> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/developer/rest-api/card-types.md).

# Card Types

The main purpose of the card type API is to find the card type you need when assigning a card to a cardholder.

A card connects a cardholder to a card type. A new card takes some defaults from its card type (such as its activity period, given by 'from' and 'until'), some limits (on the card number and PIN, for example), and other behaviours (such as how long a card can be inactive before Command Centre disables it).

The 'Site Installation' chapter of the Configuration Client online help has a section that describes card types.

As it does for the other item types, the REST API gives you read access to card types through search and details pages. However the privilege model for card types is more flexible than for other items: the 'View site' privilege determines whether you are allowed to view a card type, while the cardholder editing privileges ('Create', 'Edit', 'Create and edit') determine whether you can assign cards of that type to a cardholder, so version 8.10 of the API added a page that returns the card types that your operator is allowed to use in that way. Take its URL from `features.cardTypes.assign` in the results of `GET /api`.

This API uses the term 'card' but more broadly we prefer 'credential', because not all card types involve a physical card.

The API's coverage of PIV cards is in its own tag.

API routes that allow creating, modifying, and deleting card types are in development.

### Use cases

#### Finding the PIV card type

When you give a cardholder a card, PIV or otherwise, you need to provide the identifier of the card type. It will vary between Command Centre installations so you cannot use a value from another installation or from these examples. It will not change while Command Centre is running but it may change at upgrade, so your application should follow this process at startup.

It takes two queries and a loop:

1. `GET /api`.
2. If running 8.00 or earlier, follow the link at `features.cardTypes.cardTypes.href` (which will be to `/api/card_types`), or
3. if running 8.10 or later, follow the link at `features.cardTypes.assign.href` (which will probably be to `/api/card_types/assign`. Both URLs will work in 8.10, but the advantage of this URL is that your operator can access it at a lower privilege level).
4. Iterate through the array to find the element with `credentialClass: piv`, and
5. note its `href`.

You can accomplish the last two steps with the JSONPath filter

`$.results[?(@.credentialClass=='piv')].href`.

Explanation: Command Centre ships with a handful of card types, and administrators can add more, but the one that Command Centre uses for PIV and PIV-I cards has its own credential class.

### Licensing

Reading card types is enabled by the RESTCardholders licence. Creating, deleting, or modifying them is currently restricted.

## Search card types

> This returns the card types your operator is privileged to view.\
> \
> Since a site usually has only a few card types, and each is small, the search, sorting,\
> field selection, and pagination parameters are probably of little use to you.  But they work.\
> \
> If your result set is empty it means your operator does not have the privilege to see any\
> card types.\
> \
> You can find this URL in \`features.cardTypes.cardTypes\` in \`/api\`.  In the interest of\
> forward compatibility, \[do not build the URL\
> yourself]\(forward-compatibility-hateoas).\
> \
> The card types you can view may be a different set from those you are allowed to assign to\
> cardholders, and since assigning cards to cardholders is the only thing that this API does\
> with card types, you should probably be using \[that\
> function]\(card-types#get-api-card\_types-assign) instead.<br>

```json
{"openapi":"3.2.0","info":{"title":"Command Centre REST API","version":"2.0"},"tags":[{"name":"Card Types","description":"The main purpose of the card type API is to find the card type you need when assigning a card to\na cardholder.\n\nA card connects a cardholder to a card type.  A new card takes some defaults from its card type\n(such as its activity period, given by 'from' and 'until'), some limits (on the card number and\nPIN, for example), and other behaviours (such as how long a card can be inactive before Command\nCentre disables it).\n\nThe 'Site Installation' chapter of the Configuration Client online help has a section that\ndescribes card types.\n\nAs it does for the other item types, the REST API gives you read access to card types through\nsearch and details pages.  However the privilege model for card types is more flexible than for\nother items:  the 'View site' privilege determines whether you are allowed to view a card type,\nwhile the cardholder editing privileges ('Create', 'Edit', 'Create and edit') determine whether\nyou can assign cards of that type to a cardholder, so version 8.10 of the API added a page that\nreturns the card types that your operator is allowed to use in that way.  Take its URL from\n`features.cardTypes.assign` in the results of `GET /api`.\n\nThis API uses the term 'card' but more broadly we prefer 'credential', because not all card\ntypes involve a physical card.\n\nThe API's coverage of PIV cards is in [its own tag](piv-cards).\n\nAPI routes that allow creating, modifying, and deleting card types are in development.\n\n## Use cases\n\n### Finding the PIV card type\n\nWhen you give a cardholder a card, PIV or otherwise, you need to provide the identifier of the\ncard type.  It will vary between Command Centre installations so you cannot use a value from\nanother installation or from these examples.  It will not change while Command Centre is running\nbut it may change at upgrade, so your application should follow this process at startup.\n\nIt takes two queries and a loop:\n\n  1. `GET /api`.\n  2. If running 8.00 or earlier, follow the link at `features.cardTypes.cardTypes.href` (which\n     will be to `/api/card_types`), or\n  2. if running 8.10 or later, follow the link at `features.cardTypes.assign.href` (which will\n     probably be to `/api/card_types/assign`.  Both URLs will work in 8.10, but the advantage of\n     this URL is that your operator can access it at a lower privilege level).\n  3. Iterate through the array to find the element with `credentialClass:  piv`, and\n  4. note its `href`.\n\nYou can accomplish the last two steps with the JSONPath filter\n\n`$.results[?(@.credentialClass=='piv')].href`.\n\nExplanation:  Command Centre ships with a handful of card types, and administrators can add\nmore, but the one that Command Centre uses for PIV and PIV-I cards has its own credential class.\n\n## Licensing\n\nReading card types is enabled by the RESTCardholders licence.  Creating, deleting, or modifying\nthem is currently restricted.\n"}],"servers":[{"url":"https://127.0.0.1:8904"}],"security":[{"API_key":[]},{"basic":[]}],"components":{"securitySchemes":{"API_key":{"type":"apiKey","name":"Authorization","in":"header","description":"\nClients authenticate by including a pre-shared API key in the `Authorization` header of each\nrequest after an authorisation method of `GGL-API-KEY`:\n\n`Authorization: GGL-API-KEY C774-B01F-D695-AA4B-215F-A158-AC22-ADEB`\n\nFor a fuller description see [API authentication](api-authentication).\n"},"basic":{"type":"http","scheme":"basic","description":"This is HTTP Basic authentication using a blank username and the API key as the password.\n\nExample:  `Authorization: Basic OkM3NzQtQjAxRi1ENjk1LUFBNEItMjE1Ri1BMTU4LUFDMjItQURFQg==`\n\nThat example is equivalent to the example in the description of the api_Key method:\nprepending a colon to the API key beginning with `C774` then encoding it into Base64\nproduces the 56 characters beginning with `OkM3`.\n\nThe colon is a separator between a username, which is blank in our case, and the password,\nwhich is our API key.\n\nFor a fuller description see [API authentication](api-authentication)\n"}},"schemas":{"CardTypeSearch":{"title":"Card type search","description":"An array of card types, and a `next` link for more.  Sites generally have only a handful of\ncard types, so when retrieving them you should set your 'top' parameter high enough that you\ndo not need the 'next' link.\n\nFor the same reason, the default set of fields is much larger than it is for other items.\n","properties":{"results":{"type":"array","description":"An array of card types.","items":{"$ref":"#/components/schemas/CardType"}},"next":{"type":"object","description":"The link to the next page.  Absent if you have retrieved them all.","properties":{"href":{"type":"string","format":"uri-reference"}}}}},"CardType":{"title":"Card type","description":"This object describes a single Card Type.  \"Credential type\" would be a better name, as\nCommand Centre's card types include credentials that do not require a plastic card.\n","properties":{"href":{"type":"string","format":"uri-reference","readOnly":true,"description":"This is the identifier to use when assigning a card to a cardholder in a cardholder\n[PATCH](cardholders#patch-api-cardholders-id-) or\n[POST](cardholders#post-api-cardholders-id-).\n\nThis is also the URL for the card type's detail page.  GETting it will return you a 404 if\nyou do not have 'View site' or 'Configure site' on the card type's division."},"id":{"type":"string","readOnly":true,"description":"The API does not use this field.  