Create a spending card
Request a virtual card be issued.
To access this endpoint using an access token
you'll need to specify the /accounts/{accountID}/issued-cards.write scope.
curl -X POST "https://api.moov.io/issuing/{accountID}/cards" \
-H "Authorization: Bearer {token}" \
-H "X-Moov-Version: v2026.10.00"mc, _ := moov.NewClient()
var accountID string
mc.CreateIssuedCard(ctx, accountID, moov.CreateIssuedCard{
Controls: &moov.IssuingControls{
SingleUse: moov.PtrOf(true),
VelocityLimits: []moov.IssuingVelocityLimit{
{
Amount: moov.PtrOf(int32(10000)),
Count: moov.PtrOf(int32(5)),
Interval: moov.PtrOf(moov.IssuingIntervalLimit_Daily),
},
},
MerchantCategoryRestrictions: &moov.MerchantCategoryRestrictions{
Mode: moov.IssuingControlsRestrictionMode_Block,
Categories: []moov.IssuingMerchantCategory{moov.IssuingMerchantCategory_Gambling},
CustomMCCs: []string{"5811"},
ExemptMerchants: []moov.MerchantEntry{{Name: moov.PtrOf("Moov Financial")}},
},
MerchantRestrictions: &moov.MerchantRestrictions{
Mode: moov.IssuingControlsRestrictionMode_Allow,
Merchants: []moov.MerchantEntry{{DescriptorPattern: moov.PtrOf("(?i)amazon")}},
},
AllowedSchedule: &moov.AllowedSchedule{
Timezone: "America/Denver",
Windows: []moov.ScheduleWindow{
{
Days: []moov.IssuingScheduleDay{moov.IssuingScheduleDay_Monday},
StartTime: "09:00",
EndTime: "17:00",
},
},
},
ExpiresOn: moov.PtrOf(time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC)),
},
})
import { Moov } from "@moovio/sdk";
const moov = new Moov({
security: {
username: "",
password: "",
},
});
async function run() {
const result = await moov.cardIssuing.request({
accountID: "d9ac71ae-fccb-4dfc-9fed-710ca654e3ed",
requestCard: {
metadata: {
"optional": "metadata",
},
billingAddress: {
addressLine1: "123 Main Street",
addressLine2: "Apt 302",
city: "Boulder",
stateOrProvince: "CO",
postalCode: "80301",
country: "US",
},
expiration: {
month: "01",
year: "21",
},
controls: {
velocityLimits: [
{
amount: 10000,
interval: "per-transaction",
},
],
},
},
});
console.log(result);
}
run();declare(strict_types=1);
require 'vendor/autoload.php';
use Moov\MoovPhp;
use Moov\MoovPhp\Models\Components;
$sdk = MoovPhp\Moov::builder()
->setSecurity(
new Components\Security(
username: '',
password: '',
)
)
->build();
$requestCard = new Components\RequestCard(
metadata: [
'optional' => 'metadata',
],
billingAddress: new Components\Address(
addressLine1: '123 Main Street',
addressLine2: 'Apt 302',
city: 'Boulder',
stateOrProvince: 'CO',
postalCode: '80301',
country: 'US',
),
expiration: new Components\CardExpiration(
month: '01',
year: '21',
),
controls: new Components\IssuingControls(
velocityLimits: [
new Components\IssuingVelocityLimit(
amount: 10000,
interval: Components\IssuingIntervalLimit::PerTransaction,
),
],
),
);
$response = $sdk->cardIssuing->request(
accountID: 'd9ac71ae-fccb-4dfc-9fed-710ca654e3ed',
requestCard: $requestCard
);
if ($response->issuedCard !== null) {
// handle response
}package hello.world;
import io.moov.sdk.Moov;
import io.moov.sdk.models.components.*;
import io.moov.sdk.models.errors.GenericError;
import io.moov.sdk.models.errors.RequestCardError;
import io.moov.sdk.models.operations.RequestCardResponse;
import java.lang.Exception;
import java.util.List;
import java.util.Map;
public class Application {
public static void main(String[] args) throws GenericError, RequestCardError, Exception {
Moov sdk = Moov.builder()
.security(Security.builder()
.username("")
.password("")
.build())
.build();
RequestCardResponse res = sdk.cardIssuing().request()
.accountID("d9ac71ae-fccb-4dfc-9fed-710ca654e3ed")
