### One card's full lifecycle

`GET /api/v1/cards/{id}/timeline`

Header facts plus the chronological event list for a single card: when it was minted, printed, sold, transferred and redeemed.

- Authentication: manager session (JWT) or API token
- Permission: `prm_cards_list` (View card batches & cards)
- Risk: read
- Rate limit bucket: `card_timeline`

#### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | integer | yes | Card id. |

#### Errors

| Code | Status | When |
| --- | --- | --- |
| `ERR_NOT_FOUND` | 404 | no such card, or one outside the caller's subtree |

#### Note

This endpoint's rate-limit bucket counts DENIED lookups too, on purpose. The limiter sits ahead of the visibility check, so a walk of the card id space burns budget rather than running unmetered behind a 404.