Nor should you.\n"},"name":{"type":"string","description":"It is best if this is descriptive, so that operators are more likely to assign people\nthe intended kind of credential.\n"},"description":{"type":"string","description":"Like the name, this helps operators distinguish different card types.\n"},"division":{"type":"object","description":"The division that contains this card type.  Required when creating a card type.\n"},"notes":{"type":"string","description":"Free text.\n\nBecause of its potential size, the server does not return the notes field by default.  You\nneed to ask for it with `fields=notes`.\n"},"facilityCode":{"type":"string","description":"A facility code is a letter (A-P) followed by up to five digits.  It is encoded onto cards\nso that they only work at sites with the correct facility code.\n\nPIV cards, PIV-I cards, and mobile credentials do not have a facility code.\n\nMost credential classes require a facility code on creation.  But it cannot be changed\nonce set, so this field is ignored in a PATCH.\n"},"availableCardStates":{"readOnly":true,"type":"array","items":{"type":"string","enum":["Active","Disabled (manually)","Lost","Stolen","Damaged"]},"description":"All credential types have a set of card states.\n\nIf you need this, ask for it using the `fields` parameter.\n\nThis field is read-only:  it is derived from the card type's card state set (also known as\na workflow).  If you send it in a POST or a PATCH, the server will ignore it.\n"},"credentialClass":{"type":"string","description":"Required when creating a new card type but ignored when modifying one since a credential's\ntype cannot be changed once set.\n","enum":["card","mobile"]},"minimumNumber":{"description":"For card types with decimal card numbers, this is the minimum.  Must be non-negative.\n","type":"integer","default":1},"maximumNumber":{"description":"For card types with decimal card numbers, this is the maximum.  Must be non-negative.\n\nThe default depends on the credential type.  It is 16,777,215 (24 bits) for regular cards.\n","type":"integer"},"serverDisplayName":{"readOnly":true,"type":"string","description":"If you are running a multi-server installation and this item is homed on a remote server, this\nfield will contain the name of that server.  This field is missing from items that are held on\nthe machine that served the API request.  Added in 8.40.\n\nThis is a read-only field.  The server will ignore it if you send it.\n"},"regex":{"description":"This is the regular expression that a text card number\nmust match before Command Centre will accept it. \n","type":"string"},"regexDescription":{"description":"Regular expressions often need explaining to your users.  Do it here.","type":"string"},"cardStateSet":{"description":"A block containing the href to the card type's card state set.  Required when creating a new card type.\n","type":"object","properties":{"href":{"type":"string","format":"uri-reference"}}},"defaultIssueLevel":{"type":"integer","default":1,"description":"The value copied to a new credential of this type when created without an issue level."},"cardIssueLevelMustMatchDefault":{"type":"boolean","default":false,"description":"If true, Command Centre will prevent operators setting the issue level on cards of this\ntype to any value other than the default.\n\nWhen PATCHing a card type, attempting to set this true will fail if there are any\nexisting cards of the type with issue levels different from the default.\n"},"enableExpiryNotifications":{"type":"boolean","default":true,"description":"Whether a card expiration should generate a notification."},"warningPeriod":{"type":"integer","minimum":0,"default":0,"description":"Command Centre can send out notifications when a credential is due to expire this period\nin the future.\n\nIts units are set by `warningPeriodType`.\n\nA value of zero means the card type does not support notifications.\n"},"warningPeriodType":{"type":"string","default":"days","enum":["noperiod","days","weeks","months","years"],"description":"This sets the units for `warningPeriod`.\n\nIt will contain the value `noperiod` if the card type does not support expiry notifications.\n"},"minimumPinLength":{"type":"integer","default":4,"description":"The length of PINs on credentials of this type."},"inactivityTimeoutInDays":{"type":"integer","default":30,"description":"This is the period, in days, after which Command Centre will consider a credential of this type\nto be inactive.\n\nIt only comes out in a GET if the card type disables inactive cards.\n"},"allowReprint":{"type":"boolean","default":false,"description":"This indicates whether Command Centre clients should allow printing of a credential of this type.  It\nusually only applies to physical card types.\n"},"allowReEncode":{"type":"boolean","default":false,"description":"This shows whether Command Centre clients should allow re-encoding of a credential of\nthis type.  It usually only applies to physical card types.\n"},"sendRegistrationEmail":{"type":"boolean","description":"Only relevant for Gallagher mobile credentials.  If true, Command Centre will send an\nemail invitation to provision a new credential.  If false, the integration that creates\ncredentials of this type must do that.\n"},"sendRegistrationSms":{"type":"boolean","description":"Only relevant for Gallagher mobile credentials.  If true, Command Centre will send an\nSMS invitation to provision a new credential.  If false, the integration that creates\ncredentials of this type must do that.\n"},"cardNumberFormat":{"type":"string","enum":["decimal","text","hex"],"default":"decimal","description":"Required for credentials of credential class `card`.\n\nPOST only.  You cannot change this on an existing card type.\n"},"defaultExpiry":{"type":"object","readOnly":true,"description":"A block containing duplicates of the following fields that describe the rules for\nexpiring inactive cards.  They have the same names with the leading 'default' removed.\n\nThis block is read-only.  You can request it in a GET, but the server will ignore it if\nyou send it in a POST or PATCH.  It is probably better to pretend it does not exist and\nuse `defaultExpiryType`, `defaultExpiryFrom`, `defaultExpiryUntil`, and\n`defaultExpiryDuration`.\n"},"defaultExpiryType":{"type":"string","enum":["explicitDateTime","duration"],"description":"`explicitDateTime` means that cards of this type created without an activity period will\ninherit it from here.  One or both of the `from` and `until` dates can be missing.\n\n`duration` means that cards of this type created without activity start and end dates\nwill receive a blank `from` date, so they will be active immediately, and an `until`\ndate `defaultExpiryDuration` days in the future.\n"},"defaultExpiryFrom":{"type":"string","format":"date-time","description":"The value copied to a new credential of this type when created without it.  Only useful\nif `defaultExpiryType` is `explicitDateTime`.\n"},"defaultExpiryUntil":{"type":"string","format":"date-time","description":"The value copied to a new credential of this type when created without it.  Only useful\nif `defaultExpiryType` is `explicitDateTime`.\n"},"defaultExpiryDuration":{"type":"string","description":"Used when `defaultExpiryType` is `duration` and a credential of this type is created\nwithout an activity period.  Its start date is left clear, meaning \"now\", and its end\ndate is set `defaultExpiryDuration` into the future.\n\nThis is an ISO 8601 duration, so it will be of the form 'PnYnMnWnDTnHnM'.  Such\ndurations always start with a 'P'.  'n' is a number, and the 'Y', 'M', 'W', 'D', 'H',\nand 'M' following them are for years, months, weeks, days, hours, and minutes.  The 'T'\nis there if the units of the duration are smaller than a day, to distinguish months and\nminutes.  If any 'n' is zero then it and the unit character following it will be\nmissing.\n\nSince card lifetimes can only have one unit, the string will always be one of `PnY`,\n`PnM`, `PnW`, `PnD`, `PTnH`, or `PTnM`.\n\nFor example, if you set `defaultExpiryType=\"duration\"` and `defaultExpiryDuration=\"P7D\"`\nall cards of this type created without a `from` and `until` date of their own will be\ngood for one week.\n\nNot sent by the server unless the expiry type is `duration`.\n"}}}}},"paths":{"/api/card_types":{"get":{"tags":["Card Types"],"summary":"Search card types","description":"This returns the card types your operator is privileged to view.\n\nSince a site usually has only a few card types, and each is small, the search, sorting,\nfield selection, and pagination parameters are probably of little use to you.  But they work.\n\nIf your result set is empty it means your operator does not have the privilege to see any\ncard types.\n\nYou can find this URL in `features.cardTypes.cardTypes` in `/api`.  In the interest of\nforward compatibility, [do not build the URL\nyourself](forward-compatibility-hateoas).\n\nThe card types you can view may be a different set from those you are allowed to assign to\ncardholders, and since assigning cards to cardholders is the only thing that this API does\nwith card types, you should probably be using [that\nfunction](card-types#get-api-card_types-assign) instead.\n","responses":{"200":{"description":"Success.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CardTypeSearch"}}}},"403":{"description":"The installation lacks a cardholders licence."}}}}}}
```

