Skip to main content
The card resource represents a payment card. Cards are derived from and controlled by the cardproduct resource. For more information on cards, see About Cards. Some attributes of the card resource can be defined in an associated bulkissuance or cardproduct resource. If you define one of these attributes in more than one object, the order of precedence at fulfillment time is as follows:
1
card
2
bulkissuance
3
cardproduct
Defining an attribute in an object with higher precedence overrides, but does not overwrite, the attribute in a lower-precedence object.

Create card

Action: POST
Endpoint: /cards
Creates a card. Create the user and card product before you create the card. You create a card using the user_token of the user who will own the card and the card_product_token of the card product that will control the card.
Tip
By default, newly created cards are inactive and must be explicitly activated (see Create Card Transition for information on activating cards). To create cards that are activated upon issue, configure your card product’s config.card_life_cycle.activate_upon_issue field (see Card Products).
Send a POST request to /pins/controltoken to set the card’s personal identification number (PIN) if your program requires PIN numbers (for example, for Europay Mastercard and Visa cards); this action updates the pin_is_set field to true. See Create or Update PIN for details. You can use optional query parameters to show the primary account number (PAN) and card verification value (CVV2) number in the response. If show_pan and show_cvv_number are set to true, the fulfillment state of the card is DIGITALLY_PRESENTED instead of the typical initial state of ISSUED. This fulfillment state does not affect the delivery of physical cards. This endpoint requires PCI DSS compliance if show_pan and show_cvv_number are set to true. You must comply with PCI DSS data security requirements if you store, transmit, or process sensitive card data.

URL query parameters

Request body

Sample request body

JSON

Response body

Sample response body

JSON

List cards by last 4 digits of PAN

Action: GET
Endpoint: /cards
Retrieves an array of cards whose primary account numbers (PANs) end in the four digits specified by the last_four query parameter. This endpoint supports field filtering, object expansion, sorting, and pagination.

URL query parameters

Response body

Sample response body

JSON

Retrieve card by barcode

Action: GET
Endpoint: /cards/barcode/{barcode}
Retrieves a card by its barcode. This endpoint supports field filtering and object expansion.

URL path parameters

URL query parameters

Response body

Sample response body

JSON

Retrieve card by PAN

Action: POST
Endpoint: /cards/getbypan
Retrieves the user_token and card_token for a primary account number (PAN). In the case of a reissued card, where multiple cards share the same PAN, the information for the most recently issued card is returned. This request is useful in IVR scenarios where a user has telephoned and identifies the card by the PAN. The retrieval of these tokens is implemented as a POST request because supplying the PAN in the request body is more secure than supplying it in the URL (as would be required with a GET).
Warning
Sending a request to this endpoint requires PCI DSS compliance. You must comply with PCI DSS data security requirements if you want to store, transmit, or process sensitive card data such as the cardholder’s primary account number (PAN), personal identification number (PIN), and card expiration date.

Request body

Sample request body

JSON

Response body

Sample response body

JSON

List cards for user

Action: GET
Endpoint: /cards/user/{token}
Retrieves a list of the cards associated with a specific user. This endpoint supports field filtering, pagination, and object expansion.

URL path parameters

URL query parameters

Response body

Sample response body

JSON

Retrieve card

Action: GET
Endpoint: /cards/{token}
Retrieves a specific card. This endpoint supports field filtering and object expansion.

URL path parameters

URL query parameters

Response body

Sample response body

JSON

Update card

Action: PUT
Endpoint: /cards/{token}
Updates the details of an existing card.

URL path parameters

Request body

Sample request body

JSON

Response body

Sample response body

JSON

Show card PAN

Action: GET
Endpoint: /cards/{token}/showpan
Retrieves a primary account number (PAN). For security reasons, the PAN is not fully visible on the card resource returned by GET /cards/{token}. This endpoint supports field filtering and object expansion.

URL path parameters

URL query parameters

Response body

Sample response body

JSON