---
title: "Create a card"
method: POST
path: "/v2/cards"
---

# Create a card

`POST /v2/cards`

## Request

- Base URL: `https://api.slash.com`
- URL: `https://api.slash.com/v2/cards`
- Auth: API key in header `X-API-Key`

Issue a virtual or physical card.

## Headers

- `X-Idempotency-Key` string, required

## Request body

- union
  - CardCreateVirtual
    - `type` 'virtual', required
    - `name` string, required
    - `cardholderUserId` string, required: The user who holds the card, from `GET /v2/users`.
    - `accountId` string: The account to issue from. Required when the legal entity has more than one card account.
    - `virtualAccountId` string: Defaults to the account's primary virtual account.
    - `cardGroupId` string
    - `cardProductId` string: From `GET /v2/card-products`. Defaults to the account's.
    - `controls` CardControls: What the card may spend. The controls of its card group apply too. Replaced whole on update; `null` clears it.
      - `limit` CardControlsLimit: How much may be spent per period.
        - `amount` UsdMoney, required: A positive USD amount expressed in cents.
          - `amount` integer, required: Amount in cents. For example, `1250` represents USD 12.50.
          - `currency` 'USD', required
        - `period` 'daily' | 'weekly' | 'monthly' | 'yearly' | 'lifetime', required: Every period but `lifetime` resets at its boundary in `timezone`; `lifetime` never resets.
        - `startDate` string, date: Day the first period starts, today or earlier. Defaults to the start of the current period. Not used by `daily`.
        - `timezone` string: IANA timezone the period boundaries use. Defaults to UTC.
      - `transactionLimit` UsdMoney: A positive USD amount expressed in cents.
        - `amount` integer, required: Amount in cents. For example, `1250` represents USD 12.50.
        - `currency` 'USD', required
      - `merchantCategories` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
        - `mode` 'allow' | 'block', required
        - `values` string[], required
      - `merchantCategoryCodes` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
        - `mode` 'allow' | 'block', required
        - `values` string[], required
      - `merchants` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
        - `mode` 'allow' | 'block', required
        - `values` string[], required
      - `countries` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
        - `mode` 'allow' | 'block', required
        - `values` string[], required
      - `recurringPaymentsOnly` boolean: Approve recurring payments only. An Enterprise feature.
    - `billingAddress` Address
      - `line1` string, required
      - `line2` string
      - `city` string, required
      - `state` string
      - `postalCode` string
      - `countryCode` string: ISO 3166-1 alpha-2 country code.
    - `singleUse` boolean: Close the card after its first transaction.
  - CardCreatePhysical: The holder's name is embossed on the card.
    - `type` 'physical', required
    - `name` string, required
    - `cardholderUserId` string, required: The user who holds the card, from `GET /v2/users`.
    - `accountId` string: The account to issue from. Required when the legal entity has more than one card account.
    - `virtualAccountId` string: Defaults to the account's primary virtual account.
    - `cardGroupId` string
    - `cardProductId` string: From `GET /v2/card-products`. Defaults to the account's.
    - `controls` CardControls: What the card may spend. The controls of its card group apply too. Replaced whole on update; `null` clears it.
      - `limit` CardControlsLimit: How much may be spent per period.
        - `amount` UsdMoney, required: A positive USD amount expressed in cents.
          - `amount` integer, required: Amount in cents. For example, `1250` represents USD 12.50.
          - `currency` 'USD', required
        - `period` 'daily' | 'weekly' | 'monthly' | 'yearly' | 'lifetime', required: Every period but `lifetime` resets at its boundary in `timezone`; `lifetime` never resets.
        - `startDate` string, date: Day the first period starts, today or earlier. Defaults to the start of the current period. Not used by `daily`.
        - `timezone` string: IANA timezone the period boundaries use. Defaults to UTC.
      - `transactionLimit` UsdMoney: A positive USD amount expressed in cents.
        - `amount` integer, required: Amount in cents. For example, `1250` represents USD 12.50.
        - `currency` 'USD', required
      - `merchantCategories` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
        - `mode` 'allow' | 'block', required
        - `values` string[], required
      - `merchantCategoryCodes` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
        - `mode` 'allow' | 'block', required
        - `values` string[], required
      - `merchants` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
        - `mode` 'allow' | 'block', required
        - `values` string[], required
      - `countries` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
        - `mode` 'allow' | 'block', required
        - `values` string[], required
      - `recurringPaymentsOnly` boolean: Approve recurring payments only. An Enterprise feature.
    - `billingAddress` Address
      - `line1` string, required
      - `line2` string
      - `city` string, required
      - `state` string
      - `postalCode` string
      - `countryCode` string: ISO 3166-1 alpha-2 country code.
    - `physical` object, required
      - `design` 'plastic' | 'silver_metal' | 'gold_metal'
      - `secondLine` string: The line embossed under the holder's name.
      - `shipping` object, required
        - `address` Address, required
          - `line1` string, required
          - `line2` string
          - `city` string, required
          - `state` string
          - `postalCode` string
          - `countryCode` string: ISO 3166-1 alpha-2 country code.
        - `service` 'standard' | 'express' | 'priority': `priority` ships to US addresses only.