## Create

> Creates a new card type, setting practically everything except the PIV fields.\
> \
> \[Do not code this URL]\(forward-compatibility-hateoas) into your application.  Take\
> it from the \`href\` field in the \`features.cardTypes.cardTypes.href\` field of \`GET /api\`.\
> \
> The POST expects a document in the same format as \[the card type\
> detail]\(card-types#get-api-card\_types-id-).\
> \
> When successful it returns a location header containing the address of the new card type.\
> \
> Note that you can only create one item per POST.\
> \
> This call is not yet available under licence.<br>

```json
{"openapi":"3.2.0","info":{"title":"Command Centre REST API","version":"2.0"},"tags":[{"name":"Card Types","description":"The main purpose of the card type API is to find the card type you need when assigning a card to\na cardholder.\n\nA card connects a cardholder to a card type.  A new card takes some defaults from its card type\n(such as its activity period, given by 'from' and 'until'), some limits (on the card number and\nPIN, for example), and other behaviours (such as how long a card can be inactive before Command\nCentre disables it).\n\nThe 'Site Installation' chapter of the Configuration Client online help has a section that\ndescribes card types.\n\nAs it does for the other item types, the REST API gives you read access to card types through\nsearch and details pages.  However the privilege model for card types is more flexible than for\nother items:  the 'View site' privilege determines whether you are allowed to view a card type,\nwhile the cardholder editing privileges ('Create', 'Edit', 'Create and edit') determine whether\nyou can assign cards of that type to a cardholder, so version 8.10 of the API added a page that\nreturns the card types that your operator is allowed to use in that way.  Take its URL from\n`features.cardTypes.assign` in the results of `GET /api`.\n\nThis API uses the term 'card' but more broadly we prefer 'credential', because not all card\ntypes involve a physical card.\n\nThe API's coverage of PIV cards is in [its own tag](piv-cards).\n\nAPI routes that allow creating, modifying, and deleting card types are in development.\n\n## Use cases\n\n### Finding the PIV card type\n\nWhen you give a cardholder a card, PIV or otherwise, you need to provide the identifier of the\ncard type.  It will vary between Command Centre installations so you cannot use a value from\nanother installation or from these examples.  It will not change while Command Centre is running\nbut it may change at upgrade, so your application should follow this process at startup.\n\nIt takes two queries and a loop:\n\n  1. `GET /api`.\n  2. If running 8.00 or earlier, follow the link at `features.cardTypes.cardTypes.href` (which\n     will be to `/api/card_types`), or\n  2. if running 8.10 or later, follow the link at `features.cardTypes.assign.href` (which will\n     probably be to `/api/card_types/assign`.  Both URLs will work in 8.10, but the advantage of\n     this URL is that your operator can access it at a lower privilege level).\n  3. Iterate through the array to find the element with `credentialClass:  piv`, and\n  4. note its `href`.\n\nYou can accomplish the last two steps with the JSONPath filter\n\n`$.results[?(@.credentialClass=='piv')].href`.\n\nExplanation:  Command Centre ships with a handful of card types, and administrators can add\nmore, but the one that Command Centre uses for PIV and PIV-I cards has its own credential class.\n\n## Licensing\n\nReading card types is enabled by the RESTCardholders licence.  Creating, deleting, or modifying\nthem is currently restricted.\n"}],"servers":[{"url":"https://127.0.0.1:8904"}],"security":[{"API_key":[]},{"basic":[]}],"components":{"securitySchemes":{"API_key":{"type":"apiKey","name":"Authorization","in":"header","description":"\nClients authenticate by including a pre-shared API key in the `Authorization` header of each\nrequest after an authorisation method of `GGL-API-KEY`:\n\n`Authorization: GGL-API-KEY C774-B01F-D695-AA4B-215F-A158-AC22-ADEB`\n\nFor a fuller description see [API authentication](api-authentication).\n"},"basic":{"type":"http","scheme":"basic","description":"This is HTTP Basic authentication using a blank username and the API key as the password.\n\nExample:  `Authorization: Basic OkM3NzQtQjAxRi1ENjk1LUFBNEItMjE1Ri1BMTU4LUFDMjItQURFQg==`\n\nThat example is equivalent to the example in the description of the api_Key method:\nprepending a colon to the API key beginning with `C774` then encoding it into Base64\nproduces the 56 characters beginning with `OkM3`.\n\nThe colon is a separator between a username, which is blank in our case, and the password,\nwhich is our API key.\n\nFor a fuller description see [API authentication](api-authentication)\n"}},"requestBodies":{"CardTypePOST":{"description":"Note that not all the fields in this schema make sense to send when creating a new card\ntype.  `id` and `href`, for example.\n","required":true,"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/CardType"}],"required":["division","credentialClass","cardStateSet","cardNumberFormat"]}}}}},"schemas":{"CardType":{"title":"Card type","description":"This object describes a single Card Type.  \"Credential type\" would be a better name, as\nCommand Centre's card types include credentials that do not require a plastic card.\n","properties":{"href":{"type":"string","format":"uri-reference","readOnly":true,"description":"This is the identifier to use when assigning a card to a cardholder in a cardholder\n[PATCH](cardholders#patch-api-cardholders-id-) or\n[POST](cardholders#post-api-cardholders-id-).\n\nThis is also the URL for the card type's detail page.  GETting it will return you a 404 if\nyou do not have 'View site' or 'Configure site' on the card type's division."},"id":{"type":"string","readOnly":true,"description":"The API does not use this field.  Nor should you.\n"},"name":{"type":"string","description":"It is best if this is descriptive, so that operators are more likely to assign people\nthe intended kind of credential.\n"},"description":{"type":"string","description":"Like the name, this helps operators distinguish different card types.\n"},"division":{"type":"object","description":"The division that contains this card type.  Required when creating a card type.\n"},"notes":{"type":"string","description":"Free text.\n\nBecause of its potential size, the server does not return the notes field by default.  You\nneed to ask for it with `fields=notes`.\n"},"facilityCode":{"type":"string","description":"A facility code is a letter (A-P) followed by up to five digits.  It is encoded onto cards\nso that they only work at sites with the correct facility code.\n\nPIV cards, PIV-I cards, and mobile credentials do not have a facility code.\n\nMost credential classes require a facility code on creation.  But it cannot be changed\nonce set, so this field is ignored in a PATCH.\n"},"availableCardStates":{"readOnly":true,"type":"array","items":{"type":"string","enum":["Active","Disabled (manually)","Lost","Stolen","Damaged"]},"description":"All credential types have a set of card states.\n\nIf you need this, ask for it using the `fields` parameter.\n\nThis field is read-only:  it is derived from the card type's card state set (also known as\na workflow).  If you send it in a POST or a PATCH, the server will ignore it.\n"},"credentialClass":{"type":"string","description":"Required when creating a new card type but ignored when modifying one since a credential's\ntype cannot be changed once set.\n","enum":["card","mobile"]},"minimumNumber":{"description":"For card types with decimal card numbers, this is the minimum.  Must be non-negative.\n","type":"integer","default":1},"maximumNumber":{"description":"For card types with decimal card numbers, this is the maximum.  Must be non-negative.\n\nThe default depends on the credential type.  It is 16,777,215 (24 bits) for regular cards.\n","type":"integer"},"serverDisplayName":{"readOnly":true,"type":"string","description":"If you are running a multi-server installation and this item is homed on a remote server, this\nfield will contain the name of that server.  This field is missing from items that are held on\nthe machine that served the API request.  Added in 8.40.\n\nThis is a read-only field.  The server will ignore it if you send it.\n"},"regex":{"description":"This is the regular expression that a text card number\nmust match before Command Centre will accept it. \n","type":"string"},"regexDescription":{"description":"Regular expressions often need explaining to your users.  Do it here.","type":"string"},"cardStateSet":{"description":"A block containing the href to the card type's card state set.  Required when creating a new card type.\n","type":"object","properties":{"href":{"type":"string","format":"uri-reference"}}},"defaultIssueLevel":{"type":"integer","default":1,"description":"The value copied to a new credential of this type when created without an issue level."},"cardIssueLevelMustMatchDefault":{"type":"boolean","default":false,"description":"If true, Command Centre will prevent operators setting the issue level on cards of this\ntype to any value other than the default.\n\nWhen PATCHing a card type, attempting to set this true will fail if there are any\nexisting cards of the type with issue levels different from the default.\n"},"enableExpiryNotifications":{"type":"boolean","default":true,"description":"Whether a card expiration should generate a notification."},"warningPeriod":{"type":"integer","minimum":0,"default":0,"description":"Command Centre can send out notifications when a credential is due to expire this period\nin the future.\n\nIts units are set by `warningPeriodType`.\n\nA value of zero means the card type does not support notifications.\n"},"warningPeriodType":{"type":"string","default":"days","enum":["noperiod","days","weeks","months","years"],"description":"This sets the units for `warningPeriod`.\n\nIt will contain the value `noperiod` if the card type does not support expiry notifications.\n"},"minimumPinLength":{"type":"integer","default":4,"description":"The length of PINs on credentials of this type."},"inactivityTimeoutInDays":{"type":"integer","default":30,"description":"This is the period, in days, after which Command Centre will consider a credential of this type\nto be inactive.\n\nIt only comes out in a GET if the card type disables inactive cards.\n"},"allowReprint":{"type":"boolean","default":false,"description":"This indicates whether Command Centre clients should allow printing of a credential of this type.  It\nusually only applies to physical card types.\n"},"allowReEncode":{"type":"boolean","default":false,"description":"This shows whether Command Centre clients should allow re-encoding of a credential of\nthis type.  It usually only applies to physical card types.\n"},"sendRegistrationEmail":{"type":"boolean","description":"Only relevant for Gallagher mobile credentials.  If true, Command Centre will send an\nemail invitation to provision a new credential.  If false, the integration that creates\ncredentials of this type must do that.\n"},"sendRegistrationSms":{"type":"boolean","description":"Only relevant for Gallagher mobile credentials.  If true, Command Centre will send an\nSMS invitation to provision a new credential.  If false, the integration that creates\ncredentials of this type must do that.\n"},"cardNumberFormat":{"type":"string","enum":["decimal","text","hex"],"default":"decimal","description":"Required for credentials of credential class `card`.\n\nPOST only.  You cannot change this on an existing card type.\n"},"defaultExpiry":{"type":"object","readOnly":true,"description":"A block containing duplicates of the following fields that describe the rules for\nexpiring inactive cards.  They have the same names with the leading 'default' removed.\n\nThis block is read-only.  You can request it in a GET, but the server will ignore it if\nyou send it in a POST or PATCH.  It is probably better to pretend it does not exist and\nuse `defaultExpiryType`, `defaultExpiryFrom`, `defaultExpiryUntil`, and\n`defaultExpiryDuration`.\n"},"defaultExpiryType":{"type":"string","enum":["explicitDateTime","duration"],"description":"`explicitDateTime` means that cards of this type created without an activity period will\ninherit it from here.  One or both of the `from` and `until` dates can be missing.\n\n`duration` means that cards of this type created without activity start and end dates\nwill receive a blank `from` date, so they will be active immediately, and an `until`\ndate `defaultExpiryDuration` days in the future.\n"},"defaultExpiryFrom":{"type":"string","format":"date-time","description":"The value copied to a new credential of this type when created without it.  Only useful\nif `defaultExpiryType` is `explicitDateTime`.\n"},"defaultExpiryUntil":{"type":"string","format":"date-time","description":"The value copied to a new credential of this type when created without it.  Only useful\nif `defaultExpiryType` is `explicitDateTime`.\n"},"defaultExpiryDuration":{"type":"string","description":"Used when `defaultExpiryType` is `duration` and a credential of this type is created\nwithout an activity period.  Its start date is left clear, meaning \"now\", and its end\ndate is set `defaultExpiryDuration` into the future.\n\nThis is an ISO 8601 duration, so it will be of the form 'PnYnMnWnDTnHnM'.  Such\ndurations always start with a 'P'.  'n' is a number, and the 'Y', 'M', 'W', 'D', 'H',\nand 'M' following them are for years, months, weeks, days, hours, and minutes.  The 'T'\nis there if the units of the duration are smaller than a day, to distinguish months and\nminutes.  If any 'n' is zero then it and the unit character following it will be\nmissing.\n\nSince card lifetimes can only have one unit, the string will always be one of `PnY`,\n`PnM`, `PnW`, `PnD`, `PTnH`, or `PTnM`.\n\nFor example, if you set `defaultExpiryType=\"duration\"` and `defaultExpiryDuration=\"P7D\"`\nall cards of this type created without a `from` and `until` date of their own will be\ngood for one week.\n\nNot sent by the server unless the expiry type is `duration`.\n"}}}}},"paths":{"/api/card_types":{"post":{"tags":["Card Types"],"summary":"Create","description":"Creates a new card type, setting practically everything except the PIV fields.\n\n[Do not code this URL](forward-compatibility-hateoas) into your application.  Take\nit from the `href` field in the `features.cardTypes.cardTypes.href` field of `GET /api`.\n\nThe POST expects a document in the same format as [the card type\ndetail](card-types#get-api-card_types-id-).\n\nWhen successful it returns a location header containing the address of the new card type.\n\nNote that you can only create one item per POST.\n\nThis call is not yet available under licence.\n","requestBody":{"$ref":"#/components/requestBodies/CardTypePOST"},"responses":{"201":{"description":"Success.","headers":{"location":{"schema":{"type":"string","format":"uri-reference"},"description":"The href of the new card type."}}},"400":{"description":"The body of the POST did not describe a valid card type.\n\nIf you see 'Invalid Access Group JSON object', the server could not parse the JSON in\nthe body of your POST.  Remember to quote all strings, especially those that contain @\nsymbols.\n"},"403":{"description":"The operator does not have a privilege that allows creating card types, or the server\ndoes not have the appropriate licence.\n"}}}}}}
```

