Sign in

v1

latestOpenAPI 3.0.22026-07-26123510445.2 KB
Card Lifecycle

Create Card

Creates a card and issues it to a cardholder.

Two calling modes are supported:

  • Traditional mode — pass cardholder_id to issue a card to an existing cardholder. Optionally pass cardholder_required_fields to supplement missing cardholder data required by the card product.
  • One-step mode — omit cardholder_id and pass a complete cardholder_required_fields block. The system creates the cardholder and the card in a single request. See One-Step Card Issuance for the full integration flow.
post/v1/issuing/cards

Headers

x-on-behalf-ofstring

Specifies the sub-account on whose behalf the request is made. This should be set to the account_id, which can be retrieved via the List Connected Accounts API. If omitted or empty, the request is executed using the master account. More information at Connected Accounts.

x-idempotency-keystring uuid

A unique identifier (UUID) used to maintain operation idempotency, ensuring that repeated executions of the same operation do not result in unintended effects or duplication. It helps preserve data consistency in the face of network errors, retries, or failures.

Request body

card_limitnumber

The total credit limit assigned to the card, currency refer to card_currency. This is not a cumulative balance, but a fixed credit limit similar to that of a credit card.

Field behavior by card product:
  • Business Mastercard and Personal Visa: card_limit is required during card creation and must be greater than or equal to 0.01.
  • Business Visa: card_limit is optional.
    • If omitted, the system defaults card_limit to 0.
    • If provided, the value must be greater than or equal to 0, with up to two decimal places. Negative values are not allowed.

See Card products for the full capability matrix.

card_currency'SGD' | 'USD' | 'XUSD' required

The card currency.

name_on_cardstring

The cardholder name shown on the card. When the Secure Iframe renders the cardholder name (cardholder_name=true), this value is used as the default; if omitted, the iframe falls back to first_name + last_name from the cardholder record.

cardholder_idstring uuid

The cardholder's unique identifier.

card_product_idstring required

The card product's unique identifier.

card_art_idstring

Identifier of a card art. Stable across card products; reuse the same value when creating multiple cards with the same design.

metadataMetadata

Any key-value object. Max length = 512 bytes. This must be valid JSON data.

usage_type'NORMAL' | 'ONE_TIME'

Indicates whether the card is a standard reusable card or a one-time-use card.

  • NORMAL - A standard card that can be used for multiple transactions.
  • ONE_TIME - A one-time-use card that is automatically cancelled after the first transaction event defined by auto_cancel_trigger.
auto_cancel_trigger'ON_AUTH' | 'ON_CAPTURE'

Defines the transaction event that triggers automatic cancellation of a ONE_TIME card. Required when usage_type is ONE_TIME.

  • ON_AUTH - The card is cancelled immediately after the first authorization is approved. Subsequent authorization requests on the same card will be declined.
  • ON_CAPTURE - The card is cancelled after the first transaction's capture (settlement) succeeds, allowing a full authorization and capture cycle to complete.
expiry_atstring date-time

The absolute expiry date and time of the card. If the card has not been cancelled by a first-transaction event before this time, it is automatically cancelled and any unused balance is released.

Example request

{
  "card_limit": 2100.02,
  "card_currency": "USD",
  "name_on_card": "MARSHALL HU",
  "cardholder_id": "7c4ff2cd-1bf6-4aaa-bf16-266771425011",
  "card_product_id": "7c4ff2cd-1bf6-4aaa-bf16-266771425011",
  "card_art_id": "01KD52BKQWDMFF63R1NNQN7A79",
  "spending_controls": [
    {
      "amount": "100.03",
      "interval": "PER_TRANSACTION"
    }
  ],
  "risk_controls": {
    "enable_3ds": "Y",
    "allow_3ds_transactions": "Y",
    "blocked_mcc": [
      "5999",
      "6011"
    ]
  },
  "metadata": {
    "key1": "value1",
    "key2": "value2"
  },
  "usage_type": "NORMAL",
  "auto_cancel_trigger": "ON_AUTH",
  "expiry_at": "2026-03-19T18:46:43+08:00",
  "cardholder_required_fields": {
    "email": "demo@example.com",
    "first_name": "Emily",
    "last_name": "Toy",
    "country_code": "SG",
    "phone_number": "86683306",
    "date_of_birth": "1990-01-01",
    "gender": "MALE",
    "nationality": "SG",
    "residential_address": {
      "country": "SG",
      "state": "Singapore",
      "city": "Singapore",
      "district": "Buona Vista",
      "line1": "9 N Buona Vista Dr",
      "line2": "THE METROPOLIS",
      "line_en": "9 N Buona Vista Dr, THE METROPOLIS",
      "postal_code": "138666"
    },
    "identity": {
      "type": "PASSPORT",
      "number": "E12345678"
    },
    "kyc_verification": {
      "method": "THIRD_PARTY",
      "kyc_proof": {
        "provider": "SUMSUB",
        "reference_id": "sumsub_ref_1234567890",
        "documents": [
          {
            "file_id": "b3d9d2d5-4c12-4946-a09d-953e82sed2b0",
            "report_type": "IDV"
          }
        ]
      }
    }
  }
}

