Create a card
Issues a card for an existing customer (customer_id) or a new one (customer). Prepaid cards can be funded at creation; collateral cards need the customer approved through card KYC first. The card starts as pending, and the card.created webhook follows when it is ready.
Authorizations
Your workspace client id.
All calls must include four headers:
X-Auth-Client— your workspace client idX-Auth-Timestamp— Unix secondsX-Auth-Nonce— 16-byte random hexX-Auth-Signature— hex(HMAC-SHA256({client_id}:{timestamp}:{nonce}:{raw_body}, client_secret))
The playground computes the timestamp, nonce and signature for you.
Your sandbox client secret. The playground uses it to sign the request in your browser and removes it before the request is sent. Never send your client secret as a header in your own integration.
Body
Form of the card.
virtual, physical Initial funding, micro-units (1 USD = 1,000,000).
x >= 0Card network.
visa, mastercard Spending limits in micro-units (1 USD = 1,000,000). Card program rules (for example a single limit) are enforced by the service.
Defaults to the company's program when omitted.
prepaid, collateral, collateral_business Whether the card allows contactless payments.
Card currency.
Inline customer for card creation.
Existing customer. Provide this or customer.
Requested expiry month, YYYY-MM. Refused on collateral programs.
^[0-9]{4}-(0[1-9]|1[0-2])$A UUID that makes a retry safe. One is generated if you leave it out.
Cardholder name. Required unless customer_id is given.
100Your unique reference for this card.
JSON object as a string, at most 5KB.
5120HTTPS URL that receives webhooks for this card.
Response
Created
Successful responses are wrapped in this envelope, and so are errors a handler answers itself (request body and field validation, some not-found and conflict cases, ORG_NOT_ACTIVE): success is false and error carries a code and message. Errors raised by authentication and by the services behind a handler are a Problem instead.
true on success
When the response was written.
The payload; its shape is given per operation. Omitted when there is none.
Human-readable summary; omitted when empty.
List metadata. Page lists set page, per_page, total and total_pages; offset and cursor lists set limit, offset, has_more and next_cursor. Zero and empty fields are omitted, and metadata is absent when nothing is set.
Set on error envelopes: the request's correlation id (req_ followed by a UUID), the same value as the X-Correlation-ID response header. Quote it to support.