## Search usable card types

> This returns the card types you are privileged to assign to a cardholder.\
> \
> Since a site usually has only a few card types, and each is small, the search, sorting,\
> field selection, and pagination parameters are probably of little use to you.  But they work.\
> \
> If your result set is empty it means your operator does not have the privilege to assign any\
> card types.  Your operator needs a privilege that allows assigning cards and credentials to\
> cardholders such as 'Add / Edit Card or Credential' or 'Create / Edit / Create and Edit\
> Cardholders'.\
> \
> You can find this URL in \`features.cardTypes.assign\` in \`/api\`.  It was new in 8.10.  In the\
> interest of forward compatibility, \[do not build the URL\
> yourself]\(forward-compatibility-hateoas).<br>

```json
{"openapi":"3.2.0","info":{"title":"Command Centre REST API","version":"2.0"},"tags":[{"name":"Card Types","description":"The main purpose of the card type API is to find the card type you need when assigning a card to\na cardholder.\n\nA card connects a cardholder to a card type.  A new card takes some defaults from its card type\n(such as its activity period, given by 'from' and 'until'), some limits (on the card number and\nPIN, for example), and other behaviours (such as how long a card can be inactive before Command\nCentre disables it).\n\nThe 'Site Installation' chapter of the Configuration Client online help has a section that\ndescribes card types.\n\nAs it does for the other item types, the REST API gives you read access to card types through\nsearch and details pages.  However the privilege model for card types is more flexible than for\nother items:  the 'View site' privilege determines whether you are allowed to view a card type,\nwhile the cardholder editing privileges ('Create', 'Edit', 'Create and edit') determine whether\nyou can assign cards of that type to a cardholder, so version 8.10 of the API added a page that\nreturns the card types that your operator is allowed to use in that way.  Take its URL from\n`features.cardTypes.assign` in the results of `GET /api`.\n\nThis API uses the term 'card' but more broadly we prefer 'credential', because not all card\ntypes involve a physical card.\n\nThe API's coverage of PIV cards is in [its own tag](piv-cards).\n\nAPI routes that allow creating, modifying, and deleting card types are in development.\n\n## Use cases\n\n### Finding the PIV card type\n\nWhen you give a cardholder a card, PIV or otherwise, you need to provide the identifier of the\ncard type.  It will vary between Command Centre installations so you cannot use a value from\nanother installation or from these examples.  It will not change while Command Centre is running\nbut it may change at upgrade, so your application should follow this process at startup.\n\nIt takes two queries and a loop:\n\n  1. `GET /api`.\n  2. If running 8.00 or earlier, follow the link at `features.cardTypes.cardTypes.href` (which\n     will be to `/api/card_types`), or\n  2. if running 8.10 or later, follow the link at `features.cardTypes.assign.href` (which will\n     probably be to `/api/card_types/assign`.  Both URLs will work in 8.10, but the advantage of\n     this URL is that your operator can access it at a lower privilege level).\n  3. Iterate through the array to find the element with `credentialClass:  piv`, and\n  4. note its `href`.\n\nYou can accomplish the last two steps with the JSONPath filter\n\n`$.results[?(@.credentialClass=='piv')].href`.\n\nExplanation:  Command Centre ships with a handful of card types, and administrators can add\nmore, but the one that Command Centre uses for PIV and PIV-I cards has its own credential class.\n\n## Licensing\n\nReading card types is enabled by the RESTCardholders licence.  Creating, deleting, or modifying\nthem is currently restricted.\n"}],"servers":[{"url":"https://127.0.0.1:8904"}],"security":[{"API_key":[]},{"basic":[]}],"components":{"securitySchemes":{"API_key":{"type":"apiKey","name":"Authorization","in":"header","description":"\nClients authenticate by including a pre-shared API key in the `Authorization` header of each\nrequest after an authorisation method of `GGL-API-KEY`:\n\n`Authorization: GGL-API-KEY C774-B01F-D695-AA4B-215F-A158-AC22-ADEB`\n\nFor a fuller description see [API authentication](api-authentication).\n"},"basic":{"type":"http","scheme":"basic","description":"This is HTTP Basic authentication using a blank username and the API key as the password.\n\nExample:  `Authorization: Basic OkM3NzQtQjAxRi1ENjk1LUFBNEItMjE1Ri1BMTU4LUFDMjItQURFQg==`\n\nThat example is equivalent to the example in the description of the api_Key method:\nprepending a colon to the API key beginning with `C774` then encoding it into Base64\nproduces the 56 characters beginning with `OkM3`.\n\nThe colon is a separator between a username, which is blank in our case, and the password,\nwhich is our API key.\n\nFor a fuller description see [API authentication](api-authentication)\n"}},"parameters":{"sort":{"name":"sort","in":"query","schema":{"type":"string","enum":["id","name","-id","-name"]},"required":false,"description":"Changes the sort field between database ID and name.\n\nIf you prefix `id` or `name` with a minus sign (ASCII 45), the sort order is reversed.\n\nThere are two very strong reasons to sort by ID:\n\n1. Sorting by name carries a risk of missing or duplicating objects if your result set spans\n   multiple pages and another operator is editing the database while your REST client is\n   enumerating them.  This is known as \"page drift.\"  Sorting by ID does not carry that risk.\n2. Following a `next` link is _dramatically_ quicker when sorting by ID.\n\nWe _strongly_ recommend sorting by ID.  In case you were still in doubt, we will do that by\ndefault in a future version of Command Centre.\n\nThe server silently ignores anything except the options listed here.\n"},"top":{"name":"top","in":"query","required":false,"schema":{"type":"integer","minimum":1},"description":"Limits the results to no more than this many items per page.\n\nOlder versions of Command Centre returned 100 items per page in the absence of this parameter.  That is acceptable for GUI\napplications that will only display the first page, but for integrations that intend to\nproceed through the entire database it causes a lot of chatter.\n\n8.70 and later versions will default to 1000 items per request.  This is about where a graph\nof throughput versus page size begins to level out.\n"},"name":{"name":"name","in":"query","schema":{"type":"string"},"description":"Limits the returned items to those with a name that matches this string.  Without surrounding\nquotes or a percent sign or underscore, it is a substring match; surround the parameter with\ndouble quotes `\"...\"` for an exact match.  Without quotes, a percent sign `%` will match any\nsubstring and an underscore will match any single character.\n\nThe search is always case-insensitive.  Results are undefined if you do a substring search for\nthe empty string (`name=`).  You will receive no items if you search for those with no name\n(`name=\"\"`), as all items must have a name.\n\nSearch parameters are ANDed together.\n"},"division":{"name":"division","in":"query","required":false,"schema":{"type":"array","items":{"type":"string"}},"style":"form","explode":false,"description":"Limits the returned items to those that are in these divisions.\n\nThat includes all the items in those divisions' child divisions, because Command Centre treats\nitems as though they are also in their division's parent, and its parent, and so on up to the\nroot division.\n\nSeparate the IDs of the divisions in you are interested with commas.  Item IDs are short\nalphanumeric strings, not URLs.\n\nResults are undefined if you provide an ID that is not in the form of a division ID.\n\nSearch parameters are ANDed together.\n"},"directDivision":{"name":"directDivision","in":"query","required":false,"schema":{"type":"array","items":{"type":"string"}},"style":"form","explode":false,"description":"Restricts items to those whose division is in this list.\n\nUnlike `division=`, it does not follow ancestry.  That means it will limit the search to items\nthat are directly assigned to the divisions you list, whereas `division` (without the\n`direct`) will also include items that are assigned to their descendants.\n\nList the IDs of the divisions you are interested in separated by commas.  Item IDs are short\nalphanumeric strings, not URLs.\n\nBecause this is the first query parameter we added that contains a capital letter, this will\nbe the first time you have had to think about case sensitivity.  `directDivision` works,\n`directdivision` does not.\n\nResults are undefined if you provide an ID that is not in the form of a division ID.\n\nSearch parameters are ANDed together.\n\nAdded in 9.20.\n"},"description":{"name":"description","in":"query","required":false,"schema":{"type":"string"},"description":"Limits the returned items to those with a description that matches this string.  By default it\nis a substring match; surround it with double quotes `\"...\"` for an exact match.  A `_` will\nmatch any single character, and a `%` will match any substring.  With or without quotes,\nhaving either of these wildcards in the string will anchor it at both ends as though you had\nsurrounded it with `\"`.\n\nThe search is always case-insensitive.  Results are undefined if you search for the empty\nstring (`description=` or `description=\"\"`).\n\nSearch parameters are ANDed together.\n"},"pos":{"name":"pos","in":"query","required":false,"schema":{"type":"integer"},"description":"Reserved for internal use.  You may see it in URLs you receive from the server, but you must never add it yourself."},"skip":{"name":"skip","in":"query","required":false,"schema":{"type":"integer"},"description":"Reserved for internal use.  Do not add it to your queries."}},"schemas":{"CardTypeSearch":{"title":"Card type search","description":"An array of card types, and a `next` link for more.  Sites generally have only a handful of\ncard types, so when retrieving them you should set your 'top' parameter high enough that you\ndo not need the 'next' link.\n\nFor the same reason, the default set of fields is much larger than it is for other items.\n","properties":{"results":{"type":"array","description":"An array of card types.","items":{"$ref":"#/components/schemas/CardType"}},"next":{"type":"object","description":"The link to the next page.  Absent if you have retrieved them all.","properties":{"href":{"type":"string","format":"uri-reference"}}}}},"CardType":{"title":"Card type","description":"This object describes a single Card Type.  \"Credential type\" would be a better name, as\nCommand Centre's card types include credentials that do not require a plastic card.