# Get a gift card

`GET /api/v1/gift-cards/{id}`

One gift card by id. The redeemable code is included only when you ask for it with "?include=code" — otherwise the field is absent. Treat the code as a payment instrument: request it only when you are about to hand it to the recipient. Requires the "gift_cards:read" scope.

Scope: `gift_cards:read`

## Parameters

- `id` (path, string, required) — Awrora id (UUID) for the gift card.
- `include` (query, string) — Comma-separated extra fields to include. The only value is "code", which adds the redeemable code to the response. Omit it unless you actually need the code — it is a payment instrument.

## Responses

- `200` — The gift card. Carries "code" only when "?include=code" was sent.
- `401` — Missing, invalid, revoked or expired API key — codes "api_key_missing", "api_key_invalid", "api_key_revoked", "api_key_expired".
- `403` — The API app is off, the plan does not include the API, or the key lacks the required scope — codes "app_not_enabled", "plan_upgrade_required", "insufficient_scope" (the last carries "required_scope").
- `404` — No such resource. The same response is returned for a resource that belongs to another organization — code "not_found".
- `422` — The request was understood but cannot be fulfilled as asked — codes "validation_failed" or "idempotency_key_reused" (the same Idempotency-Key was already used with a different body).
- `429` — Rate limit exceeded — code "rate_limited". See the x-ratelimit-* headers.
- `500` — Something went wrong on our side — code "internal_error".

## Response `200`

- `id` (string, required) — Awrora id (UUID) for the gift card.
- `code_last4` (string | null, required) — Last four characters of the code, for matching against a receipt without revealing it.
- `status` ("active" | "expired" | "inactive", required) — active = usable; expired = out of validity or fully spent; inactive = deactivated by the merchant.
- `initial_amount` (Money | null, required) — Face value when the card was issued.
- `balance` (Money | null, required) — Remaining balance right now.
- `currency` (string, required) — ISO 4217 currency code for both amounts.
- `expires_at` (string | null, required) — ISO 8601 timestamp with offset, or null when the card never expires.
- `purchaser` (object, required) — Who bought the card.
- `recipient` (object, required) — Who the card was bought for.
- `created_at` (string, required) — ISO 8601 timestamp with offset.
- `code` (string | null) — The redeemable code. Only present when ?include=code was sent to GET /v1/gift-cards/{id}; absent otherwise. Never in the list and never in events — those carry code_last4. Treat it as a payment instrument.

## Example

```bash
curl -X GET "https://your-site.awrora.app/api/v1/gift-cards/id_8f2k3n" \
  -H "Authorization: Bearer $AWRORA_API_KEY"
```