## Response `200`

The card.

- Card: A virtual or physical card. Its number and security code are only available from `GET /v2/cards/{cardId}/details`.
  - `id` string, required: Card id with the `c_` prefix.
  - `type` 'virtual' | 'physical', required
  - `status` 'pending' | 'awaiting_activation' | 'active' | 'paused' | 'inactive' | 'closed', required: `pending`: being issued, or waiting for a physical card's fee. `awaiting_activation`: a physical card its holder has not activated. `active`: approves authorizations. `paused`: declines them. `inactive`: deactivated by Slash or the issuer; can only be closed. `closed`: permanent.
  - `name` string, required
  - `last4` string: Absent on physical cards until they are activated.
  - `expiryMonth` integer
  - `expiryYear` integer
  - `accountId` string, required: Account id with the `sa_group_` prefix.
  - `virtualAccountId` string: Virtual account the card spends from, with the `subaccount_` prefix.
  - `cardGroupId` string: Card group id with the `card_group_` prefix.
  - `cardProductId` string: Card product id with the `card_product_` prefix.
  - `cardholderUserId` string: The user who holds the card, with the `u_` prefix.
  - `controls` CardControls: What the card may spend. The controls of its card group apply too. Replaced whole on update; `null` clears it.
    - `limit` CardControlsLimit: How much may be spent per period.
      - `amount` UsdMoney, required: A positive USD amount expressed in cents.
        - `amount` integer, required: Amount in cents. For example, `1250` represents USD 12.50.
        - `currency` 'USD', required
      - `period` 'daily' | 'weekly' | 'monthly' | 'yearly' | 'lifetime', required: Every period but `lifetime` resets at its boundary in `timezone`; `lifetime` never resets.
      - `startDate` string, date: Day the first period starts, today or earlier. Defaults to the start of the current period. Not used by `daily`.
      - `timezone` string: IANA timezone the period boundaries use. Defaults to UTC.
    - `transactionLimit` UsdMoney: A positive USD amount expressed in cents.
      - `amount` integer, required: Amount in cents. For example, `1250` represents USD 12.50.
      - `currency` 'USD', required
    - `merchantCategories` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
      - `mode` 'allow' | 'block', required
      - `values` string[], required
    - `merchantCategoryCodes` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
      - `mode` 'allow' | 'block', required
      - `values` string[], required
    - `merchants` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
      - `mode` 'allow' | 'block', required
      - `values` string[], required
    - `countries` CardControlsRestriction: With `allow`, only the listed values are approved. With `block`, the listed values are declined.
      - `mode` 'allow' | 'block', required
      - `values` string[], required
    - `recurringPaymentsOnly` boolean: Approve recurring payments only. An Enterprise feature.
  - `singleUse` boolean, required: Whether the card closes after its first transaction. Virtual cards only.
  - `billingAddress` Address
    - `line1` string, required
    - `line2` string
    - `city` string, required
    - `state` string
    - `postalCode` string
    - `countryCode` string: ISO 3166-1 alpha-2 country code.
  - `physical` object: Present on physical cards.
    - `design` 'plastic' | 'silver_metal' | 'gold_metal', required
    - `secondLine` string: The line embossed under the holder's name.
    - `shipping` object
      - `address` Address, required
        - `line1` string, required
        - `line2` string
        - `city` string, required
        - `state` string
        - `postalCode` string
        - `countryCode` string: ISO 3166-1 alpha-2 country code.
      - `service` 'standard' | 'express' | 'priority', required
      - `status` 'pending' | 'shipped' | 'canceled', required: `pending`: ordered, not yet shipped.
      - `carrier` 'fedex' | 'usps'
      - `trackingNumber` string
      - `trackingUrl` string
      - `shippedAt` string, date-time
  - `closedReason` 'no_longer_needed' | 'lost_or_stolen' | 'never_arrived' | 'damaged' | 'closed_by_slash'
  - `createdAt` string, date-time, required
  - `closedAt` string, date-time