\n","properties":{"href":{"type":"string","format":"uri-reference","readOnly":true,"description":"This is the identifier to use when assigning a card to a cardholder in a cardholder\n[PATCH](cardholders#patch-api-cardholders-id-) or\n[POST](cardholders#post-api-cardholders-id-).\n\nThis is also the URL for the card type's detail page.  GETting it will return you a 404 if\nyou do not have 'View site' or 'Configure site' on the card type's division."},"id":{"type":"string","readOnly":true,"description":"The API does not use this field.  Nor should you.\n"},"name":{"type":"string","description":"It is best if this is descriptive, so that operators are more likely to assign people\nthe intended kind of credential.\n"},"description":{"type":"string","description":"Like the name, this helps operators distinguish different card types.\n"},"division":{"type":"object","description":"The division that contains this card type.  Required when creating a card type.\n"},"notes":{"type":"string","description":"Free text.\n\nBecause of its potential size, the server does not return the notes field by default.  You\nneed to ask for it with `fields=notes`.\n"},"facilityCode":{"type":"string","description":"A facility code is a letter (A-P) followed by up to five digits.  It is encoded onto cards\nso that they only work at sites with the correct facility code.\n\nPIV cards, PIV-I cards, and mobile credentials do not have a facility code.\n\nMost credential classes require a facility code on creation.  But it cannot be changed\nonce set, so this field is ignored in a PATCH.\n"},"availableCardStates":{"readOnly":true,"type":"array","items":{"type":"string","enum":["Active","Disabled (manually)","Lost","Stolen","Damaged"]},"description":"All credential types have a set of card states.\n\nIf you need this, ask for it using the `fields` parameter.\n\nThis field is read-only:  it is derived from the card type's card state set (also known as\na workflow).  If you send it in a POST or a PATCH, the server will ignore it.\n"},"credentialClass":{"type":"string","description":"Required when creating a new card type but ignored when modifying one since a credential's\ntype cannot be changed once set.\n","enum":["card","mobile"]},"minimumNumber":{"description":"For card types with decimal card numbers, this is the minimum.  Must be non-negative.\n","type":"integer","default":1},"maximumNumber":{"description":"For card types with decimal card numbers, this is the maximum.  Must be non-negative.\n\nThe default depends on the credential type.  It is 16,777,215 (24 bits) for regular cards.\n","type":"integer"},"serverDisplayName":{"readOnly":true,"type":"string","description":"If you are running a multi-server installation and this item is homed on a remote server, this\nfield will contain the name of that server.  This field is missing from items that are held on\nthe machine that served the API request.  Added in 8.40.\n\nThis is a read-only field.  The server will ignore it if you send it.\n"},"regex":{"description":"This is the regular expression that a text card number\nmust match before Command Centre will accept it. \n","type":"string"},"regexDescription":{"description":"Regular expressions often need explaining to your users.  Do it here.","type":"string"},"cardStateSet":{"description":"A block containing the href to the card type's card state set.  Required when creating a new card type.\n","type":"object","properties":{"href":{"type":"string","format":"uri-reference"}}},"defaultIssueLevel":{"type":"integer","default":1,"description":"The value copied to a new credential of this type when created without an issue level."},"cardIssueLevelMustMatchDefault":{"type":"boolean","default":false,"description":"If true, Command Centre will prevent operators setting the issue level on cards of this\ntype to any value other than the default.\n\nWhen PATCHing a card type, attempting to set this true will fail if there are any\nexisting cards of the type with issue levels different from the default.\n"},"enableExpiryNotifications":{"type":"boolean","default":true,"description":"Whether a card expiration should generate a notification."},"warningPeriod":{"type":"integer","minimum":0,"default":0,"description":"Command Centre can send out notifications when a credential is due to expire this period\nin the future.\n\nIts units are set by `warningPeriodType`.\n\nA value of zero means the card type does not support notifications.\n"},"warningPeriodType":{"type":"string","default":"days","enum":["noperiod","days","weeks","months","years"],"description":"This sets the units for `warningPeriod`.\n\nIt will contain the value `noperiod` if the card type does not support expiry notifications.\n"},"minimumPinLength":{"type":"integer","default":4,"description":"The length of PINs on credentials of this type."},"inactivityTimeoutInDays":{"type":"integer","default":30,"description":"This is the period, in days, after which Command Centre will consider a credential of this type\nto be inactive.\n\nIt only comes out in a GET if the card type disables inactive cards.\n"},"allowReprint":{"type":"boolean","default":false,"description":"This indicates whether Command Centre clients should allow printing of a credential of this type.  It\nusually only applies to physical card types.\n"},"allowReEncode":{"type":"boolean","default":false,"description":"This shows whether Command Centre clients should allow re-encoding of a credential of\nthis type.  It usually only applies to physical card types.\n"},"sendRegistrationEmail":{"type":"boolean","description":"Only relevant for Gallagher mobile credentials.  If true, Command Centre will send an\nemail invitation to provision a new credential.  If false, the integration that creates\ncredentials of this type must do that.\n"},"sendRegistrationSms":{"type":"boolean","description":"Only relevant for Gallagher mobile credentials.  If true, Command Centre will send an\nSMS invitation to provision a new credential.  If false, the integration that creates\ncredentials of this type must do that.\n"},"cardNumberFormat":{"type":"string","enum":["decimal","text","hex"],"default":"decimal","description":"Required for credentials of credential class `card`.\n\nPOST only.  You cannot change this on an existing card type.\n"},"defaultExpiry":{"type":"object","readOnly":true,"description":"A block containing duplicates of the following fields that describe the rules for\nexpiring inactive cards.  They have the same names with the leading 'default' removed.\n\nThis block is read-only.  You can request it in a GET, but the server will ignore it if\nyou send it in a POST or PATCH.  It is probably better to pretend it does not exist and\nuse `defaultExpiryType`, `defaultExpiryFrom`, `defaultExpiryUntil`, and\n`defaultExpiryDuration`.\n"},"defaultExpiryType":{"type":"string","enum":["explicitDateTime","duration"],"description":"`explicitDateTime` means that cards of this type created without an activity period will\ninherit it from here.  One or both of the `from` and `until` dates can be missing.\n\n`duration` means that cards of this type created without activity start and end dates\nwill receive a blank `from` date, so they will be active immediately, and an `until`\ndate `defaultExpiryDuration` days in the future.\n"},"defaultExpiryFrom":{"type":"string","format":"date-time","description":"The value copied to a new credential of this type when created without it.  Only useful\nif `defaultExpiryType` is `explicitDateTime`.\n"},"defaultExpiryUntil":{"type":"string","format":"date-time","description":"The value copied to a new credential of this type when created without it.  Only useful\nif `defaultExpiryType` is `explicitDateTime`.\n"},"defaultExpiryDuration":{"type":"string","description":"Used when `defaultExpiryType` is `duration` and a credential of this type is created\nwithout an activity period.  Its start date is left clear, meaning \"now\", and its end\ndate is set `defaultExpiryDuration` into the future.\n\nThis is an ISO 8601 duration, so it will be of the form 'PnYnMnWnDTnHnM'.  Such\ndurations always start with a 'P'.  'n' is a number, and the 'Y', 'M', 'W', 'D', 'H',\nand 'M' following them are for years, months, weeks, days, hours, and minutes.  The 'T'\nis there if the units of the duration are smaller than a day, to distinguish months and\nminutes.  If any 'n' is zero then it and the unit character following it will be\nmissing.\n\nSince card lifetimes can only have one unit, the string will always be one of `PnY`,\n`PnM`, `PnW`, `PnD`, `PTnH`, or `PTnM`.\n\nFor example, if you set `defaultExpiryType=\"duration\"` and `defaultExpiryDuration=\"P7D\"`\nall cards of this type created without a `from` and `until` date of their own will be\ngood for one week.\n\nNot sent by the server unless the expiry type is `duration`.\n"}}}}},"paths":{"/api/card_types/assign":{"get":{"tags":["Card Types"],"summary":"Search usable card types","description":"This returns the card types you are privileged to assign to a cardholder.\n\nSince a site usually has only a few card types, and each is small, the search, sorting,\nfield selection, and pagination parameters are probably of little use to you.  But they work.\n\nIf your result set is empty it means your operator does not have the privilege to assign any\ncard types.  Your operator needs a privilege that allows assigning cards and credentials to\ncardholders such as 'Add / Edit Card or Credential' or 'Create / Edit / Create and Edit\nCardholders'.\n\nYou can find this URL in `features.cardTypes.assign` in `/api`.  It was new in 8.10.  In the\ninterest of forward compatibility, [do not build the URL\nyourself](forward-compatibility-hateoas).\n","parameters":[{"$ref":"#/components/parameters/sort"},{"$ref":"#/components/parameters/top"},{"$ref":"#/components/parameters/name"},{"$ref":"#/components/parameters/division"},{"$ref":"#/components/parameters/directDivision"},{"$ref":"#/components/parameters/description"},{"name":"fields","in":"query","schema":{"type":"array","items":{"type":"string","enum":["href","id","name","division","facilityCode","availableCardStates","credentialClass","minimumNumber","maximumNumber","notes","regex","regexDescription"]}},"description":"Specifies which fields to return instead of the default set (which contains\nnearly every field).  Separate values with commas.\n\nTreat the string matches as case-sensitive:  use 'facilityCode' rather than\n'facilitycode'.\n"},{"$ref":"#/components/parameters/pos"},{"$ref":"#/components/parameters/skip"}],"responses":{"200":{"description":"Success.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CardTypeSearch"}}}},"403":{"description":"The installation lacks a cardholders licence."}}}}}}
```

