i believe it can be both. 

    curl https://api.balancedpayments.com/v1/marketplaces/TEST-MP4ZxaLUCHSt1Rv9Vj3nGNUr/accounts/AC5oGdYgC2LAFWNImeC5cmV4/debits      -u a3f5b056d9c411e2ac3c026ba7f8ec28:

returns `account_uri`

    curl https://api.balancedpayments.com/v1/marketplaces/TEST-MP4ZxaLUCHSt1Rv9Vj3nGNUr/accounts/AC5oGdYgC2LAFWNImeC5cmV4/cards      -u a3f5b056d9c411e2ac3c026ba7f8ec28:

returns `account`

don't forget we need to check for the presence of a customer too. it could be associated to one of those guys.