Skip to main content
POST
Issue a single-use card

Authorizations

Api-Key
string
header
required

Partner API key. Must carry the cards permission.

Headers

Api-Version
string
default:2026-09.1
required

The API version this request targets. 2026-09.1. See Versioning.

Pattern: ^\d{4}-\d{2}\.\d+$
Idempotency-Key
string
required

1 to 64 characters. Required on every POST that creates something. A repeat returns the first result; the same key with a different body returns 409.

Required string length: 1 - 64

Path Parameters

cardholderId
string
required

An individual or an employee (cus_).

Example:

"cus_8Qw2..."

Body

application/json
amount
object
required

From 0.01 to 100,000.00 USD.

bufferPercentage
number
default:20

How far the payment may go above amount, 0 to 20 percent. Default 20.

Required range: 0 <= x <= 20
expiresAt
string<date-time>

In the future, at most 365 days ahead.

allowedMccs
string[]

4-digit merchant category codes.

Pattern: ^\d{4}$
allowedMerchants
string[]

Up to 25 merchant names, 1 to 64 characters each.

Maximum array length: 25
Required string length: 1 - 64
displayName
string

Up to 26 characters.

Maximum string length: 26
purpose
string

Up to 255 characters.

Maximum string length: 255

Response

The Card object plus encryptedCard, returned once.

cardId
string
Example:

"crd_4fT9..."

cardholderId
string
Example:

"cus_8Qw2..."

businessId
string | null

The employee's business; null for an individual's card.

type
string

virtual.

kind
enum<string>
Available options:
standard,
single_use
status
enum<string>
Available options:
active,
frozen,
canceled
closedReason
enum<string> | null

Set when canceled: canceled (by you), spent (a used single-use card), expired.

Available options:
canceled,
spent,
expired,
null
displayName
string
last4
string
expiryMonth
string
expiryYear
string
controls
object
usage
object

spent is what the card has spent in the current limit period.

singleUse
object | null

Only for single-use cards; null otherwise.

createdAt
string<date-time>
updatedAt
string<date-time>
encryptedCard
object

The card number, CVC and expiry, encrypted to your registered RSA public key. The encoding of these fields (Base64 or Base64url) and the exact aad value are not final yet. See Card details encryption.