## Get one card type

> This returns some basic data for a card type.  It exists so that clients following card type\
> hrefs from other controllers do not receive a 404.  To find out about card types available\
> for assigning to cardholders, use\
> \[card\_types/assign]\(card-types#get-api-card\_types-assign) instead.<br>

```json
{"openapi":"3.2.0","info":{"title":"Command Centre REST API","version":"2.0"},"tags":[{"name":"Card Types","description":"The main purpose of the card type API is to find the card type you need when assigning a card to\na cardholder.\n\nA card connects a cardholder to a card type.  A new card takes some defaults from its card type\n(such as its activity period, given by 'from' and 'until'), some limits (on the card number and\nPIN, for example), and other behaviours (such as how long a card can be inactive before Command\nCentre disables it).\n\nThe 'Site Installation' chapter of the Configuration Client online help has a section that\ndescribes card types.\n\nAs it does for the other item types, the REST API gives you read access to card types through\nsearch and details pages.  However the privilege model for card types is more flexible than for\nother items:  the 'View site' privilege determines whether you are allowed to view a card type,\nwhile the cardholder editing privileges ('Create', 'Edit', 'Create and edit') determine whether\nyou can assign cards of that type to a cardholder, so version 8.10 of the API added a page that\nreturns the card types that your operator is allowed to use in that way.  Take its URL from\n`features.cardTypes.assign` in the results of `GET /api`.\n\nThis API uses the term 'card' but more broadly we prefer 'credential', because not all card\ntypes involve a physical card.\n\nThe API's coverage of PIV cards is in [its own tag](piv-cards).\n\nAPI routes that allow creating, modifying, and deleting card types are in development.\n\n## Use cases\n\n### Finding the PIV card type\n\nWhen you give a cardholder a card, PIV or otherwise, you need to provide the identifier of the\ncard type.  It will vary between Command Centre installations so you cannot use a value from\nanother installation or from these examples.  It will not change while Command Centre is running\nbut it may change at upgrade, so your application should follow this process at startup.\n\nIt takes two queries and a loop:\n\n  1. `GET /api`.\n  2. If running 8.00 or earlier, follow the link at `features.cardTypes.cardTypes.href` (which\n     will be to `/api/card_types`), or\n  2. if running 8.10 or later, follow the link at `features.cardTypes.assign.href` (which will\n     probably be to `/api/card_types/assign`.  Both URLs will work in 8.10, but the advantage of\n     this URL is that your operator can access it at a lower privilege level).\n  3. Iterate through the array to find the element with `credentialClass:  piv`, and\n  4. note its `href`.\n\nYou can accomplish the last two steps with the JSONPath filter\n\n`$.results[?(@.credentialClass=='piv')].href`.\n\nExplanation:  Command Centre ships with a handful of card types, and administrators can add\nmore, but the one that Command Centre uses for PIV and PIV-I cards has its own credential class.\n\n## Licensing\n\nReading card types is enabled by the RESTCardholders licence.  Creating, deleting, or modifying\nthem is currently restricted.\n"}],"servers":[{"url":"https://127.0.0.1:8904"}],"security":[{"API_key":[]},{"basic":[]}],"components":{"securitySchemes":{"API_key":{"type":"apiKey","name":"Authorization","in":"header","description":"\nClients authenticate by including a pre-shared API key in the `Authorization` header of each\nrequest after an authorisation method of `GGL-API-KEY`:\n\n`Authorization: GGL-API-KEY C774-B01F-D695-AA4B-215F-A158-AC22-ADEB`\n\nFor a fuller description see [API authentication](api-authentication).\n"},"basic":{"type":"http","scheme":"basic","description":"This is HTTP Basic authentication using a blank username and the API key as the password.\n\nExample:  `Authorization: Basic OkM3NzQtQjAxRi1ENjk1LUFBNEItMjE1Ri1BMTU4LUFDMjItQURFQg==`\n\nThat example is equivalent to the example in the description of the api_Key method:\nprepending a colon to the API key beginning with `C774` then encoding it into Base64\nproduces the 56 characters beginning with `OkM3`.\n\nThe colon is a separator between a username, which is blank in our case, and the password,\nwhich is our API key.\n\nFor a fuller description see [API authentication](api-authentication)\n"}},"schemas":{"CardType":{"title":"Card type","description":"This object describes a single Card Type.  \"Credential type\" would be a better name, as\nCommand Centre's card types include credentials that do not require a plastic card.\n","properties":{"href":{"type":"string","format":"uri-reference","readOnly":true,"description":"This is the identifier to use when assigning a card to a cardholder in a cardholder\n[PATCH](cardholders#patch-api-cardholders-id-) or\n[POST](cardholders#post-api-cardholders-id-).\n\nThis is also the URL for the card type's detail page.  GETting it will return you a 404 if\nyou do not have 'View site' or 'Configure site' on the card type's division."},"id":{"type":"string","readOnly":true,"description":"The API does not use this field.  Nor should you.\n"},"name":{"type":"string","description":"It is best if this is descriptive, so that operators are more likely to assign people\nthe intended kind of credential.\n"},"description":{"type":"string","description":"Like the name, this helps operators distinguish different card types.\n"},"division":{"type":"object","description":"The division that contains this card type.  Required when creating a card type.\n"},"notes":{"type":"string","description":"Free text.\n\nBecause of its potential size, the server does not return the notes field by default.  You\nneed to ask for it with `fields=notes`.\n"},"facilityCode":{"type":"string","description":"A facility code is a letter (A-P) followed by up to five digits.  It is encoded onto cards\nso that they only work at sites with the correct facility code.\n\nPIV cards, PIV-I cards, and mobile credentials do not have a facility code.\n\nMost credential classes require a facility code on creation.  But it cannot be changed\nonce set, so this field is ignored in a PATCH.\n"},"availableCardStates":{"readOnly":true,"type":"array","items":{"type":"string","enum":["Active","Disabled (manually)","Lost","Stolen","Damaged"]},"description":"All credential types have a set of card states.\n\nIf you need this, ask for it using the `fields` parameter.\n\nThis field is read-only:  it is derived from the card type's card state set (also known as\na workflow).  If you send it in a POST or a PATCH, the server will ignore it.\n"},"credentialClass":{"type":"string","description":"Required when creating a new card type but ignored when modifying one since a credential's\ntype cannot be changed once set.\n","enum":["card","mobile"]},"minimumNumber":{"description":"For card types with decimal card numbers, this is the minimum.  Must be non-negative.\n","type":"integer","default":1},"maximumNumber":{"description":"For card types with decimal card numbers, this is the maximum.  Must be non-negative.\n\nThe default depends on the credential type.  It is 16,777,215 (24 bits) for regular cards.\n","type":"integer"},"serverDisplayName":{"readOnly":true,"type":"string","description":"If you are running a multi-server installation and this item is homed on a remote server, this\nfield will contain the name of that server.  This field is missing from items that are held on\nthe machine that served the API request.  Added in 8.40.\n\nThis is a read-only field.  The server will ignore it if you send it.\n"},"regex":{"description":"This is the regular expression that a text card number\nmust match before Command Centre will accept it. \n","type":"string"},"regexDescription":{"description":"Regular expressions often need explaining to your users.  Do it here.","type":"string"},"cardStateSet":{"description":"A block containing the href to the card type's card state set.  Required when creating a new card type.\n","type":"object","properties":{"href":{"type":"string","format":"uri-reference"}}},"defaultIssueLevel":{"type":"integer","default":1,"description":"The value copied to a new credential of this type when created without an issue level."},"cardIssueLevelMustMatchDefault":{"type":"boolean","default":false,"description":"If true, Command Centre will prevent operators setting the issue level on cards of this\ntype to any value other than the default.\n\nWhen PATCHing a card type, attempting to set this true will fail if there are any\nexisting cards of the type with issue levels different from the default.\n"},"enableExpiryNotifications":{"type":"boolean","default":true,"description":"Whether a card expiration should generate a notification."},"warningPeriod":{"type":"integer","minimum":0,"default":0,"description":"Command Centre can send out notifications when a credential is due to expire this period\nin the future.\n\nIts units are set by `warningPeriodType`.\n\nA value of zero means the card type does not support notifications.\n"},"warningPeriodType":{"type":"string","default":"days","enum":["noperiod","days","weeks","months","years"],"description":"This sets the units for `warningPeriod`.\n\nIt will contain the value `noperiod` if the card type does not support expiry notifications.\n"},"minimumPinLength":{"type":"integer","default":4,"description":"The length of PINs on credentials of this type."},"inactivityTimeoutInDays":{"type":"integer","default":30,"description":"This is the period, in days, after which Command Centre will consider a credential of this type\nto be inactive.\n\nIt only comes out in a GET if the card type disables inactive cards.\n"},"allowReprint":{"type":"boolean","default":false,"description":"This indicates whether Command Centre clients should allow printing of a credential of this type.  It\nusually only applies to physical card types.\n"},"allowReEncode":{"type":"boolean","default":false,"description":"This shows whether Command Centre clients should allow re-encoding of a credential of\nthis type.  It usually only applies to physical card types.\n"},"sendRegistrationEmail":{"type":"boolean","description":"Only relevant for Gallagher mobile credentials.  If true, Command Centre will send an\nemail invitation to provision a new credential.  If false, the integration that creates\ncredentials of this type must do that.\n"},"sendRegistrationSms":{"type":"boolean","description":"Only relevant for Gallagher mobile credentials.  If true, Command Centre will send an\nSMS invitation to provision a new credential.  If false, the integration that creates\ncredentials of this type must do that.\n"},"cardNumberFormat":{"type":"string","enum":["decimal","text","hex"],"default":"decimal","description":"Required for credentials of credential class `card`.\n\nPOST only.  You cannot change this on an existing card type.\n"},"defaultExpiry":{"type":"object","readOnly":true,"description":"A block containing duplicates of the following fields that describe the rules for\nexpiring inactive cards.  They have the same names with the leading 'default' removed.\n\nThis block is read-only.  You can request it in a GET, but the server will ignore it if\nyou send it in a POST or PATCH.  It is probably better to pretend it does not exist and\nuse `defaultExpiryType`, `defaultExpiryFrom`, `defaultExpiryUntil`, and\n`defaultExpiryDuration`.\n"},"defaultExpiryType":{"type":"string","enum":["explicitDateTime","duration"],"description":"`explicitDateTime` means that cards of this type created without an activity period will\ninherit it from here.  One or both of the `from` and `until` dates can be missing.\n\n`duration` means that cards of this type created without activity start and end dates\nwill receive a blank `from` date, so they will be active immediately, and an `until`\ndate `defaultExpiryDuration` days in the future.\n"},"defaultExpiryFrom":{"type":"string","format":"date-time","description":"The value copied to a new credential of this type when created without it.  Only useful\nif `defaultExpiryType` is `explicitDateTime`.\n"},"defaultExpiryUntil":{"type":"string","format":"date-time","description":"The value copied to a new credential of this type when created without it.  Only useful\nif `defaultExpiryType` is `explicitDateTime`.\n"},"defaultExpiryDuration":{"type":"string","description":"Used when `defaultExpiryType` is `duration` and a credential of this type is created\nwithout an activity period.  Its start date is left clear, meaning \"now\", and its end\ndate is set `defaultExpiryDuration` into the future.\n\nThis is an ISO 8601 duration, so it will be of the form 'PnYnMnWnDTnHnM'.  Such\ndurations always start with a 'P'.  'n' is a number, and the 'Y', 'M', 'W', 'D', 'H',\nand 'M' following them are for years, months, weeks, days, hours, and minutes.  The 'T'\nis there if the units of the duration are smaller than a day, to distinguish months and\nminutes.  If any 'n' is zero then it and the unit character following it will be\nmissing.\n\nSince card lifetimes can only have one unit, the string will always be one of `PnY`,\n`PnM`, `PnW`, `PnD`, `PTnH`, or `PTnM`.\n\nFor example, if you set `defaultExpiryType=\"duration\"` and `defaultExpiryDuration=\"P7D\"`\nall cards of this type created without a `from` and `until` date of their own will be\ngood for one week.\n\nNot sent by the server unless the expiry type is `duration`.\n"}}}}},"paths":{"/api/card_types/{id}":{"get":{"tags":["Card Types"],"summary":"Get one card type","description":"This returns some basic data for a card type.  It exists so that clients following card type\nhrefs from other controllers do not receive a 404.  To find out about card types available\nfor assigning to cardholders, use\n[card_types/assign](card-types#get-api-card_types-assign) instead.\n","responses":{"200":{"description":"Success.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CardType"}}}},"403":{"description":"The installation lacks a cardholders licence."}}}}}}
```