.requestCard(RequestCard.builder()
.metadata(Map.ofEntries(
Map.entry("optional", "metadata")))
.billingAddress(Address.builder()
.addressLine1("123 Main Street")
.city("Boulder")
.stateOrProvince("CO")
.postalCode("80301")
.country("US")
.addressLine2("Apt 302")
.build())
.expiration(CardExpiration.builder()
.month("01")
.year("21")
.build())
.controls(IssuingControls.builder()
.velocityLimits(List.of(
IssuingVelocityLimit.builder()
.interval(IssuingIntervalLimit.PER_TRANSACTION)
.amount(10000L)
.build()))
.build())
.build())
.call();
if (res.issuedCard().isPresent()) {
System.out.println(res.issuedCard().get());
}
}
}from moovio_sdk import Moov
from moovio_sdk.models import components
with Moov(
security=components.Security(
username="",
password="",
),
) as moov:
res = moov.card_issuing.request(account_id="d9ac71ae-fccb-4dfc-9fed-710ca654e3ed", metadata={
"optional": "metadata",
}, billing_address={
"address_line1": "123 Main Street",
"address_line2": "Apt 302",
"city": "Boulder",
"state_or_province": "CO",
"postal_code": "80301",
"country": "US",
}, expiration={
"month": "01",
"year": "21",
}, controls=components.IssuingControls(
velocity_limits=[
components.IssuingVelocityLimit(
amount=10000,
interval=components.IssuingIntervalLimit.PER_TRANSACTION,
),
],
))
# Handle response
print(res)require 'moov_ruby'
Models = ::Moov::Models
s = ::Moov::Client.new(
security: Models::Components::Security.new(
username: '',
password: ''
)
)
res = s.card_issuing.request(account_id: '4d9ac71a-efcc-4bdf-bcfe-d710ca654e3e', request_card: Models::Components::RequestCard.new(
metadata: {
'optional' => 'metadata',
},
billing_address: Models::Components::Address.new(
address_line1: '123 Main Street',
address_line2: 'Apt 302',
city: 'Boulder',
state_or_province: 'CO',
postal_code: '80301',
country: 'US'
),
expiration: Models::Components::CardExpiration.new(
month: '01',
year: '21'
),
controls: Models::Components::IssuingControls.new(
velocity_limits: [
Models::Components::IssuingVelocityLimit.new(
amount: 10_000,
interval: Models::Components::IssuingIntervalLimit::PER_TRANSACTION
),
]
)
))
unless res.issued_card.nil?
# handle response
endusing Moov.Sdk;
using Moov.Sdk.Models.Components;
using System.Collections.Generic;
var sdk = new MoovClient(security: new Security() {
Username = "",
Password = "",
});
var res = await sdk.CardIssuing.RequestAsync(
accountID: "4d9ac71a-efcc-4bdf-bcfe-d710ca654e3e",
body: new RequestCard() {
Metadata = new Dictionary<string, string>() {
{ "optional", "metadata" },
},
BillingAddress = new Address() {
AddressLine1 = "123 Main Street",
AddressLine2 = "Apt 302",
City = "Boulder",
StateOrProvince = "CO",
PostalCode = "80301",
Country = "US",
},
Expiration = new CardExpiration() {
Month = "01",
Year = "21",
},
Controls = new IssuingControls() {
VelocityLimits = new List<IssuingVelocityLimit>() {
new IssuingVelocityLimit() {
Amount = 10000,
Interval = IssuingIntervalLimit.PerTransaction,
},
},
},
}
);
// handle response{
"issuedCardID": "string",
"brand": "Visa",
"lastFourCardNumber": "string",
"expiration": {
"month": "01",
"year": "21"
},
"fundingWalletID": "string",
"authorizedUserAccountID": "string",
"nickname": "string",
"metadata": {
"optional": "metadata"
},
"billingAddress": {
"addressLine1": "123 Main Street",
"addressLine2": "Apt 302",
"city": "Boulder",
"stateOrProvince": "CO",
"postalCode": "80301",
"country": "US"
},
"state": "active",
"formFactor": "virtual",
"controls": {
"singleUse": true,
"velocityLimits": [
{
"amount": 10000,
"count": 0,
"interval": "per-transaction",
"amountUsed": 0,
"amountRemaining": 0,
"countUsed": 0,