Response

Card creation successfully.

card_idstring required

Unique identifier for the card.

card_order_idstring required

ID of the card order.

create_timestring date/time required

The timestamp when the record was created in the system. Timestamp follows the ISO 8601 standard.

card_status'PENDING' | 'ACTIVE' | 'FROZEN' | 'BLOCKED' | 'PRE_CANCEL' | 'CANCELLED' | 'LOST' | 'STOLEN' | 'FAILED' required

Card status enum. See the Card lifecycle and statuses guide for more information.

  • PENDING: The request to create the card has been received and is under review.
  • ACTIVE: The request to create the card was successful and the card is ready to use.
  • FROZEN: All incoming authorization requests will be declined. The card can be reactivated to accept new authorizations.
  • BLOCKED: The card was blocked by UQPAY due to suspicious activity.
  • PRE_CANCEL: The card is scheduled for cancellation and is in a waiting period during which all incoming authorization requests are declined. It transitions to CANCELLED when the waiting period ends.
  • CANCELLED: The card cannot be reactivated from this state, all incoming authorization requests will be permanently declined.
  • LOST: The card has been reported as lost to UQPAY.
  • STOLEN: The card has been reported as stolen to UQPAY.
  • FAILED: The request to create a card using Create Card failed.
order_status'PENDING' | 'PROCESSING' | 'SUCCESS' | 'FAILED' required

This field will contain the status of the request after processing.

  • PENDING -The initial status of the order request.
  • PROCESSING - If this status shall be subject to webhooks notification.
  • SUCCESS - The final status of the order request is successful.
  • FAILED - The final status of the order request is failed.
cardholder_idstring uuid

The cardholder's unique identifier.

cardholder_createdboolean

true when a new cardholder was created inline as part of this request. Omitted otherwise.

cardholder_status'FAILED' | 'PENDING' | 'SUCCESS' | 'INCOMPLETE'

The cardholder's status.

verification_status'VERIFIED' | 'UNDER_REVIEW' | 'ACTION_REQUIRED'

The KYC verification outcome for the cardholder associated with this card creation request.

  • VERIFIED - The cardholder's identity has been verified.
  • UNDER_REVIEW - AML or KYC review is in progress.
  • ACTION_REQUIRED - The cardholder must complete an action (such as Sumsub IDV) before the card can be activated.
kyc_method'THIRD_PARTY' | 'SUMSUB_REDIRECT'

Echoes the KYC verification method that was applied. Returned when cardholder_required_fields.kyc_verification was supplied in the request.

  • THIRD_PARTY - Merchant-supplied KYC proof was used.
  • SUMSUB_REDIRECT - The cardholder is redirected to Sumsub to complete IDV.
idv_verification_urlstring uri

The IDV verification URL the cardholder must visit to complete identity verification. Returned only when kyc_method is SUMSUB_REDIRECT.

idv_url_expires_atstring date-time

The expiry time of idv_verification_url. Returned only when kyc_method is SUMSUB_REDIRECT.

messagestring

Informational message when card creation is blocked or pending due to KYC requirements (e.g., insufficient KYC, missing fields).

Example response

{
  "card_id": "c0cef051-29c5-4796-b86a-cd5b684bfad7",
  "card_order_id": "c0cef051-29c5-4796-b86a-cd5ee34bfad7",
  "create_time": "2024-03-01T00:00:00+08:00",
  "card_status": "ACTIVE",
  "risk_controls": {
    "enable_3ds": "Y",
    "allow_3ds_transactions": "Y",
    "blocked_mcc": [
      "5999",
      "6011"
    ]
  },
  "cardholder_id": "7c4ff2cd-1bf6-4aaa-bf16-266771425011",
  "cardholder_created": true,
  "verification_status": "UNDER_REVIEW",
  "kyc_method": "SUMSUB_REDIRECT",
  "idv_verification_url": "https://in.sumsub.com/websdk/p/sbx_4dwsbDuDbpJsMgou",
  "idv_url_expires_at": "2026-04-25T17:26:50+08:00"
}