## Remove

> This call removes a card type from Command Centre.  In the interest of forward compatibility,\
> take the URL from the results of a card type search rather than \[building it\
> yourself]\(forward-compatibility-hateoas).\
> \
> This call is not yet available under licence.<br>

```json
{"openapi":"3.2.0","info":{"title":"Command Centre REST API","version":"2.0"},"tags":[{"name":"Card Types","description":"The main purpose of the card type API is to find the card type you need when assigning a card to\na cardholder.\n\nA card connects a cardholder to a card type.  A new card takes some defaults from its card type\n(such as its activity period, given by 'from' and 'until'), some limits (on the card number and\nPIN, for example), and other behaviours (such as how long a card can be inactive before Command\nCentre disables it).\n\nThe 'Site Installation' chapter of the Configuration Client online help has a section that\ndescribes card types.\n\nAs it does for the other item types, the REST API gives you read access to card types through\nsearch and details pages.  However the privilege model for card types is more flexible than for\nother items:  the 'View site' privilege determines whether you are allowed to view a card type,\nwhile the cardholder editing privileges ('Create', 'Edit', 'Create and edit') determine whether\nyou can assign cards of that type to a cardholder, so version 8.10 of the API added a page that\nreturns the card types that your operator is allowed to use in that way.  Take its URL from\n`features.cardTypes.assign` in the results of `GET /api`.\n\nThis API uses the term 'card' but more broadly we prefer 'credential', because not all card\ntypes involve a physical card.\n\nThe API's coverage of PIV cards is in [its own tag](piv-cards).\n\nAPI routes that allow creating, modifying, and deleting card types are in development.\n\n## Use cases\n\n### Finding the PIV card type\n\nWhen you give a cardholder a card, PIV or otherwise, you need to provide the identifier of the\ncard type.  It will vary between Command Centre installations so you cannot use a value from\nanother installation or from these examples.  It will not change while Command Centre is running\nbut it may change at upgrade, so your application should follow this process at startup.\n\nIt takes two queries and a loop:\n\n  1. `GET /api`.\n  2. If running 8.00 or earlier, follow the link at `features.cardTypes.cardTypes.href` (which\n     will be to `/api/card_types`), or\n  2. if running 8.10 or later, follow the link at `features.cardTypes.assign.href` (which will\n     probably be to `/api/card_types/assign`.  Both URLs will work in 8.10, but the advantage of\n     this URL is that your operator can access it at a lower privilege level).\n  3. Iterate through the array to find the element with `credentialClass:  piv`, and\n  4. note its `href`.\n\nYou can accomplish the last two steps with the JSONPath filter\n\n`$.results[?(@.credentialClass=='piv')].href`.\n\nExplanation:  Command Centre ships with a handful of card types, and administrators can add\nmore, but the one that Command Centre uses for PIV and PIV-I cards has its own credential class.\n\n## Licensing\n\nReading card types is enabled by the RESTCardholders licence.  Creating, deleting, or modifying\nthem is currently restricted.\n"}],"servers":[{"url":"https://127.0.0.1:8904"}],"security":[{"API_key":[]},{"basic":[]}],"components":{"securitySchemes":{"API_key":{"type":"apiKey","name":"Authorization","in":"header","description":"\nClients authenticate by including a pre-shared API key in the `Authorization` header of each\nrequest after an authorisation method of `GGL-API-KEY`:\n\n`Authorization: GGL-API-KEY C774-B01F-D695-AA4B-215F-A158-AC22-ADEB`\n\nFor a fuller description see [API authentication](api-authentication).\n"},"basic":{"type":"http","scheme":"basic","description":"This is HTTP Basic authentication using a blank username and the API key as the password.\n\nExample:  `Authorization: Basic OkM3NzQtQjAxRi1ENjk1LUFBNEItMjE1Ri1BMTU4LUFDMjItQURFQg==`\n\nThat example is equivalent to the example in the description of the api_Key method:\nprepending a colon to the API key beginning with `C774` then encoding it into Base64\nproduces the 56 characters beginning with `OkM3`.\n\nThe colon is a separator between a username, which is blank in our case, and the password,\nwhich is our API key.\n\nFor a fuller description see [API authentication](api-authentication)\n"}}},"paths":{"/api/card_types/{id}":{"delete":{"tags":["Card Types"],"summary":"Remove","description":"This call removes a card type from Command Centre.  In the interest of forward compatibility,\ntake the URL from the results of a card type search rather than [building it\nyourself](forward-compatibility-hateoas).\n\nThis call is not yet available under licence.\n","responses":{"200":{"description":"Success."},"204":{"description":"Success."},"400":{"description":"Deleting the card type failed.  This happens when the card type is in use.  Most often\nit is because a cardholder still has a card of this type, but card types can also be\nconnected to other items.\n"},"403":{"description":"The operator has the permission to view the item but not delete it, or the server is not\nlicensed.\n"},"404":{"description":"That is not the URL of a card type, or the operator is not privileged to view it.\n"}}}}}}
```

