---
title: "Create External Card from token"
method: POST
path: "/external_cards/tokens"
tags: ["External Cards"]
---

# Create External Card from token

`POST /external_cards/tokens`

Create an External Card from token. The token and cardholder name are obtained through the iFrame. The token must be used within 5 minutes or else it will expire. If a Business ID is provided, address verification will be performed against the legal address of the business. Otherwise, the legal address of the Customer will be used. In either case, the name of the Customer will be used to match against the cardholder name.

Each unique External Card is limited to a single Customer, so once an External Card is created for a Customer, it cannot be used for any other Customers, even if the card is deleted. Given there is a limited number of test cards, to allow easier testing, this restriction is relaxed in the sandbox environment.

## Headers

- `Idempotency-Key` string

## Request body

- ExternalCardRequest
  - `business_id` string, uuid — The unique identifier of a business
  - `customer_id` string, uuid, required — The unique identifier of a customer
  - `name` string, required — The cardholder name
  - `token` string, required — The token that was returned via tokenization iframe

## Response `201`

External Card created

- ExternalCardResponse
  - `bin` string — Bank Identification Number
  - `created_time` string, date-time
  - `currency` string, required — ISO 4217 Alpha-3 currency code
  - `customer_id` string, uuid, required — The unique identifier of a customer
  - `deletion_time` string, date-time
  - `expiration_month` string, required
  - `expiration_year` string, required
  - `id` string, required — External card ID
  - `issuer` string — Name of issuing financial institution
  - `last_four` string, required — The last 4 digits of the card PAN
  - `last_modified_time` string, date-time
  - `name` string, required — The cardholder name
  - `status` 'ACTIVE' | 'DELETED' | 'SUSPENDED', required — Status of an External Card
  - `verifications` ExternalCardVerifications — Verify card passed AVS and CVV checks and if it able to perform PUSH/PULL transfers.
    - `address_verification_result` 'ADDRESS_AND_ZIP_MISMATCH' | 'ADDRESS_MISMATCH' | 'NOT_VERIFIED' | 'VERIFIED' | 'ZIP_MISMATCH', required — Address verification results Status | Description --- | --- VERIFIED | AVS verified NOT_VERIFIED | AVS not verified ADDRESS_MISMATCH | ZIP code match, address no match ZIP_MISMATCH | Address match, ZIP code no match ADDRESS_AND_ZIP_MISMATCH | Address and ZIP code no match
    - `cvv2_result` 'CVV_MISMATCH' | 'NOT_SUPPORTED' | 'NOT_VERIFIED' | 'VERIFIED', required — Card Verification Value results Status | Description --- | --- VERIFIED | CVV and expiration date verified NOT_VERIFIED | CVV and expiration date not verified CVV_MISMATCH | Either CVV or expiration date does not match NOT_SUPPORTED | Issuer does not participate in CVV2 service
    - `name_verification_result` 'NAME_MISMATCH' | 'NOT_SUPPORTED' | 'NOT_VERIFIED' | 'VERIFIED', required — Issuer cardholder name verification result with Account Name Inquiry (ANI) service The result of verifying the cardholder name against the name on file at the issuing institution. If this fails, it means the issuing institution has a different person's name on file as the cardholder. Status | Description --- | --- VERIFIED | ANI Name verified NOT_VERIFIED | ANI Name not verified NOT_SUPPORTED | Issuer does not participate in ANI service NAME_MISMATCH | ANI Name does not match
    - `pull_details` PullDetails — Additional PULL transfer details
      - `country` string — ISO-3166-1 Alpha-2 country code
      - `currency` string — ISO 4217 Alpha-3 currency code
      - `network` string — Payment network
      - `product_type` 'CREDIT' | 'DEBIT' | 'PREPAID' — Product type
      - `regulated` boolean — Exemption status from debit card interchange fee standards
    - `pull_enabled` boolean, required — Indicates if the card is able to perform PULL transfers.
    - `push_details` PushDetails — Additional PUSH transfer details
      - `country` string — ISO-3166-1 Alpha-2 country code
      - `currency` string — ISO 4217 Alpha-3 currency code
      - `funds_availability` 'FEW' | 'NEXT' | 'NOW' — Estimated timeframe of funds availability Value | Description --- | --- NOW | Within 30 minutes NEXT | Within the next business day FEW | Within a few business days
      - `network` string — Payment network
      - `product_type` 'CREDIT' | 'DEBIT' | 'PREPAID' — Product type
      - `regulated` boolean — Exemption status from debit card interchange fee standards
    - `push_enabled` boolean, required — Indicates if the card is able to perform PUSH transfers.
    - `state` 'FAILED' | 'SUCCEEDED', required

## Other responses

- `400` — BadRequest
- `401` — Unauthorized
- `403` — Forbidden error
- `422` — Unprocessable entity request response
- `500` — Internal server error

---

[API](https://skmtc.net/synctera/apis/synctera-api.md) · [All operations](https://skmtc.net/synctera/apis/synctera-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/synctera/synctera-api/revisions/b0d812e6cdd0/schema)