Hey I've run into something similar while working with the Guru API. It seems that verificationReasons doesn't always populate as expected, particularly for expired cards.
One workaround I found was to also fetch the lastVerifiedDate attribute. You can compare this date to the card's expiration settings to determine if it's stale or not. It's not as straightforward as simply checking for "EXPIRED" in verificationReasons, but it can be a reliable alternative when that field is empty.
Another thing you might want to look into is the API rate limit or data cache, as sometimes stale or incomplete data might be served. But based on my experience, checking lastVerifiedDate was the most consistent way to go.
I agree that it's a bit weird how the web app seems to have that information while the API endpoint doesn't. Maybe they're using some internal logic that's not exposed via the API.
Hope this helps, and let me know if you find a better solution!
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.