# Create an account
Source: https://developers.dash.fi/api-reference/account/create-an-account
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 post /accounts
Creates a new prepaid account for the API key's customer. The account starts with a zero balance — fund it by transferring from another of your accounts. Cards created on it draw from its balance.
Access to this endpoint must be requested via the support team.
# Get an account
Source: https://developers.dash.fi/api-reference/account/get-an-account
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 get /accounts/{account-id}
Returns one of the customer's accounts with its funding balance. `availableBalance` is what cards on the account can still spend; `reservedBalance` covers pending authorizations.
# List accounts
Source: https://developers.dash.fi/api-reference/account/list-accounts
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 get /accounts
Lists the customer's accounts. Balances are on `GET /accounts/{account-id}`.
# Rename an account
Source: https://developers.dash.fi/api-reference/account/rename-an-account
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 patch /accounts/{account-id}
Renames one of the customer's accounts.
# Transfer between accounts
Source: https://developers.dash.fi/api-reference/account/transfer-between-accounts
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 post /accounts/{account-id}/transfers
Moves funds from the account in the path to another of the customer's accounts. This is how a newly created account gets funded.
# Archive a card
Source: https://developers.dash.fi/api-reference/card/archive-a-card
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 post /cards/{card-id}/archive
Archive an existing card. Once a card is archived, it cannot be used for new transactions. Settlements for pending authorizations will still be processed.
Archival is a terminal action - once a card is archived, it cannot move back to active status.
The endpoint returns 204 upon successful archival or if the card is already archived.
# Create a card
Source: https://developers.dash.fi/api-reference/card/create-a-card
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 post /cards
Allows creating a card of different types with different limit configurations.
Access to this endpoint must be requested via support team.
# Freeze a card
Source: https://developers.dash.fi/api-reference/card/freeze-a-card
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 post /cards/{card-id}/freeze
Freeze a card. Once a card is frozen, it cannot be used for new transactions. Settlements for pending authorizations will still be processed.
To unfreeze a card, use the '/cards/{id}/unfreeze' endpoint. Once a card is unfrozen, it can be used for new transactions.
The endpoint returns 204 upon successful freezing or if the card is already frozen. 400 is returned if the card is archived.
# Get a card
Source: https://developers.dash.fi/api-reference/card/get-a-card
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 get /cards/{card-id}
Allows getting card details including current limits and
available balance.
# Get card financial events
Source: https://developers.dash.fi/api-reference/card/get-card-financial-events
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 get /cards/{card-id}/financial-events
Get card financial events by card ID. Returned in reverse chronological order. TransactionID can be used to group different events for the same transaction.
# Get cards
Source: https://developers.dash.fi/api-reference/card/get-cards
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 get /cards
Retrieves a paginated list of cards. Supports filtering by name and status.
If both pagination parameters are not provided, a default of page 1 with size 100 is used. Max page size is 100.
# Get sensitive details
Source: https://developers.dash.fi/api-reference/card/get-sensitive-details
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 get /cards/{card-id}/sensitive-details
Get sensitive details of the card. Returns 200 with a retrieval type and details on how to perform the lookup.
# Unfreeze a card
Source: https://developers.dash.fi/api-reference/card/unfreeze-a-card
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 post /cards/{card-id}/unfreeze
Unfreeze a card. Once a card is unfrozen, it can be used for new transactions.
The endpoint returns 204 upon successful unfreezing or if the card is already unfrozen. 400 is returned if the card is archived.
# Update a card
Source: https://developers.dash.fi/api-reference/card/update-a-card
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 patch /cards/{card-id}
Allows updating a card. Supports updating the limit and categories.
# Get a card transaction by ID
Source: https://developers.dash.fi/api-reference/financial/get-a-card-transaction-by-id
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 get /transactions/{transaction-id}
Retrieves a single card transaction by its `id`. The `id` matches the `transactionId` field emitted on card financial event webhooks.
# Get account balance
Source: https://developers.dash.fi/api-reference/financial/get-account-balance
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 get /balance
Returns credit limit and spend information for the authenticated account.
# Get payments
Source: https://developers.dash.fi/api-reference/financial/get-payments
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 get /payments
Retrieves a list of payments within a specified date range (max 1 year). Requires 'from' and 'to' query parameters in YYYY-MM-DD format.
# List card settlements
Source: https://developers.dash.fi/api-reference/financial/list-card-settlements
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 get /settlements
Retrieves card settlements within a specified date range (max 1 year). Requires `from` and `to` query parameters in YYYY-MM-DD format.
Each entry represents a single settlement (presentment or chargeback) and carries `paymentId` linking it to the payment that cleared it. For the full transaction lifecycle (pending / declined / settled / released) or to reconcile against webhook `transactionId`, use `/transactions`.
# List card transactions
Source: https://developers.dash.fi/api-reference/financial/list-card-transactions
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 get /transactions
Retrieves a paginated list of card transactions for the authenticated account. Each entry's `id` matches the `transactionId` field emitted on card financial event webhooks, so webhook deliveries and API rows can be reconciled directly. Returned in reverse chronological order by `createdAt`.