## Update

> This is the call you use to update a card type.  Take the URL from the results of a card\
> type search.  In the interest of forward compatibility, \[do not build it\
> yourself]\(forward-compatibility-hateoas).\
> \
> The PATCH expects a document in the same format as the \[card type\
> detail]\(models#cardtype) but with fewer fields.\
> \
> This call is not yet available under licence.<br>

```json
{"openapi":"3.2.0","info":{"title":"Command Centre REST API","version":"2.0"},"tags":[{"name":"Card Types","description":"The main purpose of the card type API is to find the card type you need when assigning a card to\na cardholder.\n\nA card connects a cardholder to a card type.  A new card takes some defaults from its card type\n(such as its activity period, given by 'from' and 'until'), some limits (on the card number and\nPIN, for example), and other behaviours (such as how long a card can be inactive before Command\nCentre disables it).\n\nThe 'Site Installation' chapter of the Configuration Client online help has a section that\ndescribes card types.\n\nAs it does for the other item types, the REST API gives you read access to card types through\nsearch and details pages.  However the privilege model for card types is more flexible than for\nother items:  the 'View site' privilege determines whether you are allowed to view a card type,\nwhile the cardholder editing privileges ('Create', 'Edit', 'Create and edit') determine whether\nyou can assign cards of that type to a cardholder, so version 8.10 of the API added a page that\nreturns the card types that your operator is allowed to use in that way.  Take its URL from\n`features.cardTypes.assign` in the results of `GET /api`.\n\nThis API uses the term 'card' but more broadly we prefer 'credential', because not all card\ntypes involve a physical card.\n\nThe API's coverage of PIV cards is in [its own tag](piv-cards).\n\nAPI routes that allow creating, modifying, and deleting card types are in development.\n\n## Use cases\n\n### Finding the PIV card type\n\nWhen you give a cardholder a card, PIV or otherwise, you need to provide the identifier of the\ncard type.  It will vary between Command Centre installations so you cannot use a value from\nanother installation or from these examples.  It will not change while Command Centre is running\nbut it may change at upgrade, so your application should follow this process at startup.\n\nIt takes two queries and a loop:\n\n  1. `GET /api`.\n  2. If running 8.00 or earlier, follow the link at `features.cardTypes.cardTypes.href` (which\n     will be to `/api/card_types`), or\n  2. if running 8.10 or later, follow the link at `features.cardTypes.assign.href` (which will\n     probably be to `/api/card_types/assign`.  Both URLs will work in 8.10, but the advantage of\n     this URL is that your operator can access it at a lower privilege level).\n  3. Iterate through the array to find the element with `credentialClass:  piv`, and\n  4. note its `href`.\n\nYou can accomplish the last two steps with the JSONPath filter\n\n`$.results[?(@.credentialClass=='piv')].href`.\n\nExplanation:  Command Centre ships with a handful of card types, and administrators can add\nmore, but the one that Command Centre uses for PIV and PIV-I cards has its own credential class.\n\n## Licensing\n\nReading card types is enabled by the RESTCardholders licence.  Creating, deleting, or modifying\nthem is currently restricted.\n"}],"servers":[{"url":"https://127.0.0.1:8904"}],"security":[{"API_key":[]},{"basic":[]}],"components":{"securitySchemes":{"API_key":{"type":"apiKey","name":"Authorization","in":"header","description":"\nClients authenticate by including a pre-shared API key in the `Authorization` header of each\nrequest after an authorisation method of `GGL-API-KEY`:\n\n`Authorization: GGL-API-KEY C774-B01F-D695-AA4B-215F-A158-AC22-ADEB`\n\nFor a fuller description see [API authentication](api-authentication).\n"},"basic":{"type":"http","scheme":"basic","description":"This is HTTP Basic authentication using a blank username and the API key as the password.\n\nExample:  `Authorization: Basic OkM3NzQtQjAxRi1ENjk1LUFBNEItMjE1Ri1BMTU4LUFDMjItQURFQg==`\n\nThat example is equivalent to the example in the description of the api_Key method:\nprepending a colon to the API key beginning with `C774` then encoding it into Base64\nproduces the 56 characters beginning with `OkM3`.\n\nThe colon is a separator between a username, which is blank in our case, and the password,\nwhich is our API key.\n\nFor a fuller description see [API authentication](api-authentication)\n"}},"requestBodies":{"CardTypePATCH":{"description":"Note that not all the fields in this schema make sense to send when updating a card\ntype.  `id` and `href`, for example.\n","required":true,"content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/CardType"}],"required":[]}}}}},"schemas":{"CardType":{"title":"Card type","description":"This object describes a single Card Type.  \"Credential type\" would be a better name, as\nCommand Centre's card types include credentials that do not require a plastic card.\n","properties":{"href":{"type":"string","format":"uri-reference","readOnly":true,"description":"This is the identifier to use when assigning a card to a cardholder in a cardholder\n[PATCH](cardholders#patch-api-cardholders-id-) or\n[POST](cardholders#post-api-cardholders-id-).\n\nThis is also the URL for the card type's detail page.  GETting it will return you a 404 if\nyou do not have 'View site' or 'Configure site' on the card type's division."},"id":{"type":"string","readOnly":true,"description":"The API does not use this field.  Nor should you.\n"},"name":{"type":"string","description":"It is best if this is descriptive, so that operators are more likely to assign people\nthe intended kind of credential.\n"},"description":{"type":"string","description":"Like the name, this helps operators distinguish different card types.\n"},"division":{"type":"object","description":"The division that contains this card type.  Required when creating a card type.\n"},"notes":{"type":"string","description":"Free text.\n\nBecause of its potential size, the server does not return the notes field by default.  You\nneed to ask for it with `fields=notes`.\n"},"facilityCode":{"type":"string","description":"A facility code is a letter (A-P) followed by up to five digits.  It is encoded onto cards\nso that they only work at sites with the correct facility code.\n\nPIV cards, PIV-I cards, and mobile credentials do not have a facility code.\n\nMost credential classes require a facility code on creation.  But it cannot be changed\nonce set, so this field is ignored in a PATCH.\n"},"availableCardStates":{"readOnly":true,"type":"array","items":{"type":"string","enum":["Active","Disabled (manually)","Lost","Stolen","Damaged"]},"description":"All credential types have a set of card states.\n\nIf you need this, ask for it using the `fields` parameter.\n\nThis field is read-only:  it is derived from the card type's card state set (also known as\na workflow).  If you send it in a POST or a PATCH, the server will ignore it.\n"},"credentialClass":{"type":"string","description":"Required when creating a new card type but ignored when modifying one since a credential's\ntype cannot be changed once set.\n","enum":["card","mobile"]},"minimumNumber":{"description":"For card types with decimal card numbers, this is the minimum.  Must be non-negative.\n","type":"integer","default":1},"maximumNumber":{"description":"For card types with decimal card numbers, this is the maximum.  Must be non-negative.\n\nThe default depends on the credential type.  It is 16,777,215 (24 bits) for regular cards.\n","type":"integer"},"serverDisplayName":{"readOnly":true,"type":"string","description":"If you are running a multi-server installation and this item is homed on a remote server, this\nfield will contain the name of that server.  This field is missing from items that are held on\nthe machine that served the API request.  Added in 8.40.\n\nThis is a read-only field.  The server will ignore it if you send it.\n"},"regex":{"description":"This is the regular expression that a text card number\nmust match before Command Centre will accept it. \n","type":"string"},"regexDescription":{"description":"Regular expressions often need explaining to your users.  Do it here.","type":"string"},"cardStateSet":{"description":"A block containing the href to the card type's card state set.  Required when creating a new card type.\n","type":"object","properties":{"href":{"type":"string","format":"uri-reference"}}},"defaultIssueLevel":{"type":"integer","default":1,"description":"The value copied to a new credential of this type when created without an issue level."},"cardIssueLevelMustMatchDefault":{"type":"boolean","default":false,"description":"If true, Command Centre will prevent operators setting the issue level on cards of this\ntype to any value other than the default.\n\nWhen PATCHing a card type, attempting to set this true will fail if there are any\nexisting cards of the type with issue levels different from the default.\n"},"enableExpiryNotifications":{"type":"boolean","default":true,"description":"Whether a card expiration should generate a notification."},"warningPeriod":{"type":"integer","minimum":0,"default":0,"description":"Command Centre can send out notifications when a credential is due to expire this period\nin the future.\n\nIts units are set by `warningPeriodType`.\n\nA value of zero means the card type does not support notifications.\n"},"warningPeriodType":{"type":"string","default":"days","enum":["noperiod","days","weeks","months","years"],"description":"This sets the units for `warningPeriod`.\n\nIt will contain the value `noperiod` if the card type does not support expiry notifications.\n"},"minimumPinLength":{"type":"integer","default":4,"description":"The length of PINs on credentials of this type."},"inactivityTimeoutInDays":{"type":"integer","default":30,"description":"This is the period, in days, after which Command Centre will consider a credential of this type\nto be inactive.\n\nIt only comes out in a GET if the card type disables inactive cards.\n"},"allowReprint":{"type":"boolean","default":false,"description":"This indicates whether Command Centre clients should allow printing of a credential of this type.  It\nusually only applies to physical card types.\n"},"allowReEncode":{"type":"boolean","default":false,"description":"This shows whether Command Centre clients should allow re-encoding of a credential of\nthis type.  It usually only applies to physical card types.\n"},"sendRegistrationEmail":{"type":"boolean","description":"Only relevant for Gallagher mobile credentials.  If true, Command Centre will send an\nemail invitation to provision a new credential.  If false, the integration that creates\ncredentials of this type must do that.\n"},"sendRegistrationSms":{"type":"boolean","description":"Only relevant for Gallagher mobile credentials.  If true, Command Centre will send an\nSMS invitation to provision a new credential.  If false, the integration that creates\ncredentials of this type must do that.\n"},"cardNumberFormat":{"type":"string","enum":["decimal","text","hex"],"default":"decimal","description":"Required for credentials of credential class `card`.\n\nPOST only.  You cannot change this on an existing card type.\n"},"defaultExpiry":{"type":"object","readOnly":true,"description":"A block containing duplicates of the following fields that describe the rules for\nexpiring inactive cards.  They have the same names with the leading 'default' removed.\n\nThis block is read-only.  You can request it in a GET, but the server will ignore it if\nyou send it in a POST or PATCH.  It is probably better to pretend it does not exist and\nuse `defaultExpiryType`, `defaultExpiryFrom`, `defaultExpiryUntil`, and\n`defaultExpiryDuration`.\n"},"defaultExpiryType":{"type":"string","enum":["explicitDateTime","duration"],"description":"`explicitDateTime` means that cards of this type created without an activity period will\ninherit it from here.  One or both of the `from` and `until` dates can be missing.\n\n`duration` means that cards of this type created without activity start and end dates\nwill receive a blank `from` date, so they will be active immediately, and an `until`\ndate `defaultExpiryDuration` days in the future.\n"},"defaultExpiryFrom":{"type":"string","format":"date-time","description":"The value copied to a new credential of this type when created without it.  Only useful\nif `defaultExpiryType` is `explicitDateTime`.\n"},"defaultExpiryUntil":{"type":"string","format":"date-time","description":"The value copied to a new credential of this type when created without it.  Only useful\nif `defaultExpiryType` is `explicitDateTime`.\n"},"defaultExpiryDuration":{"type":"string","description":"Used when `defaultExpiryType` is `duration` and a credential of this type is created\nwithout an activity period.  Its start date is left clear, meaning \"now\", and its end\ndate is set `defaultExpiryDuration` into the future.\n\nThis is an ISO 8601 duration, so it will be of the form 'PnYnMnWnDTnHnM'.  Such\ndurations always start with a 'P'.  'n' is a number, and the 'Y', 'M', 'W', 'D', 'H',\nand 'M' following them are for years, months, weeks, days, hours, and minutes.  The 'T'\nis there if the units of the duration are smaller than a day, to distinguish months and\nminutes.  If any 'n' is zero then it and the unit character following it will be\nmissing.\n\nSince card lifetimes can only have one unit, the string will always be one of `PnY`,\n`PnM`, `PnW`, `PnD`, `PTnH`, or `PTnM`.\n\nFor example, if you set `defaultExpiryType=\"duration\"` and `defaultExpiryDuration=\"P7D\"`\nall cards of this type created without a `from` and `until` date of their own will be\ngood for one week.\n\nNot sent by the server unless the expiry type is `duration`.\n"}}}}},"paths":{"/api/card_types/{id}":{"patch":{"tags":["Card Types"],"summary":"Update","description":"This is the call you use to update a card type.  Take the URL from the results of a card\ntype search.  In the interest of forward compatibility, [do not build it\nyourself](forward-compatibility-hateoas).\n\nThe PATCH expects a document in the same format as the [card type\ndetail](models#cardtype) but with fewer fields.\n\nThis call is not yet available under licence.\n","requestBody":{"$ref":"#/components/requestBodies/CardTypePATCH"},"responses":{"200":{"description":"Success.  Future versions will return feedback from the server about your PATCH.\n"},"204":{"description":"Success."},"400":{"description":"The body of the PATCH did not describe a valid card type.  Card types have many rules,\neasily enforced in a graphical interface but less so in an API.  See the body of the\nresponse for help on what went wrong.\n"},"403":{"description":"The operator has a privilege that allows viewing the item but not modifying it, or you\ntried to set the division to one you cannot configure, or the server is missing the\nnecessary licence.\n\nYou need the 'Configure Site' privilege on the item you are changing, which means you need\non it on the item's current division.  You also need it on the new division, if you are\nchanging that.\n\nThis is also the response when the server does not have the correct licence.\n"},"404":{"description":"That is not the URL of a card type or your operator does not have the privilege to view\nit.  This probably means you have built the URL yourself instead of taking it from the\nresults of a [GET](card-types#get-api-card_types).\n"},"409":{"description":"The item is locked for editing by another operator.  The body of the response will\ntell you which operator is holding the lock.\n"}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.security.gallagher.com/knowledge-hub/developer/rest-api/card-types.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.