Returns the shopper's active saved cards, default first. An unknown email returns an empty list.

Call these from your server with your merchant credentials — never from a browser or app, which must not hold your API key. The shopper is identified by email, sent in the X-Customer-Email header.

You only see and change cards the shopper saved at your checkout. Cards saved at other merchants are never returned, and is_default is your default only — it does not change which card the checkout widget pre-selects.