If both pagination parameters are not provided, a default of page 1 with size 100 is used. Max page size is 100. For post-settlement reconciliation against payment cycles, see `/settlements`.
# Health status of the service.
Source: https://developers.dash.fi/api-reference/health/health-status-of-the-service
https://api.dash.fi/v1/public/swagger/doc.json?rev=1f136be6a2e5e2d8a11e23b6b4af34381379314ca5e58b75ba3a8c8170105738 get /health
# API overview
Source: https://developers.dash.fi/api-reference/introduction
Read and act on your Dash.fi data — cards, transactions, balances, payments, and settlements — over the Public API.
The Dash.fi Public API lets you read and act on your account data from your own systems. It's a REST API that returns JSON and uses API key authentication.
## Base URL
All endpoints are served under a single base URL:
```
https://api.dash.fi/v1/public
```
## Authentication
The API uses API key authentication via a **Bearer token**. Send your API key in the `Authorization` header on every request:
```bash theme={null}
curl https://api.dash.fi/v1/public/balance \
-H "Authorization: Bearer YOUR_API_KEY"
```
### Get your API key
Create your key in the Dash.fi dashboard under **Settings → Developer → API**:
In [app.dash.fi](https://app.dash.fi), go to **Settings → Developer** and select the **API** tab.
Under **API keys**, click **Generate**. Generating a key requires the API key permission — if you don't see the button, ask an administrator on your account.
The full key is shown **only once**, right after you generate it. Copy it and store it somewhere safe.
Keep your API key secret — anyone with it can act on your behalf. Never commit it to source control or expose it in client-side code. You can hold **one key at a time**: if it's lost or leaked, click **Regenerate** in the same screen. Regenerating invalidates the previous key **immediately**, so swap it into your integrations right away.
## Endpoints
Every endpoint is listed under **API Reference**, grouped by resource. Each page carries an interactive playground — paste your API key into the **Authorization** field and send a real request straight from the docs.
Start with `GET /health` to check connectivity and that your credentials are accepted before wiring up anything else.
The Card endpoints require the **card management** feature to be enabled for your account, and the Account endpoints require **account management**. Until a feature is enabled, its endpoints return `403 Forbidden`. Contact [support@dash.fi](mailto:support@dash.fi) to request access.
The Account endpoints read and act across every account on your customer, so they also need a customer-scoped API key. An account-scoped key gets a `403` there.
## Webhooks
Dash.fi can POST events to a URL you own as they happen — for example `card.financial_event.v1`. Each delivery carries event metadata in headers (`X-Outpost-Event-Id`, `X-Outpost-Topic`, `X-Outpost-Timestamp`, `X-Outpost-Signature`) and the payload directly in the body, with no envelope. Topics are versioned (`..v`); a breaking change ships as a new topic version, so your subscriptions never shift schema underneath you.
Manage subscriptions in the dashboard under **Settings → Developer → Webhooks**. Webhooks must be enabled for your account first — if the tab is unavailable, contact [support@dash.fi](mailto:support@dash.fi) to request access.
# MCP server
Source: https://developers.dash.fi/mcp-server
Connect Claude, ChatGPT, Cursor, or any MCP-compatible AI assistant to your Dash.fi account.
The Dash.fi MCP server lets you connect your AI assistant to your Dash.fi account so you can ask questions about your data in plain language — "what bills are due this week?", "show my pending approvals", "how much did Marketing spend last month?"
The connection is **read-only**. Your assistant can look things up and report on them, but it cannot create cards, approve requests, pay bills, or move money.
## What you can ask about
| Area | What you can ask |
| - | - |
| Cards | Card status, spend vs. limit, restrictions, and cardholders |
| Transactions | Amounts, merchants, dates, status, and decline reasons |
| Bills | Vendor bills — amounts, due dates, and payment status |
| Approvals | Pending card requests, expenses, bill payments, and vendor changes |
| Teams & people | Team members, emails, and roles |
| Spend insights | Account credit position and spend summaries by card or team |
| Your profile | Who you're signed in as and what role you hold |
## Tools the server exposes
Thirteen read-only tools. Your assistant picks the right one for the question — you don't call these by name — but administrators reviewing the server can see the full surface here.
| Tool | What it does |
| - | - |
| `dash_get_current_user` | Who you're signed in as, and your role |
| `dash_list_users` | People on the account |
| `dash_list_teams` | Teams and their members |
| `dash_list_cards` | Cards, with status and limits |
| `dash_get_card` | One card in detail |
| `dash_list_transactions` | Card transactions, filterable by status or card |
| `dash_get_transaction` | One transaction in detail, including decline reason |
| `dash_find_bills` | Vendor bills — amounts, due dates, payment status |
| `dash_list_approval_requests` | The sign-off queue for cards, expenses, bills, or vendor changes |
| `dash_get_approval_request` | One approval request in detail |
| `dash_get_account_summary` | Credit position, recent spend, next payment |
| `dash_get_card_spend_summary` | Settled spend for a single card over a date window |
| `dash_get_team_spend_summary` | Settled spend for a team, broken down per card |
Every tool is annotated read-only, so compliant clients won't show "this tool can modify your data" warnings. Each one is gated on its own permission scope — a call your role doesn't cover is rejected rather than answered.
