> ## Documentation Index > Fetch the complete documentation index at: https://docs.endl.io/llms.txt > Use this file to discover all available pages before exploring further. # Issue a single-use card > Issues a single-use card. **Enabled per partner.** - The response is the Card object plus `encryptedCard` (see [Card details encryption](/api-reference/cards/encryption)), **returned once**. - A repeat with the same `Idempotency-Key` returns the card without `encryptedCard`; call [Get card details](/api-reference/cards/get-card-details) instead. - The card closes after its first approved payment: `status` becomes `canceled` and `closedReason` becomes `spent`. ## OpenAPI ````yaml api-reference/endl-cards-api.json POST /api/v0/cards/{cardholderId}/single-use openapi: 3.1.0 info: title: Endl Cards API version: '0' description: >- Issue virtual cards to your customers: enrol the customer, fund the card balance, issue cards, show card details securely, and follow every transaction by webhook. Paths are under `/api/v0`. The key must carry the **`cards`** permission. **This API is not final yet** — see [what may still change](/api-reference/cards/introduction#not-final-yet). servers: - url: https://api-sandbox.endl.io description: Sandbox security: - apiKey: [] tags: - name: Enrolment - name: Cardholders - name: Cards - name: Card details - name: Transactions and balance - name: Deposits - name: Withdrawals paths: /api/v0/cards/{cardholderId}/single-use: post: tags: - Cards summary: Issue a single-use card description: >- Issues a single-use card. **Enabled per partner.** - The response is the Card object plus `encryptedCard` (see [Card details encryption](/api-reference/cards/encryption)), **returned once**. - A repeat with the same `Idempotency-Key` returns the card without `encryptedCard`; call [Get card details](/api-reference/cards/get-card-details) instead. - The card closes after its first approved payment: `status` becomes `canceled` and `closedReason` becomes `spent`. parameters: - $ref: '#/components/parameters/ApiVersion' - $ref: '#/components/parameters/IdempotencyKey' - $ref: '#/components/parameters/CardholderId' requestBody: required: true content: application/json: schema: type: object required: - amount properties: amount: allOf: - $ref: '#/components/schemas/Money' description: From 0.01 to 100,000.00 USD. bufferPercentage: type: number minimum: 0 maximum: 20 default: 20 description: >- How far the payment may go above `amount`, 0 to 20 percent. Default 20. expiresAt: type: string format: date-time description: In the future, at most 365 days ahead. allowedMccs: type: array items: type: string pattern: ^\d{4}$ description: 4-digit merchant category codes. allowedMerchants: type: array maxItems: 25 items: type: string minLength: 1 maxLength: 64 description: Up to 25 merchant names, 1 to 64 characters each. displayName: type: string maxLength: 26 description: Up to 26 characters. purpose: type: string maxLength: 255 description: Up to 255 characters. example: amount: amount: '250.00' currency: USD bufferPercentage: 10 purpose: Conference booking responses: '201': description: The Card object plus `encryptedCard`, returned once. content: application/json: schema: allOf: - $ref: '#/components/schemas/Card' - type: object properties: encryptedCard: $ref: '#/components/schemas/EncryptedCard' '400': description: A request field is missing or invalid. content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Missing or invalid API key. content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: |- The API key lacks the `cards` permission. Single-use cards aren't enabled for your account. The customer isn't enrolled, or the enrolment isn't `active`. content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: Cardholder not found. content: application/json: schema: $ref: '#/components/schemas/Error' '409': description: |- The maximum number of cards is reached. The `Idempotency-Key` was reused with a different body. content: application/json: schema: $ref: '#/components/schemas/Error' '502': description: Card issuing is temporarily unavailable; retry. content: application/json: schema: $ref: '#/components/schemas/Error' components: parameters: ApiVersion: name: Api-Version in: header required: true description: >- The API version this request targets. `2026-09.1`. See [Versioning](/api-reference/versioning). schema: type: string pattern: ^\d{4}-\d{2}\.\d+$ default: 2026-09.1 example: 2026-09.1 IdempotencyKey: name: Idempotency-Key in: header required: true description: >- 1 to 64 characters. Required on every POST that creates something. A repeat returns the first result; the same key with a different body returns `409`. schema: type: string minLength: 1 maxLength: 64 CardholderId: name: cardholderId in: path required: true description: An individual or an employee (`cus_`). schema: type: string example: cus_8Qw2... schemas: Money: type: object required: - amount - currency description: A decimal string and a currency code. properties: amount: type: string description: Decimal string, e.g. `"42.99"`. example: '42.99' currency: type: string description: Currency code, e.g. `USD`. example: USD Card: type: object properties: cardId: type: string example: crd_4fT9... cardholderId: type: string example: cus_8Qw2... businessId: type: - string - 'null' description: The employee's business; `null` for an individual's card. type: type: string description: '`virtual`.' kind: type: string enum: - standard - single_use status: type: string enum: - active - frozen - canceled closedReason: type: - string - 'null' enum: - canceled - spent - expired - null description: >- Set when `canceled`: `canceled` (by you), `spent` (a used single-use card), `expired`. displayName: type: string last4: type: string expiryMonth: type: string expiryYear: type: string controls: $ref: '#/components/schemas/Controls' usage: type: object description: '`spent` is what the card has spent in the current limit period.' properties: spent: $ref: '#/components/schemas/Money' period: type: string singleUse: type: - object - 'null' description: Only for single-use cards; `null` otherwise. properties: amount: $ref: '#/components/schemas/Money' bufferPercentage: type: number lifetimeLimit: {} expiresAt: type: string format: date-time allowedMccs: type: array items: type: string allowedMerchants: type: array items: type: string purpose: type: string spentAt: {} createdAt: type: string format: date-time updatedAt: type: string format: date-time EncryptedCard: type: object description: >- The card number, CVC and expiry, encrypted to your registered RSA public key. The **encoding of these fields (Base64 or Base64url) and the exact `aad` value are not final yet.** See [Card details encryption](/api-reference/cards/encryption). properties: alg: type: string example: RSA-OAEP-256+A256GCM keyId: type: string description: Names the key used, so you can rotate keys safely. example: key_2026_01 encryptedKey: type: string iv: type: string ciphertext: type: string tag: type: string aad: type: string Error: type: object description: >- The standard Endl error body. `errors[].code` is an `ERRCRD_` code — **the code numbers are not final yet** — and `field` names the request field when one is at fault. properties: code: type: integer message: type: string status: type: string enum: - ERROR data: type: 'null' errors: type: array items: type: object properties: code: type: string message: type: string field: type: - string - 'null' Controls: type: object required: - spendLimit properties: spendLimit: $ref: '#/components/schemas/SpendLimit' SpendLimit: type: object required: - amount - period properties: amount: allOf: - $ref: '#/components/schemas/Money' description: The limit. period: type: string enum: - transaction - day - week - month - year - lifetime description: >- Limit periods may be rolling or calendar windows, so don't rely on a fixed reset time. securitySchemes: apiKey: type: apiKey in: header name: Api-Key description: Partner API key. Must carry the `cards` permission. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.