#how-it-works","How it works",[753,792],"Real-time evaluation — every transaction, including $0 pre-authorizations, triggers a rule check.Post-transaction enforcement — our engine acts on subsequent transactions after a rule fires; it cannot reverse the transaction that triggered it.Independent rules — each rule evaluates separately; when multiple rules fire simultaneously, the strongest action applies.",{"id":801,"title":802,"titles":803,"content":804,"level":25},"\u002Frisk\u002Frisk-policy#enforcement-actions","Enforcement actions",[753,792],"ActionEffectCard ClosureCard enters a pending-close state and is permanently closed after settlement (approx. 24 hours). This action is irreversible.Penalty Fee$0.15 deducted from the workspace wallet per triggering event. The balance may go negative; transactions are blocked until the shortfall is cleared.",{"id":806,"title":807,"titles":808,"content":809,"level":25},"\u002Frisk\u002Frisk-policy#active-rules-effective-june-18-2026","Active rules (effective June 18, 2026)",[753,792],"RuleTriggersActionConsecutive transaction failures10 consecutive declined transactions on a single cardCard ClosureFailed transaction penalty feeAny declined transaction — assessed per occurrence with no minimum thresholdPenalty ($0.15)Blacklisted merchantTransaction resolved to a merchant flagged for over-settlement riskCard Closure",{"id":811,"title":812,"titles":813,"content":814,"level":25},"\u002Frisk\u002Frisk-policy#rule-notes","Rule notes",[753,792],"Consecutive failures: The failure counter resets upon any successful authorization, settlement, or refund. Occasional declines during normal use will not trigger card closure. The per-decline penalty fee is the primary deterrent; closure is a last resort for cards that sustain prolonged failure without corrective action. Post-closure penalty fees: Even after a card is closed, delayed or force-posted charges from merchants continue to incur the $0.15 fee until the card is removed from the merchant's billing system. The only way to stop recurring charges is to cancel the subscription or remove the card directly with the merchant. Blacklisted merchants: Certain merchants are known to settle amounts exceeding the original authorization. Cards used at these merchants are closed upon the first transaction as a protective measure. Contact support if you believe a merchant has been incorrectly classified.",{"id":816,"title":817,"titles":818,"content":819,"level":19},"\u002Frisk\u002Frisk-policy#_4-withdrawal-policy","4. Withdrawal Policy",[753],"4.1 Withdrawal requests are processed manually by Dotva compliance staff within 7–15 business days. Each request is reviewed individually, and Dotva may approve it in whole or in part, reduce, delay, or decline it based on a risk and compliance assessment (see §7.8 of the User Service Agreement). 4.2 Withdrawal fees are set out in §5.2 of the User Service Agreement. 4.3 Withdrawals may be delayed or refused if: The workspace has active risk flags or a pending compliance reviewThere are outstanding fee obligations (including a negative wallet balance)The requested amount exceeds the available cleared balanceThe withdrawal would leave the wallet with insufficient funds to cover pending card authorizations, unsettled transactions, or anticipated post-closure charges and fees 4.4 Withdrawals are processed in USDT to the address specified in the request. Only one pending withdrawal request is allowed per workspace at a time. 4.5 Settlement reserve and continuing liability. Because merchants may settle, reverse, or force-post charges after authorization — including after a card is frozen or closed — Dotva may require active cards to be closed before a full-balance withdrawal, withhold a reserve against pending settlements and anticipated post-closure charges and fees, and hold that reserve until the applicable settlement and chargeback windows have elapsed. Withdrawing funds or closing a workspace does not release the Workspace Owner from liability for any negative balance that subsequently arises. See §7 of the User Service Agreement for full terms.",{"id":821,"title":822,"titles":823,"content":824,"level":19},"\u002Frisk\u002Frisk-policy#_5-regulatory-compliance","5. Regulatory Compliance",[753],"Our platform strictly adheres to applicable financial regulations, including but not limited to: Bank Secrecy Act (BSA)Anti-Money Laundering (AML) regulationsOffice of Foreign Assets Control (OFAC) sanctionsPayment Card Industry Data Security Standard (PCI DSS)Card network rules (Visa program requirements) Dotva may be legally required to report transactions to relevant authorities, including Financial Intelligence Units (FIU), tax authorities, and law enforcement when served with valid legal process. We will notify affected users of legal disclosures where permitted by law.",{"id":826,"title":827,"titles":828,"content":829,"level":19},"\u002Frisk\u002Frisk-policy#_6-enforcement-actions","6. Enforcement Actions",[753],"Violations of this policy will result in immediate action, including one or more of the following: Account suspension — platform access is restricted pending investigationFreezing of associated funds — wallet balance is held until the investigation concludesInvestigation of suspicious activity — our compliance team will review the accountFinancial penalties — fees assessed per Section 3Recovery of financial losses — Dotva reserves the right to recover losses caused by policy violationsAdditional penalties for repeat violations — escalating consequences for continued non-compliance Suspended accounts retain their wallet balance. Funds will be returned (minus outstanding fees and penalties) after the investigation is complete.",{"id":831,"title":832,"titles":833,"content":834,"level":19},"\u002Frisk\u002Frisk-policy#_7-updates-to-this-policy","7. Updates to This Policy",[753],"Dotva reserves the right to update this policy as required by regulatory changes or card network rule updates. Material changes will be communicated with 30 days' notice where possible. Automated risk rule thresholds may be adjusted at any time without prior notice.",{"id":836,"title":837,"titles":838,"content":839,"level":19},"\u002Frisk\u002Frisk-policy#_8-contact","8. Contact",[753],"For risk, compliance, and support inquiries: support@dotva.io",[841,859,866,875],{"title":842,"path":843,"stem":844,"children":845,"page":858},"Api","\u002Fapi","api",[846,848,850,852,854,856],{"title":6,"path":5,"stem":847},"api\u002F01.overview",{"title":48,"path":47,"stem":849},"api\u002F02.authentication",{"title":82,"path":81,"stem":851},"api\u002F03.conventions",{"title":126,"path":125,"stem":853},"api\u002F04.virtual-cards",{"title":212,"path":211,"stem":855},"api\u002F05.orders-wallet",{"title":274,"path":273,"stem":857},"api\u002F06.webhooks",false,{"title":860,"path":861,"stem":862,"children":863,"page":858},"Faq","\u002Ffaq","faq",[864],{"title":308,"path":307,"stem":865},"faq\u002F01.general",{"title":867,"path":868,"stem":869,"children":870,"page":858},"Legal","\u002Flegal","legal",[871,873],{"title":542,"path":541,"stem":872},"legal\u002F01.service-agreement",{"title":636,"path":635,"stem":874},"legal\u002F02.privacy-policy",{"title":876,"path":877,"stem":878,"children":879,"page":858},"Risk","\u002Frisk","risk",[880],{"title":753,"path":752,"stem":881},"risk\u002F01.risk-policy",1785863144220]