Skip to main content
POST
/
v1
/
issuing
/
cards
Create Card
curl --request POST \
  --url https://api-sandbox.uqpaytech.com/api/v1/issuing/cards \
  --header 'Content-Type: application/json' \
  --header 'x-auth-token: <api-key>' \
  --header 'x-idempotency-key: <x-idempotency-key>' \
  --data '
{
  "card_currency": "USD",
  "cardholder_id": "7c4ff2cd-1bf6-4aaa-bf16-266771425011",
  "card_product_id": "7c4ff2cd-1bf6-4aaa-bf16-266771425011",
  "card_limit": 2100.02,
  "spending_controls": [
    {
      "amount": 100.03,
      "interval": "PER_TRANSACTION"
    }
  ],
  "risk_controls": {
    "allow_3ds_transactions": "Y",
    "allowed_mcc": null,
    "blocked_mcc": [
      "5999",
      "6011"
    ]
  },
  "metadata": {
    "key1": "value1",
    "key2": "value2"
  },
  "usage_type": "NORMAL",
  "auto_cancel_trigger": "ON_AUTH",
  "expiry_at": "2026-03-19T18:46:43+08:00",
  "cardholder_required_fields": {
    "gender": "MALE",
    "nationality": "SG",
    "phone_number": "86683306",
    "date_of_birth": "1990-01-01"
  }
}
'
{
  "card_id": "c0cef051-29c5-4796-b86a-cd5b684bfad7",
  "card_order_id": "c0cef051-29c5-4796-b86a-cd5ee34bfad7",
  "create_time": "2024-03-21T17:17:32+08:00",
  "card_status": "ACTIVE",
  "order_status": "PENDING",
  "cardholder_status": "SUCCESS",
  "message": "<string>"
}

Authorizations

​
x-auth-token
string
header
required

The API token for login provided by UQPay.

Headers

​
x-on-behalf-of
string

Specifies the sub-account on whose behalf the request is made. This should be set to the account_id, which can be retrieved via the List Connected Accounts. If omitted or empty, the request is executed using the master account. More information at Connected Accounts.

​
x-idempotency-key
string<uuid>
required

A unique identifier (UUID) used to maintain operation idempotency, ensuring that repeated executions of the same operation do not result in unintended effects or duplication. It helps preserve data consistency in the face of network errors, retries, or failures.

Body

application/json
​
card_currency
enum<string>
required

The card currency. For example USD or SGD.

Available options:
SGD,
USD
Example:

"USD"

​
cardholder_id
string<uuid>
required

The cardholder’s unique identifier.

Example:

"7c4ff2cd-1bf6-4aaa-bf16-266771425011"

​
card_product_id
string
required

The card product's unique identifier.

Example:

"7c4ff2cd-1bf6-4aaa-bf16-266771425011"

​
card_limit
number

The total credit limit assigned to the card, currency refer to card_currency. This is not a cumulative balance, but a fixed credit limit similar to that of a credit card.

Field Behavior by Card BIN:

  • For the following BINs, card_limit is required during card creation and must be greater than or equal to 0.01:

    • 527735
    • 555071
    • 555243

  • For all other BINs, card_limit is optional:

    • If omitted, the system will default card_limit to 0.
    • If provided, the value must be greater than or equal to 0, with up to two decimal places. Negative values are not allowed.
Required range: x >= 0
Example:

2100.02

​
spending_controls
object[]

Rules that control spending for this card.

​
risk_controls
object

User-customized risk control settings.

Supported configurations depend on the card BIN. See [Supported BINs for Risk Control Configurations](/card-issuance/v1.6/guide/Supported BINs for Risk Control Configurations) for details.

​
metadata
object

Any key-value object. Max length = 3200 bytes. This must be valid JSON data.

Example:
{ "key1": "value1", "key2": "value2" }
​
usage_type
enum<string>
default:NORMAL

Indicates whether the card is a standard reusable card or a one-time-use card.

  • NORMAL - A standard card that can be used for multiple transactions.
  • ONE_TIME - A one-time-use card that is automatically cancelled after the first transaction event defined by auto_cancel_trigger.
Available options:
NORMAL,
ONE_TIME
Example:

"NORMAL"

​
auto_cancel_trigger
enum<string>

Defines the transaction event that triggers automatic cancellation of a ONE_TIME card. Required when usage_type is ONE_TIME.

  • ON_AUTH - The card is cancelled immediately after the first authorization is approved. Subsequent authorization requests on the same card will be declined.
  • ON_CAPTURE - The card is cancelled after the first transaction's capture (settlement) succeeds, allowing a full authorization and capture cycle to complete.
Available options:
ON_AUTH,
ON_CAPTURE
Example:

"ON_AUTH"

​
expiry_at
string<date-time>

The absolute expiry date and time of the card. If the card has not been cancelled by a first-transaction event before this time, it is automatically cancelled and any unused balance is released.

Example:

"2026-03-19T18:46:43+08:00"

​
cardholder_required_fields
object

Supplementary cardholder KYC information provided at card creation time to fulfill the product's required_fields.

Response

Card creation successfully.

​
card_id
string
required

Unique identifier for the card.

Example:

"c0cef051-29c5-4796-b86a-cd5b684bfad7"

​
card_order_id
string
required

ID of the card order.

Example:

"c0cef051-29c5-4796-b86a-cd5ee34bfad7"

​
create_time
string
required

Create time at which the object was created.

Example:

"2024-03-21T17:17:32+08:00"

​
card_status
enum<string>
required

Card status enum. See the Card lifecycle and statuses guide for more information.

Available options:
PENDING,
ACTIVE,
FROZEN,
BLOCKED,
CANCELLED,
LOST,
STOLEN,
FAILED
Example:

"ACTIVE"

​
order_status
enum<string>
required

This field will contain the status of the request after processing.

  • PENDING -The initial status of the order request.
  • PROCESSING - If this status shall be subject to webhooks notification.
  • SUCCESS - The final status of the order request is successful.
  • FAILED - The final status of the order request is failed.
Available options:
PENDING,
PROCESSING,
SUCCESS,
FAILED
​
cardholder_status
enum<string>
default:SUCCESS

The cardholder's status.

Available options:
FAILED,
PENDING,
SUCCESS,
INCOMPLETE
​
message
string

Informational message when card creation is blocked or pending due to KYC requirements (e.g., insufficient KYC, missing fields).