Skip to main content
POST
Issue a card

Overview

Issue a virtual prepaid card to a cardholder under one of your programs. Pass productId — the program, card type, and spend limits are all derived from the product automatically.
Card issuance is asynchronous. A successful response means the request was accepted; the card may be returned with status CREATING (no PAN yet) and becomes usable only once provisioning completes. If the response is delayed or times out, the card is still being created — poll Get Card until status is ACTIVE rather than treating the immediate response as final.
JIT vs pre-funded cards:
  • JIT-enabled products (features.hasJIT: true): The card is funded on-demand at the point of each transaction. amount is optional.
  • Standard products (features.hasJIT: false): The card requires an initial balance at issuance. amount is required.

Request Body

Example

Success Response (201)

Response Fields

Provisioning is asynchronous

The card provider provisions cards asynchronously. When you call POST /cards, the card may come back with status: "CREATING" and empty maskedPan, last4, and expirationDate — provisioning can take anywhere from a few seconds up to ~1 hour. The 201 response is an acknowledgement that the card was accepted, not a guarantee the card number is ready.
If you store only the cardId from the 201, do not read maskedPan/last4/expirationDate from that response — they may be blank. Use the CARD_ISSUED webhook (below) as the authoritative “card is ready” signal: it fires once, when provisioning completes, and always carries the finalized maskedPan, last4, and expirationDate. You can also poll GET /cards/{id} — a CREATING card returns ACTIVE with full details once ready.

Webhook

The CARD_ISSUED event is fired when the card finishes provisioning (CREATINGACTIVE) — immediately for instantly-provisioned cards, or later (up to ~1h) for cards that were CREATING. It always includes the complete card details:

Who Can Hold a Card

Two things about the cardholder are checked before a card is issued. Verification. Some BINs require a verified cardholder and some require none; BINs on one programme differ. GET /cardholders/{id} returns programEligibility, which says which BINs are open to a given cardholder and what to do where one is not. Country. Some products cannot be issued to cardholders from particular countries. Both nationality and country of residence are checked, and a match returns 422 CARDHOLDER_COUNTRY_RESTRICTED naming the country.

Cards That Are Still Provisioning

A 201 means the card was accepted, not that it exists at the provider yet. On some BINs provisioning is immediate and the response carries everything; on others the card comes back as "status": "CREATING" with maskedPan and last4 empty and no expirationDate. Do not treat a missing PAN as a failure. Wait for the card.created webhook, or poll GET /cards/{id} until status becomes ACTIVE.
Code that reads maskedPan, last4, expirationDate or spendingLimit straight from the create response will break on a card that is still provisioning. Read them once the card is ACTIVE.

Spending Limits

Spending limits belong to the product, which falls back to the program when it sets none. There is no per-card limit on this endpoint — a third place to set one would only give the three a way to disagree. To change what a card may spend, change the product, or use POST /cards/{id}/limits where the BIN supports per-card limits. Some do not, and answer 422 CARD_LIMITS_UNSUPPORTED; for those the card balance is the spending ceiling.

Error Codes

Authorizations

Authorization
string
header
required

API key from the FYATU CaaS portal. Pass as Authorization: Bearer <key>.

Body

application/json
cardholderId
string
required

The cardholder to issue the card to

Example:

"chl_01HXYZ1234ABCDEF5678"

productId
string
required

The card product — card type and program are derived from this

Example:

"prd_01HXYZ1111ABCDEF0001"

amount
number<float>

Initial balance in USD. Required for non-JIT products; optional for JIT-enabled products.

Example:

100

customName
string

Card label. Defaults to the cardholder's full name when omitted.

Example:

"Travel Card"

Response

Card issued

success
boolean
Example:

true

status
integer
Example:

201

message
string
Example:

"Card issued"

data
object

Card object returned at issuance. Also includes the one-time CVV — identical to GET /cards/{id} except nameOnCard is only present here.

meta
object