# Download a managed card statement as a PDF

Returns the statement for the managed card identified by the `id` path parameter as a PDF
document, suitable for delivery to the end customer.
Every date and time on the document is rendered in `timezone`, and `startPeriod` and
`endPeriod` are resolved to local midnight in that timezone. The PDF carries a label stating
which timezone it was rendered in. When `timezone` is omitted the document renders in `UTC`.
Unlike the JSON statement endpoint, this returns **every** entry in the period rather than a
single page. A period longer than 12 months, or one containing more than 5,000 entries, is
rejected with a `400` rather than silently truncated — narrow the period and request again.
Pre-paid mode cards hold their own balance, so the opening and closing balances refer only
to the requested card. Debit-mode cards do not hold a balance — their activity posts to the
parent Managed Account — so their document omits the balance column.
A period containing no entries produces a valid PDF with no entry rows.

Endpoint: GET /managed_cards/{id}/statement/pdf
Version: v3
Security: auth_token, api-key

## Path parameters:

  - `id` (string, required)
    The unique identifier of the managed card.

## Query parameters:

  - `startPeriod` (string)
    First day of the statement period, inclusive, as a date in the format `yyyy-MM-dd`.

Interpreted as local midnight in `timezone`. Defaults to one month before `endPeriod`.

  - `endPeriod` (string)
    Last day of the statement period, inclusive, as a date in the format `yyyy-MM-dd`.

Interpreted as local midnight in `timezone`, so the period ends at the final moment of this
day in that timezone. Defaults to today in `timezone`. The period must not exceed 12 months.

  - `timezone` (string)
    IANA timezone used to render every date and time on the PDF, and to resolve `startPeriod`
and `endPeriod` to local midnight. Defaults to `UTC`.

Only IANA timezone names are accepted, for example `Europe/Rome` or `America/New_York`.
Fixed offsets such as `+02:00` or `GMT+2` are rejected, because they carry no
daylight-saving rules and would render incorrect times across a transition.

## Response 400 fields (application/json):

  - `message` (string)
    When present helps to identify and fix the problem.

  - `syntaxErrors` (object)
    Is returned as part of an HTTP error response whenever a syntax error is detected. A list of the fields together with their syntax error will be provided.

  - `syntaxErrors.invalidFields` (array)

  - `syntaxErrors.invalidFields.params` (array)

  - `syntaxErrors.invalidFields.fieldName` (string)

  - `syntaxErrors.invalidFields.error` (string)
    Enum: "REQUIRED", "HAS_TEXT", "REQUIRES", "SIZE", "RANGE", "IN", "NOT_IN", "REGEX", "EXACTLY", "AT_LEAST", "AT_MOST", "ALL_OR_NONE"

## Response 403 fields (application/json):

  - `errorCode` (string)
    Enum: "STEP_UP_REQUIRED", "ACCESS_TOKEN_REQUIRED", "INSUFFICIENT_PERMISSIONS"

## Response 404 fields (application/json):

  - `code` (string)

  - `message` (string)

## Response default fields (application/json):

  - `code` (string)

  - `message` (string)