---
title: "Create a card group"
method: POST
path: "/v2/card-groups"
---

# Create a card group

`POST /v2/card-groups`

## Request

- Base URL: `https://api.slash.com`
- URL: `https://api.slash.com/v2/card-groups`
- Auth: API key in header `X-API-Key`

## Headers

- `X-Idempotency-Key` string, required

## Request body

- CardGroupCreate
  - `name` string, required
  - `controls` CardGroupControls: What the group's cards may spend together; a group limit is shared across its cards. Replaced whole on update; `null` clears it.
    - `limit` CardControlsLimit: How much may be spent per period.
      - `amount` UsdMoney, required: A positive USD amount expressed in cents.
        - `amount` integer, required: Amount in cents. For example, `1250` represents USD 12.50.
        - `currency` 'USD', required
      - `period` 'daily' | 'weekly' | 'monthly' | 'yearly' | 'lifetime', required: Every period but `lifetime` resets at its boundary in `timezone`; `lifetime` never resets.
      - `startDate` string, date: Day the first period starts, today or earlier. Defaults to the start of the current period. Not used by `daily`.
      - `timezone` string: IANA timezone the period boundaries use. Defaults to UTC.
    - `transactionLimit` UsdMoney: A positive USD amount expressed in cents.
      - `amount` integer, required: Amount in cents. For example, `1250` represents USD 12.50.
      - `currency` 'USD', required
    - `merchantCategories` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
      - `mode` 'allow' | 'block', required
      - `values` string[], required
    - `merchantCategoryCodes` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
      - `mode` 'allow' | 'block', required
      - `values` string[], required
    - `merchants` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
      - `mode` 'allow' | 'block', required
      - `values` string[], required
    - `countries` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
      - `mode` 'allow' | 'block', required
      - `values` string[], required

## Response `200`

The card group.

- CardGroup
  - `id` string, required: Card group id with the `card_group_` prefix.
  - `name` string, required
  - `status` 'active' | 'archived', required
  - `controls` CardGroupControls: What the group's cards may spend together; a group limit is shared across its cards. Replaced whole on update; `null` clears it.
    - `limit` CardControlsLimit: How much may be spent per period.
      - `amount` UsdMoney, required: A positive USD amount expressed in cents.
        - `amount` integer, required: Amount in cents. For example, `1250` represents USD 12.50.
        - `currency` 'USD', required
      - `period` 'daily' | 'weekly' | 'monthly' | 'yearly' | 'lifetime', required: Every period but `lifetime` resets at its boundary in `timezone`; `lifetime` never resets.
      - `startDate` string, date: Day the first period starts, today or earlier. Defaults to the start of the current period. Not used by `daily`.
      - `timezone` string: IANA timezone the period boundaries use. Defaults to UTC.
    - `transactionLimit` UsdMoney: A positive USD amount expressed in cents.
      - `amount` integer, required: Amount in cents. For example, `1250` represents USD 12.50.
      - `currency` 'USD', required
    - `merchantCategories` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
      - `mode` 'allow' | 'block', required
      - `values` string[], required
    - `merchantCategoryCodes` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
      - `mode` 'allow' | 'block', required
      - `values` string[], required
    - `merchants` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
      - `mode` 'allow' | 'block', required
      - `values` string[], required
    - `countries` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
      - `mode` 'allow' | 'block', required
      - `values` string[], required
  - `createdAt` string, date-time, required

## Other responses

- `400`: - `invalid_request (request shape)` — The body, query, or headers failed validation, or a required header is missing. `details` has one entry per failing location, keyed by JSON pointer or header name.
- `401`: - `unauthorized` — API key authentication is missing or invalid.
- `403`: - `forbidden` — The credential is not permitted to perform this action on the resource. When the resource is a field of the request, `details` names that `field` and the `id` it received. - `forbidden (legal entity)` — The credential is not permitted to act for the selected legal entity. - `not_available` — Public API v2 is not yet available. Use [Public API v1](https://docs.slash.com/introduction) in the meantime. - `user_api_key_required` — The API key is scoped to a legal entity rather than a user. Every v2 request needs a user API key, created under Settings → API keys in the Slash dashboard, together with the `x-legal-entity` header.
- `409`: - `conflict (idempotency key reused)` — A consumed `X-Idempotency-Key` was reused; the original response is not replayed.
- `429`: The request exceeded the applicable rate limit. The response body is plain text, not the error object; clients must not depend on its wording.
- `500`: - `internal` — Slash could not complete the request. Quote `referenceId` when contacting Slash support.

## Changes

- **2026-10-16** `8b5d371ffeea`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/slashfi/apis/slash-public-api/changes/v2/card-groups/post.md)

---

[API](https://skmtc.dev/slashfi/apis/slash-public-api.md) - [All operations](https://skmtc.dev/slashfi/apis/slash-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/slashfi/apis/slash-public-api/revisions/eaed2d63c9e2?raw)