---
title: "Create a new virtual card"
method: POST
path: "/accounts/{accountId}/cards"
tags: ["Cards"]
---

# Create a new virtual card

`POST /accounts/{accountId}/cards`

## Path parameters

- `accountId` string, required

## Request body

- CardCreateCardRequest — Card
  - `limit` number, double, required — Total card authorisation limit.
  - `expiry` string, required — ISO 8601 date with year & month components only. The supplied value must be in the future (cannot be the current month) and is _inclusive_ of the specified month.
  - `productCode` string, required — Identifies the _type_ of card to create (GBP consumer, GBP business, etc). Modulr will supply a list of possible values.
  - `externalRef` string, required — Client reference for the newly created card. Maximum of 50 alphanumeric characters (including underscore, hyphen and space).
  - `constraints` CardConstraints
    - `authorisation` CardAuthorisationConstraints — Authorisation constraints
      - `spend` CardSpendConstraintDetail[] — Spending constraints
        - `currency` 'GBP' | 'EUR' | 'AED' | 'AFN' | 'ALL' | 'AMD' | 'ANG' | 'AOA' | 'ARS' | 'AUD' | 'AWG' | 'AZN' | 'BAM' | 'BBD' | 'BDT' | 'BGN' | 'BHD' | 'BIF' | 'BMD' | 'BND' | 'BOB' | 'BOV' | 'BRL' | 'BSD' | 'BTN' | 'BWP' | 'BYN' | 'BZD' | 'CAD' | 'CDF' | 'CHE' | 'CHF' | 'CHW' | 'CLF' | 'CLP' | 'CNY' | 'COP' | 'COU' | 'CRC' | 'CUC' | 'CUP' | 'CVE' | 'CZK' | 'DJF' | 'DKK' | 'DOP' | 'DZD' | 'EGP' | 'ERN' | 'ETB' | 'FJD' | 'FKP' | 'GEL' | 'GHS' | 'GIP' | 'GMD' | 'GNF' | 'GTQ' | 'GYD' | 'HKD' | 'HNL' | 'HRK' | 'HTG' | 'HUF' | 'IDR' | 'ILS' | 'INR' | 'IQD' | 'IRR' | 'ISK' | 'JMD' | 'JOD' | 'JPY' | 'KES' | 'KGS' | 'KHR' | 'KMF' | 'KPW' | 'KRW' | 'KWD' | 'KYD' | 'KZT' | 'LAK' | 'LBP' | 'LKR' | 'LRD' | 'LSL' | 'LYD' | 'MAD' | 'MDL' | 'MGA' | 'MKD' | 'MMK' | 'MNT' | 'MOP' | 'MRU' | 'MUR' | 'MVR' | 'MWK' | 'MXN' | 'MXV' | 'MYR' | 'MZN' | 'NAD' | 'NGN' | 'NIO' | 'NOK' | 'NPR' | 'NZD' | 'OMR' | 'PAB' | 'PEN' | 'PGK' | 'PHP' | 'PKR' | 'PLN' | 'PYG' | 'QAR' | 'RON' | 'RSD' | 'RUB' | 'RWF' | 'SAR' | 'SBD' | 'SCR' | 'SDG' | 'SEK' | 'SGD' | 'SLE' | 'SLL' | 'SOS' | 'SRD' | 'SSP' | 'STN' | 'SVC' | 'SYP' | 'SZL' | 'SHP' | 'THB' | 'TJS' | 'TMT' | 'TND' | 'TOP' | 'TRY' | 'TTD' | 'TWD' | 'TZS' | 'UAH' | 'UGX' | 'USD' | 'USN' | 'UYI' | 'UYU' | 'UYW' | 'UZS' | 'VES' | 'VND' | 'VUV' | 'WST' | 'XAF' | 'XAG' | 'XAU' | 'XBA' | 'XBB' | 'XBC' | 'XBD' | 'XCD' | 'XDR' | 'XOF' | 'XPD' | 'XPF' | 'XPT' | 'XSU' | 'XTS' | 'XUA' | 'XXX' | 'YER' | 'ZAR' | 'ZMW' | 'ZWL', required — A 3 letter ISO 4217 code representing the transaction currency
        - `min` number — Minimum spend amount (inclusive)
        - `max` number — Maximum spend amount (inclusive)
  - `authentication` CardCardAuthentication
    - `knowledgeBase` CardCardKnowledgeBasedAuthentication[], required — 3DS knowledge-based authentication (KBA) answers
      - `type` 'FIRST_PET_NAME' | 'MATERNAL_GRANDMOTHER_MAIDEN_NAME' | 'FAVOURITE_CHILDHOOD_FRIEND' | 'FIRST_CAR' | 'CITY_PARENTS_MET', required — 3DS knowledge-based authentication answer type
      - `answer` string, required — 3DS knowledge-based authentication answer
  - `cancellationDate` string — Date for card to be cancelled on
  - `customFields` CardCardCustomFieldRequest[] — Custom fields of card
