---
title: "POST /card"
method: POST
path: "/card"
---

# POST /card

`POST /card`

Create a card

## Request body

- object
  - `accountId` string — The ID of the account to create the card under. You can get this by calling `GET /account`. This field is required unless you are authenticating via API key, in which case it will default to your first commercial account. We recommend supplying this even if you are authenticating via API key.
  - `virtualAccountId` string — The ID of the virtual account to create the card under. Virtual accounts can be retrieved by calling `GET /virtual-account`.
  - `type` 'virtual', required — Specify the type of card you'd like to create. At the moment, only virtual cards are supported.
  - `name` string, required
  - `spendingConstraint` SpendingConstraint — A constraint that can be applied to a CardGroupSpendingRule
    - `merchantCategoryRule` object, nullable
      - `merchantCategories` string[], required
      - `restriction` 'allowlist' | 'blacklist', required
    - `merchantRule` object, nullable
      - `merchants` string[], required
      - `restriction` 'allowlist' | 'blacklist', required
    - `spendingRule` object, nullable
      - `utilizationLimit` object
        - `timezone` string — IANA timezone string. Limits always reset at midnight of the timezone specified. If no timezone is specified, then UTC time is used.
        - `limitAmount` Money, required — Represents a monetary value
          - `amountCents` integer, required — The amount in cents
        - `preset` 'daily' | 'weekly' | 'monthly' | 'yearly' | 'collective', required
        - `startDate` string — Format ISO-8601. A day that equals today or the past. This is optional.If the `preset` is "daily", this value is ignored. If the `preset` is "weekly", "monthly" or "yearly", then the this value is used to compute when the limit should start limit.
      - `utilizationLimitV2` object[]
        - `timezone` string — IANA timezone string. Limits always reset at midnight of the timezone specified. If no timezone is specified, then UTC time is used.
        - `limitAmount` Money, required — Represents a monetary value
          - `amountCents` integer, required — The amount in cents
        - `preset` 'daily' | 'weekly' | 'monthly' | 'yearly' | 'collective', required
        - `startDate` string — Format ISO-8601. A day that equals today or the past. This is optional.If the `preset` is "daily", this value is ignored. If the `preset` is "weekly", "monthly" or "yearly", then the this value is used to compute when the limit should start limit.
      - `transactionSizeLimit` object
        - `minimum` Money — Represents a monetary value
          - `amountCents` integer, required — The amount in cents
        - `maximum` Money — Represents a monetary value
          - `amountCents` integer, required — The amount in cents
    - `countryRule` object, nullable
      - `countries` string[], required — A 2 digit country code
      - `restriction` 'allowlist' | 'blacklist', required
    - `merchantCategoryCodeRule` object, nullable
      - `merchantCategoryCodes` string[], required
      - `restriction` 'allowlist' | 'blacklist', required
  - `isSingleUse` boolean — Defaults to false. When set to true, the card will be automatically closed after a single authorization attempt. Note that the card will be closed even if the authorization declines or drops
  - `userData` object — Arbitrary information that can be attached to the card. This should be a JSON object and cannot exceed 4kb.
  - `cardGroupId` string
  - `cardProductId` string — The ID of the card product to use when creating this card, if not specified a random card product will be chosen.

## Response `201`

OK

- Card
  - `id` string, required
  - `accountId` string, required — The account that this card is associated with
  - `virtualAccountId` string — The virtual account that this card is associated with
  - `last4` string, required — The last 4 digits of the card number
  - `name` string, required — The name assigned to the card that appears on the user dashboard
  - `expiryMonth` string, required — The month the card expires formatted as MM (01, 02, ..., 12)
  - `expiryYear` string, required — The year the card expires formatted as YYYY (2024, 2025, ...)
  - `status` 'active' | 'paused' | 'inactive' | 'closed', required — The status of the card
  - `isPhysical` boolean, required — When true, a physical card has been issued. Otherwise, this is a virtual card.
  - `isSingleUse` boolean — When true, the card will be automatically closed after a single authorization attempt. Note that the card will be closed even if the authorization declines or drops
  - `pan` string — This field contains the full PAN which will only be sent on a request for a single card when you set the query param "include_pan" to "true"
  - `cvv` string — This field will contain full CVV which will only be sent on a request for a single card when you set the query param "include_pan" to "true"
  - `cardGroupId` string — The card group the card belongs to.
  - `cardGroupName` string — The name of the card group the card belongs to.
  - `createdAt` string, date-time
  - `spendingConstraint` SpendingConstraint — A constraint that can be applied to a CardGroupSpendingRule
    - `merchantCategoryRule` object, nullable
      - `merchantCategories` string[], required
      - `restriction` 'allowlist' | 'blacklist', required
    - `merchantRule` object, nullable
      - `merchants` string[], required
      - `restriction` 'allowlist' | 'blacklist', required
    - `spendingRule` object, nullable
      - `utilizationLimit` object
        - `timezone` string — IANA timezone string. Limits always reset at midnight of the timezone specified. If no timezone is specified, then UTC time is used.
        - `limitAmount` Money, required — Represents a monetary value
          - `amountCents` integer, required — The amount in cents
        - `preset` 'daily' | 'weekly' | 'monthly' | 'yearly' | 'collective', required
        - `startDate` string — Format ISO-8601. A day that equals today or the past. This is optional.If the `preset` is "daily", this value is ignored. If the `preset` is "weekly", "monthly" or "yearly", then the this value is used to compute when the limit should start limit.
      - `utilizationLimitV2` object[]
        - `timezone` string — IANA timezone string. Limits always reset at midnight of the timezone specified. If no timezone is specified, then UTC time is used.
        - `limitAmount` Money, required — Represents a monetary value
          - `amountCents` integer, required — The amount in cents
        - `preset` 'daily' | 'weekly' | 'monthly' | 'yearly' | 'collective', required
        - `startDate` string — Format ISO-8601. A day that equals today or the past. This is optional.If the `preset` is "daily", this value is ignored. If the `preset` is "weekly", "monthly" or "yearly", then the this value is used to compute when the limit should start limit.
      - `transactionSizeLimit` object
        - `minimum` Money — Represents a monetary value
          - `amountCents` integer, required — The amount in cents
        - `maximum` Money — Represents a monetary value
          - `amountCents` integer, required — The amount in cents
    - `countryRule` object, nullable
      - `countries` string[], required — A 2 digit country code
      - `restriction` 'allowlist' | 'blacklist', required
    - `merchantCategoryCodeRule` object, nullable
      - `merchantCategoryCodes` string[], required
      - `restriction` 'allowlist' | 'blacklist', required
  - `userData` object — Arbitrary information that can be attached to the card. See the [`PATCH /card/{cardId}`](api-reference/card-patch) endpoint for more details on how to add user data.
  - `cardProductId` string — The ID of the card product this card was created with.

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `429` — TooManyRequests
- `500` — Internal Error

---

[API](https://skmtc.net/slashfi/apis/slash-public-api.md) · [All operations](https://skmtc.net/slashfi/apis/slash-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/slashfi/slash-public-api/versions/773c90f079c5/schema)