The two spend-summary tools read from the analytics warehouse, so their figures are current as of the latest refresh and can lag live transactions by a short period.
## What it can't do
* **Read-only** — the assistant cannot create a card, approve a request, pay a bill, or move money
* Can't filter transactions by date range *(planned)*
* Can't narrow the approvals queue to only those waiting on you specifically *(planned)*
## Permissions
The assistant signs in as you and inherits your exact Dash.fi permissions — it gives no extra access. If you can't see something in Dash.fi, the assistant can't either.
| Role | What the assistant can access |
| - | - |
| Administrator | The whole company |
| Bookkeeper | The whole company's transactions, teams, bills, and spend insights; cards within your own visibility |
| Manager | Yourself, plus the people and teams you manage |
| Employee | Your own cards, transactions, and expenses |
Spend insights (the account credit position and spend summaries by card or team) require the Administrator or Bookkeeper role. Every other role can read cards, transactions, bills, and approvals within the visibility above; a spend-insight question is answered with an "insufficient scope" message rather than data.
## Connect your assistant
**Connector URL:** `https://mcp.dash.fi/mcp`
Add Dash.fi as a connector in your AI assistant, then sign in with your Dash.fi account when prompted. You only need to approve it once — you can disconnect at any time from the same settings screen.
| Assistant | How to add it |
| - | - |
| Claude (web & desktop) | Settings → Connectors → Add custom connector → paste the URL |
| Claude Code | `claude mcp add --transport http dashfi https://mcp.dash.fi/mcp`, then `/mcp` to sign in |
| ChatGPT | Settings → Apps & Connectors → add by URL |
| Cursor | Settings → MCP → add the server URL |
| Other MCP-compatible tools | Use the connector URL above and follow that tool's MCP setup docs |
**Verify it's working.** Ask your assistant *"Who am I?"* or *"List my cards"* — a sensible answer confirms the connection.
MCP is available to every Dash.fi organisation. An administrator needs to turn it on once under **Company → Products** before anyone can connect — until then, sign-in fails for everyone in the organisation.
## Security
* You sign in with your own Dash.fi login — no separate password, no extra access granted
* You only ever see your own company's data
* Full card numbers and vendor bank account details are never exposed to the assistant
* Every request is logged for audit
* The connection is read-only
### How sign-in works
Sign-in uses the OAuth authorization code flow with PKCE. Your assistant redirects you to Dash.fi, you approve the connection once, and the assistant receives a token — **your password never reaches the MCP server**, and the server never stores credentials of any kind.
* **Short-lived access tokens.** An access token is valid for 60 minutes, after which your assistant obtains a fresh one. A leaked token stops working within the hour.
* **Tokens are validated at the edge.** Signature, audience, and expiry are checked before a request reaches the server at all, so an expired or forged token never touches your data.
* **Scoped tokens.** A token carries only the permission scopes your role holds. Any call beyond them is rejected for insufficient scope, and each tool re-checks its own scope on every call.
* **Client registration is dynamic.** Assistants register themselves at connection time, so there's no shared secret for you to distribute or rotate.
### Audit logging
Every tool call is recorded, and so is every rejected attempt — an expired token, a missing scope, or a request made while MCP is switched off. Each record captures who called, which tool, when, the outcome, and how long it took.
* **Outputs are never stored.** The log keeps the size of the response, not its contents.
* **Inputs are reduced to an allow-list.** Only a named set of fields per tool is retained, so free-text arguments don't land in the log.
* **Records are append-only** — they can't be edited or deleted after the fact.
Logs are held by Dash.fi. Contact [support@dash.fi](mailto:support@dash.fi) if you need MCP activity for your organisation as part of a security review or audit.
### Turning it off for everyone
An administrator can revoke MCP for the whole organisation at any time under **Company → Products**. This takes effect immediately: every subsequent request from every connected assistant is rejected, regardless of tokens already issued, and each rejection is recorded in the audit log. Re-enabling restores access without anyone having to re-approve the connection.
Changing a person's role is the narrower lever — it shrinks what their assistant can read on their next reconnect. Removing them from Dash.fi ends their access outright.
## Troubleshooting
The assistant uses your exact Dash.fi permissions. If you can't see it inside Dash.fi directly, the assistant can't either. Check what you see for the same query inside the app first.
Either your role doesn't include that data, or there are simply no matching records. Check what you'd see for the same query inside Dash.fi.
Disconnect and reconnect the connector. This refreshes your permissions so the assistant picks up your new role.
Disconnect and reconnect the connector — this refreshes the list of available tools.
Check you're using the correct connector URL and the correct Dash.fi account. If sign-in still fails, MCP may not be turned on yet — ask an administrator to enable it under **Company → Products**.