    - `key` string, required — Custom field key
    - `value` string, required — Custom field value
  - `authorisationWindow` CardAuthorisationWindowRequest
    - `startDate` string
    - `endDate` string
  - `frequencyUsage` 'SINGLE_USE' | 'MULTI_USE'
  - `holder` CardCardHolder
    - `title` string — Cardholder title is optional for all card types. Maximum of 4 alphanumeric characters.
    - `firstName` string, required — Cardholder first name. Maximum of 20 alphanumeric characters including space, hyphen and apostrophe. Optional for individual customers whose partner has verification type EXTERNAL and for Virtual Business customers.
    - `lastName` string, required — Cardholder last name. Maximum of 20 alphanumeric characters including space, hyphen and apostrophe. Optional for individual customers whose partner has verification type EXTERNAL and for Virtual Business customers.
    - `billingAddress` CardAddressDetail — Address details for the cardholder. Optional for individual customers whose partner has verification type EXTERNAL.
      - `addressLine1` string, required — First line of address
      - `addressLine2` string — Second line of address
      - `postTown` string, required — Post town
      - `postCode` string, required — Postcode
      - `country` 'AT' | 'BE' | 'BG' | 'CY' | 'CZ' | 'DK' | 'EE' | 'FI' | 'FR' | 'DE' | 'GR' | 'HR' | 'HU' | 'IS' | 'IE' | 'IT' | 'LV' | 'LI' | 'LT' | 'LU' | 'MT' | 'NL' | 'NO' | 'PL' | 'PT' | 'RO' | 'SK' | 'SI' | 'ES' | 'SE' | 'AX' | 'AW' | 'BL' | 'CW' | 'GF' | 'GL' | 'GP' | 'ME' | 'MF' | 'MQ' | 'NC' | 'PF' | 'PM' | 'RE' | 'SX' | 'TF' | 'WF' | 'YT' | 'AI' | 'BM' | 'FK' | 'GB' | 'GG' | 'GI' | 'GS' | 'IO' | 'JE' | 'KY' | 'MS' | 'PN' | 'SH' | 'TC' | 'VG', required — Country (ISO 3166 alpha-2 country code)
    - `dateOfBirth` string, date — Cardholder date of birth. Must match date format of yyyy-mm-dd. Required for virtual consumer and physical cards. Optional for individual customers.
    - `mobileNumber` string — Cardholder mobile number. Must start with a '+', followed by the country code and then the mobile number. Required for virtual consumer and physical cards.
    - `email` string, email — Cardholder email

## Response `201`

Virtual card created successfully

- CardCreateCardResponse
  - `id` string, required — Card identifier. Maximum of 10 alphanumeric characters.
  - `pan` string, required — Full card PAN.
  - `maskedPan` string — Masked card PAN.
  - `cvv2` string, required — Card CVV2 number.
  - `externalRef` string, required — Client reference for the newly created card.
  - `createdDate` string, date-time, required — The creation date of the card
  - `maxLimit` string, required — Maximum Limit which can be set on this card and is the maximum lifetime spend the card can have
  - `frequencyUsage` 'SINGLE_USE' | 'MULTI_USE', required — Card frequency usage
  - `shareLink` string — Link that can be used by client to share secure details. Will only be returned when shareDetails method is RETURN in request body.

## Other responses

- `400` — Invalid request

---

[API](https://skmtc.net/modulrfinance/apis/modulr-api.md) · [All operations](https://skmtc.net/modulrfinance/apis/modulr-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/modulrfinance/modulr-api/versions/cbd52524c8ef/schema)