## Other responses

- `400`: - `account_required` — The legal entity issues cards from more than one account, so the request must name one with `accountId`. List them with `GET /v2/accounts`. - `card_group_in_other_account` — The card group holds the cards of another account or virtual account. Pick a group of the card’s virtual account. - `physical_cards_not_available` — The account’s card program has no physical card stock. Issue a virtual card, or a physical card from another account. - `shipping_address_undeliverable` — The carrier cannot deliver to the shipping address. `details.reason` says why: `no_match` (the address was not found), `secondary_required` (an apartment, suite or unit is missing), `international_unverified`, `po_box_express` (express shipping cannot go to a PO box) or `undeliverable` (a line is too long or too short). Correct the address and retry. - `shipping_country_restricted` — Shipping restrictions rule out the destination country. Ship to an address in another country. - `invalid_request (request shape)` — The body, query, or headers failed validation, or a required header is missing. `details` has one entry per failing location, keyed by JSON pointer or header name.
- `401`: - `unauthorized` — API key authentication is missing or invalid.
- `403`: - `forbidden` — The credential is not permitted to perform this action on the resource. When the resource is a field of the request, `details` names that `field` and the `id` it received. - `international_shipping_not_enabled` — Physical cards ship to US addresses unless international shipping is enabled for the legal entity. Contact Slash support. - `metal_cards_not_enabled` — Metal designs are not enabled for the legal entity. Order `plastic`, or contact Slash support. - `recurring_payments_only_not_enabled` — Recurring-payments-only cards are an Enterprise feature. Contact Slash sales to enable it. - `forbidden (legal entity)` — The credential is not permitted to act for the selected legal entity. - `not_available` — Public API v2 is not yet available. Use [Public API v1](https://docs.slash.com/introduction) in the meantime. - `user_api_key_required` — The API key is scoped to a legal entity rather than a user. Every v2 request needs a user API key, created under Settings → API keys in the Slash dashboard, together with the `x-legal-entity` header.
- `404`: - `not_found` — No resource matches the identifier. When the identifier is a field of the request, `details` names that `field` and the `id` it received.
- `409`: - `account_locked` — Slash has locked the account, during a review or while it closes, so cards cannot be issued on it or changed. Contact Slash support. - `card_fee_insufficient_funds` — Ordering this card charges a fee to the virtual account, which does not hold enough. Fund it and retry. - `card_group_archived` — Archived card groups cannot change or take new cards. - `card_issuer_not_approved` — Cards on this account need the legal entity and the cardholder to be approved by the card issuer. `field` names which one is not approved yet: `accountId` for the legal entity, `cardholderUserId` for the cardholder. Retry once it is approved. - `card_limit_reached` — The account already holds as many open cards as it may. Close cards you no longer need, or contact Slash support to raise the limit. - `conflict (idempotency key reused)` — A consumed `X-Idempotency-Key` was reused; the original response is not replayed.
- `429`: The request exceeded the applicable rate limit. The response body is plain text, not the error object; clients must not depend on its wording.
- `500`: - `internal` — Slash could not complete the request. Quote `referenceId` when contacting Slash support.

## Changes

- **2026-10-29** `5f68aed44f93`: 1 info
  - added `subschema #4: card_issuer_not_approved` to the response body `anyOf` list for the response status `409`
- **2026-10-16** `8b5d371ffeea`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/slashfi/apis/slash-public-api/changes/v2/cards/post.md)

---

[API](https://skmtc.dev/slashfi/apis/slash-public-api.md) - [All operations](https://skmtc.dev/slashfi/apis/slash-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/slashfi/apis/slash-public-api/revisions/eaed2d63c9e2?raw)