---
title: "Create a card"
method: POST
path: "/issuing/cards"
tags: ["Cards"]
---

# Create a card

`POST /issuing/cards`

## Request

- Base URL: `https://{prefix}.api.sandbox.checkout.com`
- URL: `https://{prefix}.api.sandbox.checkout.com/issuing/cards`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `string` scopes: `issuing:card-management-write`
- TypeScript: <https://skmtc.dev/checkout/apis/checkout-com-api-reference/docs/issuing/cards/post.ts> (a function with typed inputs; its response is checked against the schema)

Creates a physical or virtual card and issues it to the specified cardholder.

## Headers

- `Cko-Idempotency-Key` string

## Request body

- AddCardRequest
  - `type` string, required: The card type.
  - `cardholder_id` string, required: The cardholder's unique identifier.
  - `lifetime` CardLifetime: The duration of time during which the card will accept incoming authorizations. The `unit` and `value` combination you supply will determine the card's expiry date from the date of issue. For example, to set the card to expire in a year and a half, pass the following: ``` { "lifetime": { "unit": "Months", "value": "18" } } ```
    - `unit` 'Months' | 'Years': The unit of time to specify the card lifetime's in.
    - `value` integer, required: The length of time before the card will expire, in the `unit` of time specified.
  - `reference` string: Your reference.
  - `metadata` IssuingCardMetadata: User's metadata.
    - `udf1` string: User defined field 1
    - `udf2` string: User defined field 2
    - `udf3` string: User defined field 3
    - `udf4` string: User defined field 4
    - `udf5` string: User defined field 5
  - `scheduled_revocation_date` string, date: The card will be revoked at midnight UTC on the date specified. - Format: `YYYY-MM-DD`
  - `revocation_date` string, date: Deprecated. Use `scheduled_revocation_date` instead. Date scheduling the card's automatic revocation. - Supported format: `YYYY-MM-DD` (time is midnight UTC)
  - `scheduled_activation_date` string: Date scheduling the card's first activation. Only applies to the initial activation of a card. Two formats are supported: - Date only: `YYYY-MM-DD` (treated as midnight UTC) - Date with round hour: `YYYY-MM-DDTHH:mmZ` (UTC) or `YYYY-MM-DDTHH:mm±HH:mm` (offset) Only round hours are allowed when a time is provided (`HH:00`). The value must be at least the next round hour after the request time.
  - `card_product_id` string, required: The card product's unique identifier.

## Response `201`

Card created successfully

- AddCardResponse
  - `id` string, required: The card's unique identifier.
  - `client_id` string, required: The client's unique identifier.
  - `entity_id` string, required: The entity's unique identifier.
  - `display_name` string: The name to display on the card.
  - `last_four` string, required: The last four digits of the card number, also known as the PAN.
  - `expiry_month` integer, required: The card's expiration month.
  - `expiry_year` integer, required: The card's expiration year.
  - `billing_currency` string, ISO4217, required: The issuing currency, as a three-letter <a href="https://docs.checkout.com/docs/currency-codes" target="blank">ISO currency code</a>.
  - `issuing_country` string, required: The issuing country, as a two-letter <a href="https://www.checkout.com/docs/resources/codes/country-codes" target="blank" >ISO country code</a>.
  - `status` 'active' | 'inactive' | 'revoked' | 'suspended', required: The card's status, which determines whether it can approve incoming authorizations: - `inactive`: the default state - authorizations will be declined until the card is activated - `active`: authorization requests can be approved - `suspended`: incoming authorization requests will be declined - the card can be reactivated to accept new authorizations - `revoked`: incoming authorization requests will be permanently declined - the card cannot be reactivated from this state
  - `type` string, required: The card type.
  - `reference` string: Your reference.
  - `scheme` 'mastercard' | 'visa', required: the card scheme.
  - `created_date` string, date-time, required
  - `last_activated_on` string, date-time, nullable: The date and time the card was last activated. If the card has never been activated, this field returns `null`.
  - `_links` CardLinks: The links related to the card.
    - `self` IssuingLink, required
      - `href` string, required: The link URL.
      - `actions` string[], required: The HTTP Methods that can be performed on the link.
      - `types` string[], required: The Content Types for the link to the resource
    - `credentials` IssuingLink, required
      - `href` string, required: The link URL.
      - `actions` string[], required: The HTTP Methods that can be performed on the link.
      - `types` string[], required: The Content Types for the link to the resource
    - `revoke` IssuingLink, required
      - `href` string, required: The link URL.
      - `actions` string[], required: The HTTP Methods that can be performed on the link.
      - `types` string[], required: The Content Types for the link to the resource
    - `controls` IssuingLink, required
      - `href` string, required: The link URL.
      - `actions` string[], required: The HTTP Methods that can be performed on the link.
      - `types` string[], required: The Content Types for the link to the resource

## Other responses

- `401`: Unauthorized
- `422`: Invalid data was sent
- `500`: Internal Server Error
- `503`: Service Unavailable

---

[API](https://skmtc.dev/checkout/apis/checkout-com-api-reference.md) - [All operations](https://skmtc.dev/checkout/apis/checkout-com-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/checkout/apis/checkout-com-api-reference/revisions/0f1abdb1c3e9?raw)