CARDO connects your product to the CIRQL identity network — delivering verified phone numbers, email addresses, and mailing addresses in real time, with explicit user consent baked in.
Why CARDO
CARDO is the enterprise API layer for CIRQL. When a CIRQL user's details change, every system with permission receives the update automatically. No re-verification. No manual refresh. No stale records.
When a user updates their phone, address, or email in CIRQL, the change propagates to your systems instantly. Your database stays accurate without a single re-verification call.
Every data point is explicitly granted by the end user. You receive only what they've approved — and access revokes automatically when they remove it. Compliance isn't an add-on; it's the architecture.
REST and webhook APIs built for production workloads. Real-time push events mean no polling. SLA-backed uptime means your pipeline never waits on identity.
CIRQL is a federated network — no single company owns the identity graph. CARDO gives you access without creating a new point of failure or a new privacy liability.
How CARDO works
Authenticate with your CARDO API key and specify which identity fields your product needs.
End users approve your app's data request directly in CIRQL. You receive only what's been explicitly permitted.
CARDO pushes change events to your webhook endpoint the moment a user updates their info — no polling, no lag.
Developer-first API
Clean REST API with JSON throughout. Full SDK support for Node, Python, and Go. Webhooks use signed payloads so you can verify every event.
// Resolve a contact via CARDO
const response = await fetch('https://api.cardo.id/v1/resolve', {
method: 'POST',
headers: {
'Authorization': `Bearer ${apiKey}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
lookup: 'user@example.com',
fields: ['phone', 'address'],
}),
});
const identity = await response.json();
// {
// phone: "+1 415 555 0123",
// address: { street: "...", city: "...", ... },
// consent_ref: "crd_perm_abc123",
// freshness: "2026-04-04T17:00:00Z"
// }Built for the enterprise
Consent is explicit, auditable, and user-controlled. You never hold data the user hasn't actively shared.
Access controls, audit logs, and encryption in transit and at rest.
Scope credentials to read-only, webhook, or admin functions across teams.
Signed payloads, retry logic, and delivery receipts so your systems never miss a change event.
TLS on all endpoints. Data encrypted at rest. No central data warehouse.
Every request logged with who accessed what, when, and under which consent reference.
See how CARDO integrates with your stack in under 30 minutes. Our team will walk you through the API, data model, and compliance controls.