---
title: "Add card"
method: POST
path: "/profiles/{profileId}/cards"
tags: ["Profiles"]
---

# Add card

`POST /profiles/{profileId}/cards`

## Request

- Base URL: `https://api.na.bambora.com/v1`
- URL: `https://api.na.bambora.com/v1/profiles/{profileId}/cards`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `Sub-Merchant-Id`
- TypeScript: <https://skmtc.dev/worldline-solutions/apis/worldline-payment-apis/docs/profiles/:profileId/cards/post.ts> (a function with typed inputs; its response is checked against the schema)

Add a card to the profile. Note that there is a default limit of 1 card per profile. You can change this in your Profiles settings in the back office.

## Path parameters

- `profileId` string, required

## Request body

- ProfileBodyCard
  - `card` ProfileFromCard
    - `name` string, required: Card holder name.
    - `number` string, required: Credit card number (PAN)
    - `expiry_month` string, required: eg. 02 for February.
    - `expiry_year` string, required: eg. 17 for 2017.
    - `cvd` string: Security code on the back of the credit card. This can be set to mandatory in the back office.
  - `token` ProfileFromToken
    - `name` string, required: Card holder name.
    - `code` string, required: The token received from the client-side tokenization service.
  - `comment` string: Any comments that a user would like to attach to the Payment Profile
  - `validate` boolean: Set to true to automatically process a pre-auth transaction for validation purposes. Processor token transactions require validation, and must be set to true.

## Response `200`

The Profile.

- ProfileResponse
  - `code` number
  - `message` string
  - `customer_code` string: the ID of the payment profile. You need to keep track of this value.
  - `validation` CardValidation
    - `id` string: Transaction ID
    - `approved` integer: Approval status of payment transaction. 0 if the transaction is not approved. 1 if the transaction is approved.
    - `message_id` integer: Payment response code
    - `message` string: Message containing information about the transactions status
    - `auth_code` string: Auth Code
    - `trans_date` string: The date it was created '2015-04-22T10:03:19.323-07:00'
    - `order_number` string: Order number
    - `type` 'P' | 'R' | 'VP' | 'VR' | 'PA' | 'PAC': Payment transaction type
    - `amount` number, double: A decimal value in dollars. Uses up to two decimal places.
    - `cvd_id` integer: CVD Response ID
  - `limited_use_card_token` string: Uniquely identifies specific cards in payment profile accounts. Used only for performing Method URL operations.

## Other responses

- `400`: Bad Request
- `401`: Authentication Failure
- `402`: Business Rule Violation or Decline
- `403`: Authorization Failure
- `405`: Invalid Request Method
- `500`: Internal Server Error

---

[API](https://skmtc.dev/worldline-solutions/apis/worldline-payment-apis.md) - [All operations](https://skmtc.dev/worldline-solutions/apis/worldline-payment-apis/llms.txt) - [OpenAPI document](https://skmtc.dev/worldline-solutions/apis/worldline-payment-apis/revisions/d661d9e357a1?raw)