"countRemaining": 0,
"resetsOn": "2019-08-24T14:15:22Z"
}
],
"merchantCategoryRestrictions": {
"mode": "allow",
"categories": [
"advertising"
],
"customMCCs": [
"string"
],
"exemptMerchants": [
{
"networkID": "string",
"descriptorPattern": "string",
"name": "string"
}
]
},
"merchantRestrictions": {
"mode": "allow",
"merchants": [
{
"networkID": "string",
"descriptorPattern": "string",
"name": "string"
}
]
},
"allowedSchedule": {
"timezone": "string",
"windows": [
{
"days": [
"monday"
],
"startTime": "string",
"endTime": "string"
}
]
},
"expiresOn": "2019-08-24T14:15:22Z"
},
"createdOn": "2019-08-24T14:15:22Z",
"updatedOn": "2019-08-24T14:15:22Z"
}Response headers
x-request-id
string
required
{
"error": "string"
}Response headers
x-request-id
string
required
Response headers
x-request-id
string
required
Response headers
x-request-id
string
required
Response headers
x-request-id
string
required
{
"authorizedUserAccountID": "string",
"nickname": "string",
"metadata": "string",
"billingAddress": {
"addressLine1": "string",
"addressLine2": "string",
"city": "string",
"stateOrProvince": "string",
"postalCode": "string",
"country": "string"
},
"expiration": {
"month": "string",
"year": "string"
},
"controls": {
"velocityLimits": {
"0": {
"amount": "must be no less than 1",
"interval": "must be a valid value"
}
}
}
}Response headers
x-request-id
string
required
Response headers
x-request-id
string
required
Response headers
x-request-id
string
required
Response headers
x-request-id
string
required
Headers
X-Moov-Version
string
v2026.08.00 uses v2026.07.00.
A malformed value, such as 2022, returns a 404 response.
v2026.10.00
Path parameters
accountID
string
required
Body
authorizedUserAccountID
string
billingAddress
object
Show child attributes
billingAddress
addressLine1
string
<=60 characters
required
Pattern
city
string
<=32 characters
required
Pattern
country
string
<=2 characters
required
postalCode
string
<=5 characters
required
stateOrProvince
string
<=2 characters
required
addressLine2
string
<=32 characters
Pattern
controls
object
Show child attributes
controls
allowedSchedule
object
| null
Show child attributes
controls.allowedSchedule
timezone
string
required
windows
array<object>
required
Show child attributes
controls.allowedSchedule.windows[]
days
array<string>
monday,
tuesday,
wednesday,
thursday,
friday,
saturday,
sunday
endTime
string
HH:MM format. If earlier than startTime, the window wraps past midnight.
startTime
string
HH:MM format.
expiresOn
string<date-time>
| null
null for no cutoff.
merchantCategoryRestrictions
object
Show child attributes
controls.merchantCategoryRestrictions
mode
string<enum>
required
allow) or blocked (block).
allow,
block
categories
array<string>
advertising,
airlines,
alcohol-and-bars,
car-rental,
education,
electronics,
fuel-and-gas,
gambling,
groceries,
ground-transportation,
hardware-and-home,
healthcare,
live-entertainment,
lodging,
movies,
office-supplies,
parking,
personal-care,
professional-services,
restaurants-and-dining,
retail-general,
rideshare-and-taxis,
software-and-saas,
sports-and-recreation,
subscriptions,
travel-agencies
customMCCs
array<string>
exemptMerchants
array<object>
Show child attributes
controls.merchantCategoryRestrictions.exemptMerchants[]
descriptorPattern
string
name
string
networkID
string
merchantRestrictions
object
Show child attributes
controls.merchantRestrictions
merchants
array<object>
required
Show child attributes
controls.merchantRestrictions.merchants[]
descriptorPattern
string
name
string
networkID
string
mode
string<enum>
required
allow) or blocked (block).
allow,
block
singleUse
boolean
velocityLimits
array<object>
Show child attributes
controls.velocityLimits[]
amount
integer<int64>
count
integer<int64>
amount or count must be set.
interval
string<enum>
per-transaction applies to each individual authorization and never resets. Time-based intervals (where supported) reset at midnight ET.
per-transaction,
daily,
weekly,
monthly
expiration
object
Show child attributes
expiration
month
string
2 characters
required
year
string
2 characters
required
metadata
object
nickname
string
Response
brand
string<enum>
required
American Express,
Discover,
Mastercard,
Visa,
Unknown
createdOn
string<date-time>
required
expiration
object
required
Show child attributes
expiration
month
string
2 characters
required
year
string
2 characters
required
formFactor
string<enum>
required
virtual
fundingWalletID
string
required
issuedCardID
string
required
lastFourCardNumber
string
required
state
string<enum>
required
The state represents the operational status of an issued card.
Authorizations can only be approved while the card is active:
active: The card is operational and authorizations can be approved.frozen: The card is temporarily suspended and authorizations cannot be approved. Set the state back toactiveto reactivate it. A card can move betweenfrozenandactiveas often as needed.closed: The card is permanently deactivated. A card is closed by request or when it expires, and cannot be reopened.
active,
frozen,
closed
updatedOn
string<date-time>
required
authorizedUserAccountID
string
billingAddress
object
Show child attributes
billingAddress
addressLine1
string
<=60 characters
required
Pattern
addressLine2
string
<=32 characters
Pattern
city
string
<=32 characters
required
Pattern
country
string
<=2 characters
required
postalCode
string
<=5 characters
required
stateOrProvince
string
<=2 characters
required
controls
object
Show child attributes
controls
allowedSchedule
object
| null
Show child attributes
controls.allowedSchedule
timezone
string
required
windows
array<object>
required
Show child attributes
controls.allowedSchedule.windows[]
days
array<string>
monday,
tuesday,
wednesday,
thursday,
friday,
saturday,
sunday
endTime
string
HH:MM format. If earlier than startTime, the window wraps past midnight.
startTime
string
HH:MM format.
expiresOn
string<date-time>
| null
merchantCategoryRestrictions
object
Show child attributes
controls.merchantCategoryRestrictions
mode
string<enum>
required
allow) or blocked (block).
allow,
block
categories
array<string>
advertising,
airlines,
alcohol-and-bars,
car-rental,
education,
electronics,
fuel-and-gas,
gambling,
groceries,
ground-transportation,
hardware-and-home,
healthcare,
live-entertainment,
lodging,
movies,
office-supplies,
parking,
personal-care,
professional-services,
restaurants-and-dining,
retail-general,
rideshare-and-taxis,
software-and-saas,
sports-and-recreation,
subscriptions,
travel-agencies
customMCCs
array<string>
exemptMerchants
array<object>
Show child attributes
controls.merchantCategoryRestrictions.exemptMerchants[]
descriptorPattern
string
name
string
networkID
string
merchantRestrictions
object
Show child attributes
controls.merchantRestrictions
merchants
array<object>
required
Show child attributes
controls.merchantRestrictions.merchants[]
descriptorPattern
string
name
string
networkID
string
mode
string<enum>
required
allow) or blocked (block).
allow,
block
singleUse
boolean
velocityLimits
array<object>
Show child attributes
controls.velocityLimits[]
amount
integer<int64>
amountRemaining
integer<int64>
amountUsed
integer<int64>
count
integer<int64>
countRemaining
integer<int64>
countUsed
integer<int64>
interval
string<enum>
per-transaction applies to each individual authorization and never resets. Time-based intervals (where supported) reset at midnight ET.
per-transaction,
daily,
weekly,
monthly
resetsOn
string<date-time>
metadata
object
nickname
string